@Test public void test_checkUploadIdAccess_forbidden() throws Throwable { prepareMethodCalls("UP456", "uploadId", null); UploadIdAccessCheck check = createUploadAccessCheckAnnotation("uploadId"); Object retObj = aspectToTest.checkUpoadIdAccess(joinPoint, check); Assert.assertEquals("forbidden", retObj); }
@Around("within(edu.asu.diging.gilesecosystem.web.controllers..*) && @annotation(uploadCheck)") public Object checkUpoadIdAccess(ProceedingJoinPoint joinPoint, UploadIdAccessCheck uploadCheck) throws Throwable { String uploadId = getRequestParameter(joinPoint, uploadCheck.value()); Authentication auth = SecurityContextHolder.getContext() .getAuthentication(); User user = (User) auth.getPrincipal(); if (user.getRoles().contains(GilesGrantedAuthority.ROLE_ADMIN)) { return joinPoint.proceed(); } IUpload upload = uploadService.getUpload(uploadId); if (upload == null) { return "notFound"; } if (!upload.getUsername().equals(user.getUsername())) { return "forbidden"; } return joinPoint.proceed(); }
SecurityAspect { @Around("within(edu.asu.diging.gilesecosystem.web.controllers..*) && @annotation(uploadCheck)") public Object checkUpoadIdAccess(ProceedingJoinPoint joinPoint, UploadIdAccessCheck uploadCheck) throws Throwable { String uploadId = getRequestParameter(joinPoint, uploadCheck.value()); Authentication auth = SecurityContextHolder.getContext() .getAuthentication(); User user = (User) auth.getPrincipal(); if (user.getRoles().contains(GilesGrantedAuthority.ROLE_ADMIN)) { return joinPoint.proceed(); } IUpload upload = uploadService.getUpload(uploadId); if (upload == null) { return "notFound"; } if (!upload.getUsername().equals(user.getUsername())) { return "forbidden"; } return joinPoint.proceed(); } }
SecurityAspect { @Around("within(edu.asu.diging.gilesecosystem.web.controllers..*) && @annotation(uploadCheck)") public Object checkUpoadIdAccess(ProceedingJoinPoint joinPoint, UploadIdAccessCheck uploadCheck) throws Throwable { String uploadId = getRequestParameter(joinPoint, uploadCheck.value()); Authentication auth = SecurityContextHolder.getContext() .getAuthentication(); User user = (User) auth.getPrincipal(); if (user.getRoles().contains(GilesGrantedAuthority.ROLE_ADMIN)) { return joinPoint.proceed(); } IUpload upload = uploadService.getUpload(uploadId); if (upload == null) { return "notFound"; } if (!upload.getUsername().equals(user.getUsername())) { return "forbidden"; } return joinPoint.proceed(); }  }
SecurityAspect { @Around("within(edu.asu.diging.gilesecosystem.web.controllers..*) && @annotation(uploadCheck)") public Object checkUpoadIdAccess(ProceedingJoinPoint joinPoint, UploadIdAccessCheck uploadCheck) throws Throwable { String uploadId = getRequestParameter(joinPoint, uploadCheck.value()); Authentication auth = SecurityContextHolder.getContext() .getAuthentication(); User user = (User) auth.getPrincipal(); if (user.getRoles().contains(GilesGrantedAuthority.ROLE_ADMIN)) { return joinPoint.proceed(); } IUpload upload = uploadService.getUpload(uploadId); if (upload == null) { return "notFound"; } if (!upload.getUsername().equals(user.getUsername())) { return "forbidden"; } return joinPoint.proceed(); }  @Around("within(edu.asu.diging.gilesecosystem.web.controllers..*) && @annotation(noCheck)") Object doNotCheckUserAccess(ProceedingJoinPoint joinPoint,
            NoAccessCheck noCheck); @Around("within(edu.asu.diging.gilesecosystem.web.controllers..*) && @annotation(uploadCheck)") Object checkUpoadIdAccess(ProceedingJoinPoint joinPoint,
            UploadIdAccessCheck uploadCheck); @Around("within(edu.asu.diging.gilesecosystem.web.controllers..*) && @annotation(docCheck)") Object checkDocumentIdAccess(ProceedingJoinPoint joinPoint, DocumentIdAccessCheck docCheck); @Around("within(edu.asu.diging.gilesecosystem.web.controllers..*) && @annotation(fileCheck)") Object checkFileAccess(ProceedingJoinPoint joinPoint,
            FileAccessCheck fileCheck); @Around("within(edu.asu.diging.gilesecosystem.web.controllers..*) && @annotation(check)") Object checkAccount(ProceedingJoinPoint joinPoint, AccountCheck check); }
SecurityAspect { @Around("within(edu.asu.diging.gilesecosystem.web.controllers..*) && @annotation(uploadCheck)") public Object checkUpoadIdAccess(ProceedingJoinPoint joinPoint, UploadIdAccessCheck uploadCheck) throws Throwable { String uploadId = getRequestParameter(joinPoint, uploadCheck.value()); Authentication auth = SecurityContextHolder.getContext() .getAuthentication(); User user = (User) auth.getPrincipal(); if (user.getRoles().contains(GilesGrantedAuthority.ROLE_ADMIN)) { return joinPoint.proceed(); } IUpload upload = uploadService.getUpload(uploadId); if (upload == null) { return "notFound"; } if (!upload.getUsername().equals(user.getUsername())) { return "forbidden"; } return joinPoint.proceed(); }  @Around("within(edu.asu.diging.gilesecosystem.web.controllers..*) && @annotation(noCheck)") Object doNotCheckUserAccess(ProceedingJoinPoint joinPoint,
            NoAccessCheck noCheck); @Around("within(edu.asu.diging.gilesecosystem.web.controllers..*) && @annotation(uploadCheck)") Object checkUpoadIdAccess(ProceedingJoinPoint joinPoint,
            UploadIdAccessCheck uploadCheck); @Around("within(edu.asu.diging.gilesecosystem.web.controllers..*) && @annotation(docCheck)") Object checkDocumentIdAccess(ProceedingJoinPoint joinPoint, DocumentIdAccessCheck docCheck); @Around("within(edu.asu.diging.gilesecosystem.web.controllers..*) && @annotation(fileCheck)") Object checkFileAccess(ProceedingJoinPoint joinPoint,
            FileAccessCheck fileCheck); @Around("within(edu.asu.diging.gilesecosystem.web.controllers..*) && @annotation(check)") Object checkAccount(ProceedingJoinPoint joinPoint, AccountCheck check);  }