AppRoleService { public ResponseEntity<String> readSecretIdAccessors(String token, String rolename, UserDetails userDetails){ if (rolename.equals(TVaultConstants.SELF_SERVICE_APPROLE_NAME)) { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Access denied: You don't have enough permission to read the accessors of SecretIds associated with the AppRole\"]}"); } log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "readSecretIdAccessors"). put(LogMessage.MESSAGE, String.format("Trying to read accessors of all the SecretIDs [%s]", rolename)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); if (!userDetails.isAdmin()) { token = userDetails.getSelfSupportToken(); } if (!doesAppRoleExist(rolename, userDetails)) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "readSecretIdAccessors"). put(LogMessage.MESSAGE, "Unable to read accessors of all the SecretIDs. AppRole may not exist"). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.OK).body("{\"errors\":[\"Unable to read AppRole. AppRole does not exist.\"]}"); } boolean isAllowed = isAllowed(rolename, userDetails, TVaultConstants.APPROLE_READ_OPERATION); if (isAllowed) { Response response = reqProcessor.process("/auth/approle/role/accessors/list","{\"role_name\":\""+rolename+"\"}",token); if(HttpStatus.OK.equals(response.getHttpstatus())) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "readSecretIdAccessors"). put(LogMessage.MESSAGE, "Reading accessors of all the SecretIDs for AppRole completed"). put(LogMessage.STATUS, response.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(response.getHttpstatus()).body(response.getResponse()); } else if (HttpStatus.NOT_FOUND.equals(response.getHttpstatus())) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "readSecretIdAccessors"). put(LogMessage.MESSAGE, "Reading accessors of all the SecretIDs for AppRole completed. There are no accessor_ids."). put(LogMessage.STATUS, response.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.OK).body("{\"keys\":[]}"); } else { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "readSecretIdAccessors"). put(LogMessage.MESSAGE, "Reading accessors of all the SecretIDs for AppRole completed"). put(LogMessage.STATUS, response.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Not able to read accessor_ids.\"]}"); } } log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "readSecretIdAccessors"). put(LogMessage.MESSAGE, "Reading accessors of all the SecretIDs for AppRole failed"). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Access denied: You don't have enough permission to read the accessors of SecretIds associated with the AppRole\"]}"); }  ResponseEntity<String> createAppRole(String token, AppRole appRole, UserDetails userDetails); ResponseEntity<String> readAppRole(String token, String rolename); ResponseEntity<String> readAppRoles(String token); ResponseEntity<String> listAppRoles(String token,  UserDetails userDetails); ResponseEntity<String> readAppRoleRoleId(String token, String rolename); String readRoleId(String token, String rolename); List<String> readAccessorIds(String token, String rolename); AppRoleMetadata readAppRoleMetadata(String token, String rolename); AppRole readAppRoleBasicDetails(String token, String rolename); ResponseEntity<String> readAppRoleRoleId(String token, String rolename, UserDetails userDetails); ResponseEntity<String> readAppRoleSecretId(String token, String rolename, UserDetails userDetails); ResponseEntity<String> readSecretIdAccessors(String token, String rolename, UserDetails userDetails); ResponseEntity<String> readAppRoleDetails(String token, String rolename, UserDetails userDetails); ResponseEntity<String> createsecretId(String token, AppRoleSecretData appRoleSecretData); ResponseEntity<String> readAppRoleSecretId(String token, String rolename); ResponseEntity<String> deleteSecretId(String token, AppRoleNameSecretId appRoleNameSecretId); ResponseEntity<String> deleteAppRole(String token, AppRole appRole, UserDetails userDetails); ResponseEntity<String> deleteSecretIds(String token, AppRoleAccessorIds appRoleAccessorIds, UserDetails userDetails); ResponseEntity<String> login(AppRoleIdSecretId appRoleIdSecretId); ResponseEntity<String> associateApprole(String token, SafeAppRoleAccess safeAppRoleAccess); ResponseEntity<String> updateAppRole(String token, AppRole appRole, UserDetails userDetails); Response configureApprole(String rolename,String policies,String token );  }
@Test public void test_readSecretIdAccessors_WithUserDetails_successfully() throws Exception { String token = "5PDrOhsy4ig8L3EpsJZSLAMg"; String responseJson = "{\r\n" + " \"keys\": [\r\n" + " \"generated-accessor-id1\",\r\n" + " \"generated-accessor-id2\"\r\n" + " ]\r\n" + "}"; String role_id_response = "{\n" + " \"data\": {\n" + " \"role_id\": \"generated-role-id\"\n" + " }\n" + "}"; Response response =getMockResponse(HttpStatus.OK, true, responseJson); UserDetails userDetails = getMockUser("testuser1", false); String role_name = "approle1"; String username = userDetails.getUsername(); String path = TVaultConstants.APPROLE_METADATA_MOUNT_PATH + "/" + role_name; Map<String, Object> responseMap = new HashMap<>(); Map<String,Object> roleIdDataMap = new HashMap<>(); roleIdDataMap.put("role_id", "generated-id"); roleIdDataMap.put("createdBy", username); responseMap.put("data", roleIdDataMap); ResponseEntity<String> responseEntityExpected = ResponseEntity.status(HttpStatus.OK).body(responseJson); when(reqProcessor.process("/auth/approle/role/accessors/list","{\"role_name\":\""+role_name+"\"}",userDetails.getSelfSupportToken())).thenReturn(response); when(reqProcessor.process("/auth/approle/role/readRoleID","{\"role_name\":\""+role_name+"\"}",userDetails.getSelfSupportToken())).thenReturn (getMockResponse(HttpStatus.OK, true, role_id_response)); when(ControllerUtil.parseJson(role_id_response)).thenReturn(responseMap); Response approleMetadataResponse = getMockResponse(HttpStatus.OK, true, getAppRoleMetadataJSON(path, username, role_name)); when(reqProcessor.process("/read","{\"path\":\""+path+"\"}",userDetails.getSelfSupportToken())).thenReturn(approleMetadataResponse); when(ControllerUtil.parseJson("{\"path\":\""+path+"\",\"data\":{\"name\":\""+role_name+"\",\"createdBy\":\""+username+"\"}}")).thenReturn(responseMap); ResponseEntity<String> responseEntityActual = appRoleService.readSecretIdAccessors(token, role_name, userDetails); assertEquals(HttpStatus.OK, responseEntityActual.getStatusCode()); assertEquals(responseEntityExpected, responseEntityActual); }
@Test public void test_readSecretIdAccessors_WithUserDetails_failure() throws Exception { String token = "5PDrOhsy4ig8L3EpsJZSLAMg"; String responseJson = "{\"errors\":[\"Unable to read AppRole. AppRole does not exist.\"]}"; Response response =getMockResponse(HttpStatus.OK, true, responseJson); UserDetails userDetails = getMockUser("testuser1", false); String role_name = "approle1"; String username = userDetails.getUsername(); String path = TVaultConstants.APPROLE_METADATA_MOUNT_PATH + "/" + role_name; ResponseEntity<String> responseEntityExpected = ResponseEntity.status(HttpStatus.OK).body(responseJson); when(reqProcessor.process("/auth/approle/role/accessors/list","{\"role_name\":\""+role_name+"\"}",userDetails.getSelfSupportToken())).thenReturn(response); when(reqProcessor.process("/auth/approle/role/readRoleID","{\"role_name\":\""+role_name+"\"}",userDetails.getSelfSupportToken())).thenReturn (getMockResponse(HttpStatus.NOT_FOUND, true, responseJson)); Response approleMetadataResponse = getMockResponse(HttpStatus.OK, true, getAppRoleMetadataJSON(path, username, role_name)); when(reqProcessor.process("/read","{\"path\":\""+path+"\"}",userDetails.getSelfSupportToken())).thenReturn(approleMetadataResponse); Map<String, Object> responseMap = new HashMap<>(); Map<String,Object> roleIdDataMap = new HashMap<>(); roleIdDataMap.put("role_id", "generated-id"); roleIdDataMap.put("createdBy", username); responseMap.put("data", roleIdDataMap); when(ControllerUtil.parseJson("{\"path\":\""+path+"\",\"data\":{\"name\":\""+role_name+"\",\"createdBy\":\""+username+"\"}}")).thenReturn(responseMap); ResponseEntity<String> responseEntityActual = appRoleService.readSecretIdAccessors(token, role_name, userDetails); assertEquals(HttpStatus.OK, responseEntityActual.getStatusCode()); assertEquals(responseEntityExpected, responseEntityActual); }
@Test public void test_readSecretIdAccessors_WithUserDetails_BAD_REQUEST() throws Exception { String token = "5PDrOhsy4ig8L3EpsJZSLAMg"; UserDetails userDetails = getMockUser("testuser1", false); String role_name = "approle1"; String username = userDetails.getUsername(); String path = TVaultConstants.APPROLE_METADATA_MOUNT_PATH + "/" + role_name; String role_id_response = "{\n" + " \"data\": {\n" + " \"role_id\": \"generated-role-id\"\n" + " }\n" + "}"; Map<String, Object> roleIdResponseMap = new HashMap<>(); Map<String,Object> roleIdDataMap = new HashMap<>(); roleIdDataMap.put("role_id", "generated-id"); roleIdDataMap.put("createdBy", username); roleIdResponseMap.put("data", roleIdDataMap); when(reqProcessor.process("/auth/approle/role/readRoleID","{\"role_name\":\""+role_name+"\"}",userDetails.getSelfSupportToken())).thenReturn(getMockResponse(HttpStatus.OK, true, role_id_response)); when(ControllerUtil.parseJson(role_id_response)).thenReturn(roleIdResponseMap); Response approleMetadataResponse = getMockResponse(HttpStatus.OK, true, getAppRoleMetadataJSON(path, username, role_name)); when(reqProcessor.process("/read","{\"path\":\""+path+"\"}",userDetails.getSelfSupportToken())).thenReturn(approleMetadataResponse); Map<String, Object> responseMap = new HashMap<>(); roleIdDataMap = new HashMap<>(); roleIdDataMap.put("role_id", "generated-id"); roleIdDataMap.put("createdBy", "testuser2"); responseMap.put("data", roleIdDataMap); when(ControllerUtil.parseJson("{\"path\":\""+path+"\",\"data\":{\"name\":\""+role_name+"\",\"createdBy\":\""+username+"\"}}")).thenReturn(responseMap); String responseJson = "{\"errors\":[\"Access denied: You don't have enough permission to read the accessors of SecretIds associated with the AppRole\"]}"; Response response =getMockResponse(HttpStatus.OK, true, responseJson); ResponseEntity<String> responseEntityExpected = ResponseEntity.status(HttpStatus.BAD_REQUEST).body(responseJson); ResponseEntity<String> responseEntityActual = appRoleService.readSecretIdAccessors(token, role_name, userDetails); assertEquals(HttpStatus.BAD_REQUEST, responseEntityActual.getStatusCode()); assertEquals(responseEntityExpected, responseEntityActual); }