@Test public void testGetValidatedEntityContextsNotAllValidated() { EntityDefinition def = createEntityDef("student"); Entity student0 = createEntity("student", 0); Entity student1 = createEntity("student", 1); Entity student2 = createEntity("student", 2); List<Entity> students = Arrays.asList(student0, student1, student2); Mockito.when(edOrgHelper.getDirectEdorgs(Mockito.eq(student1))).thenReturn(new HashSet<String>(Arrays.asList("edOrg1"))); boolean isTransitive = false; Mockito.when(ownership.canAccess(student0, isTransitive)).thenReturn(true); Mockito.when(ownership.canAccess(student1, isTransitive)).thenReturn(true); Mockito.when(ownership.canAccess(student2, isTransitive)).thenReturn(true); Map<String, SecurityUtil.UserContext> validatedEntityContexts = contextValidator.getValidatedEntityContexts(def, students, isTransitive, true); Assert.assertEquals(2, validatedEntityContexts.size()); Assert.assertEquals(SecurityUtil.UserContext.STAFF_CONTEXT, validatedEntityContexts.get("student1")); Assert.assertEquals(SecurityUtil.UserContext.DUAL_CONTEXT, validatedEntityContexts.get("student2")); }
public Map<String, SecurityUtil.UserContext> getValidatedEntityContexts(EntityDefinition def, Collection<Entity> entities, boolean isTransitive, boolean isRead) throws APIAccessDeniedException { if (skipValidation(def, isRead)) { return null; } Map<String, SecurityUtil.UserContext> entityContexts = new HashMap<String, SecurityUtil.UserContext>(); List<IContextValidator> contextValidators = findContextualValidators(def.getType(), isTransitive); Collection<String> ids = getEntityIds(entities); if (!contextValidators.isEmpty()) { Set<String> idsToValidate = getEntityIdsToValidateForgiving(entities, isTransitive); for (IContextValidator validator : contextValidators) { Set<String> validatedIds = getValidatedIds(def, idsToValidate, validator); for (String id : validatedIds) { if (!entityContexts.containsKey(id)) { entityContexts.put(id, validator.getContext()); } else if ((entityContexts.get(id).equals(SecurityUtil.UserContext.STAFF_CONTEXT)) && (validator.getContext().equals(SecurityUtil.UserContext.TEACHER_CONTEXT)) || (entityContexts.get(id).equals(SecurityUtil.UserContext.TEACHER_CONTEXT)) && (validator.getContext().equals(SecurityUtil.UserContext.STAFF_CONTEXT))) { entityContexts.put(id, SecurityUtil.UserContext.DUAL_CONTEXT); } } } Set<String> accessibleNonValidatedIds = new HashSet<String>(ids); accessibleNonValidatedIds.removeAll(idsToValidate); for (String id : accessibleNonValidatedIds) { entityContexts.put(id, SecurityUtil.getUserContext()); } } else { throw new APIAccessDeniedException("No validator for " + def.getType() + ", transitive=" + isTransitive, def.getType(), ids); } return entityContexts; }
ContextValidator implements ApplicationContextAware { public Map<String, SecurityUtil.UserContext> getValidatedEntityContexts(EntityDefinition def, Collection<Entity> entities, boolean isTransitive, boolean isRead) throws APIAccessDeniedException { if (skipValidation(def, isRead)) { return null; } Map<String, SecurityUtil.UserContext> entityContexts = new HashMap<String, SecurityUtil.UserContext>(); List<IContextValidator> contextValidators = findContextualValidators(def.getType(), isTransitive); Collection<String> ids = getEntityIds(entities); if (!contextValidators.isEmpty()) { Set<String> idsToValidate = getEntityIdsToValidateForgiving(entities, isTransitive); for (IContextValidator validator : contextValidators) { Set<String> validatedIds = getValidatedIds(def, idsToValidate, validator); for (String id : validatedIds) { if (!entityContexts.containsKey(id)) { entityContexts.put(id, validator.getContext()); } else if ((entityContexts.get(id).equals(SecurityUtil.UserContext.STAFF_CONTEXT)) && (validator.getContext().equals(SecurityUtil.UserContext.TEACHER_CONTEXT)) || (entityContexts.get(id).equals(SecurityUtil.UserContext.TEACHER_CONTEXT)) && (validator.getContext().equals(SecurityUtil.UserContext.STAFF_CONTEXT))) { entityContexts.put(id, SecurityUtil.UserContext.DUAL_CONTEXT); } } } Set<String> accessibleNonValidatedIds = new HashSet<String>(ids); accessibleNonValidatedIds.removeAll(idsToValidate); for (String id : accessibleNonValidatedIds) { entityContexts.put(id, SecurityUtil.getUserContext()); } } else { throw new APIAccessDeniedException("No validator for " + def.getType() + ", transitive=" + isTransitive, def.getType(), ids); } return entityContexts; } }
ContextValidator implements ApplicationContextAware { public Map<String, SecurityUtil.UserContext> getValidatedEntityContexts(EntityDefinition def, Collection<Entity> entities, boolean isTransitive, boolean isRead) throws APIAccessDeniedException { if (skipValidation(def, isRead)) { return null; } Map<String, SecurityUtil.UserContext> entityContexts = new HashMap<String, SecurityUtil.UserContext>(); List<IContextValidator> contextValidators = findContextualValidators(def.getType(), isTransitive); Collection<String> ids = getEntityIds(entities); if (!contextValidators.isEmpty()) { Set<String> idsToValidate = getEntityIdsToValidateForgiving(entities, isTransitive); for (IContextValidator validator : contextValidators) { Set<String> validatedIds = getValidatedIds(def, idsToValidate, validator); for (String id : validatedIds) { if (!entityContexts.containsKey(id)) { entityContexts.put(id, validator.getContext()); } else if ((entityContexts.get(id).equals(SecurityUtil.UserContext.STAFF_CONTEXT)) && (validator.getContext().equals(SecurityUtil.UserContext.TEACHER_CONTEXT)) || (entityContexts.get(id).equals(SecurityUtil.UserContext.TEACHER_CONTEXT)) && (validator.getContext().equals(SecurityUtil.UserContext.STAFF_CONTEXT))) { entityContexts.put(id, SecurityUtil.UserContext.DUAL_CONTEXT); } } } Set<String> accessibleNonValidatedIds = new HashSet<String>(ids); accessibleNonValidatedIds.removeAll(idsToValidate); for (String id : accessibleNonValidatedIds) { entityContexts.put(id, SecurityUtil.getUserContext()); } } else { throw new APIAccessDeniedException("No validator for " + def.getType() + ", transitive=" + isTransitive, def.getType(), ids); } return entityContexts; }  }
ContextValidator implements ApplicationContextAware { public Map<String, SecurityUtil.UserContext> getValidatedEntityContexts(EntityDefinition def, Collection<Entity> entities, boolean isTransitive, boolean isRead) throws APIAccessDeniedException { if (skipValidation(def, isRead)) { return null; } Map<String, SecurityUtil.UserContext> entityContexts = new HashMap<String, SecurityUtil.UserContext>(); List<IContextValidator> contextValidators = findContextualValidators(def.getType(), isTransitive); Collection<String> ids = getEntityIds(entities); if (!contextValidators.isEmpty()) { Set<String> idsToValidate = getEntityIdsToValidateForgiving(entities, isTransitive); for (IContextValidator validator : contextValidators) { Set<String> validatedIds = getValidatedIds(def, idsToValidate, validator); for (String id : validatedIds) { if (!entityContexts.containsKey(id)) { entityContexts.put(id, validator.getContext()); } else if ((entityContexts.get(id).equals(SecurityUtil.UserContext.STAFF_CONTEXT)) && (validator.getContext().equals(SecurityUtil.UserContext.TEACHER_CONTEXT)) || (entityContexts.get(id).equals(SecurityUtil.UserContext.TEACHER_CONTEXT)) && (validator.getContext().equals(SecurityUtil.UserContext.STAFF_CONTEXT))) { entityContexts.put(id, SecurityUtil.UserContext.DUAL_CONTEXT); } } } Set<String> accessibleNonValidatedIds = new HashSet<String>(ids); accessibleNonValidatedIds.removeAll(idsToValidate); for (String id : accessibleNonValidatedIds) { entityContexts.put(id, SecurityUtil.getUserContext()); } } else { throw new APIAccessDeniedException("No validator for " + def.getType() + ", transitive=" + isTransitive, def.getType(), ids); } return entityContexts; }  @Override void setApplicationContext(ApplicationContext applicationContext); void validateContextToUri(ContainerRequest request, SLIPrincipal principal); boolean isUrlBlocked(ContainerRequest request); List<PathSegment> cleanEmptySegments(List<PathSegment> pathSegments); void validateContextToCallUri(List<PathSegment> segments); boolean checkAccessOfStudentsThroughDisciplineIncidents(List<PathSegment> segments); void validateContextToEntities(EntityDefinition def, Collection<String> ids, boolean isTransitive); Set<String> getValidIdsIncludeOrphans(EntityDefinition def, Set<String> ids, boolean isTransitive); Map<String, SecurityUtil.UserContext> getValidatedEntityContexts(EntityDefinition def, Collection<Entity> entities, boolean isTransitive, boolean isRead); IContextValidator findValidator(String toType, boolean isTransitive); static boolean isTransitive(List<PathSegment> segs); List<IContextValidator> findContextualValidators(String toType, boolean isTransitive); boolean isGlobalEntity(String type); }
ContextValidator implements ApplicationContextAware { public Map<String, SecurityUtil.UserContext> getValidatedEntityContexts(EntityDefinition def, Collection<Entity> entities, boolean isTransitive, boolean isRead) throws APIAccessDeniedException { if (skipValidation(def, isRead)) { return null; } Map<String, SecurityUtil.UserContext> entityContexts = new HashMap<String, SecurityUtil.UserContext>(); List<IContextValidator> contextValidators = findContextualValidators(def.getType(), isTransitive); Collection<String> ids = getEntityIds(entities); if (!contextValidators.isEmpty()) { Set<String> idsToValidate = getEntityIdsToValidateForgiving(entities, isTransitive); for (IContextValidator validator : contextValidators) { Set<String> validatedIds = getValidatedIds(def, idsToValidate, validator); for (String id : validatedIds) { if (!entityContexts.containsKey(id)) { entityContexts.put(id, validator.getContext()); } else if ((entityContexts.get(id).equals(SecurityUtil.UserContext.STAFF_CONTEXT)) && (validator.getContext().equals(SecurityUtil.UserContext.TEACHER_CONTEXT)) || (entityContexts.get(id).equals(SecurityUtil.UserContext.TEACHER_CONTEXT)) && (validator.getContext().equals(SecurityUtil.UserContext.STAFF_CONTEXT))) { entityContexts.put(id, SecurityUtil.UserContext.DUAL_CONTEXT); } } } Set<String> accessibleNonValidatedIds = new HashSet<String>(ids); accessibleNonValidatedIds.removeAll(idsToValidate); for (String id : accessibleNonValidatedIds) { entityContexts.put(id, SecurityUtil.getUserContext()); } } else { throw new APIAccessDeniedException("No validator for " + def.getType() + ", transitive=" + isTransitive, def.getType(), ids); } return entityContexts; }  @Override void setApplicationContext(ApplicationContext applicationContext); void validateContextToUri(ContainerRequest request, SLIPrincipal principal); boolean isUrlBlocked(ContainerRequest request); List<PathSegment> cleanEmptySegments(List<PathSegment> pathSegments); void validateContextToCallUri(List<PathSegment> segments); boolean checkAccessOfStudentsThroughDisciplineIncidents(List<PathSegment> segments); void validateContextToEntities(EntityDefinition def, Collection<String> ids, boolean isTransitive); Set<String> getValidIdsIncludeOrphans(EntityDefinition def, Set<String> ids, boolean isTransitive); Map<String, SecurityUtil.UserContext> getValidatedEntityContexts(EntityDefinition def, Collection<Entity> entities, boolean isTransitive, boolean isRead); IContextValidator findValidator(String toType, boolean isTransitive); static boolean isTransitive(List<PathSegment> segs); List<IContextValidator> findContextualValidators(String toType, boolean isTransitive); boolean isGlobalEntity(String type);  }