SecurityCatalogService { public boolean checkUserPermissions(String objectNamespace, Long objectId, Long userId, EnumSet<Permission> required) { User user = getUser(userId); if (user == null) { return false; } EnumSet<Permission> remaining = EnumSet.copyOf(required); List<QueryParam> qps = QueryParam.params( AclEntry.OBJECT_NAMESPACE, objectNamespace, AclEntry.OBJECT_ID, String.valueOf(objectId), AclEntry.SID_TYPE, USER.toString(), AclEntry.SID_ID, String.valueOf(userId)); Collection<AclEntry> acls = listAcls(qps); if (acls.size() > 1) { throw new IllegalStateException("More than one ACL entry for " + qps); } else if (acls.size() == 1) { AclEntry aclEntry = acls.iterator().next(); remaining.removeAll(aclEntry.getPermissions()); } if (!remaining.isEmpty() && user.getRoles() != null) { qps = QueryParam.params( AclEntry.OBJECT_NAMESPACE, objectNamespace, AclEntry.OBJECT_ID, String.valueOf(objectId), AclEntry.SID_TYPE, AclEntry.SidType.ROLE.toString()); acls = listAcls(qps); Set<Role> userRoles = getAllUserRoles(user); Iterator<AclEntry> it = acls.iterator(); while (!remaining.isEmpty() && it.hasNext()) { AclEntry roleEntry = it.next(); if (userRoles.contains(getRole(roleEntry.getSidId()))) { remaining.removeAll(roleEntry.getPermissions()); } } } return remaining.isEmpty(); } SecurityCatalogService(StorageManager storageManager); Collection<Role> listRoles(); Collection<Role> listRoles(List<QueryParam> params); Optional<Role> getRole(String roleName); Role getRole(Long roleId); Role addRole(Role role); Role addOrUpdateRole(Long id, Role role); Role removeRole(Long roleId); Collection<User> listUsers(); Collection<User> listUsers(List<QueryParam> params); Collection<User> listUsers(Role role); User getUser(String name); User getUser(Long userId); User addUser(User user); User addOrUpdateUser(Long id, User user); User removeUser(Long userId); Set<Role> getChildRoles(Long parentRoleId); RoleHierarchy addChildRole(Long parentRoleId, Long childRoleId); RoleHierarchy removeChildRole(Long parentRoleId, Long childRoleId); Collection<UserRole> listUserRoles(List<QueryParam> qps); UserRole addUserRole(Long userId, Long roleId); UserRole removeUserRole(Long userId, Long roleId); Collection<AclEntry> listAcls(); Collection<AclEntry> listAcls(List<QueryParam> params); Collection<AclEntry> listUserAcls(Long userId, String targetEntityNamespace, Long targetEntityId); Collection<AclEntry> listRoleAcls(Long roleId, String targetEntityNamespace, Long targetEntityId); AclEntry getAcl(Long aclEntryId); AclEntry addAcl(AclEntry aclEntry); AclEntry addOrUpdateAcl(Long id, AclEntry aclEntry); AclEntry removeAcl(Long id); boolean checkUserPermissions(String objectNamespace, Long objectId, Long userId, EnumSet<Permission> required);  }
@Test public void checkUserPermissions() throws Exception { SecurityCatalogService catalogService = new SecurityCatalogService(null); AclEntry userAclEntry = new AclEntry(); userAclEntry.setSidType(AclEntry.SidType.USER); userAclEntry.setSidId(1L); userAclEntry.setObjectId(1L); userAclEntry.setObjectNamespace("topology"); userAclEntry.setPermissions(EnumSet.of(Permission.WRITE)); AclEntry roleAclEntry = new AclEntry(); roleAclEntry.setSidType(AclEntry.SidType.ROLE); roleAclEntry.setSidId(1L); roleAclEntry.setObjectId(1L); roleAclEntry.setObjectNamespace("topology"); roleAclEntry.setPermissions(EnumSet.of(Permission.READ)); Role role = new Role(); role.setId(1L); role.setName("ROLE_FOO"); List<QueryParam> qps1 = QueryParam.params( AclEntry.OBJECT_NAMESPACE, "topology", AclEntry.OBJECT_ID, "1", AclEntry.SID_TYPE, USER.toString(), AclEntry.SID_ID, "1"); List<QueryParam> qps2 = QueryParam.params( AclEntry.OBJECT_NAMESPACE, "topology", AclEntry.OBJECT_ID, "1", AclEntry.SID_TYPE, AclEntry.SidType.ROLE.toString()); User user = new User(); user.setRoles(Sets.newHashSet("ROLE_FOO")); new Expectations(catalogService) {{ catalogService.getUser(anyLong); result = user; catalogService.listAcls(qps1); result = Arrays.asList(userAclEntry); catalogService.getAllUserRoles(user); result = Sets.newHashSet(role); catalogService.listAcls(qps2); result = Arrays.asList(roleAclEntry); catalogService.getRole(1L); result = role; }}; assertTrue(catalogService.checkUserPermissions("topology", 1L, 1L, EnumSet.of(Permission.READ))); assertTrue(catalogService.checkUserPermissions("topology", 1L, 1L, EnumSet.of(Permission.WRITE))); assertTrue(catalogService.checkUserPermissions("topology", 1L, 1L, EnumSet.of(Permission.WRITE, Permission.READ))); assertFalse(catalogService.checkUserPermissions("topology", 1L, 1L, EnumSet.of(Permission.WRITE, Permission.DELETE))); }