RangerPolicyValidator extends RangerValidator { boolean isValidResourceNames(final RangerPolicy policy, final List<ValidationFailureDetails> failures, final RangerServiceDef serviceDef) { if(LOG.isDebugEnabled()) { LOG.debug(String.format("==> RangerPolicyValidator.isValidResourceNames(%s, %s, %s)", policy, failures, serviceDef)); } boolean valid = true; convertPolicyResourceNamesToLower(policy); Set<String> policyResources = policy.getResources().keySet(); RangerServiceDefHelper defHelper = new RangerServiceDefHelper(serviceDef); Set<List<RangerResourceDef>> hierarchies = defHelper.getResourceHierarchies(policy.getPolicyType()); if (hierarchies.isEmpty()) { if (LOG.isDebugEnabled()) { LOG.debug("RangerPolicyValidator.isValidResourceNames: serviceDef does not have any resource hierarchies, possibly due to invalid service def!!"); } ValidationErrorCode error = ValidationErrorCode.POLICY_VALIDATION_ERR_INVALID_RESOURCE_NO_COMPATIBLE_HIERARCHY; failures.add(new ValidationFailureDetailsBuilder() .field("service def resource hierarchies") .subField("incompatible") .isSemanticallyIncorrect() .becauseOf(error.getMessage(serviceDef.getName(), " does not have any resource hierarchies")) .errorCode(error.getErrorCode()) .build()); valid = false; } else { Set<List<RangerResourceDef>> candidateHierarchies = filterHierarchies_hierarchyHasAllPolicyResources(policyResources, hierarchies, defHelper); if (candidateHierarchies.isEmpty()) { if (LOG.isDebugEnabled()) { LOG.debug(String.format("No compatible resource hierarchies found: resource[%s], service-def[%s], valid-resource-hierarchies[%s]", policyResources.toString(), serviceDef.getName(), toStringHierarchies_all(hierarchies, defHelper))); } ValidationErrorCode error; if (hierarchies.size() == 1) { error = ValidationErrorCode.POLICY_VALIDATION_ERR_INVALID_RESOURCE_NO_COMPATIBLE_HIERARCHY_SINGLE; } else { error = ValidationErrorCode.POLICY_VALIDATION_ERR_INVALID_RESOURCE_NO_COMPATIBLE_HIERARCHY; } failures.add(new ValidationFailureDetailsBuilder() .field("policy resources") .subField("incompatible") .isSemanticallyIncorrect() .becauseOf(error.getMessage(serviceDef.getName(), toStringHierarchies_all(hierarchies, defHelper))) .errorCode(error.getErrorCode()) .build()); valid = false; } else { if (LOG.isDebugEnabled()) { LOG.debug("isValidResourceNames: Found [" + candidateHierarchies.size() + "] compatible hierarchies: " + toStringHierarchies_all(candidateHierarchies, defHelper)); } Set<List<RangerResourceDef>> validHierarchies = filterHierarchies_mandatoryResourcesSpecifiedInPolicy(policyResources, candidateHierarchies, defHelper); if (validHierarchies.isEmpty()) { ValidationErrorCode error; if (candidateHierarchies.size() == 1) { error = ValidationErrorCode.POLICY_VALIDATION_ERR_INVALID_RESOURCE_MISSING_MANDATORY_SINGLE; } else { error = ValidationErrorCode.POLICY_VALIDATION_ERR_INVALID_RESOURCE_MISSING_MANDATORY; } failures.add(new ValidationFailureDetailsBuilder() .field("policy resources") .subField("missing mandatory") .isSemanticallyIncorrect() .becauseOf(error.getMessage(serviceDef.getName(), toStringHierarchies_mandatory(candidateHierarchies, defHelper))) .errorCode(error.getErrorCode()) .build()); valid = false; } else { if (LOG.isDebugEnabled()) { LOG.debug("isValidResourceNames: Found hierarchies with all mandatory fields specified: " + toStringHierarchies_mandatory(validHierarchies, defHelper)); } } } } if(LOG.isDebugEnabled()) { LOG.debug(String.format("<== RangerPolicyValidator.isValidResourceNames(%s, %s, %s): %s", policy, failures, serviceDef, valid)); } return valid; } RangerPolicyValidator(ServiceStore store); void validate(RangerPolicy policy, Action action, boolean isAdmin);  }
@Test public final void test_isValidResourceNames_happyPath() { String serviceName = "a-service-def"; Date now = new Date(); when(_serviceDef.getName()).thenReturn(serviceName ); when(_serviceDef.getUpdateTime()).thenReturn(now); List<RangerResourceDef> resourceDefs = _utils.createResourceDefs(resourceDefData_multipleHierarchies); when(_serviceDef.getResources()).thenReturn(resourceDefs); Map<String, RangerPolicyResource> policyResources = _utils.createPolicyResourceMap(policyResourceMap_goodMultipleHierarchies); when(_policy.getResources()).thenReturn(policyResources); Assert.assertTrue(_validator.isValidResourceNames(_policy, _failures, _serviceDef)); }
@Test public final void test_isValidResourceNames_failures() { String serviceName = "a-service-def"; Date now = new Date(); when(_serviceDef.getName()).thenReturn(serviceName ); when(_serviceDef.getUpdateTime()).thenReturn(now); List<RangerResourceDef> resourceDefs = _utils.createResourceDefs(resourceDefData_multipleHierarchies); when(_serviceDef.getResources()).thenReturn(resourceDefs); Map<String, RangerPolicyResource> policyResources = _utils.createPolicyResourceMap(policyResourceMap_bad); when(_policy.getResources()).thenReturn(policyResources); Assert.assertFalse("Missing required resource and unknown resource", _validator.isValidResourceNames(_policy, _failures, _serviceDef)); _utils.checkFailureForSemanticError(_failures, "policy resources"); policyResources = _utils.createPolicyResourceMap(policyResourceMap_bad_multiple_hierarchies); when(_policy.getResources()).thenReturn(policyResources); _failures.clear(); Assert.assertFalse("Policy with resources for multiple hierarchies", _validator.isValidResourceNames(_policy, _failures, _serviceDef)); _utils.checkFailureForSemanticError(_failures, "policy resources", "incompatible"); policyResources = _utils.createPolicyResourceMap(policyResourceMap_bad_multiple_hierarchies_missing_mandatory); when(_policy.getResources()).thenReturn(policyResources); _failures.clear(); Assert.assertFalse("Policy with resources for multiple hierarchies missing mandatory resources for all pontential matches", _validator.isValidResourceNames(_policy, _failures, _serviceDef)); _utils.checkFailureForSemanticError(_failures, "policy resources", "missing mandatory"); }