RangerPolicyValidator extends RangerValidator { @Override boolean isValid(Long id, Action action, List<ValidationFailureDetails> failures) { if(LOG.isDebugEnabled()) { LOG.debug(String.format("==> RangerPolicyValidator.isValid(%s, %s, %s)", id, action, failures)); } boolean valid = true; if (action != Action.DELETE) { ValidationErrorCode error = ValidationErrorCode.POLICY_VALIDATION_ERR_UNSUPPORTED_ACTION; failures.add(new ValidationFailureDetailsBuilder() .isAnInternalError() .becauseOf(error.getMessage()) .errorCode(error.getErrorCode()) .build()); valid = false; } else if (id == null) { ValidationErrorCode error = ValidationErrorCode.POLICY_VALIDATION_ERR_MISSING_FIELD; failures.add(new ValidationFailureDetailsBuilder() .becauseOf("policy id was null/missing") .field("id") .isMissing() .errorCode(error.getErrorCode()) .becauseOf(error.getMessage("id")) .build()); valid = false; } else if (policyExists(id)) { if (LOG.isDebugEnabled()) { LOG.debug("No policy found for id[" + id + "]! ok!"); } } if(LOG.isDebugEnabled()) { LOG.debug(String.format("<== RangerPolicyValidator.isValid(%s, %s, %s): %s", id, action, failures, valid)); } return valid; } RangerPolicyValidator(ServiceStore store); void validate(RangerPolicy policy, Action action, boolean isAdmin);  }
@Test public final void testIsValid_long() throws Exception { Assert.assertFalse(_validator.isValid(3L, Action.CREATE, _failures)); _utils.checkFailureForInternalError(_failures); _failures.clear(); _failures.clear(); Assert.assertFalse(_validator.isValid((Long)null, Action.DELETE, _failures)); _utils.checkFailureForMissingValue(_failures, "id"); when(_store.getPolicy(1L)).thenReturn(null); when(_store.getPolicy(2L)).thenThrow(new Exception()); RangerPolicy existingPolicy = mock(RangerPolicy.class); when(_store.getPolicy(3L)).thenReturn(existingPolicy); _failures.clear(); Assert.assertTrue(_validator.isValid(1L, Action.DELETE, _failures)); Assert.assertTrue(_failures.isEmpty()); _failures.clear(); Assert.assertTrue(_validator.isValid(2L, Action.DELETE, _failures)); Assert.assertTrue(_failures.isEmpty()); _failures.clear(); Assert.assertTrue(_validator.isValid(3L, Action.DELETE, _failures)); Assert.assertTrue(_failures.isEmpty()); }
@Test public final void testIsValid_errorPaths() throws Exception { boolean isAdmin = true; Action action = Action.CREATE; when(_policy.getService()).thenReturn("non-existing-service-name"); when(_store.getServiceByName("non-existing-service-name")).thenReturn(null); Assert.assertFalse(action.toString(), _validator.isValid(_policy, action, isAdmin, _failures)); RangerPolicy existingPolicy = mock(RangerPolicy.class); when(existingPolicy.getId()).thenReturn(8L); when(existingPolicy.getService()).thenReturn("service-name"); RangerService service = mock(RangerService.class); when(service.getType()).thenReturn("service-type"); when(service.getName()).thenReturn("service-name"); when(_store.getServiceByName("service-name")).thenReturn(service); RangerService service2 = mock(RangerService.class); when(service2.getType()).thenReturn("service-type"); when(service2.getName()).thenReturn("service-name2"); when(_store.getServiceByName("service-name2")).thenReturn(service2); when(_policy.getService()).thenReturn("service-name2"); when(_store.getServiceByName("service-name2")).thenReturn(service2); action = Action.UPDATE; Assert.assertFalse(action.toString(), _validator.isValid(_policy, action, isAdmin, _failures)); when(existingPolicy.getId()).thenReturn(8L); when(existingPolicy.getService()).thenReturn("service-name"); when(existingPolicy.getPolicyType()).thenReturn(Integer.valueOf(0)); when(_policy.getId()).thenReturn(8L); when(_policy.getService()).thenReturn("service-name"); when(_policy.getPolicyType()).thenReturn(Integer.valueOf(1)); Assert.assertFalse(action.toString(), _validator.isValid(_policy, action, isAdmin, _failures)); }
@Test public final void testIsValid_happyPath() throws Exception { when(_policy.getService()).thenReturn("service-name"); RangerService service = mock(RangerService.class); when(service.getType()).thenReturn("service-type"); when(service.getId()).thenReturn(2L); when(_store.getServiceByName("service-name")).thenReturn(service); _serviceDef = _utils.createServiceDefWithAccessTypes(accessTypes); when(_serviceDef.getName()).thenReturn("service-type"); when(_store.getServiceDefByName("service-type")).thenReturn(_serviceDef); when(_store.getPolicy(7L)).thenReturn(null); RangerPolicy existingPolicy = mock(RangerPolicy.class); when(existingPolicy.getId()).thenReturn(8L); when(existingPolicy.getService()).thenReturn("service-name"); when(_store.getPolicy(8L)).thenReturn(existingPolicy); when(_policy.getResources()).thenReturn(null); for (Action action : cu) { for (Boolean auditEnabled : new Boolean[] { null, true } ) { for (boolean isAdmin : new boolean[] { true, false }) { when(_policy.getIsAuditEnabled()).thenReturn(auditEnabled); if (action == Action.CREATE) { when(_policy.getId()).thenReturn(7L); when(_policy.getName()).thenReturn("policy-name-1"); when(_store.getPolicyId(service.getId(), _policy.getName(), _zoneId)).thenReturn(null); Assert.assertTrue("" + action + ", " + auditEnabled, _validator.isValid(_policy, action, isAdmin, _failures)); Assert.assertTrue(_failures.isEmpty()); } else { when(_policy.getId()).thenReturn(8L); when(_policy.getName()).thenReturn("policy-name-1"); Assert.assertTrue("" + action + ", " + auditEnabled, _validator.isValid(_policy, action, isAdmin, _failures)); Assert.assertTrue(_failures.isEmpty()); when(_policy.getName()).thenReturn("policy-name-2"); when(_store.getPolicyId(service.getId(), _policy.getName(), _zoneId)).thenReturn(null); Assert.assertTrue("" + action + ", " + auditEnabled, _validator.isValid(_policy, action, isAdmin, _failures)); Assert.assertTrue(_failures.isEmpty()); } } } } List<RangerPolicyItem> policyItems = _utils.createPolicyItems(policyItemsData); when(_policy.getPolicyItems()).thenReturn(policyItems); when(_policy.getIsAuditEnabled()).thenReturn(false); for (Action action : cu) { for (boolean isAdmin : new boolean[] { true, false}) { if (action == Action.CREATE) { when(_policy.getId()).thenReturn(7L); when(_policy.getName()).thenReturn("policy-name-1"); } else { when(_policy.getId()).thenReturn(8L); when(_policy.getName()).thenReturn("policy-name-2"); } Assert.assertTrue("" + action , _validator.isValid(_policy, action, isAdmin, _failures)); Assert.assertTrue(_failures.isEmpty()); } } List<RangerResourceDef> resourceDefs = _utils.createResourceDefs(resourceDefData); when(_serviceDef.getResources()).thenReturn(resourceDefs); Map<String, RangerPolicyResource> resourceMap = _utils.createPolicyResourceMap(policyResourceMap_good); when(_policy.getResources()).thenReturn(resourceMap); RangerPolicyResourceSignature policySignature = mock(RangerPolicyResourceSignature.class); when(_factory.createPolicyResourceSignature(_policy)).thenReturn(policySignature); when(policySignature.getSignature()).thenReturn("hash-1"); when(_store.getPoliciesByResourceSignature("service-name", "hash-1", true)).thenReturn(null); for (Action action : cu) { if (action == Action.CREATE) { when(_policy.getId()).thenReturn(7L); when(_policy.getName()).thenReturn("policy-name-1"); } else { when(_policy.getId()).thenReturn(8L); when(_policy.getName()).thenReturn("policy-name-2"); } Assert.assertTrue("" + action , _validator.isValid(_policy, action, true, _failures)); Assert.assertTrue(_failures.isEmpty()); } }
@Test public final void testIsValid_failures() throws Exception { for (Action action : cu) { _policy = null; checkFailure_isValid(action, "missing", "policy"); _policy = mock(RangerPolicy.class); for (String name : new String[] { null, " " }) { when(_policy.getName()).thenReturn(name); when(_policy.getResources()).thenReturn(null); checkFailure_isValid(action, "missing", "name"); } if (action == Action.UPDATE) { when(_policy.getId()).thenReturn(null); checkFailure_isValid(action, "missing", "id"); } } RangerService service = mock(RangerService.class); when(_policy.getName()).thenReturn("policy-name"); when(_policy.getService()).thenReturn("service-name"); when(_store.getServiceByName("service-name")).thenReturn(service); when(service.getId()).thenReturn(2L); RangerPolicy existingPolicy = mock(RangerPolicy.class); when(existingPolicy.getId()).thenReturn(7L); when(existingPolicy.getService()).thenReturn("service-name"); List<RangerPolicy> existingPolicies = new ArrayList<>(); when(_store.getPolicyId(service.getId(), "policy-name", _zoneId)).thenReturn(7L); checkFailure_isValid(Action.CREATE, "semantic", "policy name"); when(_policy.getId()).thenReturn(7L); when(_store.getPolicy(7L)).thenReturn(null); checkFailure_isValid(Action.UPDATE, "semantic", "id"); when(_store.getPolicy(7L)).thenReturn(existingPolicy); RangerPolicy anotherExistingPolicy = mock(RangerPolicy.class); when(anotherExistingPolicy.getId()).thenReturn(8L); when(anotherExistingPolicy.getService()).thenReturn("service-name"); existingPolicies.add(anotherExistingPolicy); when(_store.getPolicyId(service.getId(), "policy-name", _zoneId)).thenReturn(8L); checkFailure_isValid(Action.UPDATE, "semantic", "id/name"); when(_policy.getName()).thenReturn("policy-name"); for (Action action : cu) { for (boolean isAdmin : new boolean[] { true, false }) { when(_policy.getService()).thenReturn(null); _failures.clear(); Assert.assertFalse(_validator.isValid(_policy, action, isAdmin, _failures)); _utils.checkFailureForMissingValue(_failures, "service name"); when(_policy.getService()).thenReturn(""); _failures.clear(); Assert.assertFalse(_validator.isValid(_policy, action, isAdmin, _failures)); _utils.checkFailureForMissingValue(_failures, "service name"); } } when(_store.getServiceByName("service-name")).thenReturn(null); when(_store.getServiceByName("another-service-name")).thenThrow(new Exception()); for (Action action : cu) { for (boolean isAdmin : new boolean[] { true, false }) { when(_policy.getService()).thenReturn(null); _failures.clear(); Assert.assertFalse(_validator.isValid(_policy, action, isAdmin, _failures)); _utils.checkFailureForMissingValue(_failures, "service name"); when(_policy.getService()).thenReturn(null); _failures.clear(); Assert.assertFalse(_validator.isValid(_policy, action, isAdmin, _failures)); _utils.checkFailureForMissingValue(_failures, "service name"); when(_policy.getService()).thenReturn("service-name"); _failures.clear(); Assert.assertFalse(_validator.isValid(_policy, action, isAdmin, _failures)); _utils.checkFailureForSemanticError(_failures, "service name"); when(_policy.getService()).thenReturn("another-service-name"); _failures.clear(); Assert.assertFalse(_validator.isValid(_policy, action, isAdmin, _failures)); _utils.checkFailureForSemanticError(_failures, "service name"); } } List<RangerPolicyItem> policyItems = new ArrayList<>(); for (Action action : cu) { for (boolean isAdmin : new boolean[] { true, false }) { when(_policy.getPolicyItems()).thenReturn(null); _failures.clear(); Assert.assertFalse(_validator.isValid(_policy, action, isAdmin, _failures)); _utils.checkFailureForMissingValue(_failures, "policy items"); when(_policy.getPolicyItems()).thenReturn(policyItems); _failures.clear(); Assert.assertFalse(_validator.isValid(_policy, action, isAdmin, _failures)); _utils.checkFailureForMissingValue(_failures, "policy items"); } } policyItems = _utils.createPolicyItems(policyItemsData); when(_policy.getPolicyItems()).thenReturn(policyItems); when(service.getType()).thenReturn("service-type"); when(_store.getServiceDefByName("service-type")).thenReturn(null); for (Action action : cu) { for (boolean isAdmin : new boolean[] { true, false }) { when(_policy.getService()).thenReturn("service-name"); when(_store.getServiceByName("service-name")).thenReturn(service); _failures.clear(); Assert.assertFalse(_validator.isValid(_policy, action, isAdmin, _failures)); _utils.checkFailureForInternalError(_failures, "policy service def"); } } _serviceDef = _utils.createServiceDefWithAccessTypes(accessTypes_bad, "service-type"); when(_store.getServiceDefByName("service-type")).thenReturn(_serviceDef); for (Action action : cu) { for (boolean isAdmin : new boolean[] { true, false }) { _failures.clear(); Assert.assertFalse(_validator.isValid(_policy, action, isAdmin, _failures)); _utils.checkFailureForSemanticError(_failures, "policy item access type"); } } _serviceDef = _utils.createServiceDefWithAccessTypes(accessTypes, "service-type"); when(_store.getPolicyId(service.getId(), "policy-name", _zoneId)).thenReturn(null); List<RangerResourceDef> resourceDefs = _utils.createResourceDefs(resourceDefData); when(_serviceDef.getResources()).thenReturn(resourceDefs); when(_store.getServiceDefByName("service-type")).thenReturn(_serviceDef); Map<String, RangerPolicyResource> policyResources = _utils.createPolicyResourceMap(policyResourceMap_bad); when(_policy.getResources()).thenReturn(policyResources); RangerPolicyResourceSignature signature = mock(RangerPolicyResourceSignature.class); when(_factory.createPolicyResourceSignature(_policy)).thenReturn(signature); when(signature.getSignature()).thenReturn("hash-1"); when(_store.getPoliciesByResourceSignature("service-name", "hash-1", true)).thenReturn(null); for (Action action : cu) { for (boolean isAdmin : new boolean[] { true, false }) { _failures.clear(); Assert.assertFalse(_validator.isValid(_policy, action, isAdmin, _failures)); _utils.checkFailureForSemanticError(_failures, "resource-values", "col"); _utils.checkFailureForSemanticError(_failures, "isRecursive", "db"); _utils.checkFailureForSemanticError(_failures, "isExcludes", "col"); } } when(_store.getPoliciesByResourceSignature("service-name", "hash-1", true)).thenReturn(existingPolicies); for (Action action : cu) { for (boolean isAdmin : new boolean[] { true, false }) { _failures.clear(); Assert.assertFalse(_validator.isValid(_policy, action, isAdmin, _failures)); _utils.checkFailureForSemanticError(_failures, "policy resources"); } } }
@Test public final void test_isValidServiceWithZone_happyPath() throws Exception{ boolean isAdmin = true; when(_policy.getId()).thenReturn(1L); when(_policy.getName()).thenReturn("my-all"); when(_policy.getService()).thenReturn("hdfssvc"); when(_policy.getZoneName()).thenReturn("zone1"); when(_policy.getResources()).thenReturn(null); when(_policy.getIsAuditEnabled()).thenReturn(Boolean.TRUE); when(_policy.getIsEnabled()).thenReturn(Boolean.FALSE); RangerService service = new RangerService(); service.setType("service-type"); service.setId(2L); Action action = Action.CREATE; List<String> tagSvcList = new ArrayList<String>(); tagSvcList.add("hdfssvc"); when(_store.getServiceByName("hdfssvc")).thenReturn(service); RangerSecurityZone securityZone = new RangerSecurityZone(); securityZone.setName("zone1"); securityZone.setId(1L); securityZone.setTagServices(tagSvcList); when(_store.getSecurityZone("zone1")).thenReturn(securityZone); when(_store.getPolicyId(2L, "my-all", 1L)).thenReturn(null); RangerServiceDef svcDef = new RangerServiceDef(); svcDef.setName("my-svc-def"); when(_store.getServiceDefByName("service-type")).thenReturn(svcDef); RangerPolicyResourceSignature policySignature = mock(RangerPolicyResourceSignature.class); when(_factory.createPolicyResourceSignature(_policy)).thenReturn(policySignature); Assert.assertTrue(_validator.isValid(_policy, action, isAdmin, _failures)); }
@Test public final void test_isValidServiceWithZone_failurePath() throws Exception{ boolean isAdmin = true; when(_policy.getId()).thenReturn(1L); when(_policy.getName()).thenReturn("my-all"); when(_policy.getService()).thenReturn("hdfssvc1"); when(_policy.getZoneName()).thenReturn("zone1"); when(_policy.getResources()).thenReturn(null); when(_policy.getIsAuditEnabled()).thenReturn(Boolean.TRUE); when(_policy.getIsEnabled()).thenReturn(Boolean.FALSE); RangerService service = new RangerService(); service.setType("service-type"); service.setId(2L); Action action = Action.CREATE; List<String> tagSvcList = new ArrayList<String>(); tagSvcList.add("hdfssvc"); when(_store.getServiceByName("hdfssvc1")).thenReturn(service); RangerSecurityZone securityZone = new RangerSecurityZone(); securityZone.setName("zone1"); securityZone.setId(1L); securityZone.setTagServices(tagSvcList); when(_store.getSecurityZone("zone1")).thenReturn(securityZone); when(_store.getPolicyId(2L, "my-all", 1L)).thenReturn(null); RangerServiceDef svcDef = new RangerServiceDef(); svcDef.setName("my-svc-def"); when(_store.getServiceDefByName("service-type")).thenReturn(svcDef); RangerPolicyResourceSignature policySignature = mock(RangerPolicyResourceSignature.class); when(_factory.createPolicyResourceSignature(_policy)).thenReturn(policySignature); boolean isValid = _validator.isValid(_policy, action, isAdmin, _failures); Assert.assertFalse(isValid); Assert.assertEquals(_failures.get(0)._errorCode, 3048); Assert.assertEquals(_failures.get(0)._reason,"Service name = hdfssvc1 is not associated to Zone name = zone1"); }