DBService implements RolesProvider { Policy updateTemplatePolicy(Policy policy, String domainName, List<TemplateParam> params) { String templatePolicyName = policy.getName().replace(TEMPLATE_DOMAIN_NAME, domainName); if (params != null) { for (TemplateParam param : params) { final String paramKey = "_" + param.getName() + "_"; templatePolicyName = templatePolicyName.replace(paramKey, param.getValue()); } } Policy templatePolicy = new Policy().setName(templatePolicyName); List<Assertion> assertions = policy.getAssertions(); List<Assertion> newAssertions = new ArrayList<>(); if (assertions != null && !assertions.isEmpty()) { for (Assertion assertion : assertions) { Assertion newAssertion = new Assertion(); newAssertion.setAction(assertion.getAction()); newAssertion.setEffect(assertion.getEffect()); String resource = assertion.getResource().replace(TEMPLATE_DOMAIN_NAME, domainName); String role = assertion.getRole().replace(TEMPLATE_DOMAIN_NAME, domainName); if (params != null) { for (TemplateParam param : params) { final String paramKey = "_" + param.getName() + "_"; resource = resource.replace(paramKey, param.getValue()); role = role.replace(paramKey, param.getValue()); } } newAssertion.setResource(resource); newAssertion.setRole(role); newAssertions.add(newAssertion); } } templatePolicy.setAssertions(newAssertions); return templatePolicy; } DBService(ObjectStore store, AuditLogger auditLogger, ZMSConfig zmsConfig, AuditReferenceValidator auditReferenceValidator); DomainRoleMembers listOverdueReviewRoleMembers(String domainName); @Override List<Role> getRolesByDomain(String domain); ResourceAccessList getResourceAccessList(String principal, String action); AthenzDomain getAthenzDomain(final String domainName, boolean masterCopy); Quota getQuota(String domainName); void executePutRoleSystemMeta(ResourceContext ctx, final String domainName, final String roleName,
           RoleSystemMeta meta, final String attribute, final String auditRef, final String caller); void executePutGroupSystemMeta(ResourceContext ctx, final String domainName, final String groupName,
                                          GroupSystemMeta meta, final String attribute, final String auditRef); void executePutServiceIdentitySystemMeta(ResourceContext ctx, String domainName, String serviceName,
            ServiceIdentitySystemMeta meta, String attribute, String auditRef, String caller); void executePutRoleMeta(ResourceContext ctx, String domainName, String roleName, Role originalRole,
                                   RoleMeta meta, String auditRef, String caller); void executePutGroupMeta(ResourceContext ctx, final String domainName, final String groupName,
                                    GroupMeta meta, final String auditRef); Set<String> getPendingMembershipApproverRoles(int delayDays); Set<String> getPendingGroupMembershipApproverRoles(int delayDays); Map<String, DomainRoleMember> getRoleExpiryMembers(int delayDays); Map<String, DomainRoleMember> getRoleReviewMembers(int delayDays); Map<String, DomainGroupMember> getGroupExpiryMembers(int delayDays); void processExpiredPendingMembers(int pendingRoleMemberLifespan, final String monitorIdentity); void processExpiredPendingGroupMembers(int pendingGroupMemberLifespan, final String monitorIdentity); static int AUDIT_TYPE_ROLE; static int AUDIT_TYPE_POLICY; static int AUDIT_TYPE_SERVICE; static int AUDIT_TYPE_DOMAIN; static int AUDIT_TYPE_ENTITY; static int AUDIT_TYPE_TENANCY; static int AUDIT_TYPE_TEMPLATE; static int AUDIT_TYPE_GROUP; }
@Test public void testUpdateTemplatePolicy() { Policy policy = createPolicyObject("_domain_", "policy1", "role1", true, "read", "_domain_:*", AssertionEffect.ALLOW); Policy newPolicy = zms.dbService.updateTemplatePolicy(policy, "athenz", null); assertEquals("athenz:policy.policy1", newPolicy.getName()); List<Assertion> assertions = newPolicy.getAssertions(); assertEquals(1, assertions.size()); Assertion assertion = assertions.get(0); assertEquals("athenz:role.role1", assertion.getRole()); assertEquals("athenz:*", assertion.getResource()); assertEquals("read", assertion.getAction()); assertEquals(AssertionEffect.ALLOW, assertion.getEffect()); }
@Test public void testUpdateTemplatePolicyNoAssertions() { Policy policy = new Policy().setName("_domain_:policy.policy1"); Policy newPolicy = zms.dbService.updateTemplatePolicy(policy, "athenz", null); assertEquals("athenz:policy.policy1", newPolicy.getName()); List<Assertion> assertions = newPolicy.getAssertions(); assertEquals(0, assertions.size()); }