SafesService { public ResponseEntity<String> addAwsRoleToSafe(String token, AWSRole awsRole) { String jsonstr = JSONUtil.getJSON(awsRole); ObjectMapper objMapper = new ObjectMapper(); Map<String,String> requestMap = null; try { requestMap = objMapper.readValue(jsonstr, new TypeReference<Map<String,String>>() {}); } catch (IOException e) { log.error(e); } if(!ControllerUtil.areAWSRoleInputsValid(requestMap)) { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid input values\"]}"); } String role = (String)requestMap.get("role"); String path = (String)requestMap.get("path"); String access = (String)requestMap.get("access"); role = (role !=null) ? role.toLowerCase() : role; path = (path != null) ? path.toLowerCase() : path; access = (access != null) ? access.toLowerCase(): access; boolean canAddAWSRole = ControllerUtil.canAddPermission(path, token); if(canAddAWSRole){ String folders[] = path.split("[/]+"); String policyPrefix =""; switch (access){ case TVaultConstants.READ_POLICY: policyPrefix = "r_"; break ; case TVaultConstants.WRITE_POLICY: policyPrefix = "w_" ;break; case TVaultConstants.DENY_POLICY: policyPrefix = "d_" ;break; } if("".equals(policyPrefix)){ return ResponseEntity.status(HttpStatus.UNPROCESSABLE_ENTITY).body("{\"errors\":[\"Incorrect access requested. Valid values are read,write,deny \"]}"); } String policy = policyPrefix+folders[0]+"_"+folders[1]; String r_policy = "r_"; String w_policy = "w_"; String d_policy = "d_"; if (folders.length > 0) { for (int index = 0; index < folders.length; index++) { if (index == folders.length -1 ) { r_policy += folders[index]; w_policy += folders[index]; d_policy += folders[index]; } else { r_policy += folders[index] +"_"; w_policy += folders[index] +"_"; d_policy += folders[index] +"_"; } } } Response roleResponse = reqProcessor.process("/auth/aws/roles","{\"role\":\""+role+"\"}",token); String responseJson=""; String auth_type = "ec2"; List<String> policies = new ArrayList<>(); List<String> currentpolicies = new ArrayList<>(); String policiesString = ""; String currentpoliciesString = ""; if(HttpStatus.OK.equals(roleResponse.getHttpstatus())){ responseJson = roleResponse.getResponse(); try { JsonNode policiesArry =objMapper.readTree(responseJson).get("policies"); for(JsonNode policyNode : policiesArry){ currentpolicies.add(policyNode.asText()); } auth_type = objMapper.readTree(responseJson).get("auth_type").asText(); } catch (IOException e) { log.error(e); } policies.addAll(currentpolicies); policies.remove(r_policy); policies.remove(w_policy); policies.remove(d_policy); policies.add(policy); policiesString = StringUtils.join(policies, ","); currentpoliciesString = StringUtils.join(currentpolicies, ","); }else{ return ResponseEntity.status(HttpStatus.UNPROCESSABLE_ENTITY).body("{\"errors\":[\"Non existing role name. Please configure it as first step\"]}"); } Response ldapConfigresponse = null; if (TVaultConstants.IAM.equals(auth_type)) { ldapConfigresponse = awsiamAuthService.configureAWSIAMRole(role,policiesString,token); } else { ldapConfigresponse = awsAuthService.configureAWSRole(role,policiesString,token); } if(ldapConfigresponse.getHttpstatus().equals(HttpStatus.NO_CONTENT)){ Map<String,String> params = new HashMap<String,String>(); params.put("type", "aws-roles"); params.put("name",role); params.put("path",path); params.put("access",access); Response metadataResponse = ControllerUtil.updateMetadata(params,token); if(metadataResponse != null && HttpStatus.NO_CONTENT.equals(metadataResponse.getHttpstatus())){ return ResponseEntity.status(HttpStatus.OK).body("{\"messages\":[\"Role is successfully associated \"]}"); }else{ String safeType = ControllerUtil.getSafeType(path); String safeName = ControllerUtil.getSafeName(path); List<String> safeNames = ControllerUtil.getAllExistingSafeNames(safeType, token); String newPath = path; if (safeNames != null ) { for (String existingSafeName: safeNames) { if (existingSafeName.equalsIgnoreCase(safeName)) { newPath = safeType + "/" + existingSafeName; break; } } } params.put("path",newPath); metadataResponse = ControllerUtil.updateMetadata(params,token); if(metadataResponse != null && HttpStatus.NO_CONTENT.equals(metadataResponse.getHttpstatus())){ return ResponseEntity.status(HttpStatus.OK).body("{\"messages\":[\"Role is successfully associated \"]}"); } else { System.out.println("Meta data update failed"); System.out.println((null!=metadataResponse)?metadataResponse.getResponse():TVaultConstants.EMPTY); ldapConfigresponse = awsAuthService.configureAWSRole(role,currentpoliciesString,token); if(ldapConfigresponse.getHttpstatus().equals(HttpStatus.NO_CONTENT)){ System.out.println("Reverting user policy uupdate"); return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"Role configuration failed.Please try again\"]}"); }else{ System.out.println("Reverting user policy update failed"); return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"Role configuration failed.Contact Admin \"]}"); } } } }else{ return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"Role configuration failed.Try Again\"]}"); } }else{ return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid 'path' specified\"]}"); } }  ResponseEntity<String> getFolders( String token, String path); ResponseEntity<String> getInfo(String token, String path); ResponseEntity<String> createfolder(String token, String path); ResponseEntity<String> createSafe(String token, Safe safe); ResponseEntity<String> getSafe(String token, String path); ResponseEntity<String> deleteSafe(String token, Safe safe, UserDetails userDetails); ResponseEntity<String> updateSafe(String token, Safe safe); ResponseEntity<String> addUserToSafe(String token, SafeUser safeUser, UserDetails userDetails); ResponseEntity<String> addGroupToSafe(String token, SafeGroup safeGroup, UserDetails userDetails); ResponseEntity<String> removeUserFromSafe(String token, SafeUser safeUser, UserDetails userDetails); ResponseEntity<String> removeGroupFromSafe(String token, SafeGroup safeGroup, UserDetails userDetails); ResponseEntity<String> addAwsRoleToSafe(String token, AWSRole awsRole); ResponseEntity<String> removeAWSRoleFromSafe(String token, AWSRole awsRole, boolean detachOnly, UserDetails userDetails); ResponseEntity<String> deletefolder(String token, String path, UserDetails userDetails); ResponseEntity<String> getFoldersRecursively(String token, String path); ResponseEntity<String> createNestedfolder(String token, String path, UserDetails userDetails); ResponseEntity<String> associateApproletoSDB(String token, SafeAppRoleAccess safeAppRoleAccess); ResponseEntity<String> removeApproleFromSafe(String token, String jsonstr);  }
@Test public void test_addAwsRoleToSafe_failure_400() { String token = "5PDrOhsy4ig8L3EpsJZSLAMg"; String path = "shared/mysafe01"; AWSRole awsRole = new AWSRole(path,"iam","read"); String jsonStr = "{ \"access\": \"read\", \"path\": \"shared/mysafe01\", \"role\": \"iam\"}"; ResponseEntity<String> responseEntityExpected = ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid input values\"]}"); when(JSONUtil.getJSON(awsRole)).thenReturn(jsonStr); when(ControllerUtil.areAWSRoleInputsValid(any(Map.class))).thenReturn(false); ResponseEntity<String> responseEntity = safesService.addAwsRoleToSafe(token, awsRole); assertEquals(HttpStatus.BAD_REQUEST, responseEntity.getStatusCode()); assertEquals(responseEntityExpected, responseEntity); }