DBService implements RolesProvider { void updateRoleMembersSystemDisabledState(ResourceContext ctx, ObjectStoreConnection con, final String domainName, final String roleName, Role originalRole, Role updatedRole, final String auditRef, final String caller) { if (originalRole.getTrust() != null && !originalRole.getTrust().isEmpty()) { return; } final List<RoleMember> roleMembers = originalRole.getRoleMembers(); if (roleMembers == null || roleMembers.isEmpty()) { return; } if (!isUserAuthorityFilterChanged(originalRole.getUserAuthorityFilter(), updatedRole.getUserAuthorityFilter())) { return; } final String principal = getPrincipalName(ctx); List<RoleMember> roleMembersWithUpdatedDisabledState = getRoleMembersWithUpdatedDisabledState(roleMembers, updatedRole.getUserAuthorityFilter(), getDomainUserAuthorityFilter(con, domainName)); if (updateRoleMemberDisabledState(ctx, con, roleMembersWithUpdatedDisabledState, domainName, roleName, principal, auditRef, caller)) { con.updateRoleModTimestamp(domainName, roleName); con.updateDomainModTimestamp(domainName); cacheStore.invalidate(domainName); } } DBService(ObjectStore store, AuditLogger auditLogger, ZMSConfig zmsConfig, AuditReferenceValidator auditReferenceValidator); DomainRoleMembers listOverdueReviewRoleMembers(String domainName); @Override List<Role> getRolesByDomain(String domain); ResourceAccessList getResourceAccessList(String principal, String action); AthenzDomain getAthenzDomain(final String domainName, boolean masterCopy); Quota getQuota(String domainName); void executePutRoleSystemMeta(ResourceContext ctx, final String domainName, final String roleName,
           RoleSystemMeta meta, final String attribute, final String auditRef, final String caller); void executePutGroupSystemMeta(ResourceContext ctx, final String domainName, final String groupName,
                                          GroupSystemMeta meta, final String attribute, final String auditRef); void executePutServiceIdentitySystemMeta(ResourceContext ctx, String domainName, String serviceName,
            ServiceIdentitySystemMeta meta, String attribute, String auditRef, String caller); void executePutRoleMeta(ResourceContext ctx, String domainName, String roleName, Role originalRole,
                                   RoleMeta meta, String auditRef, String caller); void executePutGroupMeta(ResourceContext ctx, final String domainName, final String groupName,
                                    GroupMeta meta, final String auditRef); Set<String> getPendingMembershipApproverRoles(int delayDays); Set<String> getPendingGroupMembershipApproverRoles(int delayDays); Map<String, DomainRoleMember> getRoleExpiryMembers(int delayDays); Map<String, DomainRoleMember> getRoleReviewMembers(int delayDays); Map<String, DomainGroupMember> getGroupExpiryMembers(int delayDays); void processExpiredPendingMembers(int pendingRoleMemberLifespan, final String monitorIdentity); void processExpiredPendingGroupMembers(int pendingGroupMemberLifespan, final String monitorIdentity); static int AUDIT_TYPE_ROLE; static int AUDIT_TYPE_POLICY; static int AUDIT_TYPE_SERVICE; static int AUDIT_TYPE_DOMAIN; static int AUDIT_TYPE_ENTITY; static int AUDIT_TYPE_TENANCY; static int AUDIT_TYPE_TEMPLATE; static int AUDIT_TYPE_GROUP; }
@Test public void testUpdateRoleMembersSystemDisabledState() { Authority savedAuthority = zms.dbService.zmsConfig.getUserAuthority(); Authority authority = Mockito.mock(Authority.class); Mockito.when(authority.isAttributeSet("user.john", "employee")).thenReturn(true); Mockito.when(authority.isAttributeSet("user.jane", "employee")).thenReturn(false); Mockito.when(authority.isAttributeSet("user.joe", "employee")).thenReturn(true); zms.dbService.zmsConfig.setUserAuthority(authority); ObjectStoreConnection mockConn = Mockito.mock(ObjectStoreConnection.class); Mockito.when(mockConn.updateRoleMemberDisabledState(Mockito.anyString(), Mockito.anyString(), Mockito.any(), Mockito.any(), Mockito.anyInt(), Mockito.anyString())).thenReturn(true); final String domainName = "user-auth-attrs"; Mockito.when(mockConn.updateDomainModTimestamp(domainName)).thenReturn(true); List<RoleMember> roleMembers = new ArrayList<>(); roleMembers.add(new RoleMember().setMemberName("user.john")); roleMembers.add(new RoleMember().setMemberName("user.jane")); roleMembers.add(new RoleMember().setMemberName("sports.api")); Timestamp tstamp = Timestamp.fromMillis(System.currentTimeMillis() - 10000); roleMembers.add(new RoleMember().setMemberName("weather.api").setExpiration(tstamp)); Role originalRole = new Role() .setName(domainName + ":role.auth-role") .setRoleMembers(roleMembers); Role updatedRole = new Role().setName(domainName + ":role.auth-role") .setUserAuthorityFilter("employee") .setRoleMembers(roleMembers); zms.dbService.updateRoleMembersSystemDisabledState(mockDomRsrcCtx, mockConn, domainName, "auth-role", originalRole, updatedRole, auditRef, "unit-test"); RoleMember member = getRoleMember(updatedRole, "user.john"); assertNull(member.getExpiration()); assertNull(member.getSystemDisabled()); member = getRoleMember(updatedRole, "user.jane"); assertNull(member.getExpiration()); assertEquals(member.getSystemDisabled(), Integer.valueOf(ZMSConsts.ZMS_DISABLED_AUTHORITY_FILTER)); member = getRoleMember(updatedRole, "sports.api"); assertNull(member.getExpiration()); assertNull(member.getSystemDisabled()); member = getRoleMember(updatedRole, "weather.api"); assertEquals(member.getExpiration(), tstamp); assertNull(member.getSystemDisabled()); originalRole.setUserAuthorityFilter("employee"); updatedRole.setUserAuthorityFilter(null); zms.dbService.updateRoleMembersSystemDisabledState(mockDomRsrcCtx, mockConn, domainName, "auth-role", originalRole, updatedRole, auditRef, "unit-test"); member = getRoleMember(updatedRole, "user.john"); assertNull(member.getExpiration()); assertNull(member.getSystemDisabled()); member = getRoleMember(updatedRole, "user.jane"); assertNull(member.getExpiration()); assertEquals(member.getSystemDisabled(), Integer.valueOf(0)); member = getRoleMember(updatedRole, "sports.api"); assertNull(member.getExpiration()); assertNull(member.getSystemDisabled()); member = getRoleMember(updatedRole, "weather.api"); assertEquals(member.getExpiration(), tstamp); assertNull(member.getSystemDisabled()); zms.dbService.zmsConfig.setUserAuthority(savedAuthority); }