@Test public void test_checkFileAccess_success() throws Throwable { prepareMethodCalls("FI123", "fileId", null); Mockito.when(joinPoint.proceed()).thenReturn("proceed"); FileAccessCheck check = createFileAccessCheckAnnotation("fileId"); Object retObj = aspectToTest.checkFileAccess(joinPoint, check); Assert.assertEquals("proceed", retObj); }
@Around("within(edu.asu.diging.gilesecosystem.web.controllers..*) && @annotation(fileCheck)") public Object checkFileAccess(ProceedingJoinPoint joinPoint, FileAccessCheck fileCheck) throws Throwable { String fileId = getRequestParameter(joinPoint, fileCheck.value()); Authentication auth = SecurityContextHolder.getContext() .getAuthentication(); User user = (User) auth.getPrincipal(); if (user.getRoles().contains(GilesGrantedAuthority.ROLE_ADMIN)) { return joinPoint.proceed(); } IFile file = fileService.getFileById(fileId); if (file == null) { return new ResponseEntity<String>(HttpStatus.NOT_FOUND); } if (!file.getUsername().equals(user.getUsername())) { return new ResponseEntity<String>(HttpStatus.FORBIDDEN); } return joinPoint.proceed(); }
SecurityAspect { @Around("within(edu.asu.diging.gilesecosystem.web.controllers..*) && @annotation(fileCheck)") public Object checkFileAccess(ProceedingJoinPoint joinPoint, FileAccessCheck fileCheck) throws Throwable { String fileId = getRequestParameter(joinPoint, fileCheck.value()); Authentication auth = SecurityContextHolder.getContext() .getAuthentication(); User user = (User) auth.getPrincipal(); if (user.getRoles().contains(GilesGrantedAuthority.ROLE_ADMIN)) { return joinPoint.proceed(); } IFile file = fileService.getFileById(fileId); if (file == null) { return new ResponseEntity<String>(HttpStatus.NOT_FOUND); } if (!file.getUsername().equals(user.getUsername())) { return new ResponseEntity<String>(HttpStatus.FORBIDDEN); } return joinPoint.proceed(); } }
SecurityAspect { @Around("within(edu.asu.diging.gilesecosystem.web.controllers..*) && @annotation(fileCheck)") public Object checkFileAccess(ProceedingJoinPoint joinPoint, FileAccessCheck fileCheck) throws Throwable { String fileId = getRequestParameter(joinPoint, fileCheck.value()); Authentication auth = SecurityContextHolder.getContext() .getAuthentication(); User user = (User) auth.getPrincipal(); if (user.getRoles().contains(GilesGrantedAuthority.ROLE_ADMIN)) { return joinPoint.proceed(); } IFile file = fileService.getFileById(fileId); if (file == null) { return new ResponseEntity<String>(HttpStatus.NOT_FOUND); } if (!file.getUsername().equals(user.getUsername())) { return new ResponseEntity<String>(HttpStatus.FORBIDDEN); } return joinPoint.proceed(); }  }
SecurityAspect { @Around("within(edu.asu.diging.gilesecosystem.web.controllers..*) && @annotation(fileCheck)") public Object checkFileAccess(ProceedingJoinPoint joinPoint, FileAccessCheck fileCheck) throws Throwable { String fileId = getRequestParameter(joinPoint, fileCheck.value()); Authentication auth = SecurityContextHolder.getContext() .getAuthentication(); User user = (User) auth.getPrincipal(); if (user.getRoles().contains(GilesGrantedAuthority.ROLE_ADMIN)) { return joinPoint.proceed(); } IFile file = fileService.getFileById(fileId); if (file == null) { return new ResponseEntity<String>(HttpStatus.NOT_FOUND); } if (!file.getUsername().equals(user.getUsername())) { return new ResponseEntity<String>(HttpStatus.FORBIDDEN); } return joinPoint.proceed(); }  @Around("within(edu.asu.diging.gilesecosystem.web.controllers..*) && @annotation(noCheck)") Object doNotCheckUserAccess(ProceedingJoinPoint joinPoint,
            NoAccessCheck noCheck); @Around("within(edu.asu.diging.gilesecosystem.web.controllers..*) && @annotation(uploadCheck)") Object checkUpoadIdAccess(ProceedingJoinPoint joinPoint,
            UploadIdAccessCheck uploadCheck); @Around("within(edu.asu.diging.gilesecosystem.web.controllers..*) && @annotation(docCheck)") Object checkDocumentIdAccess(ProceedingJoinPoint joinPoint, DocumentIdAccessCheck docCheck); @Around("within(edu.asu.diging.gilesecosystem.web.controllers..*) && @annotation(fileCheck)") Object checkFileAccess(ProceedingJoinPoint joinPoint,
            FileAccessCheck fileCheck); @Around("within(edu.asu.diging.gilesecosystem.web.controllers..*) && @annotation(check)") Object checkAccount(ProceedingJoinPoint joinPoint, AccountCheck check); }
SecurityAspect { @Around("within(edu.asu.diging.gilesecosystem.web.controllers..*) && @annotation(fileCheck)") public Object checkFileAccess(ProceedingJoinPoint joinPoint, FileAccessCheck fileCheck) throws Throwable { String fileId = getRequestParameter(joinPoint, fileCheck.value()); Authentication auth = SecurityContextHolder.getContext() .getAuthentication(); User user = (User) auth.getPrincipal(); if (user.getRoles().contains(GilesGrantedAuthority.ROLE_ADMIN)) { return joinPoint.proceed(); } IFile file = fileService.getFileById(fileId); if (file == null) { return new ResponseEntity<String>(HttpStatus.NOT_FOUND); } if (!file.getUsername().equals(user.getUsername())) { return new ResponseEntity<String>(HttpStatus.FORBIDDEN); } return joinPoint.proceed(); }  @Around("within(edu.asu.diging.gilesecosystem.web.controllers..*) && @annotation(noCheck)") Object doNotCheckUserAccess(ProceedingJoinPoint joinPoint,
            NoAccessCheck noCheck); @Around("within(edu.asu.diging.gilesecosystem.web.controllers..*) && @annotation(uploadCheck)") Object checkUpoadIdAccess(ProceedingJoinPoint joinPoint,
            UploadIdAccessCheck uploadCheck); @Around("within(edu.asu.diging.gilesecosystem.web.controllers..*) && @annotation(docCheck)") Object checkDocumentIdAccess(ProceedingJoinPoint joinPoint, DocumentIdAccessCheck docCheck); @Around("within(edu.asu.diging.gilesecosystem.web.controllers..*) && @annotation(fileCheck)") Object checkFileAccess(ProceedingJoinPoint joinPoint,
            FileAccessCheck fileCheck); @Around("within(edu.asu.diging.gilesecosystem.web.controllers..*) && @annotation(check)") Object checkAccount(ProceedingJoinPoint joinPoint, AccountCheck check);  }