WorkflowActionAuthorizer { public void authorizeWorkflowAction(AuthContext ac, WorkflowId workflowId) { final Optional<Workflow> workflowOpt; try { workflowOpt = storage.workflow(workflowId); } catch (IOException e) { throw new RuntimeException(e); } final Workflow workflow = workflowOpt.orElseThrow(() -> new ResponseException( Response.forStatus(Status.NOT_FOUND.withReasonPhrase("workflow not found")))); authorizeWorkflowAction(ac, workflow); } WorkflowActionAuthorizer(Storage storage,
                                  ServiceAccountUsageAuthorizer serviceAccountUsageAuthorizer); void authorizeWorkflowAction(AuthContext ac, WorkflowId workflowId); void authorizeWorkflowAction(AuthContext ac, Workflow workflow);  }
@Test public void authorizeWorkflowActionWithIdShouldFailIfStorageReadFails() throws IOException { final IOException cause = new IOException(); when(storage.workflow(any())).thenThrow(cause); exception.expect(RuntimeException.class); exception.expectCause(is(cause)); sut.authorizeWorkflowAction(ac, WORKFLOW.id()); }
@Test public void authorizeWorkflowActionWithIdShouldFailIfWorkflowNotFound() throws IOException { when(storage.workflow(any())).thenReturn(Optional.empty()); exception.expect(ResponseException.class); sut.authorizeWorkflowAction(ac, WORKFLOW.id()); }
@Test public void authorizeWorkflowActionWithIdShouldPass() throws IOException { when(storage.workflow(any())).thenReturn(Optional.of(WORKFLOW)); when(ac.user()).thenReturn(Optional.of(idToken)); assertThat(Try.run(() -> sut.authorizeWorkflowAction(ac, WORKFLOW.id())).isSuccess(), is(true)); verify(authorizer).authorizeServiceAccountUsage( WORKFLOW.id(), WORKFLOW.configuration().serviceAccount().orElseThrow(), idToken); }
@Test public void authorizeWorkflowActionShouldFailIfNoUser() { when(ac.user()).thenReturn(Optional.empty()); exception.expect(AssertionError.class); sut.authorizeWorkflowAction(ac, WORKFLOW); }
@Test public void authorizeWorkflowActionShouldPassIfNoServiceAccountConfigured() { when(ac.user()).thenReturn(Optional.of(idToken)); assertThat(Try.run(() -> sut.authorizeWorkflowAction(ac, WORKFLOW_WITHOUT_SA)).isSuccess(), is(true)); }
@Test public void authorizeWorkflowActionShouldPassIfAuthorizerPasses() { when(ac.user()).thenReturn(Optional.of(idToken)); assertThat(Try.run(() -> sut.authorizeWorkflowAction(ac, WORKFLOW)).isSuccess(), is(true)); verify(authorizer).authorizeServiceAccountUsage( WORKFLOW.id(), WORKFLOW.configuration().serviceAccount().orElseThrow(), idToken); }
@Test public void authorizeWorkflowActionShouldFailIfAuthorizerFails() { when(ac.user()).thenReturn(Optional.of(idToken)); final ResponseException cause = new ResponseException(Response.forStatus(FORBIDDEN)); doThrow(cause).when(authorizer).authorizeServiceAccountUsage(any(), any(), any()); exception.expect(is(cause)); sut.authorizeWorkflowAction(ac, WORKFLOW); final Try<Void> invocation = Try.run(() -> sut.authorizeWorkflowAction(ac, WORKFLOW)); assertThat(invocation.isFailure(), is(true)); verify(authorizer).authorizeServiceAccountUsage( WORKFLOW.id(), WORKFLOW.configuration().serviceAccount().orElseThrow(), idToken); assertThat(invocation.getCause(), is(cause)); }