@Test(expected = AuthorizationException.class) public void testAuthorizeAddFollowerPrivateGroupNotCoordinator() { final SetFollowingStatusRequest request = new SetFollowingStatusRequest("1", "1", EntityType.GROUP, false, Follower.FollowerStatus.FOLLOWING); final DomainGroupModelView testGroup = new DomainGroupModelView(); testGroup.setIsPublic(false); testGroup.setEntityId(1L); final Set<Long> groupCoordIds = new HashSet<Long>(); groupCoordIds.add(1L); context.checking(new Expectations() { { oneOf(groupMapperMock).fetchUniqueResult(with(any(String.class))); will(returnValue(testGroup)); oneOf(groupCoordMapperMock).execute(1L); will(returnValue(groupCoordIds)); oneOf(principalMock).getId(); will(returnValue(2L)); } }); ServiceActionContext currentContext = new ServiceActionContext(request, principalMock); sut.authorize(currentContext); context.assertIsSatisfied(); }
@Override public void authorize(final PrincipalActionContext inActionContext) throws AuthorizationException { SetFollowingStatusRequest request = (SetFollowingStatusRequest) inActionContext.getParams(); DomainGroupModelView targetResult = groupMapper.fetchUniqueResult(request.getTargetUniqueId()); if (request.getFollowerStatus().equals(Follower.FollowerStatus.FOLLOWING)) { if (!targetResult.isPublic()) { Set<Long> groupCoordinators = groupCoordMapper.execute(targetResult.getEntityId()); if (!groupCoordinators.contains(inActionContext.getPrincipal().getId())) { throw new AuthorizationException("Only group coordinators can add members to a private group."); } } } else { if (!targetResult.isPublic()) { Set<Long> groupCoordinators = groupCoordMapper.execute(targetResult.getEntityId()); if (!groupCoordinators.contains(inActionContext.getPrincipal().getId()) && !request.getFollowerUniqueId().equals(inActionContext.getPrincipal().getAccountId())) { throw new AuthorizationException("Coordinators and Followers are the only ones who can remove a " + "follower from a private group."); } } else if (request.getFollowerUniqueId() != null && request.getFollowerUniqueId() != "" && !request.getFollowerUniqueId().equals(inActionContext.getPrincipal().getAccountId())) { throw new AuthorizationException("Only the owner of a relationship can remove it."); } } }
SetFollowingGroupStatusAuthorization implements AuthorizationStrategy<PrincipalActionContext> { @Override public void authorize(final PrincipalActionContext inActionContext) throws AuthorizationException { SetFollowingStatusRequest request = (SetFollowingStatusRequest) inActionContext.getParams(); DomainGroupModelView targetResult = groupMapper.fetchUniqueResult(request.getTargetUniqueId()); if (request.getFollowerStatus().equals(Follower.FollowerStatus.FOLLOWING)) { if (!targetResult.isPublic()) { Set<Long> groupCoordinators = groupCoordMapper.execute(targetResult.getEntityId()); if (!groupCoordinators.contains(inActionContext.getPrincipal().getId())) { throw new AuthorizationException("Only group coordinators can add members to a private group."); } } } else { if (!targetResult.isPublic()) { Set<Long> groupCoordinators = groupCoordMapper.execute(targetResult.getEntityId()); if (!groupCoordinators.contains(inActionContext.getPrincipal().getId()) && !request.getFollowerUniqueId().equals(inActionContext.getPrincipal().getAccountId())) { throw new AuthorizationException("Coordinators and Followers are the only ones who can remove a " + "follower from a private group."); } } else if (request.getFollowerUniqueId() != null && request.getFollowerUniqueId() != "" && !request.getFollowerUniqueId().equals(inActionContext.getPrincipal().getAccountId())) { throw new AuthorizationException("Only the owner of a relationship can remove it."); } } } }
SetFollowingGroupStatusAuthorization implements AuthorizationStrategy<PrincipalActionContext> { @Override public void authorize(final PrincipalActionContext inActionContext) throws AuthorizationException { SetFollowingStatusRequest request = (SetFollowingStatusRequest) inActionContext.getParams(); DomainGroupModelView targetResult = groupMapper.fetchUniqueResult(request.getTargetUniqueId()); if (request.getFollowerStatus().equals(Follower.FollowerStatus.FOLLOWING)) { if (!targetResult.isPublic()) { Set<Long> groupCoordinators = groupCoordMapper.execute(targetResult.getEntityId()); if (!groupCoordinators.contains(inActionContext.getPrincipal().getId())) { throw new AuthorizationException("Only group coordinators can add members to a private group."); } } } else { if (!targetResult.isPublic()) { Set<Long> groupCoordinators = groupCoordMapper.execute(targetResult.getEntityId()); if (!groupCoordinators.contains(inActionContext.getPrincipal().getId()) && !request.getFollowerUniqueId().equals(inActionContext.getPrincipal().getAccountId())) { throw new AuthorizationException("Coordinators and Followers are the only ones who can remove a " + "follower from a private group."); } } else if (request.getFollowerUniqueId() != null && request.getFollowerUniqueId() != "" && !request.getFollowerUniqueId().equals(inActionContext.getPrincipal().getAccountId())) { throw new AuthorizationException("Only the owner of a relationship can remove it."); } } } SetFollowingGroupStatusAuthorization(final GetDomainGroupsByShortNames inGroupMapper,
            final GetAllPersonIdsWhoHaveGroupCoordinatorAccess inGroupCoordMapper); }
SetFollowingGroupStatusAuthorization implements AuthorizationStrategy<PrincipalActionContext> { @Override public void authorize(final PrincipalActionContext inActionContext) throws AuthorizationException { SetFollowingStatusRequest request = (SetFollowingStatusRequest) inActionContext.getParams(); DomainGroupModelView targetResult = groupMapper.fetchUniqueResult(request.getTargetUniqueId()); if (request.getFollowerStatus().equals(Follower.FollowerStatus.FOLLOWING)) { if (!targetResult.isPublic()) { Set<Long> groupCoordinators = groupCoordMapper.execute(targetResult.getEntityId()); if (!groupCoordinators.contains(inActionContext.getPrincipal().getId())) { throw new AuthorizationException("Only group coordinators can add members to a private group."); } } } else { if (!targetResult.isPublic()) { Set<Long> groupCoordinators = groupCoordMapper.execute(targetResult.getEntityId()); if (!groupCoordinators.contains(inActionContext.getPrincipal().getId()) && !request.getFollowerUniqueId().equals(inActionContext.getPrincipal().getAccountId())) { throw new AuthorizationException("Coordinators and Followers are the only ones who can remove a " + "follower from a private group."); } } else if (request.getFollowerUniqueId() != null && request.getFollowerUniqueId() != "" && !request.getFollowerUniqueId().equals(inActionContext.getPrincipal().getAccountId())) { throw new AuthorizationException("Only the owner of a relationship can remove it."); } } } SetFollowingGroupStatusAuthorization(final GetDomainGroupsByShortNames inGroupMapper,
            final GetAllPersonIdsWhoHaveGroupCoordinatorAccess inGroupCoordMapper); @Override void authorize(final PrincipalActionContext inActionContext); }
SetFollowingGroupStatusAuthorization implements AuthorizationStrategy<PrincipalActionContext> { @Override public void authorize(final PrincipalActionContext inActionContext) throws AuthorizationException { SetFollowingStatusRequest request = (SetFollowingStatusRequest) inActionContext.getParams(); DomainGroupModelView targetResult = groupMapper.fetchUniqueResult(request.getTargetUniqueId()); if (request.getFollowerStatus().equals(Follower.FollowerStatus.FOLLOWING)) { if (!targetResult.isPublic()) { Set<Long> groupCoordinators = groupCoordMapper.execute(targetResult.getEntityId()); if (!groupCoordinators.contains(inActionContext.getPrincipal().getId())) { throw new AuthorizationException("Only group coordinators can add members to a private group."); } } } else { if (!targetResult.isPublic()) { Set<Long> groupCoordinators = groupCoordMapper.execute(targetResult.getEntityId()); if (!groupCoordinators.contains(inActionContext.getPrincipal().getId()) && !request.getFollowerUniqueId().equals(inActionContext.getPrincipal().getAccountId())) { throw new AuthorizationException("Coordinators and Followers are the only ones who can remove a " + "follower from a private group."); } } else if (request.getFollowerUniqueId() != null && request.getFollowerUniqueId() != "" && !request.getFollowerUniqueId().equals(inActionContext.getPrincipal().getAccountId())) { throw new AuthorizationException("Only the owner of a relationship can remove it."); } } } SetFollowingGroupStatusAuthorization(final GetDomainGroupsByShortNames inGroupMapper,
            final GetAllPersonIdsWhoHaveGroupCoordinatorAccess inGroupCoordMapper); @Override void authorize(final PrincipalActionContext inActionContext);  }