SafeUtils { public boolean canAddOrRemoveUser(UserDetails userDetails, SafeUser safeUser, String action) { String token = userDetails.getSelfSupportToken(); String path = safeUser.getPath(); String safeType = ControllerUtil.getSafeType(path); String safeName = ControllerUtil.getSafeName(path); if (StringUtils.isEmpty(safeType) || StringUtils.isEmpty(safeName)) { return false; } if (userDetails.isAdmin()) { token = userDetails.getClientToken(); } Safe safeMetaData = getSafeMetaData(token, safeType, safeName); if (safeMetaData == null) { return false; } String safeOwnerid = safeMetaData.getSafeBasicDetails().getOwnerid(); if (userDetails.isAdmin()) { if (StringUtils.isEmpty(safeOwnerid)) { return true; } else { if (safeOwnerid.equalsIgnoreCase(safeUser.getUsername())) { if (TVaultConstants.READ_POLICY.equals(safeUser.getAccess()) || TVaultConstants.WRITE_POLICY.equals(safeUser.getAccess()) || (null==safeUser.getAccess() && action.equals(TVaultConstants.REMOVE_USER))) { return true; } return false; } else { return true; } } } else { if (userDetails.getUsername() != null && userDetails.getUsername().equalsIgnoreCase(safeOwnerid)) { if (safeUser.getUsername().equalsIgnoreCase(safeOwnerid)) { if (TVaultConstants.READ_POLICY.equals(safeUser.getAccess()) || TVaultConstants.WRITE_POLICY.equals(safeUser.getAccess()) || (null==safeUser.getAccess() && action.equals(TVaultConstants.REMOVE_USER))) { return true; } return false; } return true; } return false; } } SafeUtils(); List<String> getPoliciesForManagedSafes(JsonNode policiesNode); String[] getManagedSafes(String[] policies, String safeType); boolean canAddOrRemoveUser(UserDetails userDetails, SafeUser safeUser, String action); Safe getSafeMetaData(String token, String safeType, String safeName); Safe getSafeInfo(JsonNode dataNode);  }
@Test public void test_canAddOrRemoveUser_successfully() { UserDetails userDetails = getMockUser(false); SafeUser safeUser = new SafeUser("users/ert", "normaluser", "write"); Response response = getMockResponse(HttpStatus.OK, true, "{\"data\":{\"aws-roles\":" + "{\"erole\":\"read\",\"role1\":\"read\",\"role22\":\"read\",\"testrole3\":\"read\"}," + "\"description\":\"asd\",\"name\":\"ert\",\"owner\":\"sd@g.com\",\"ownerid\":\"normaluser\"," + "\"type\":\"\",\"users\":{\"normaluser\":\"sudo\",\"normaluser2\":\"read\"}}}"); when(ControllerUtil.getSafeType("users/ert")).thenReturn("users"); when(ControllerUtil.getSafeName("users/ert")).thenReturn("ert"); when(ControllerUtil.getReqProcessor().process("/sdb", "{\"path\":\"metadata/users/ert\"}", "5PDrOhsy4ig8L3EpsJZSLAMg")).thenReturn(response); boolean canAdd = safeUtils.canAddOrRemoveUser(userDetails, safeUser, "addUser"); assertTrue(canAdd); }
@Test public void test_canAddOrRemoveUser_successfully_admin() { UserDetails userDetails = getMockUser(true); SafeUser safeUser = new SafeUser("users/ert", "normaluser", "write"); Response response = getMockResponse(HttpStatus.OK, true, "{\"data\":{\"aws-roles\":" + "{\"erole\":\"read\",\"role1\":\"read\",\"role22\":\"read\",\"testrole3\":\"read\"}," + "\"description\":\"asd\",\"name\":\"ert\",\"owner\":\"sd@g.com\",\"ownerid\":\"normaluser\"," + "\"type\":\"\",\"users\":{\"normaluser\":\"sudo\",\"normaluser2\":\"read\"}}}"); when(ControllerUtil.getSafeType("users/ert")).thenReturn("users"); when(ControllerUtil.getSafeName("users/ert")).thenReturn("ert"); when(ControllerUtil.getReqProcessor().process("/sdb", "{\"path\":\"metadata/users/ert\"}", "5PDrOhsy4ig8L3EpsJZSLAMg")).thenReturn(response); boolean canAdd = safeUtils.canAddOrRemoveUser(userDetails, safeUser, "addUser"); assertTrue(canAdd); }
@Test public void test_canAddOrRemoveUser_failure_owner_deny() { UserDetails userDetails = getMockUser(false); SafeUser safeUser = new SafeUser("users/ert", "normaluser", "deny"); Response response = getMockResponse(HttpStatus.OK, true, "{\"data\":{\"aws-roles\":" + "{\"erole\":\"read\",\"role1\":\"read\",\"role22\":\"read\",\"testrole3\":\"read\"}," + "\"description\":\"asd\",\"name\":\"ert\",\"owner\":\"sd@g.com\",\"ownerid\":\"normaluser\"," + "\"type\":\"\",\"users\":{\"normaluser\":\"sudo\",\"normaluser2\":\"read\"}}}"); when(ControllerUtil.getSafeType("users/ert")).thenReturn("users"); when(ControllerUtil.getSafeName("users/ert")).thenReturn("ert"); when(ControllerUtil.getReqProcessor().process("/sdb", "{\"path\":\"metadata/users/ert\"}", "5PDrOhsy4ig8L3EpsJZSLAMg")).thenReturn(response); boolean canAdd = safeUtils.canAddOrRemoveUser(userDetails, safeUser, "addUser"); assertFalse(canAdd); }
@Test public void test_canAddOrRemoveUser_failure_owner_deny_admin() { UserDetails userDetails = getMockUser(true); SafeUser safeUser = new SafeUser("users/ert", "normaluser", "deny"); Response response = getMockResponse(HttpStatus.OK, true, "{\"data\":{\"aws-roles\":" + "{\"erole\":\"read\",\"role1\":\"read\",\"role22\":\"read\",\"testrole3\":\"read\"}," + "\"description\":\"asd\",\"name\":\"ert\",\"owner\":\"sd@g.com\",\"ownerid\":\"normaluser\"," + "\"type\":\"\",\"users\":{\"normaluser\":\"sudo\",\"normaluser2\":\"read\"}}}"); when(ControllerUtil.getSafeType("users/ert")).thenReturn("users"); when(ControllerUtil.getSafeName("users/ert")).thenReturn("ert"); when(ControllerUtil.getReqProcessor().process("/sdb", "{\"path\":\"metadata/users/ert\"}", "5PDrOhsy4ig8L3EpsJZSLAMg")).thenReturn(response); boolean canAdd = safeUtils.canAddOrRemoveUser(userDetails, safeUser, "addUser"); assertFalse(canAdd); }
@Test public void test_canAddOrRemoveUser_failure_admin() { UserDetails userDetails = getMockUser(true); SafeUser safeUser = new SafeUser("users/ert", "normaluser", "write"); Response response = getMockResponse(HttpStatus.OK, true, "{\"data\":{\"aws-roles\":" + "{\"erole\":\"read\",\"role1\":\"read\",\"role22\":\"read\",\"testrole3\":\"read\"}," + "\"description\":\"asd\",\"name\":\"ert\",\"owner\":\"sd@g.com\"," + "\"type\":\"\",\"users\":{\"normaluser\":\"sudo\",\"normaluser2\":\"read\"}}}"); when(ControllerUtil.getSafeType("users/ert")).thenReturn("users"); when(ControllerUtil.getSafeName("users/ert")).thenReturn("ert"); when(ControllerUtil.getReqProcessor().process("/sdb", "{\"path\":\"metadata/users/ert\"}", "5PDrOhsy4ig8L3EpsJZSLAMg")).thenReturn(response); boolean canAdd = safeUtils.canAddOrRemoveUser(userDetails, safeUser, "addUser"); assertTrue(canAdd); }
@Test public void test_canAddOrRemoveUser_successfully_for_normaluser() { UserDetails userDetails = getMockUser(true); SafeUser safeUser = new SafeUser("users/ert", "normaluser", "write"); Response response = getMockResponse(HttpStatus.OK, true, "{\"data\":{\"aws-roles\":" + "{\"erole\":\"read\",\"role1\":\"read\",\"role22\":\"read\",\"testrole3\":\"read\"}," + "\"description\":\"asd\",\"name\":\"ert\",\"owner\":\"sd@g.com\",\"ownerid\":\"normaluser1\"," + "\"type\":\"\",\"users\":{\"normaluser\":\"sudo\",\"normaluser2\":\"read\"}}}"); when(ControllerUtil.getSafeType("users/ert")).thenReturn("users"); when(ControllerUtil.getSafeName("users/ert")).thenReturn("ert"); when(ControllerUtil.getReqProcessor().process("/sdb", "{\"path\":\"metadata/users/ert\"}", "5PDrOhsy4ig8L3EpsJZSLAMg")).thenReturn(response); boolean canAdd = safeUtils.canAddOrRemoveUser(userDetails, safeUser, "addUser"); assertTrue(canAdd); }
@Test public void test_canAddOrRemoveUser_failure_normaluser() { UserDetails userDetails = getMockUser(false); SafeUser safeUser = new SafeUser("users/ert", "normaluser", "write"); Response response = getMockResponse(HttpStatus.OK, true, "{\"data\":{\"aws-roles\":" + "{\"erole\":\"read\",\"role1\":\"read\",\"role22\":\"read\",\"testrole3\":\"read\"}," + "\"description\":\"asd\",\"name\":\"ert\",\"owner\":\"sd@g.com\",\"ownerid\":\"normaluser1\"," + "\"type\":\"\",\"users\":{\"normaluser\":\"sudo\",\"normaluser2\":\"read\"}}}"); when(ControllerUtil.getSafeType("users/ert")).thenReturn("users"); when(ControllerUtil.getSafeName("users/ert")).thenReturn("ert"); when(ControllerUtil.getReqProcessor().process("/sdb", "{\"path\":\"metadata/users/ert\"}", "5PDrOhsy4ig8L3EpsJZSLAMg")).thenReturn(response); boolean canAdd = safeUtils.canAddOrRemoveUser(userDetails, safeUser, "addUser"); assertFalse(canAdd); }
@Test public void test_canAddOrRemoveUser_successfully_normaluser() { UserDetails userDetails = getMockUser(false); SafeUser safeUser = new SafeUser("users/ert", "normaluser1", "write"); Response response = getMockResponse(HttpStatus.OK, true, "{\"data\":{\"aws-roles\":" + "{\"erole\":\"read\",\"role1\":\"read\",\"role22\":\"read\",\"testrole3\":\"read\"}," + "\"description\":\"asd\",\"name\":\"ert\",\"owner\":\"sd@g.com\",\"ownerid\":\"normaluser\"," + "\"type\":\"\",\"users\":{\"normaluser\":\"sudo\",\"normaluser2\":\"read\"}}}"); when(ControllerUtil.getSafeType("users/ert")).thenReturn("users"); when(ControllerUtil.getSafeName("users/ert")).thenReturn("ert"); when(ControllerUtil.getReqProcessor().process("/sdb", "{\"path\":\"metadata/users/ert\"}", "5PDrOhsy4ig8L3EpsJZSLAMg")).thenReturn(response); boolean canAdd = safeUtils.canAddOrRemoveUser(userDetails, safeUser, "addUser"); assertTrue(canAdd); }
@Test public void test_canAddOrRemoveUser_failure_empty_safetype() { UserDetails userDetails = getMockUser(false); SafeUser safeUser = new SafeUser("ert", "normaluser", "write"); when(ControllerUtil.getSafeType("ert")).thenReturn(""); when(ControllerUtil.getSafeName("users/ert")).thenReturn("ert"); boolean canAdd = safeUtils.canAddOrRemoveUser(userDetails, safeUser, "addUser"); assertFalse(canAdd); }