@Test (expected = RuntimeException.class) public void testValidateAdminBadRights() { assertNull(resource.validateAdminRights(Arrays.asList(ONE_ADMIN_RIGHT_ONLY), null)); }
Response validateAdminRights(Collection<GrantedAuthority> rights, String tenant) { Collection<GrantedAuthority> rightSet = new HashSet<GrantedAuthority>(rights); rightSet.retainAll(Arrays.asList(Right.ALL_ADMIN_CRUD_RIGHTS)); boolean nullTenant = (tenant == null && !(rights.contains(Right.CRUD_SANDBOX_SLC_OPERATOR) || rights .contains(Right.CRUD_SLC_OPERATOR))); if (nullTenant) { LOG.error("Non-operator user {} has null tenant. Giving up.", new Object[] { secUtil.getUid() }); throw new IllegalArgumentException("Non-operator user " + secUtil.getUid() + " has null tenant. Giving up."); } if (rightSet.isEmpty() || nullTenant) { return composeForbiddenResponse("You are not authorized to access this resource."); } return null; }
UserResource { Response validateAdminRights(Collection<GrantedAuthority> rights, String tenant) { Collection<GrantedAuthority> rightSet = new HashSet<GrantedAuthority>(rights); rightSet.retainAll(Arrays.asList(Right.ALL_ADMIN_CRUD_RIGHTS)); boolean nullTenant = (tenant == null && !(rights.contains(Right.CRUD_SANDBOX_SLC_OPERATOR) || rights .contains(Right.CRUD_SLC_OPERATOR))); if (nullTenant) { LOG.error("Non-operator user {} has null tenant. Giving up.", new Object[] { secUtil.getUid() }); throw new IllegalArgumentException("Non-operator user " + secUtil.getUid() + " has null tenant. Giving up."); } if (rightSet.isEmpty() || nullTenant) { return composeForbiddenResponse("You are not authorized to access this resource."); } return null; } }
UserResource { Response validateAdminRights(Collection<GrantedAuthority> rights, String tenant) { Collection<GrantedAuthority> rightSet = new HashSet<GrantedAuthority>(rights); rightSet.retainAll(Arrays.asList(Right.ALL_ADMIN_CRUD_RIGHTS)); boolean nullTenant = (tenant == null && !(rights.contains(Right.CRUD_SANDBOX_SLC_OPERATOR) || rights .contains(Right.CRUD_SLC_OPERATOR))); if (nullTenant) { LOG.error("Non-operator user {} has null tenant. Giving up.", new Object[] { secUtil.getUid() }); throw new IllegalArgumentException("Non-operator user " + secUtil.getUid() + " has null tenant. Giving up."); } if (rightSet.isEmpty() || nullTenant) { return composeForbiddenResponse("You are not authorized to access this resource."); } return null; }  }
UserResource { Response validateAdminRights(Collection<GrantedAuthority> rights, String tenant) { Collection<GrantedAuthority> rightSet = new HashSet<GrantedAuthority>(rights); rightSet.retainAll(Arrays.asList(Right.ALL_ADMIN_CRUD_RIGHTS)); boolean nullTenant = (tenant == null && !(rights.contains(Right.CRUD_SANDBOX_SLC_OPERATOR) || rights .contains(Right.CRUD_SLC_OPERATOR))); if (nullTenant) { LOG.error("Non-operator user {} has null tenant. Giving up.", new Object[] { secUtil.getUid() }); throw new IllegalArgumentException("Non-operator user " + secUtil.getUid() + " has null tenant. Giving up."); } if (rightSet.isEmpty() || nullTenant) { return composeForbiddenResponse("You are not authorized to access this resource."); } return null; }  @POST @RightsAllowed({Right.CRUD_LEA_ADMIN, Right.CRUD_SEA_ADMIN, Right.CRUD_SLC_OPERATOR, Right.CRUD_SANDBOX_ADMIN, Right.CRUD_SANDBOX_SLC_OPERATOR }) final Response create(final User newUser); @GET @RightsAllowed({Right.CRUD_LEA_ADMIN, Right.CRUD_SEA_ADMIN, Right.CRUD_SLC_OPERATOR, Right.CRUD_SANDBOX_ADMIN, Right.CRUD_SANDBOX_SLC_OPERATOR }) final Response readAll(); @PUT @RightsAllowed({Right.CRUD_LEA_ADMIN, Right.CRUD_SEA_ADMIN, Right.CRUD_SLC_OPERATOR, Right.CRUD_SANDBOX_ADMIN, Right.CRUD_SANDBOX_SLC_OPERATOR }) final Response update(final User updateUser); @DELETE @Path("{uid}") @RightsAllowed({Right.CRUD_LEA_ADMIN, Right.CRUD_SEA_ADMIN, Right.CRUD_SLC_OPERATOR, Right.CRUD_SANDBOX_ADMIN, Right.CRUD_SANDBOX_SLC_OPERATOR }) final Response delete(@PathParam("uid") final String uid); @GET @Path("edorgs") @RightsAllowed({Right.CRUD_LEA_ADMIN, Right.CRUD_SEA_ADMIN, Right.CRUD_SLC_OPERATOR, Right.CRUD_SANDBOX_ADMIN, Right.CRUD_SANDBOX_SLC_OPERATOR }) final Response getEdOrgs(); void setRealm(String realm); }
UserResource { Response validateAdminRights(Collection<GrantedAuthority> rights, String tenant) { Collection<GrantedAuthority> rightSet = new HashSet<GrantedAuthority>(rights); rightSet.retainAll(Arrays.asList(Right.ALL_ADMIN_CRUD_RIGHTS)); boolean nullTenant = (tenant == null && !(rights.contains(Right.CRUD_SANDBOX_SLC_OPERATOR) || rights .contains(Right.CRUD_SLC_OPERATOR))); if (nullTenant) { LOG.error("Non-operator user {} has null tenant. Giving up.", new Object[] { secUtil.getUid() }); throw new IllegalArgumentException("Non-operator user " + secUtil.getUid() + " has null tenant. Giving up."); } if (rightSet.isEmpty() || nullTenant) { return composeForbiddenResponse("You are not authorized to access this resource."); } return null; }  @POST @RightsAllowed({Right.CRUD_LEA_ADMIN, Right.CRUD_SEA_ADMIN, Right.CRUD_SLC_OPERATOR, Right.CRUD_SANDBOX_ADMIN, Right.CRUD_SANDBOX_SLC_OPERATOR }) final Response create(final User newUser); @GET @RightsAllowed({Right.CRUD_LEA_ADMIN, Right.CRUD_SEA_ADMIN, Right.CRUD_SLC_OPERATOR, Right.CRUD_SANDBOX_ADMIN, Right.CRUD_SANDBOX_SLC_OPERATOR }) final Response readAll(); @PUT @RightsAllowed({Right.CRUD_LEA_ADMIN, Right.CRUD_SEA_ADMIN, Right.CRUD_SLC_OPERATOR, Right.CRUD_SANDBOX_ADMIN, Right.CRUD_SANDBOX_SLC_OPERATOR }) final Response update(final User updateUser); @DELETE @Path("{uid}") @RightsAllowed({Right.CRUD_LEA_ADMIN, Right.CRUD_SEA_ADMIN, Right.CRUD_SLC_OPERATOR, Right.CRUD_SANDBOX_ADMIN, Right.CRUD_SANDBOX_SLC_OPERATOR }) final Response delete(@PathParam("uid") final String uid); @GET @Path("edorgs") @RightsAllowed({Right.CRUD_LEA_ADMIN, Right.CRUD_SEA_ADMIN, Right.CRUD_SLC_OPERATOR, Right.CRUD_SANDBOX_ADMIN, Right.CRUD_SANDBOX_SLC_OPERATOR }) final Response getEdOrgs(); void setRealm(String realm);  }