ResourcePermissionService { public void grantAuthorizedEnvironmentsAndEnvTypesPerApplication(AbstractSecurityEnabledResource resource, String[] applicationsToAdd, String[] environmentsToAdd, String[] environmentTypesToAdd) { List<String> envIds = Lists.newArrayList(); IResourceSaver noSave = null; if (ArrayUtils.isNotEmpty(applicationsToAdd)) { grantPermission(resource, noSave, Subject.APPLICATION, applicationsToAdd); for (String applicationToAddId : applicationsToAdd) { ApplicationEnvironment[] aes = applicationEnvironmentService.getByApplicationId(applicationToAddId); for (ApplicationEnvironment ae : aes) { envIds.add(ae.getId()); } } if (!envIds.isEmpty()) { revokePermission(resource, noSave, Subject.ENVIRONMENT, envIds.toArray(new String[envIds.size()])); } Set<String> envTypes = Sets.newHashSet(); for (String applicationToAddId : applicationsToAdd) { for (EnvironmentType envType : EnvironmentType.values()) { envTypes.add(applicationToAddId + ":" + envType.toString()); } } if (!envTypes.isEmpty()) { revokePermission(resource, noSave, Subject.ENVIRONMENT_TYPE, envTypes.toArray(new String[envTypes.size()])); } } if (ArrayUtils.isNotEmpty(environmentsToAdd)) { List<String> envToAddSet = Arrays.stream(environmentsToAdd).filter(env -> !envIds.contains(env)).collect(Collectors.toList()); grantPermission(resource, noSave, Subject.ENVIRONMENT, envToAddSet.toArray(new String[envToAddSet.size()])); } if (ArrayUtils.isNotEmpty(environmentTypesToAdd)) { grantPermission(resource, noSave, Subject.ENVIRONMENT_TYPE, environmentTypesToAdd); } alienDAO.save(resource); }  void grantPermission(ISecurityEnabledResource resource, Subject subjectType, String... subjects); void grantPermission(ISecurityEnabledResource resource, IResourceSaver saver, Subject subjectType, String... subjects); void revokePermission(ISecurityEnabledResource resource, Subject subjectType, String... subjects); void revokePermission(ISecurityEnabledResource resource, IResourceSaver saver, Subject subjectType, String... subjects); boolean anyHasPermission(ISecurityEnabledResource resource, Map<Subject, Set<String>> subjects); boolean allHavePermission(ISecurityEnabledResource resource, Map<Subject, Set<String>> subjects); List<User> getAuthorizedUsers(AbstractSecurityEnabledResource resource); List<Group> getAuthorizedGroups(AbstractSecurityEnabledResource resource); void revokeAuthorizedEnvironmentsAndEnvironmentTypesPerApplication(AbstractSecurityEnabledResource resource, String[] applicationsToDelete,
                                                                              String[] environmentsToDelete, String[] environmentTypesToDelete); void grantAuthorizedEnvironmentsAndEnvTypesPerApplication(AbstractSecurityEnabledResource resource, String[] applicationsToAdd, String[] environmentsToAdd,
                                                                     String[] environmentTypesToAdd);  }
@Test public void when_permission_added_at_application_level_remove_any_permissions_hidden_at_lower_level() { resourceSecured = new AbstractSecurityEnabledResource() { @Override public String getId() { return "id"; } }; HashSet<Permission> permissions = new HashSet<>(); permissions.add(Permission.ADMIN); resourceSecured.addPermissions(Subject.APPLICATION, "subject1", new HashSet<>(permissions)); resourceSecured.addPermissions(Subject.ENVIRONMENT, "subject1_1", new HashSet<>(permissions)); resourceSecured.addPermissions(Subject.ENVIRONMENT, "subject1_2", new HashSet<>(permissions)); resourceSecured.addPermissions(Subject.ENVIRONMENT_TYPE, "subject1:INTEGRATION_TESTS", new HashSet<>(permissions)); ApplicationEnvironment ae1 = new ApplicationEnvironment(); ae1.setId("subject1_1"); ae1.setEnvironmentType(EnvironmentType.INTEGRATION_TESTS); ApplicationEnvironment ae2 = new ApplicationEnvironment(); ae2.setId("subject1_2"); ae2.setEnvironmentType(EnvironmentType.INTEGRATION_TESTS); Mockito.when(applicationEnvironmentService.getByApplicationId("subject1")).thenReturn(new ApplicationEnvironment[] { ae1, ae2 }); service.grantAuthorizedEnvironmentsAndEnvTypesPerApplication((AbstractSecurityEnabledResource) resourceSecured, new String[] { "subject1" }, new String[] { "subject1_1", "subject1_2" }, new String[] {"subject_env_1_1" }); verify(alienDAO).save(resourceSecuredCaptor.capture()); assertThat(resourceSecuredCaptor.getValue().getPermissions(Subject.APPLICATION, "subject1")).containsExactly(Permission.ADMIN); assertThat(resourceSecuredCaptor.getValue().getPermissions(Subject.ENVIRONMENT, "subject1_1")).isEmpty(); assertThat(resourceSecuredCaptor.getValue().getPermissions(Subject.ENVIRONMENT, "subject1_2")).isEmpty(); assertThat(resourceSecuredCaptor.getValue().getPermissions(Subject.ENVIRONMENT_TYPE, "subject1:INTEGRATION_TESTS")).isEmpty(); }
@Test public void when_permission_added_at_application_level_unrelated_environment_and_env_type_are_unmodified() { resourceSecured = new AbstractSecurityEnabledResource() { @Override public String getId() { return "id"; } }; HashSet<Permission> permissions = new HashSet<>(); permissions.add(Permission.ADMIN); resourceSecured.addPermissions(Subject.APPLICATION, "subject1", new HashSet<>(permissions)); resourceSecured.addPermissions(Subject.ENVIRONMENT, "subject1_1", new HashSet<>(permissions)); resourceSecured.addPermissions(Subject.ENVIRONMENT, "subject2_1", new HashSet<>(permissions)); resourceSecured.addPermissions(Subject.ENVIRONMENT_TYPE, "subject1:INTEGRATION_TESTS", new HashSet<>(permissions)); ApplicationEnvironment ae1 = new ApplicationEnvironment(); ae1.setId("subject1_1"); ae1.setEnvironmentType(EnvironmentType.INTEGRATION_TESTS); ApplicationEnvironment ae2 = new ApplicationEnvironment(); ae2.setId("subject2_1"); ae2.setEnvironmentType(EnvironmentType.INTEGRATION_TESTS); Mockito.when(applicationEnvironmentService.getByApplicationId("subject1")).thenReturn(new ApplicationEnvironment[] { ae1 }); service.grantAuthorizedEnvironmentsAndEnvTypesPerApplication((AbstractSecurityEnabledResource) resourceSecured, new String[] { "subject1" }, new String[] { "subject1_1", "subject2_1" }, new String[] { EnvironmentType.INTEGRATION_TESTS.toString() }); verify(alienDAO).save(resourceSecuredCaptor.capture()); assertThat(resourceSecuredCaptor.getValue().getPermissions(Subject.APPLICATION, "subject1")).containsExactly(Permission.ADMIN); assertThat(resourceSecuredCaptor.getValue().getPermissions(Subject.ENVIRONMENT, "subject1_1")).isEmpty(); assertThat(resourceSecuredCaptor.getValue().getPermissions(Subject.ENVIRONMENT, "subject2_1")).containsExactly(Permission.ADMIN); assertThat(resourceSecuredCaptor.getValue().getPermissions(Subject.ENVIRONMENT_TYPE, EnvironmentType.INTEGRATION_TESTS.toString())).containsExactly(Permission.ADMIN); }