AclDAO { protected void allowAccess(Configuration configuration, long secretId, long groupId) { long now = OffsetDateTime.now().toEpochSecond(); boolean assigned = 0 < DSL.using(configuration) .fetchCount(ACCESSGRANTS, ACCESSGRANTS.SECRETID.eq(secretId).and( ACCESSGRANTS.GROUPID.eq(groupId))); if (assigned) { return; } String verificationHmac = rowHmacGenerator.computeRowHmac( ACCESSGRANTS.getName(), List.of(groupId, secretId)); DSL.using(configuration) .insertInto(ACCESSGRANTS) .set(ACCESSGRANTS.SECRETID, secretId) .set(ACCESSGRANTS.GROUPID, groupId) .set(ACCESSGRANTS.CREATEDAT, now) .set(ACCESSGRANTS.UPDATEDAT, now) .set(ACCESSGRANTS.ROW_HMAC, verificationHmac) .execute(); } private  AclDAO(DSLContext dslContext, ClientDAOFactory clientDAOFactory, GroupDAOFactory groupDAOFactory,
                 SecretContentDAOFactory secretContentDAOFactory, SecretSeriesDAOFactory secretSeriesDAOFactory,
                 ClientMapper clientMapper, GroupMapper groupMapper, SecretSeriesMapper secretSeriesMapper,
                 SecretContentMapper secretContentMapper, RowHmacGenerator rowHmacGenerator,
                 KeywhizConfig config); void findAndAllowAccess(long secretId, long groupId, AuditLog auditLog, String user, Map<String, String> extraInfo); void findAndRevokeAccess(long secretId, long groupId, AuditLog auditLog, String user, Map<String, String> extraInfo); void findAndEnrollClient(long clientId, long groupId, AuditLog auditLog, String user, Map<String, String> extraInfo); void findAndEvictClient(long clientId, long groupId, AuditLog auditLog, String user, Map<String, String> extraInfo); ImmutableSet<SanitizedSecret> getSanitizedSecretsFor(Group group); Set<Group> getGroupsFor(Secret secret); Set<Group> getGroupsFor(Client client); Set<Client> getClientsFor(Group group); ImmutableSet<SanitizedSecret> getSanitizedSecretsFor(Client client); Set<Client> getClientsFor(Secret secret); Optional<SanitizedSecret> getSanitizedSecretFor(Client client, String secretName); List<SanitizedSecret> getBatchSanitizedSecretsFor(Client client, List<String> secretNames); Map<Long, List<Group>> getGroupsForSecrets(Set<Long> secretIdList);  }
@Test public void allowsAccess() { int before = accessGrantsTableSize(); aclDAO.allowAccess(jooqContext.configuration(), secret2.getId(), group1.getId()); assertThat(accessGrantsTableSize()).isEqualTo(before + 1); }
@Test public void allowsAccessOnlyOnce() { int before = accessGrantsTableSize(); aclDAO.allowAccess(jooqContext.configuration(), secret2.getId(), group1.getId()); aclDAO.allowAccess(jooqContext.configuration(), secret2.getId(), group1.getId()); assertThat(accessGrantsTableSize()).isEqualTo(before + 1); }
@Test public void accessGrantsHasReferentialIntegrity() { aclDAO.allowAccess(jooqContext.configuration(), secret1.getId(), group1.getId()); aclDAO.allowAccess(jooqContext.configuration(), secret2.getId(), group2.getId()); int before = accessGrantsTableSize(); groupDAO.deleteGroup(group1); assertThat(accessGrantsTableSize()).isEqualTo(before - 1); secretSeriesDAO.deleteSecretSeriesById(secret2.getId()); assertThat(accessGrantsTableSize()).isEqualTo(before - 2); }