GroupRoleEndpoint { @PUT @Path("{id}") @RestQuery(name = "updateGroup", description = "Update a group", returnDescription = "Return the status codes", pathParameters = { @RestParameter(name = "id", description = "The group identifier", isRequired = true, type = Type.STRING) }, restParameters = { @RestParameter(name = "name", description = "The group name", isRequired = true, type = Type.STRING), @RestParameter(name = "description", description = "The group description", isRequired = false, type = Type.STRING), @RestParameter(name = "roles", description = "A comma seperated string of additional group roles", isRequired = false, type = Type.TEXT), @RestParameter(name = "users", description = "A comma seperated string of group members", isRequired = true, type = Type.TEXT) }, responses = { @RestResponse(responseCode = SC_OK, description = "Group updated"), @RestResponse(responseCode = SC_FORBIDDEN, description = "Not enough permissions to update a group with the admin role."), @RestResponse(responseCode = SC_NOT_FOUND, description = "Group not found"), @RestResponse(responseCode = SC_BAD_REQUEST, description = "Name too long") }) public Response updateGroup(@PathParam("id") String groupId, @FormParam("name") String name, @FormParam("description") String description, @FormParam("roles") String roles, @FormParam("users") String users) throws NotFoundException { try { jpaGroupRoleProvider.updateGroup(groupId, name, description, roles, users); } catch (IllegalArgumentException e) { logger.warn("Unable to update group id {}: {}", groupId, e.getMessage()); return Response.status(SC_BAD_REQUEST).build(); } catch (UnauthorizedException ex) { return Response.status(SC_FORBIDDEN).build(); } return Response.ok().build(); }  @Reference(name = "JpaGroupRoleProvider") void setJpaGroupRoleProvider(JpaGroupRoleProvider jpaGroupRoleProvider); @Activate void activate(); @GET @Produces({ MediaType.TEXT_XML, MediaType.APPLICATION_JSON }) @Path("groups.{format:xml|json}") @RestQuery(name = "allgroup", description = "Returns a list of groups", returnDescription = "Returns a JSON or XML representation of the list of groups available the current user's organization", pathParameters = { @RestParameter(description = "The output format (json or xml) of the response body.", isRequired = true, name = "format", type = RestParameter.Type.STRING) }, restParameters = { @RestParameter(defaultValue = "100", description = "The maximum number of items to return per page.", isRequired = false, name = "limit", type = RestParameter.Type.STRING), @RestParameter(defaultValue = "0", description = "The page number.", isRequired = false, name = "offset", type = RestParameter.Type.STRING) }, responses = { @RestResponse(responseCode = SC_OK, description = "The groups.") }) Response getGroupsAsJsonOrXml(@PathParam("format") String format, @QueryParam("limit") int limit,
          @QueryParam("offset") int offset); @DELETE @Path("{id}") @RestQuery(name = "removegroup", description = "Remove a group", returnDescription = "Return no content", pathParameters = { @RestParameter(name = "id", description = "The group identifier", isRequired = true, type = Type.STRING) }, responses = { @RestResponse(responseCode = SC_OK, description = "Group deleted"), @RestResponse(responseCode = SC_FORBIDDEN, description = "Not enough permissions to remove a group with the admin role."), @RestResponse(responseCode = SC_NOT_FOUND, description = "Group not found."), @RestResponse(responseCode = SC_INTERNAL_SERVER_ERROR, description = "An internal server error occured.") }) Response removeGroup(@PathParam("id") String groupId); @POST @Path("") @RestQuery(name = "createGroup", description = "Add a group", returnDescription = "Return the status codes", restParameters = { @RestParameter(name = "name", description = "The group name", isRequired = true, type = Type.STRING), @RestParameter(name = "description", description = "The group description", isRequired = false, type = Type.STRING), @RestParameter(name = "roles", description = "A comma seperated string of additional group roles", isRequired = false, type = Type.TEXT), @RestParameter(name = "users", description = "A comma seperated string of group members", isRequired = false, type = Type.TEXT) }, responses = { @RestResponse(responseCode = SC_CREATED, description = "Group created"), @RestResponse(responseCode = SC_BAD_REQUEST, description = "Name too long"), @RestResponse(responseCode = SC_FORBIDDEN, description = "Not enough permissions to create a group with the admin role."), @RestResponse(responseCode = SC_CONFLICT, description = "An group with this name already exists.") }) Response createGroup(@FormParam("name") String name, @FormParam("description") String description,
          @FormParam("roles") String roles, @FormParam("users") String users); @PUT @Path("{id}") @RestQuery(name = "updateGroup", description = "Update a group", returnDescription = "Return the status codes", pathParameters = { @RestParameter(name = "id", description = "The group identifier", isRequired = true, type = Type.STRING) }, restParameters = { @RestParameter(name = "name", description = "The group name", isRequired = true, type = Type.STRING), @RestParameter(name = "description", description = "The group description", isRequired = false, type = Type.STRING), @RestParameter(name = "roles", description = "A comma seperated string of additional group roles", isRequired = false, type = Type.TEXT), @RestParameter(name = "users", description = "A comma seperated string of group members", isRequired = true, type = Type.TEXT) }, responses = { @RestResponse(responseCode = SC_OK, description = "Group updated"), @RestResponse(responseCode = SC_FORBIDDEN, description = "Not enough permissions to update a group with the admin role."), @RestResponse(responseCode = SC_NOT_FOUND, description = "Group not found"), @RestResponse(responseCode = SC_BAD_REQUEST, description = "Name too long") }) Response updateGroup(@PathParam("id") String groupId, @FormParam("name") String name,
          @FormParam("description") String description, @FormParam("roles") String roles,
          @FormParam("users") String users);  }
@Test public void testUpdateGroupNotAllowedAsNonAdminUser() throws UnauthorizedException { JpaGroup group = new JpaGroup("test", org1, "Test", "Test group", Collections.set( new JpaRole(SecurityConstants.GLOBAL_ADMIN_ROLE, org1))); try { provider.addGroup(group); Group loadGroup = provider.loadGroup(group.getGroupId(), group.getOrganization().getId()); assertNotNull(loadGroup); assertEquals(loadGroup.getGroupId(), loadGroup.getGroupId()); } catch (Exception e) { fail("The group schould be added"); } JpaUser user = new JpaUser("user", "pass1", org1, "User", "user@localhost", "opencast", true, Collections.set(new JpaRole("ROLE_USER", org1))); SecurityService securityService = EasyMock.createNiceMock(SecurityService.class); EasyMock.expect(securityService.getUser()).andReturn(user).anyTimes(); EasyMock.expect(securityService.getOrganization()).andReturn(org1).anyTimes(); EasyMock.replay(securityService); provider.setSecurityService(securityService); try { Response updateGroupResponse = endpoint.updateGroup(group.getGroupId(), group.getName(), group.getDescription(), "ROLE_USER, " + SecurityConstants.GLOBAL_ADMIN_ROLE, null); assertNotNull(updateGroupResponse); assertEquals(HttpStatus.SC_FORBIDDEN, updateGroupResponse.getStatus()); updateGroupResponse = endpoint.updateGroup(group.getGroupId(), group.getName(), group.getDescription(), "ROLE_USER", null); assertNotNull(updateGroupResponse); assertEquals(HttpStatus.SC_FORBIDDEN, updateGroupResponse.getStatus()); } catch (NotFoundException e) { fail("The existing group isn't found"); } }