@Test public void testAccessGrantedToSecurityProfileWithMatchingPermission() throws Exception { VitamThreadUtils.getVitamSession().setSecurityProfileIdentifier(SECURITY_PROFILE_IDENTIFIER); AdminManagementClient adminManagementClient = mock(AdminManagementClient.class); boolean fullAccess = false; Set<String> permissions = new HashSet<>(Arrays.asList("some_permission", PERMISSION, "some_other_permission")); SecurityProfileModel securityProfile = new SecurityProfileModel("guid", SECURITY_PROFILE_IDENTIFIER, "Sec profile", fullAccess, permissions); when(adminManagementClient.findSecurityProfileByIdentifier(SECURITY_PROFILE_IDENTIFIER)) .thenReturn(new RequestResponseOK().addResult(securityProfile)); ContainerRequestContext containerRequestContext = spy(ContainerRequestContext.class); EndpointPermissionAuthorizationFilter instance = new EndpointPermissionAuthorizationFilter(PERMISSION, adminManagementClient); instance.filter(containerRequestContext); verify(containerRequestContext, never()).abortWith(any()); }
@Override public void filter(ContainerRequestContext requestContext) throws IOException { String securityProfileIdentifier = VitamThreadUtils.getVitamSession().getSecurityProfileIdentifier(); try { RequestResponse<SecurityProfileModel> securityProfileResponse = adminManagementClient.findSecurityProfileByIdentifier(securityProfileIdentifier); SecurityProfileModel securityProfile; if (securityProfileResponse.isOk()) { securityProfile = ((RequestResponseOK<SecurityProfileModel>) securityProfileResponse).getFirstResult(); } else { LOGGER.error("Could not retrieve security profile by identifier " + securityProfileIdentifier); VitamError vitamError = (VitamError) securityProfileResponse; requestContext.abortWith( Response.status(vitamError.getHttpCode()).entity(vitamError).type(MediaType.APPLICATION_JSON_TYPE) .build()); return; } if (securityProfile.getFullAccess()) { LOGGER.debug("Full access granted."); return; } if (securityProfile.getPermissions() != null && securityProfile.getPermissions().contains(permission)) { LOGGER.debug("Access granted with permission " + permission); return; } LOGGER.warn("Access denied for permission " + permission); throw new VitamSecurityException("Access denied."); } catch (InvalidParseOperationException | AdminManagementClientServerException | ReferentialNotFoundException | VitamSecurityException e) { LOGGER.error("An error occured during authorization filter check", e); final VitamError vitamError = generateVitamError(e, permission); requestContext.abortWith( Response.status(vitamError.getHttpCode()).entity(vitamError).type(MediaType.APPLICATION_JSON_TYPE) .build()); return; } }
EndpointPermissionAuthorizationFilter implements ContainerRequestFilter { @Override public void filter(ContainerRequestContext requestContext) throws IOException { String securityProfileIdentifier = VitamThreadUtils.getVitamSession().getSecurityProfileIdentifier(); try { RequestResponse<SecurityProfileModel> securityProfileResponse = adminManagementClient.findSecurityProfileByIdentifier(securityProfileIdentifier); SecurityProfileModel securityProfile; if (securityProfileResponse.isOk()) { securityProfile = ((RequestResponseOK<SecurityProfileModel>) securityProfileResponse).getFirstResult(); } else { LOGGER.error("Could not retrieve security profile by identifier " + securityProfileIdentifier); VitamError vitamError = (VitamError) securityProfileResponse; requestContext.abortWith( Response.status(vitamError.getHttpCode()).entity(vitamError).type(MediaType.APPLICATION_JSON_TYPE) .build()); return; } if (securityProfile.getFullAccess()) { LOGGER.debug("Full access granted."); return; } if (securityProfile.getPermissions() != null && securityProfile.getPermissions().contains(permission)) { LOGGER.debug("Access granted with permission " + permission); return; } LOGGER.warn("Access denied for permission " + permission); throw new VitamSecurityException("Access denied."); } catch (InvalidParseOperationException | AdminManagementClientServerException | ReferentialNotFoundException | VitamSecurityException e) { LOGGER.error("An error occured during authorization filter check", e); final VitamError vitamError = generateVitamError(e, permission); requestContext.abortWith( Response.status(vitamError.getHttpCode()).entity(vitamError).type(MediaType.APPLICATION_JSON_TYPE) .build()); return; } } }
EndpointPermissionAuthorizationFilter implements ContainerRequestFilter { @Override public void filter(ContainerRequestContext requestContext) throws IOException { String securityProfileIdentifier = VitamThreadUtils.getVitamSession().getSecurityProfileIdentifier(); try { RequestResponse<SecurityProfileModel> securityProfileResponse = adminManagementClient.findSecurityProfileByIdentifier(securityProfileIdentifier); SecurityProfileModel securityProfile; if (securityProfileResponse.isOk()) { securityProfile = ((RequestResponseOK<SecurityProfileModel>) securityProfileResponse).getFirstResult(); } else { LOGGER.error("Could not retrieve security profile by identifier " + securityProfileIdentifier); VitamError vitamError = (VitamError) securityProfileResponse; requestContext.abortWith( Response.status(vitamError.getHttpCode()).entity(vitamError).type(MediaType.APPLICATION_JSON_TYPE) .build()); return; } if (securityProfile.getFullAccess()) { LOGGER.debug("Full access granted."); return; } if (securityProfile.getPermissions() != null && securityProfile.getPermissions().contains(permission)) { LOGGER.debug("Access granted with permission " + permission); return; } LOGGER.warn("Access denied for permission " + permission); throw new VitamSecurityException("Access denied."); } catch (InvalidParseOperationException | AdminManagementClientServerException | ReferentialNotFoundException | VitamSecurityException e) { LOGGER.error("An error occured during authorization filter check", e); final VitamError vitamError = generateVitamError(e, permission); requestContext.abortWith( Response.status(vitamError.getHttpCode()).entity(vitamError).type(MediaType.APPLICATION_JSON_TYPE) .build()); return; } } EndpointPermissionAuthorizationFilter(String permission); @VisibleForTesting  EndpointPermissionAuthorizationFilter(String permission,
        AdminManagementClient adminManagementClient); }
EndpointPermissionAuthorizationFilter implements ContainerRequestFilter { @Override public void filter(ContainerRequestContext requestContext) throws IOException { String securityProfileIdentifier = VitamThreadUtils.getVitamSession().getSecurityProfileIdentifier(); try { RequestResponse<SecurityProfileModel> securityProfileResponse = adminManagementClient.findSecurityProfileByIdentifier(securityProfileIdentifier); SecurityProfileModel securityProfile; if (securityProfileResponse.isOk()) { securityProfile = ((RequestResponseOK<SecurityProfileModel>) securityProfileResponse).getFirstResult(); } else { LOGGER.error("Could not retrieve security profile by identifier " + securityProfileIdentifier); VitamError vitamError = (VitamError) securityProfileResponse; requestContext.abortWith( Response.status(vitamError.getHttpCode()).entity(vitamError).type(MediaType.APPLICATION_JSON_TYPE) .build()); return; } if (securityProfile.getFullAccess()) { LOGGER.debug("Full access granted."); return; } if (securityProfile.getPermissions() != null && securityProfile.getPermissions().contains(permission)) { LOGGER.debug("Access granted with permission " + permission); return; } LOGGER.warn("Access denied for permission " + permission); throw new VitamSecurityException("Access denied."); } catch (InvalidParseOperationException | AdminManagementClientServerException | ReferentialNotFoundException | VitamSecurityException e) { LOGGER.error("An error occured during authorization filter check", e); final VitamError vitamError = generateVitamError(e, permission); requestContext.abortWith( Response.status(vitamError.getHttpCode()).entity(vitamError).type(MediaType.APPLICATION_JSON_TYPE) .build()); return; } } EndpointPermissionAuthorizationFilter(String permission); @VisibleForTesting  EndpointPermissionAuthorizationFilter(String permission,
        AdminManagementClient adminManagementClient); @Override void filter(ContainerRequestContext requestContext); String getPermission(); }
EndpointPermissionAuthorizationFilter implements ContainerRequestFilter { @Override public void filter(ContainerRequestContext requestContext) throws IOException { String securityProfileIdentifier = VitamThreadUtils.getVitamSession().getSecurityProfileIdentifier(); try { RequestResponse<SecurityProfileModel> securityProfileResponse = adminManagementClient.findSecurityProfileByIdentifier(securityProfileIdentifier); SecurityProfileModel securityProfile; if (securityProfileResponse.isOk()) { securityProfile = ((RequestResponseOK<SecurityProfileModel>) securityProfileResponse).getFirstResult(); } else { LOGGER.error("Could not retrieve security profile by identifier " + securityProfileIdentifier); VitamError vitamError = (VitamError) securityProfileResponse; requestContext.abortWith( Response.status(vitamError.getHttpCode()).entity(vitamError).type(MediaType.APPLICATION_JSON_TYPE) .build()); return; } if (securityProfile.getFullAccess()) { LOGGER.debug("Full access granted."); return; } if (securityProfile.getPermissions() != null && securityProfile.getPermissions().contains(permission)) { LOGGER.debug("Access granted with permission " + permission); return; } LOGGER.warn("Access denied for permission " + permission); throw new VitamSecurityException("Access denied."); } catch (InvalidParseOperationException | AdminManagementClientServerException | ReferentialNotFoundException | VitamSecurityException e) { LOGGER.error("An error occured during authorization filter check", e); final VitamError vitamError = generateVitamError(e, permission); requestContext.abortWith( Response.status(vitamError.getHttpCode()).entity(vitamError).type(MediaType.APPLICATION_JSON_TYPE) .build()); return; } } EndpointPermissionAuthorizationFilter(String permission); @VisibleForTesting  EndpointPermissionAuthorizationFilter(String permission,
        AdminManagementClient adminManagementClient); @Override void filter(ContainerRequestContext requestContext); String getPermission();  }