PoliciesAclMigrations { public static Policy accessControlListToPolicyEntries(final AccessControlList accessControlList, final PolicyId policyId, final List<SubjectIssuer> subjectIssuers) { final PolicyBuilder policyBuilder = PoliciesModelFactory.newPolicyBuilder(policyId); accessControlList.getEntriesSet().forEach(aclEntry -> { final String sid = getSubjectWithoutIssuer(aclEntry); final PolicyBuilder.LabelScoped labelScoped = policyBuilder.forLabel(ACL_LABEL_PREFIX + sid); subjectIssuers.forEach( subjectIssuer -> labelScoped.setSubject(subjectIssuer, sid)); if (aclEntry.getPermissions().contains(org.eclipse.ditto.model.things.Permission.READ) && aclEntry.getPermissions() .contains(org.eclipse.ditto.model.things.Permission.WRITE)) { labelScoped.setGrantedPermissions(PoliciesResourceType.policyResource(ROOT_PATH), Permission.READ); labelScoped.setGrantedPermissions(PoliciesResourceType.thingResource(ROOT_PATH), Permission.READ, Permission.WRITE); labelScoped.setGrantedPermissions(PoliciesResourceType.messageResource(ROOT_PATH), Permission.READ, Permission.WRITE); } else if (aclEntry.getPermissions().contains(org.eclipse.ditto.model.things.Permission.READ)) { labelScoped.setGrantedPermissions(PoliciesResourceType.policyResource(ROOT_PATH), Permission.READ); labelScoped.setGrantedPermissions(PoliciesResourceType.thingResource(ROOT_PATH), Permission.READ); labelScoped.setGrantedPermissions(PoliciesResourceType.messageResource(ROOT_PATH), Permission.READ); } else if (aclEntry.getPermissions().contains(org.eclipse.ditto.model.things.Permission.WRITE)) { labelScoped.setGrantedPermissions(PoliciesResourceType.thingResource(ROOT_PATH), Permission.WRITE); labelScoped.setGrantedPermissions(PoliciesResourceType.messageResource(ROOT_PATH), Permission.WRITE); } if (aclEntry.getPermissions().contains(org.eclipse.ditto.model.things.Permission.ADMINISTRATE)) { labelScoped.setGrantedPermissions(PoliciesResourceType.policyResource(ROOT_PATH), Permission.READ, Permission.WRITE); labelScoped.setGrantedPermissions(PoliciesResourceType.thingResource(Thing.JsonFields.ACL.getPointer()), Permission.READ, Permission.WRITE); } else { labelScoped.setRevokedPermissions(PoliciesResourceType.thingResource(Thing.JsonFields.ACL.getPointer()), Permission.WRITE); } }); return policyBuilder.build(); } private  PoliciesAclMigrations(); static Policy accessControlListToPolicyEntries(final AccessControlList accessControlList,
            final PolicyId policyId, final List<SubjectIssuer> subjectIssuers); static final String ACL_LABEL_PREFIX; }
@Test public void verifyMigratedSubjects() { final SubjectId subjectId = SubjectId.newInstance(SubjectIssuer.GOOGLE, "user"); final AccessControlList aclToMigrate = AccessControlList.newBuilder() .set(AclEntry.newInstance(AuthorizationSubject.newInstance(subjectId), Permission.READ)) .build(); final PolicyId policyId = PolicyId.dummy(); final List<SubjectIssuer> issuers = Arrays.asList(SubjectIssuer.GOOGLE, SubjectIssuer.newInstance("any-other")); final String expectedLabel = "acl_" + subjectId.getSubject(); final PolicyEntry expectedEntry = createExpectedPolicyEntry(expectedLabel, subjectId, issuers); final Policy migratedPolicy = PoliciesAclMigrations.accessControlListToPolicyEntries(aclToMigrate, policyId, issuers); assertThat(migratedPolicy.getEntryFor(expectedLabel)).contains(expectedEntry); }