@Test public void testSharePermissionSuccessOnUpdateManyRelationshipPackageLevel() { ContainerWithPackageShare containerWithPackageShare = new ContainerWithPackageShare(); ShareableWithPackageShare shareableWithPackageShare = new ShareableWithPackageShare(); shareableWithPackageShare.setContainerWithPackageShare(containerWithPackageShare); List<Resource> shareableList = new ArrayList<>(); shareableList.add(new ResourceIdentifier("shareableWithPackageShare", "1").castToResource()); Relationship shareables = new Relationship(null, new Data<>(shareableList)); User goodUser = new User(1); DataStoreTransaction tx = mock(DataStoreTransaction.class); when(tx.loadObject(eq(ShareableWithPackageShare.class), eq(1L), any(), any())).thenReturn(shareableWithPackageShare); RequestScope goodScope = buildRequestScope(tx, goodUser); PersistentResource<ContainerWithPackageShare> containerResource = new PersistentResource<>(containerWithPackageShare, null, goodScope.getUUIDFor(containerWithPackageShare), goodScope); containerResource.updateRelation("shareableWithPackageShares", shareables.toPersistentResources(goodScope)); assertEquals(1, containerWithPackageShare.getShareableWithPackageShares().size()); assertTrue(containerWithPackageShare.getShareableWithPackageShares().contains(shareableWithPackageShare)); }
public boolean updateRelation(String fieldName, Set<PersistentResource> resourceIdentifiers) { RelationshipType type = getRelationshipType(fieldName); Set<PersistentResource> resources = filter(ReadPermission.class, Optional.empty(), getRelationUncheckedUnfiltered(fieldName)); boolean isUpdated; if (type.isToMany()) { List<Object> modifiedResources = CollectionUtils.isEmpty(resourceIdentifiers) ? Collections.emptyList() : resourceIdentifiers.stream().map(PersistentResource::getObject).collect(Collectors.toList()); checkFieldAwareDeferPermissions( UpdatePermission.class, fieldName, modifiedResources, resources.stream().map(PersistentResource::getObject).collect(Collectors.toList()) ); isUpdated = updateToManyRelation(fieldName, resourceIdentifiers, resources); } else { PersistentResource resource = firstOrNullIfEmpty(resources); Object original = (resource == null) ? null : resource.getObject(); PersistentResource modifiedResource = firstOrNullIfEmpty(resourceIdentifiers); Object modified = (modifiedResource == null) ? null : modifiedResource.getObject(); checkFieldAwareDeferPermissions(UpdatePermission.class, fieldName, modified, original); isUpdated = updateToOneRelation(fieldName, resourceIdentifiers, resources); } return isUpdated; }
PersistentResource implements com.yahoo.elide.security.PersistentResource<T> { public boolean updateRelation(String fieldName, Set<PersistentResource> resourceIdentifiers) { RelationshipType type = getRelationshipType(fieldName); Set<PersistentResource> resources = filter(ReadPermission.class, Optional.empty(), getRelationUncheckedUnfiltered(fieldName)); boolean isUpdated; if (type.isToMany()) { List<Object> modifiedResources = CollectionUtils.isEmpty(resourceIdentifiers) ? Collections.emptyList() : resourceIdentifiers.stream().map(PersistentResource::getObject).collect(Collectors.toList()); checkFieldAwareDeferPermissions( UpdatePermission.class, fieldName, modifiedResources, resources.stream().map(PersistentResource::getObject).collect(Collectors.toList()) ); isUpdated = updateToManyRelation(fieldName, resourceIdentifiers, resources); } else { PersistentResource resource = firstOrNullIfEmpty(resources); Object original = (resource == null) ? null : resource.getObject(); PersistentResource modifiedResource = firstOrNullIfEmpty(resourceIdentifiers); Object modified = (modifiedResource == null) ? null : modifiedResource.getObject(); checkFieldAwareDeferPermissions(UpdatePermission.class, fieldName, modified, original); isUpdated = updateToOneRelation(fieldName, resourceIdentifiers, resources); } return isUpdated; } }
PersistentResource implements com.yahoo.elide.security.PersistentResource<T> { public boolean updateRelation(String fieldName, Set<PersistentResource> resourceIdentifiers) { RelationshipType type = getRelationshipType(fieldName); Set<PersistentResource> resources = filter(ReadPermission.class, Optional.empty(), getRelationUncheckedUnfiltered(fieldName)); boolean isUpdated; if (type.isToMany()) { List<Object> modifiedResources = CollectionUtils.isEmpty(resourceIdentifiers) ? Collections.emptyList() : resourceIdentifiers.stream().map(PersistentResource::getObject).collect(Collectors.toList()); checkFieldAwareDeferPermissions( UpdatePermission.class, fieldName, modifiedResources, resources.stream().map(PersistentResource::getObject).collect(Collectors.toList()) ); isUpdated = updateToManyRelation(fieldName, resourceIdentifiers, resources); } else { PersistentResource resource = firstOrNullIfEmpty(resources); Object original = (resource == null) ? null : resource.getObject(); PersistentResource modifiedResource = firstOrNullIfEmpty(resourceIdentifiers); Object modified = (modifiedResource == null) ? null : modifiedResource.getObject(); checkFieldAwareDeferPermissions(UpdatePermission.class, fieldName, modified, original); isUpdated = updateToOneRelation(fieldName, resourceIdentifiers, resources); } return isUpdated; } PersistentResource(@NonNull T obj, PersistentResource parent, String id, @NonNull RequestScope scope); }
PersistentResource implements com.yahoo.elide.security.PersistentResource<T> { public boolean updateRelation(String fieldName, Set<PersistentResource> resourceIdentifiers) { RelationshipType type = getRelationshipType(fieldName); Set<PersistentResource> resources = filter(ReadPermission.class, Optional.empty(), getRelationUncheckedUnfiltered(fieldName)); boolean isUpdated; if (type.isToMany()) { List<Object> modifiedResources = CollectionUtils.isEmpty(resourceIdentifiers) ? Collections.emptyList() : resourceIdentifiers.stream().map(PersistentResource::getObject).collect(Collectors.toList()); checkFieldAwareDeferPermissions( UpdatePermission.class, fieldName, modifiedResources, resources.stream().map(PersistentResource::getObject).collect(Collectors.toList()) ); isUpdated = updateToManyRelation(fieldName, resourceIdentifiers, resources); } else { PersistentResource resource = firstOrNullIfEmpty(resources); Object original = (resource == null) ? null : resource.getObject(); PersistentResource modifiedResource = firstOrNullIfEmpty(resourceIdentifiers); Object modified = (modifiedResource == null) ? null : modifiedResource.getObject(); checkFieldAwareDeferPermissions(UpdatePermission.class, fieldName, modified, original); isUpdated = updateToOneRelation(fieldName, resourceIdentifiers, resources); } return isUpdated; } PersistentResource(@NonNull T obj, PersistentResource parent, String id, @NonNull RequestScope scope); @Override String toString(); static PersistentResource<T> createObject(
            PersistentResource<?> parent,
            Class<T> entityClass,
            RequestScope requestScope,
            Optional<String> uuid); @Override boolean matchesId(String checkId); @SuppressWarnings("resource") @NonNull static PersistentResource<T> loadRecord(
            Class<T> loadClass, String id, RequestScope requestScope); static Set<PersistentResource> loadRecords(
            Class<?> loadClass,
            List<String> ids,
            Optional<FilterExpression> filter,
            Optional<Sorting> sorting,
            Optional<Pagination> pagination,
            RequestScope requestScope); boolean updateAttribute(String fieldName, Object newVal); boolean updateRelation(String fieldName, Set<PersistentResource> resourceIdentifiers); boolean clearRelation(String relationName); void removeRelation(String fieldName, PersistentResource removeResource); boolean relationshipAlreadyExists(String fieldName, PersistentResource toAdd); void addRelation(String fieldName, PersistentResource newRelation); void deleteResource(); @Override String getId(); void setId(String id); boolean isIdGenerated(); @Override Optional<String> getUUID(); PersistentResource getRelation(String relation, String id); Set<PersistentResource> getRelation(String relation,
            List<String> ids,
            Optional<FilterExpression> filter,
            Optional<Sorting> sorting,
            Optional<Pagination> pagination); Set<PersistentResource> getRelationCheckedFiltered(String relationName,
            Optional<FilterExpression> filterExpression,
            Optional<Sorting> sorting,
            Optional<Pagination> pagination); RelationshipType getRelationshipType(String relation); Object getAttribute(String attr); @Override T getObject(); void setObject(T obj); @Override @JsonIgnore Class<T> getResourceClass(); @Override String getType(); @Override int hashCode(); @Override boolean equals(Object obj); ResourceLineage getLineage(); EntityDictionary getDictionary(); @Override RequestScope getRequestScope(); Resource toResource(); Resource toResourceWithSortingAndPagination(); Resource toResource(final Supplier<Map<String, Relationship>> relationshipSupplier,
                               final Supplier<Map<String, Object>> attributeSupplier); static Object getValue(Object target, String fieldName, RequestScope requestScope); }
PersistentResource implements com.yahoo.elide.security.PersistentResource<T> { public boolean updateRelation(String fieldName, Set<PersistentResource> resourceIdentifiers) { RelationshipType type = getRelationshipType(fieldName); Set<PersistentResource> resources = filter(ReadPermission.class, Optional.empty(), getRelationUncheckedUnfiltered(fieldName)); boolean isUpdated; if (type.isToMany()) { List<Object> modifiedResources = CollectionUtils.isEmpty(resourceIdentifiers) ? Collections.emptyList() : resourceIdentifiers.stream().map(PersistentResource::getObject).collect(Collectors.toList()); checkFieldAwareDeferPermissions( UpdatePermission.class, fieldName, modifiedResources, resources.stream().map(PersistentResource::getObject).collect(Collectors.toList()) ); isUpdated = updateToManyRelation(fieldName, resourceIdentifiers, resources); } else { PersistentResource resource = firstOrNullIfEmpty(resources); Object original = (resource == null) ? null : resource.getObject(); PersistentResource modifiedResource = firstOrNullIfEmpty(resourceIdentifiers); Object modified = (modifiedResource == null) ? null : modifiedResource.getObject(); checkFieldAwareDeferPermissions(UpdatePermission.class, fieldName, modified, original); isUpdated = updateToOneRelation(fieldName, resourceIdentifiers, resources); } return isUpdated; } PersistentResource(@NonNull T obj, PersistentResource parent, String id, @NonNull RequestScope scope); @Override String toString(); static PersistentResource<T> createObject(
            PersistentResource<?> parent,
            Class<T> entityClass,
            RequestScope requestScope,
            Optional<String> uuid); @Override boolean matchesId(String checkId); @SuppressWarnings("resource") @NonNull static PersistentResource<T> loadRecord(
            Class<T> loadClass, String id, RequestScope requestScope); static Set<PersistentResource> loadRecords(
            Class<?> loadClass,
            List<String> ids,
            Optional<FilterExpression> filter,
            Optional<Sorting> sorting,
            Optional<Pagination> pagination,
            RequestScope requestScope); boolean updateAttribute(String fieldName, Object newVal); boolean updateRelation(String fieldName, Set<PersistentResource> resourceIdentifiers); boolean clearRelation(String relationName); void removeRelation(String fieldName, PersistentResource removeResource); boolean relationshipAlreadyExists(String fieldName, PersistentResource toAdd); void addRelation(String fieldName, PersistentResource newRelation); void deleteResource(); @Override String getId(); void setId(String id); boolean isIdGenerated(); @Override Optional<String> getUUID(); PersistentResource getRelation(String relation, String id); Set<PersistentResource> getRelation(String relation,
            List<String> ids,
            Optional<FilterExpression> filter,
            Optional<Sorting> sorting,
            Optional<Pagination> pagination); Set<PersistentResource> getRelationCheckedFiltered(String relationName,
            Optional<FilterExpression> filterExpression,
            Optional<Sorting> sorting,
            Optional<Pagination> pagination); RelationshipType getRelationshipType(String relation); Object getAttribute(String attr); @Override T getObject(); void setObject(T obj); @Override @JsonIgnore Class<T> getResourceClass(); @Override String getType(); @Override int hashCode(); @Override boolean equals(Object obj); ResourceLineage getLineage(); EntityDictionary getDictionary(); @Override RequestScope getRequestScope(); Resource toResource(); Resource toResourceWithSortingAndPagination(); Resource toResource(final Supplier<Map<String, Relationship>> relationshipSupplier,
                               final Supplier<Map<String, Object>> attributeSupplier); static Object getValue(Object target, String fieldName, RequestScope requestScope);  }