AclDAO { protected ImmutableSet<SecretSeries> getSecretSeriesFor(Configuration configuration, Group group) { List<SecretSeries> r = DSL.using(configuration) .select(SECRETS.fields()) .from(SECRETS) .join(ACCESSGRANTS).on(SECRETS.ID.eq(ACCESSGRANTS.SECRETID)) .join(GROUPS).on(GROUPS.ID.eq(ACCESSGRANTS.GROUPID)) .where(GROUPS.NAME.eq(group.getName()).and(SECRETS.CURRENT.isNotNull())) .fetchInto(SECRETS) .map(secretSeriesMapper); return ImmutableSet.copyOf(r); } private  AclDAO(DSLContext dslContext, ClientDAOFactory clientDAOFactory, GroupDAOFactory groupDAOFactory,
                 SecretContentDAOFactory secretContentDAOFactory, SecretSeriesDAOFactory secretSeriesDAOFactory,
                 ClientMapper clientMapper, GroupMapper groupMapper, SecretSeriesMapper secretSeriesMapper,
                 SecretContentMapper secretContentMapper, RowHmacGenerator rowHmacGenerator,
                 KeywhizConfig config); void findAndAllowAccess(long secretId, long groupId, AuditLog auditLog, String user, Map<String, String> extraInfo); void findAndRevokeAccess(long secretId, long groupId, AuditLog auditLog, String user, Map<String, String> extraInfo); void findAndEnrollClient(long clientId, long groupId, AuditLog auditLog, String user, Map<String, String> extraInfo); void findAndEvictClient(long clientId, long groupId, AuditLog auditLog, String user, Map<String, String> extraInfo); ImmutableSet<SanitizedSecret> getSanitizedSecretsFor(Group group); Set<Group> getGroupsFor(Secret secret); Set<Group> getGroupsFor(Client client); Set<Client> getClientsFor(Group group); ImmutableSet<SanitizedSecret> getSanitizedSecretsFor(Client client); Set<Client> getClientsFor(Secret secret); Optional<SanitizedSecret> getSanitizedSecretFor(Client client, String secretName); List<SanitizedSecret> getBatchSanitizedSecretsFor(Client client, List<String> secretNames); Map<Long, List<Group>> getGroupsForSecrets(Set<Long> secretIdList);  }
@Test public void getSecretSeriesForWhenUnauthorized() throws Exception { assertThat(aclDAO.getSecretSeriesFor(jooqContext.configuration(), client1, secret1.getName())) .isEmpty(); }
@Test public void getSecretSeriesForWhenMissing() throws Exception { assertThat(aclDAO.getSecretSeriesFor(jooqContext.configuration(), client1, "non-existent")) .isEmpty(); }
@Test public void getSecretSeriesFor() throws Exception { SecretSeries secretSeries1 = secretSeriesDAO.getSecretSeriesById(secret1.getId()).get(); aclDAO.enrollClient(jooqContext.configuration(), client2.getId(), group1.getId()); aclDAO.enrollClient(jooqContext.configuration(), client2.getId(), group3.getId()); aclDAO.enrollClient(jooqContext.configuration(), client2.getId(), group2.getId()); aclDAO.allowAccess(jooqContext.configuration(), secret1.getId(), group1.getId()); aclDAO.allowAccess(jooqContext.configuration(), secret1.getId(), group2.getId()); SecretSeries secretSeries = aclDAO.getSecretSeriesFor(jooqContext.configuration(), client2, secret1.getName()) .orElseThrow(RuntimeException::new); assertThat(secretSeries).isEqualToIgnoringGivenFields(secretSeries1, "id"); aclDAO.evictClient(jooqContext.configuration(), client2.getId(), group1.getId()); aclDAO.evictClient(jooqContext.configuration(), client2.getId(), group2.getId()); assertThat(aclDAO.getSecretSeriesFor(jooqContext.configuration(), client2, secret1.getName())) .isEmpty(); aclDAO.allowAccess(jooqContext.configuration(), secret1.getId(), group3.getId()); secretSeries = aclDAO.getSecretSeriesFor(jooqContext.configuration(), client2, secret1.getName()) .orElseThrow(RuntimeException::new); assertThat(secretSeries).isEqualToIgnoringGivenFields(secretSeries1, "id"); }