DBService implements RolesProvider { boolean updateUserAuthorityExpiry(RoleMember roleMember, final String userAuthorityExpiry) { if (!ZMSUtils.isUserDomainPrincipal(roleMember.getMemberName(), zmsConfig.getUserDomainPrefix(), zmsConfig.getAddlUserCheckDomainPrefixList())) { return false; } Date authorityExpiry = zmsConfig.getUserAuthority().getDateAttribute(roleMember.getMemberName(), userAuthorityExpiry); boolean expiryDateUpdated = false; Timestamp memberExpiry = roleMember.getExpiration(); if (authorityExpiry == null) { if (memberExpiry == null || memberExpiry.millis() > System.currentTimeMillis()) { roleMember.setExpiration(Timestamp.fromCurrentTime()); expiryDateUpdated = true; } } else { if (memberExpiry == null || memberExpiry.millis() != authorityExpiry.getTime()) { roleMember.setExpiration(Timestamp.fromDate(authorityExpiry)); expiryDateUpdated = true; } } return expiryDateUpdated; } DBService(ObjectStore store, AuditLogger auditLogger, ZMSConfig zmsConfig, AuditReferenceValidator auditReferenceValidator); DomainRoleMembers listOverdueReviewRoleMembers(String domainName); @Override List<Role> getRolesByDomain(String domain); ResourceAccessList getResourceAccessList(String principal, String action); AthenzDomain getAthenzDomain(final String domainName, boolean masterCopy); Quota getQuota(String domainName); void executePutRoleSystemMeta(ResourceContext ctx, final String domainName, final String roleName,
           RoleSystemMeta meta, final String attribute, final String auditRef, final String caller); void executePutGroupSystemMeta(ResourceContext ctx, final String domainName, final String groupName,
                                          GroupSystemMeta meta, final String attribute, final String auditRef); void executePutServiceIdentitySystemMeta(ResourceContext ctx, String domainName, String serviceName,
            ServiceIdentitySystemMeta meta, String attribute, String auditRef, String caller); void executePutRoleMeta(ResourceContext ctx, String domainName, String roleName, Role originalRole,
                                   RoleMeta meta, String auditRef, String caller); void executePutGroupMeta(ResourceContext ctx, final String domainName, final String groupName,
                                    GroupMeta meta, final String auditRef); Set<String> getPendingMembershipApproverRoles(int delayDays); Set<String> getPendingGroupMembershipApproverRoles(int delayDays); Map<String, DomainRoleMember> getRoleExpiryMembers(int delayDays); Map<String, DomainRoleMember> getRoleReviewMembers(int delayDays); Map<String, DomainGroupMember> getGroupExpiryMembers(int delayDays); void processExpiredPendingMembers(int pendingRoleMemberLifespan, final String monitorIdentity); void processExpiredPendingGroupMembers(int pendingGroupMemberLifespan, final String monitorIdentity); static int AUDIT_TYPE_ROLE; static int AUDIT_TYPE_POLICY; static int AUDIT_TYPE_SERVICE; static int AUDIT_TYPE_DOMAIN; static int AUDIT_TYPE_ENTITY; static int AUDIT_TYPE_TENANCY; static int AUDIT_TYPE_TEMPLATE; static int AUDIT_TYPE_GROUP; }
@Test public void testUpdateUserAuthorityExpiryRoleMember() { Authority savedAuthority = zms.dbService.zmsConfig.getUserAuthority(); Authority authority = Mockito.mock(Authority.class); Date currentDate = new Date(); Timestamp authorityDate = Timestamp.fromDate(currentDate); Mockito.when(authority.getDateAttribute("user.john", "elevated-clearance")) .thenReturn(currentDate); Mockito.when(authority.getDateAttribute("user.jane", "elevated-clearance")) .thenReturn(currentDate); Mockito.when(authority.getDateAttribute("user.joe", "elevated-clearance")) .thenReturn(null); zms.dbService.zmsConfig.setUserAuthority(authority); RoleMember roleMember = new RoleMember().setMemberName("coretech.api"); assertFalse(zms.dbService.updateUserAuthorityExpiry(roleMember, "elevated-clearance")); roleMember = new RoleMember().setMemberName("user.joe"); assertTrue(zms.dbService.updateUserAuthorityExpiry(roleMember, "elevated-clearance")); assertNotNull(roleMember.getExpiration()); Timestamp expiryDate = Timestamp.fromMillis(System.currentTimeMillis() + 1000000); roleMember.setExpiration(expiryDate); assertTrue(zms.dbService.updateUserAuthorityExpiry(roleMember, "elevated-clearance")); assertNotEquals(roleMember.getExpiration(), expiryDate); expiryDate = Timestamp.fromMillis(System.currentTimeMillis() - 1000000); roleMember.setExpiration(expiryDate); assertFalse(zms.dbService.updateUserAuthorityExpiry(roleMember, "elevated-clearance")); assertEquals(roleMember.getExpiration(), expiryDate); roleMember = new RoleMember().setMemberName("user.jane"); assertTrue(zms.dbService.updateUserAuthorityExpiry(roleMember, "elevated-clearance")); assertNotNull(roleMember.getExpiration()); assertEquals(roleMember.getExpiration(), authorityDate); roleMember.setExpiration(authorityDate); assertFalse(zms.dbService.updateUserAuthorityExpiry(roleMember, "elevated-clearance")); assertNotNull(roleMember.getExpiration()); assertEquals(roleMember.getExpiration(), authorityDate); roleMember.setExpiration(Timestamp.fromMillis(System.currentTimeMillis() - 2000000)); assertTrue(zms.dbService.updateUserAuthorityExpiry(roleMember, "elevated-clearance")); assertNotNull(roleMember.getExpiration()); assertEquals(roleMember.getExpiration(), authorityDate); zms.dbService.zmsConfig.setUserAuthority(savedAuthority); }
@Test public void testUpdateUserAuthorityExpiryGroupMember() { Authority savedAuthority = zms.dbService.zmsConfig.getUserAuthority(); Authority authority = Mockito.mock(Authority.class); Date currentDate = new Date(); Timestamp authorityDate = Timestamp.fromDate(currentDate); Mockito.when(authority.getDateAttribute("user.john", "elevated-clearance")) .thenReturn(currentDate); Mockito.when(authority.getDateAttribute("user.jane", "elevated-clearance")) .thenReturn(currentDate); Mockito.when(authority.getDateAttribute("user.joe", "elevated-clearance")) .thenReturn(null); zms.dbService.zmsConfig.setUserAuthority(authority); GroupMember groupMember = new GroupMember().setMemberName("sports.api"); assertFalse(zms.dbService.updateUserAuthorityExpiry(groupMember, "elevated-clearance")); groupMember = new GroupMember().setMemberName("user.joe"); assertTrue(zms.dbService.updateUserAuthorityExpiry(groupMember, "elevated-clearance")); assertNotNull(groupMember.getExpiration()); Timestamp expiryDate = Timestamp.fromMillis(System.currentTimeMillis() + 1000000); groupMember.setExpiration(expiryDate); assertTrue(zms.dbService.updateUserAuthorityExpiry(groupMember, "elevated-clearance")); assertNotEquals(groupMember.getExpiration(), expiryDate); expiryDate = Timestamp.fromMillis(System.currentTimeMillis() - 1000000); groupMember.setExpiration(expiryDate); assertFalse(zms.dbService.updateUserAuthorityExpiry(groupMember, "elevated-clearance")); assertEquals(groupMember.getExpiration(), expiryDate); groupMember = new GroupMember().setMemberName("user.jane"); assertTrue(zms.dbService.updateUserAuthorityExpiry(groupMember, "elevated-clearance")); assertNotNull(groupMember.getExpiration()); assertEquals(groupMember.getExpiration(), authorityDate); groupMember.setExpiration(authorityDate); assertFalse(zms.dbService.updateUserAuthorityExpiry(groupMember, "elevated-clearance")); assertNotNull(groupMember.getExpiration()); assertEquals(groupMember.getExpiration(), authorityDate); groupMember.setExpiration(Timestamp.fromMillis(System.currentTimeMillis() - 2000000)); assertTrue(zms.dbService.updateUserAuthorityExpiry(groupMember, "elevated-clearance")); assertNotNull(groupMember.getExpiration()); assertEquals(groupMember.getExpiration(), authorityDate); zms.dbService.zmsConfig.setUserAuthority(savedAuthority); }