DBService implements RolesProvider { void updateRoleSystemMetaFields(ObjectStoreConnection con, Role updatedRole, Role originalRole, final String attribute, RoleSystemMeta meta, final String caller) { if (ZMSConsts.SYSTEM_META_AUDIT_ENABLED.equals(attribute)) { updatedRole.setAuditEnabled(meta.getAuditEnabled()); if (updatedRole.getAuditEnabled() == Boolean.TRUE && originalRole.getRoleMembers() != null) { for (RoleMember roleMember : originalRole.getRoleMembers()) { final String memberName = roleMember.getMemberName(); if (ZMSUtils.principalType(memberName, zmsConfig.getUserDomainPrefix(), zmsConfig.getAddlUserCheckDomainPrefixList()) != Principal.Type.GROUP) { continue; } int idx = memberName.indexOf(AuthorityConsts.GROUP_SEP); final String domainName = memberName.substring(0, idx); final String groupName = memberName.substring(idx + AuthorityConsts.GROUP_SEP.length()); Group group = con.getGroup(domainName, groupName); if (group == null) { throw ZMSUtils.requestError("role has invalid group member: " + memberName, caller); } if (group.getAuditEnabled() != Boolean.TRUE) { throw ZMSUtils.requestError("role member: " + memberName + " must have audit flag enabled", caller); } } } } else { throw ZMSUtils.requestError("unknown role system meta attribute: " + attribute, caller); } } DBService(ObjectStore store, AuditLogger auditLogger, ZMSConfig zmsConfig, AuditReferenceValidator auditReferenceValidator); DomainRoleMembers listOverdueReviewRoleMembers(String domainName); @Override List<Role> getRolesByDomain(String domain); ResourceAccessList getResourceAccessList(String principal, String action); AthenzDomain getAthenzDomain(final String domainName, boolean masterCopy); Quota getQuota(String domainName); void executePutRoleSystemMeta(ResourceContext ctx, final String domainName, final String roleName,
           RoleSystemMeta meta, final String attribute, final String auditRef, final String caller); void executePutGroupSystemMeta(ResourceContext ctx, final String domainName, final String groupName,
                                          GroupSystemMeta meta, final String attribute, final String auditRef); void executePutServiceIdentitySystemMeta(ResourceContext ctx, String domainName, String serviceName,
            ServiceIdentitySystemMeta meta, String attribute, String auditRef, String caller); void executePutRoleMeta(ResourceContext ctx, String domainName, String roleName, Role originalRole,
                                   RoleMeta meta, String auditRef, String caller); void executePutGroupMeta(ResourceContext ctx, final String domainName, final String groupName,
                                    GroupMeta meta, final String auditRef); Set<String> getPendingMembershipApproverRoles(int delayDays); Set<String> getPendingGroupMembershipApproverRoles(int delayDays); Map<String, DomainRoleMember> getRoleExpiryMembers(int delayDays); Map<String, DomainRoleMember> getRoleReviewMembers(int delayDays); Map<String, DomainGroupMember> getGroupExpiryMembers(int delayDays); void processExpiredPendingMembers(int pendingRoleMemberLifespan, final String monitorIdentity); void processExpiredPendingGroupMembers(int pendingGroupMemberLifespan, final String monitorIdentity); static int AUDIT_TYPE_ROLE; static int AUDIT_TYPE_POLICY; static int AUDIT_TYPE_SERVICE; static int AUDIT_TYPE_DOMAIN; static int AUDIT_TYPE_ENTITY; static int AUDIT_TYPE_TENANCY; static int AUDIT_TYPE_TEMPLATE; static int AUDIT_TYPE_GROUP; }
@Test public void testUpdateRoleSystemMetaFields() { Role updatedRole = new Role(); Role originalRole = new Role(); RoleSystemMeta meta = new RoleSystemMeta() .setAuditEnabled(true); zms.dbService.updateRoleSystemMetaFields(mockJdbcConn, updatedRole, originalRole, "auditenabled", meta, "unit-test"); assertTrue(updatedRole.getAuditEnabled()); try { zms.dbService.updateRoleSystemMetaFields(mockJdbcConn, updatedRole, originalRole, "unknown", meta, "unit-test"); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 400); } }
@Test public void testUpdateRoleSystemMetaFieldsInvalidGroup() { Role updatedRole = new Role().setAuditEnabled(true); RoleMember roleMember = new RoleMember().setMemberName("coretech:group.group1"); List<RoleMember> roleMembers = new ArrayList<>(); roleMembers.add(roleMember); Role originalRole = new Role().setRoleMembers(roleMembers); RoleSystemMeta meta = new RoleSystemMeta().setAuditEnabled(true); try { zms.dbService.updateRoleSystemMetaFields(mockJdbcConn, updatedRole, originalRole, "auditenabled", meta, "unittest"); fail(); } catch (ResourceException ex) { assertTrue(ex.getMessage().contains("role has invalid group member")); } }