DBService implements RolesProvider { public void executePutRoleSystemMeta(ResourceContext ctx, final String domainName, final String roleName, RoleSystemMeta meta, final String attribute, final String auditRef, final String caller) { for (int retryCount = defaultRetryCount; ; retryCount--) { try (ObjectStoreConnection con = store.getConnection(false, true)) { Domain domain = con.getDomain(domainName); if (domain == null) { con.rollbackChanges(); throw ZMSUtils.notFoundError(caller + ": Unknown domain: " + domainName, caller); } checkDomainAuditEnabled(con, domain, auditRef, caller, getPrincipalName(ctx), AUDIT_TYPE_ROLE); if (domain.getAuditEnabled() != Boolean.TRUE) { throw ZMSUtils.requestError(caller + ": auditEnabled flag not set for domain: " + domainName + " to add it on the role: " + roleName, caller); } Role originalRole = getRole(con, domainName, roleName, false, false, false); Role updatedRole = new Role() .setName(originalRole.getName()) .setAuditEnabled(originalRole.getAuditEnabled()) .setTrust(originalRole.getTrust()) .setSelfServe(originalRole.getSelfServe()) .setMemberExpiryDays(originalRole.getMemberExpiryDays()) .setServiceExpiryDays(originalRole.getServiceExpiryDays()) .setGroupExpiryDays(originalRole.getGroupExpiryDays()) .setTokenExpiryMins(originalRole.getTokenExpiryMins()) .setCertExpiryMins(originalRole.getCertExpiryMins()) .setMemberReviewDays(originalRole.getMemberReviewDays()) .setServiceReviewDays(originalRole.getServiceReviewDays()) .setSignAlgorithm(originalRole.getSignAlgorithm()) .setReviewEnabled(originalRole.getReviewEnabled()) .setNotifyRoles(originalRole.getNotifyRoles()); updateRoleSystemMetaFields(con, updatedRole, originalRole, attribute, meta, ctx.getApiName()); con.updateRole(domainName, updatedRole); saveChanges(con, domainName); StringBuilder auditDetails = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); auditLogRoleSystemMeta(auditDetails, updatedRole, roleName); auditLogRequest(ctx, domainName, auditRef, caller, ZMSConsts.HTTP_PUT, domainName, auditDetails.toString()); return; } catch (ResourceException ex) { if (!shouldRetryOperation(ex, retryCount)) { throw ex; } } } } DBService(ObjectStore store, AuditLogger auditLogger, ZMSConfig zmsConfig, AuditReferenceValidator auditReferenceValidator); DomainRoleMembers listOverdueReviewRoleMembers(String domainName); @Override List<Role> getRolesByDomain(String domain); ResourceAccessList getResourceAccessList(String principal, String action); AthenzDomain getAthenzDomain(final String domainName, boolean masterCopy); Quota getQuota(String domainName); void executePutRoleSystemMeta(ResourceContext ctx, final String domainName, final String roleName,
           RoleSystemMeta meta, final String attribute, final String auditRef, final String caller); void executePutGroupSystemMeta(ResourceContext ctx, final String domainName, final String groupName,
                                          GroupSystemMeta meta, final String attribute, final String auditRef); void executePutServiceIdentitySystemMeta(ResourceContext ctx, String domainName, String serviceName,
            ServiceIdentitySystemMeta meta, String attribute, String auditRef, String caller); void executePutRoleMeta(ResourceContext ctx, String domainName, String roleName, Role originalRole,
                                   RoleMeta meta, String auditRef, String caller); void executePutGroupMeta(ResourceContext ctx, final String domainName, final String groupName,
                                    GroupMeta meta, final String auditRef); Set<String> getPendingMembershipApproverRoles(int delayDays); Set<String> getPendingGroupMembershipApproverRoles(int delayDays); Map<String, DomainRoleMember> getRoleExpiryMembers(int delayDays); Map<String, DomainRoleMember> getRoleReviewMembers(int delayDays); Map<String, DomainGroupMember> getGroupExpiryMembers(int delayDays); void processExpiredPendingMembers(int pendingRoleMemberLifespan, final String monitorIdentity); void processExpiredPendingGroupMembers(int pendingGroupMemberLifespan, final String monitorIdentity); static int AUDIT_TYPE_ROLE; static int AUDIT_TYPE_POLICY; static int AUDIT_TYPE_SERVICE; static int AUDIT_TYPE_DOMAIN; static int AUDIT_TYPE_ENTITY; static int AUDIT_TYPE_TENANCY; static int AUDIT_TYPE_TEMPLATE; static int AUDIT_TYPE_GROUP; }
@Test public void testExecutePutRoleSystemMeta() { List<String> admins = new ArrayList<>(); admins.add(adminUser); zms.dbService.makeDomain(mockDomRsrcCtx, ZMSTestUtils.makeDomainObject("MetaDom1", "test desc", "testOrg", false, "", 1234, "", 0), admins, null, auditRef); Role role = createRoleObject("MetaDom1", "MetaRole1", null, "user.john", "user.jane"); zms.dbService.executePutRole(mockDomRsrcCtx, "MetaDom1", "MetaRole1", role, "test", "putrole"); RoleSystemMeta rsm = new RoleSystemMeta(); rsm.setAuditEnabled(true); try { zms.dbService.executePutRoleSystemMeta(mockDomRsrcCtx, "MetaDom1", "MetaRole1", rsm,"auditenabled", auditRef, "putrolesystemmeta"); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 400); } zms.dbService.executeDeleteDomain(mockDomRsrcCtx, "MetaDom1", auditRef, "deletedomain"); Domain dom2 = new Domain() .setName("MetaDom2") .setAuditEnabled(true) .setYpmId(1234) .setCertDnsDomain("athenz.cloud"); zms.dbService.makeDomain(mockDomRsrcCtx, ZMSTestUtils.makeDomainObject("MetaDom2", "test desc", "testOrg", true, "", 1234, "", 0), admins, null, auditRef); DomainMeta meta2 = new DomainMeta() .setAccount("acct") .setYpmId(1234) .setCertDnsDomain("athenz.cloud"); zms.dbService.updateSystemMetaFields(dom2, "auditenabled", false, meta2); Role role2 = createRoleObject("MetaDom2", "MetaRole2", null, "user.john", "user.jane"); zms.dbService.executePutRole(mockDomRsrcCtx, "MetaDom2", "MetaRole2",role2, "test", "putrole"); RoleSystemMeta rsm2 = new RoleSystemMeta(); rsm2.setAuditEnabled(true); zms.dbService.executePutRoleSystemMeta(mockDomRsrcCtx, "MetaDom2", "MetaRole2", rsm2,"auditenabled", auditRef, "putrolesystemmeta"); Role resRole2 = zms.dbService.getRole("MetaDom2", "MetaRole2", false, true, false); assertTrue(resRole2.getAuditEnabled()); zms.dbService.executeDeleteDomain(mockDomRsrcCtx, "MetaDom2", auditRef, "deletedomain"); }