@Test public final void performSecurityTestGroupEntityAdmin() throws Exception { final List<Long> adminIds = new ArrayList<Long>(); adminIds.add(CURRENT_USER_ID); setupCommonGroupExpectations(); context.checking(new Expectations() { { oneOf(groupMock).isPublic(); will(returnValue(false)); oneOf(coordMapper).execute(GROUP_ID); will(returnValue(new ArrayList<Long>())); oneOf(groupFollowerIdsMapper).execute(GROUP_ID); will(returnValue(new ArrayList<Long>())); oneOf(adminIdsMapper).execute(null); will(returnValue(adminIds)); } }); sut.authorize(actionContext); context.assertIsSatisfied(); }
@Override public void authorize(final PrincipalActionContext inActionContext) { GetFollowersFollowingRequest actionRequest = (GetFollowersFollowingRequest) inActionContext.getParams(); EntityType targetType = actionRequest.getEntityType(); if (targetType == EntityType.PERSON) { return; } if (targetType == EntityType.GROUP) { long userId = inActionContext.getPrincipal().getId(); String groupShortName = actionRequest.getEntityId(); List<DomainGroupModelView> groups = groupMapper.execute(Collections.singletonList(groupShortName)); if (groups.size() > 0) { DomainGroupModelView group = groups.get(0); if (group.isPublic() || isUserCoordForGroup(userId, group.getId()) || isUserFollowingGroup(userId, group.getId()) || adminIdsMapper.execute(null).contains(inActionContext.getPrincipal().getId())) { return; } } throw new AuthorizationException("Only a coordinator or follower can get the list of followers " + "of a private group"); } }
GetFollowersAuthorizationStrategy implements AuthorizationStrategy<PrincipalActionContext> { @Override public void authorize(final PrincipalActionContext inActionContext) { GetFollowersFollowingRequest actionRequest = (GetFollowersFollowingRequest) inActionContext.getParams(); EntityType targetType = actionRequest.getEntityType(); if (targetType == EntityType.PERSON) { return; } if (targetType == EntityType.GROUP) { long userId = inActionContext.getPrincipal().getId(); String groupShortName = actionRequest.getEntityId(); List<DomainGroupModelView> groups = groupMapper.execute(Collections.singletonList(groupShortName)); if (groups.size() > 0) { DomainGroupModelView group = groups.get(0); if (group.isPublic() || isUserCoordForGroup(userId, group.getId()) || isUserFollowingGroup(userId, group.getId()) || adminIdsMapper.execute(null).contains(inActionContext.getPrincipal().getId())) { return; } } throw new AuthorizationException("Only a coordinator or follower can get the list of followers " + "of a private group"); } } }
GetFollowersAuthorizationStrategy implements AuthorizationStrategy<PrincipalActionContext> { @Override public void authorize(final PrincipalActionContext inActionContext) { GetFollowersFollowingRequest actionRequest = (GetFollowersFollowingRequest) inActionContext.getParams(); EntityType targetType = actionRequest.getEntityType(); if (targetType == EntityType.PERSON) { return; } if (targetType == EntityType.GROUP) { long userId = inActionContext.getPrincipal().getId(); String groupShortName = actionRequest.getEntityId(); List<DomainGroupModelView> groups = groupMapper.execute(Collections.singletonList(groupShortName)); if (groups.size() > 0) { DomainGroupModelView group = groups.get(0); if (group.isPublic() || isUserCoordForGroup(userId, group.getId()) || isUserFollowingGroup(userId, group.getId()) || adminIdsMapper.execute(null).contains(inActionContext.getPrincipal().getId())) { return; } } throw new AuthorizationException("Only a coordinator or follower can get the list of followers " + "of a private group"); } } GetFollowersAuthorizationStrategy(final DomainMapper<Long, List<Long>> inCoordMapper,
            final DomainMapper<Long, List<Long>> inGroupFollowerIdsMapper,
            final GetDomainGroupsByShortNames inGroupMapper,
            final DomainMapper<Serializable, List<Long>> inAdminIdsMapper); }
GetFollowersAuthorizationStrategy implements AuthorizationStrategy<PrincipalActionContext> { @Override public void authorize(final PrincipalActionContext inActionContext) { GetFollowersFollowingRequest actionRequest = (GetFollowersFollowingRequest) inActionContext.getParams(); EntityType targetType = actionRequest.getEntityType(); if (targetType == EntityType.PERSON) { return; } if (targetType == EntityType.GROUP) { long userId = inActionContext.getPrincipal().getId(); String groupShortName = actionRequest.getEntityId(); List<DomainGroupModelView> groups = groupMapper.execute(Collections.singletonList(groupShortName)); if (groups.size() > 0) { DomainGroupModelView group = groups.get(0); if (group.isPublic() || isUserCoordForGroup(userId, group.getId()) || isUserFollowingGroup(userId, group.getId()) || adminIdsMapper.execute(null).contains(inActionContext.getPrincipal().getId())) { return; } } throw new AuthorizationException("Only a coordinator or follower can get the list of followers " + "of a private group"); } } GetFollowersAuthorizationStrategy(final DomainMapper<Long, List<Long>> inCoordMapper,
            final DomainMapper<Long, List<Long>> inGroupFollowerIdsMapper,
            final GetDomainGroupsByShortNames inGroupMapper,
            final DomainMapper<Serializable, List<Long>> inAdminIdsMapper); @Override void authorize(final PrincipalActionContext inActionContext); }
GetFollowersAuthorizationStrategy implements AuthorizationStrategy<PrincipalActionContext> { @Override public void authorize(final PrincipalActionContext inActionContext) { GetFollowersFollowingRequest actionRequest = (GetFollowersFollowingRequest) inActionContext.getParams(); EntityType targetType = actionRequest.getEntityType(); if (targetType == EntityType.PERSON) { return; } if (targetType == EntityType.GROUP) { long userId = inActionContext.getPrincipal().getId(); String groupShortName = actionRequest.getEntityId(); List<DomainGroupModelView> groups = groupMapper.execute(Collections.singletonList(groupShortName)); if (groups.size() > 0) { DomainGroupModelView group = groups.get(0); if (group.isPublic() || isUserCoordForGroup(userId, group.getId()) || isUserFollowingGroup(userId, group.getId()) || adminIdsMapper.execute(null).contains(inActionContext.getPrincipal().getId())) { return; } } throw new AuthorizationException("Only a coordinator or follower can get the list of followers " + "of a private group"); } } GetFollowersAuthorizationStrategy(final DomainMapper<Long, List<Long>> inCoordMapper,
            final DomainMapper<Long, List<Long>> inGroupFollowerIdsMapper,
            final GetDomainGroupsByShortNames inGroupMapper,
            final DomainMapper<Serializable, List<Long>> inAdminIdsMapper); @Override void authorize(final PrincipalActionContext inActionContext);  }