AppRoleService { public ResponseEntity<String> readAppRoleDetails(String token, String rolename, UserDetails userDetails){ if (rolename.equals(TVaultConstants.SELF_SERVICE_APPROLE_NAME)) { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Access denied: You don't have enough permission to read the information of the AppRole\"]}"); } log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "readAppRoleDetails"). put(LogMessage.MESSAGE, String.format("Trying to read AppRole information for [%s]", rolename)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); if (!userDetails.isAdmin()) { token = userDetails.getSelfSupportToken(); } AppRole appRole = readAppRoleBasicDetails(token, rolename); if (appRole ==null) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "readAppRoleSecretId"). put(LogMessage.MESSAGE, String.format("Unable to read AppRole information. AppRole [%s] doesn't exist", rolename)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"AppRole doesn't exist\"]}"); } boolean isAllowed = isAllowed(rolename, userDetails, TVaultConstants.APPROLE_READ_OPERATION); if (isAllowed) { AppRoleMetadata appRoleMetadata = readAppRoleMetadata(token, rolename); String roleId = readRoleId(token, rolename); List<String> accessorIds = readAccessorIds(token, rolename); AppRoleDetails appRoleDetails = new AppRoleDetails(); appRoleDetails.setAppRole(appRole); appRoleDetails.setRole_id(roleId); appRoleDetails.setAppRoleMetadata(appRoleMetadata); if (!CollectionUtils.isEmpty(accessorIds)) { appRoleDetails.setAccessorIds(accessorIds.toArray(new String[accessorIds.size()])); } Response response = new Response(); response.setHttpstatus(HttpStatus.OK); response.setSuccess(true); response.setResponse(JSONUtil.getJSON(appRoleDetails)); return ResponseEntity.status(response.getHttpstatus()).body(response.getResponse()); } log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "readAppRoleSecretId"). put(LogMessage.MESSAGE, "Reading secret_id for AppRole failed"). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Access denied: You don't have enough permission to read the secret_id associated with the AppRole\"]}"); }  ResponseEntity<String> createAppRole(String token, AppRole appRole, UserDetails userDetails); ResponseEntity<String> readAppRole(String token, String rolename); ResponseEntity<String> readAppRoles(String token); ResponseEntity<String> listAppRoles(String token,  UserDetails userDetails); ResponseEntity<String> readAppRoleRoleId(String token, String rolename); String readRoleId(String token, String rolename); List<String> readAccessorIds(String token, String rolename); AppRoleMetadata readAppRoleMetadata(String token, String rolename); AppRole readAppRoleBasicDetails(String token, String rolename); ResponseEntity<String> readAppRoleRoleId(String token, String rolename, UserDetails userDetails); ResponseEntity<String> readAppRoleSecretId(String token, String rolename, UserDetails userDetails); ResponseEntity<String> readSecretIdAccessors(String token, String rolename, UserDetails userDetails); ResponseEntity<String> readAppRoleDetails(String token, String rolename, UserDetails userDetails); ResponseEntity<String> createsecretId(String token, AppRoleSecretData appRoleSecretData); ResponseEntity<String> readAppRoleSecretId(String token, String rolename); ResponseEntity<String> deleteSecretId(String token, AppRoleNameSecretId appRoleNameSecretId); ResponseEntity<String> deleteAppRole(String token, AppRole appRole, UserDetails userDetails); ResponseEntity<String> deleteSecretIds(String token, AppRoleAccessorIds appRoleAccessorIds, UserDetails userDetails); ResponseEntity<String> login(AppRoleIdSecretId appRoleIdSecretId); ResponseEntity<String> associateApprole(String token, SafeAppRoleAccess safeAppRoleAccess); ResponseEntity<String> updateAppRole(String token, AppRole appRole, UserDetails userDetails); Response configureApprole(String rolename,String policies,String token );  }
@Test public void test_readAppRoleDetails_WithUserDetails_successfully() throws Exception { String token = "5PDrOhsy4ig8L3EpsJZSLAMg"; UserDetails userDetails = getMockUser("testuser1", true); String role_name = "approle1"; String username = userDetails.getUsername(); String path = TVaultConstants.APPROLE_METADATA_MOUNT_PATH + "/" + role_name; String roleId="generated-role-id"; ArrayList<String> policiesList = new ArrayList<String>(); policiesList.add("r_shared_safe01"); String[] policies = policiesList.toArray(new String[policiesList.size()]); AppRole appRole = new AppRole(role_name, policies, true, 0, 0, 0); String appRoleResponseJson = new ObjectMapper().writeValueAsString(appRole); Response appRoleResponse = getMockResponse(HttpStatus.OK, true, appRoleResponseJson); Map<String, Object> appRoleResponseMap = new HashMap<>(); Map<String, Object> dataMap = new HashMap<>(); appRoleResponseMap.put("data", dataMap); dataMap.put("policies",policiesList); dataMap.put("bind_secret_id",new Boolean(true)); dataMap.put("secret_id_num_uses", new Integer(0)); dataMap.put("secret_id_ttl", new Integer(0)); dataMap.put("token_num_uses", new Integer(0)); dataMap.put("token_ttl", new Integer(0)); dataMap.put("token_max_ttl", new Integer(0)); when(ControllerUtil.parseJson(appRoleResponseJson)).thenReturn(appRoleResponseMap); when(reqProcessor.process("/auth/approle/role/read", "{\"role_name\":\""+role_name+"\"}",token)).thenReturn(appRoleResponse); AppRoleMetadata approleMetadata = new AppRoleMetadata(); approleMetadata.setPath(path); AppRoleMetadataDetails appRoleMetadataDetails = new AppRoleMetadataDetails(); appRoleMetadataDetails.setCreatedBy(username); appRoleMetadataDetails.setName(role_name); approleMetadata.setAppRoleMetadataDetails(appRoleMetadataDetails); String appRoleMetadataResponseJson = new ObjectMapper().writeValueAsString(approleMetadata); Response appRoleMetadataResponse = getMockResponse(HttpStatus.OK, true, appRoleMetadataResponseJson); Map<String, Object> appRoleMetadatResponseMap = new HashMap<>(); Map<String, Object> appRoleMetadataMap = new HashMap<>(); appRoleMetadataMap.put("createdBy",username); appRoleMetadatResponseMap.put("data", appRoleMetadataMap); when(ControllerUtil.parseJson(appRoleMetadataResponseJson)).thenReturn(appRoleMetadatResponseMap); when(reqProcessor.process("/read", "{\"path\":\""+path+"\"}",token)).thenReturn(appRoleMetadataResponse); String roleIdResponseJson = "{\"data\":{ \"role_id\": \""+roleId+"\"}}"; Response roleIdResponse = getMockResponse(HttpStatus.OK, true, roleIdResponseJson); Map<String, Object> responseMap = new HashMap<>(); Map<String,Object> roleIdDataMap = new HashMap<>(); roleIdDataMap.put("role_id", roleId); responseMap.put("data", roleIdDataMap); when(ControllerUtil.parseJson("{\"data\":{ \"role_id\": \""+roleId+"\"}}")).thenReturn(responseMap); when(reqProcessor.process("/auth/approle/role/readRoleID", "{\"role_name\":\""+role_name+"\"}",token)).thenReturn(roleIdResponse); String accessorIdResponseJson = "{\r\n" + " \"keys\": [\r\n" + " \"generated-accessor-id1\"\r\n" + " ]\r\n" + "}"; Response accessorIdResponse = getMockResponse(HttpStatus.OK, true, accessorIdResponseJson); Map<String, Object> accessorIdResponseMap = new HashMap<>(); ArrayList<String> accessorIds = new ArrayList<String>(); accessorIds.add("generated-accessor-id1"); accessorIdResponseMap.put("keys", accessorIds); when(ControllerUtil.parseJson(accessorIdResponseJson)).thenReturn(responseMap); when(reqProcessor.process("/auth/approle/role/accessors/list", "{\"role_name\":\""+role_name+"\"}",token)).thenReturn(accessorIdResponse); AppRoleDetails appRoleDetails = new AppRoleDetails(); appRoleDetails.setAppRole(appRole); appRoleDetails.setRole_id(roleId); appRoleDetails.setAppRoleMetadata(approleMetadata); if (!CollectionUtils.isEmpty(accessorIds)) { appRoleDetails.setAccessorIds(accessorIds.toArray(new String[accessorIds.size()])); } String appRoleDetailsJson = objMapper.writeValueAsString(appRoleDetails); String appRoleDetailsResponseJson = objMapper.writeValueAsString(appRoleDetails); Response appRoleDetailsResponse =getMockResponse(HttpStatus.OK, true, appRoleDetailsResponseJson); ResponseEntity<String> responseEntityExpected = ResponseEntity.status(appRoleDetailsResponse.getHttpstatus()).body(appRoleDetailsResponse.getResponse()); when(JSONUtil.getJSON(Mockito.any(AppRoleDetails.class))).thenReturn(appRoleDetailsJson); ResponseEntity<String> responseEntityActual = appRoleService.readAppRoleDetails(token, role_name, userDetails); assertEquals(HttpStatus.OK, responseEntityActual.getStatusCode()); assertEquals(responseEntityExpected, responseEntityActual); }
@Test public void test_readAppRoleDetails_WithUserDetails_admin_success() throws Exception { String token = "5PDrOhsy4ig8L3EpsJZSLAMg"; UserDetails userDetails = getMockUser("testuser2", false); String role_name = "approle1"; String username = userDetails.getUsername(); String path = TVaultConstants.APPROLE_METADATA_MOUNT_PATH + "/" + role_name; String roleId="generated-role-id"; ArrayList<String> policiesList = new ArrayList<String>(); policiesList.add("r_shared_safe01"); String[] policies = policiesList.toArray(new String[policiesList.size()]); AppRole appRole = new AppRole(role_name, policies, true, 0, 0, 0); String appRoleResponseJson = new ObjectMapper().writeValueAsString(appRole); Response appRoleResponse = getMockResponse(HttpStatus.OK, true, appRoleResponseJson); Map<String, Object> appRoleResponseMap = new HashMap<>(); Map<String, Object> dataMap = new HashMap<>(); appRoleResponseMap.put("data", dataMap); dataMap.put("policies",policiesList); dataMap.put("bind_secret_id",new Boolean(true)); dataMap.put("secret_id_num_uses", new Integer(0)); dataMap.put("secret_id_ttl", new Integer(0)); dataMap.put("token_num_uses", new Integer(0)); dataMap.put("token_ttl", new Integer(0)); dataMap.put("token_max_ttl", new Integer(0)); when(ControllerUtil.parseJson(appRoleResponseJson)).thenReturn(appRoleResponseMap); when(reqProcessor.process("/auth/approle/role/read", "{\"role_name\":\""+role_name+"\"}",userDetails.getSelfSupportToken())).thenReturn(appRoleResponse); AppRoleMetadata approleMetadata = new AppRoleMetadata(); approleMetadata.setPath(path); AppRoleMetadataDetails appRoleMetadataDetails = new AppRoleMetadataDetails(); appRoleMetadataDetails.setCreatedBy(username); appRoleMetadataDetails.setName(role_name); approleMetadata.setAppRoleMetadataDetails(appRoleMetadataDetails); String appRoleMetadataResponseJson = new ObjectMapper().writeValueAsString(approleMetadata); Response appRoleMetadataResponse = getMockResponse(HttpStatus.OK, true, appRoleMetadataResponseJson); Map<String, Object> appRoleMetadatResponseMap = new HashMap<>(); Map<String, Object> appRoleMetadataMap = new HashMap<>(); appRoleMetadataMap.put("createdBy",username); appRoleMetadatResponseMap.put("data", appRoleMetadataMap); when(ControllerUtil.parseJson(appRoleMetadataResponseJson)).thenReturn(appRoleMetadatResponseMap); when(reqProcessor.process("/read", "{\"path\":\""+path+"\"}",userDetails.getSelfSupportToken())).thenReturn(appRoleMetadataResponse); String roleIdResponseJson = "{\"data\":{ \"role_id\": \""+roleId+"\"}}"; Response roleIdResponse = getMockResponse(HttpStatus.OK, true, roleIdResponseJson); Map<String, Object> responseMap = new HashMap<>(); Map<String,Object> roleIdDataMap = new HashMap<>(); roleIdDataMap.put("role_id", roleId); responseMap.put("data", roleIdDataMap); when(ControllerUtil.parseJson("{\"data\":{ \"role_id\": \""+roleId+"\"}}")).thenReturn(responseMap); when(reqProcessor.process("/auth/approle/role/readRoleID", "{\"role_name\":\""+role_name+"\"}",userDetails.getSelfSupportToken())).thenReturn(roleIdResponse); String accessorIdResponseJson = "{\r\n" + " \"keys\": [\r\n" + " \"generated-accessor-id1\"\r\n" + " ]\r\n" + "}"; Response accessorIdResponse = getMockResponse(HttpStatus.OK, true, accessorIdResponseJson); Map<String, Object> accessorIdResponseMap = new HashMap<>(); ArrayList<String> accessorIds = new ArrayList<String>(); accessorIds.add("generated-accessor-id1"); accessorIdResponseMap.put("keys", accessorIds); when(ControllerUtil.parseJson(accessorIdResponseJson)).thenReturn(responseMap); when(reqProcessor.process("/auth/approle/role/accessors/list", "{\"role_name\":\""+role_name+"\"}",userDetails.getSelfSupportToken())).thenReturn(accessorIdResponse); AppRoleDetails appRoleDetails = new AppRoleDetails(); appRoleDetails.setAppRole(appRole); appRoleDetails.setRole_id(roleId); appRoleDetails.setAppRoleMetadata(approleMetadata); if (!CollectionUtils.isEmpty(accessorIds)) { appRoleDetails.setAccessorIds(accessorIds.toArray(new String[accessorIds.size()])); } String appRoleDetailsJson = objMapper.writeValueAsString(appRoleDetails); String appRoleDetailsResponseJson = objMapper.writeValueAsString(appRoleDetails); Response appRoleDetailsResponse =getMockResponse(HttpStatus.OK, true, appRoleDetailsResponseJson); ResponseEntity<String> responseEntityExpected = ResponseEntity.status(appRoleDetailsResponse.getHttpstatus()).body(appRoleDetailsResponse.getResponse()); when(JSONUtil.getJSON(Mockito.any(AppRoleDetails.class))).thenReturn(appRoleDetailsJson); ResponseEntity<String> responseEntityActual = appRoleService.readAppRoleDetails(token, role_name, userDetails); assertEquals(HttpStatus.OK, responseEntityActual.getStatusCode()); assertEquals(responseEntityExpected, responseEntityActual); }
@Test public void test_readAppRoleDetails_WithUserDetails_failure() throws Exception { String token = "5PDrOhsy4ig8L3EpsJZSLAMg"; UserDetails userDetails = getMockUser("testuser2", false); String role_name = "approle1"; String username = userDetails.getUsername(); String path = TVaultConstants.APPROLE_METADATA_MOUNT_PATH + "/" + role_name; String roleId="generated-role-id"; ArrayList<String> policiesList = new ArrayList<String>(); policiesList.add("r_shared_safe01"); String[] policies = policiesList.toArray(new String[policiesList.size()]); AppRole appRole = new AppRole(role_name, policies, true, 0, 0, 0); String appRoleResponseJson = new ObjectMapper().writeValueAsString(appRole); Response appRoleResponse = getMockResponse(HttpStatus.OK, true, appRoleResponseJson); Map<String, Object> appRoleResponseMap = new HashMap<>(); Map<String, Object> dataMap = new HashMap<>(); appRoleResponseMap.put("data", dataMap); dataMap.put("policies",policiesList); dataMap.put("bind_secret_id",new Boolean(true)); dataMap.put("secret_id_num_uses", new Integer(0)); dataMap.put("secret_id_ttl", new Integer(0)); dataMap.put("token_num_uses", new Integer(0)); dataMap.put("token_ttl", new Integer(0)); dataMap.put("token_max_ttl", new Integer(0)); when(ControllerUtil.parseJson(appRoleResponseJson)).thenReturn(appRoleResponseMap); when(reqProcessor.process("/auth/approle/role/read", "{\"role_name\":\""+role_name+"\"}",userDetails.getSelfSupportToken())).thenReturn(appRoleResponse); AppRoleMetadata approleMetadata = new AppRoleMetadata(); approleMetadata.setPath(path); AppRoleMetadataDetails appRoleMetadataDetails = new AppRoleMetadataDetails(); appRoleMetadataDetails.setCreatedBy(username); appRoleMetadataDetails.setName(role_name); approleMetadata.setAppRoleMetadataDetails(appRoleMetadataDetails); String appRoleMetadataResponseJson = new ObjectMapper().writeValueAsString(approleMetadata); Response appRoleMetadataResponse = getMockResponse(HttpStatus.NOT_FOUND, true, appRoleMetadataResponseJson); Map<String, Object> appRoleMetadatResponseMap = new HashMap<>(); Map<String, Object> appRoleMetadataMap = new HashMap<>(); appRoleMetadataMap.put("createdBy",username); appRoleMetadatResponseMap.put("data", appRoleMetadataMap); when(ControllerUtil.parseJson(appRoleMetadataResponseJson)).thenReturn(appRoleMetadatResponseMap); when(reqProcessor.process("/read", "{\"path\":\""+path+"\"}",userDetails.getSelfSupportToken())).thenReturn(appRoleMetadataResponse); String roleIdResponseJson = "{\"data\":{ \"role_id\": \""+roleId+"\"}}"; Response roleIdResponse = getMockResponse(HttpStatus.OK, true, roleIdResponseJson); Map<String, Object> responseMap = new HashMap<>(); Map<String,Object> roleIdDataMap = new HashMap<>(); roleIdDataMap.put("role_id", roleId); responseMap.put("data", roleIdDataMap); when(ControllerUtil.parseJson("{\"data\":{ \"role_id\": \""+roleId+"\"}}")).thenReturn(responseMap); when(reqProcessor.process("/auth/approle/role/readRoleID", "{\"role_name\":\""+role_name+"\"}",userDetails.getSelfSupportToken())).thenReturn(roleIdResponse); String accessorIdResponseJson = "{\r\n" + " \"keys\": [\r\n" + " \"generated-accessor-id1\"\r\n" + " ]\r\n" + "}"; Response accessorIdResponse = getMockResponse(HttpStatus.OK, true, accessorIdResponseJson); Map<String, Object> accessorIdResponseMap = new HashMap<>(); ArrayList<String> accessorIds = new ArrayList<String>(); accessorIds.add("generated-accessor-id1"); accessorIdResponseMap.put("keys", accessorIds); when(ControllerUtil.parseJson(accessorIdResponseJson)).thenReturn(responseMap); when(reqProcessor.process("/auth/approle/role/accessors/list", "{\"role_name\":\""+role_name+"\"}",userDetails.getSelfSupportToken())).thenReturn(accessorIdResponse); AppRoleDetails appRoleDetails = new AppRoleDetails(); appRoleDetails.setAppRole(appRole); appRoleDetails.setRole_id(roleId); appRoleDetails.setAppRoleMetadata(approleMetadata); if (!CollectionUtils.isEmpty(accessorIds)) { appRoleDetails.setAccessorIds(accessorIds.toArray(new String[accessorIds.size()])); } String appRoleDetailsResponseJson = "{\"errors\":[\"Access denied: You don't have enough permission to read the secret_id associated with the AppRole\"]}"; Response appRoleDetailsResponse =getMockResponse(HttpStatus.BAD_REQUEST, true, appRoleDetailsResponseJson); ResponseEntity<String> responseEntityExpected = ResponseEntity.status(appRoleDetailsResponse.getHttpstatus()).body(appRoleDetailsResponse.getResponse()); ResponseEntity<String> responseEntityActual = appRoleService.readAppRoleDetails(token, role_name, userDetails); assertEquals(HttpStatus.BAD_REQUEST, responseEntityActual.getStatusCode()); assertEquals(responseEntityExpected, responseEntityActual); }