|
@@ -156,7 +156,6 @@ public class AclImplTests {
|
|
|
MutableAcl acl = new AclImpl(this.objectIdentity, 1, this.authzStrategy, this.pgs, null, null, true,
|
|
|
new PrincipalSid("joe"));
|
|
|
MockAclService service = new MockAclService();
|
|
|
-
|
|
|
// Insert one permission
|
|
|
acl.insertAce(0, BasePermission.READ, new GrantedAuthoritySid("ROLE_TEST1"), true);
|
|
|
service.updateAcl(acl);
|
|
@@ -165,7 +164,6 @@ public class AclImplTests {
|
|
|
assertThat(acl).isEqualTo(acl.getEntries().get(0).getAcl());
|
|
|
assertThat(BasePermission.READ).isEqualTo(acl.getEntries().get(0).getPermission());
|
|
|
assertThat(acl.getEntries().get(0).getSid()).isEqualTo(new GrantedAuthoritySid("ROLE_TEST1"));
|
|
|
-
|
|
|
// Add a second permission
|
|
|
acl.insertAce(1, BasePermission.READ, new GrantedAuthoritySid("ROLE_TEST2"), true);
|
|
|
service.updateAcl(acl);
|
|
@@ -174,7 +172,6 @@ public class AclImplTests {
|
|
|
assertThat(acl).isEqualTo(acl.getEntries().get(1).getAcl());
|
|
|
assertThat(BasePermission.READ).isEqualTo(acl.getEntries().get(1).getPermission());
|
|
|
assertThat(acl.getEntries().get(1).getSid()).isEqualTo(new GrantedAuthoritySid("ROLE_TEST2"));
|
|
|
-
|
|
|
// Add a third permission, after the first one
|
|
|
acl.insertAce(1, BasePermission.WRITE, new GrantedAuthoritySid("ROLE_TEST3"), false);
|
|
|
service.updateAcl(acl);
|
|
@@ -193,11 +190,9 @@ public class AclImplTests {
|
|
|
MutableAcl acl = new AclImpl(this.objectIdentity, 1, this.authzStrategy, this.pgs, null, null, true,
|
|
|
new PrincipalSid("joe"));
|
|
|
MockAclService service = new MockAclService();
|
|
|
-
|
|
|
// Insert one permission
|
|
|
acl.insertAce(0, BasePermission.READ, new GrantedAuthoritySid("ROLE_TEST1"), true);
|
|
|
service.updateAcl(acl);
|
|
|
-
|
|
|
acl.insertAce(55, BasePermission.READ, new GrantedAuthoritySid("ROLE_TEST2"), true);
|
|
|
}
|
|
|
|
|
@@ -206,20 +201,17 @@ public class AclImplTests {
|
|
|
MutableAcl acl = new AclImpl(this.objectIdentity, 1, this.authzStrategy, this.pgs, null, null, true,
|
|
|
new PrincipalSid("joe"));
|
|
|
MockAclService service = new MockAclService();
|
|
|
-
|
|
|
// Add several permissions
|
|
|
acl.insertAce(0, BasePermission.READ, new GrantedAuthoritySid("ROLE_TEST1"), true);
|
|
|
acl.insertAce(1, BasePermission.READ, new GrantedAuthoritySid("ROLE_TEST2"), true);
|
|
|
acl.insertAce(2, BasePermission.READ, new GrantedAuthoritySid("ROLE_TEST3"), true);
|
|
|
service.updateAcl(acl);
|
|
|
-
|
|
|
// Delete first permission and check the order of the remaining permissions is
|
|
|
// kept
|
|
|
acl.deleteAce(0);
|
|
|
assertThat(acl.getEntries()).hasSize(2);
|
|
|
assertThat(acl.getEntries().get(0).getSid()).isEqualTo(new GrantedAuthoritySid("ROLE_TEST2"));
|
|
|
assertThat(acl.getEntries().get(1).getSid()).isEqualTo(new GrantedAuthoritySid("ROLE_TEST3"));
|
|
|
-
|
|
|
// Add one more permission and remove the permission in the middle
|
|
|
acl.insertAce(2, BasePermission.READ, new GrantedAuthoritySid("ROLE_TEST4"), true);
|
|
|
service.updateAcl(acl);
|
|
@@ -227,7 +219,6 @@ public class AclImplTests {
|
|
|
assertThat(acl.getEntries()).hasSize(2);
|
|
|
assertThat(acl.getEntries().get(0).getSid()).isEqualTo(new GrantedAuthoritySid("ROLE_TEST2"));
|
|
|
assertThat(acl.getEntries().get(1).getSid()).isEqualTo(new GrantedAuthoritySid("ROLE_TEST4"));
|
|
|
-
|
|
|
// Remove remaining permissions
|
|
|
acl.deleteAce(1);
|
|
|
acl.deleteAce(0);
|
|
@@ -274,17 +265,14 @@ public class AclImplTests {
|
|
|
auth.setAuthenticated(true);
|
|
|
SecurityContextHolder.getContext().setAuthentication(auth);
|
|
|
ObjectIdentity rootOid = new ObjectIdentityImpl(TARGET_CLASS, 100);
|
|
|
-
|
|
|
// Create an ACL which owner is not the authenticated principal
|
|
|
MutableAcl rootAcl = new AclImpl(rootOid, 1, this.authzStrategy, this.pgs, null, null, false,
|
|
|
new PrincipalSid("joe"));
|
|
|
-
|
|
|
// Grant some permissions
|
|
|
rootAcl.insertAce(0, BasePermission.READ, new PrincipalSid("ben"), false);
|
|
|
rootAcl.insertAce(1, BasePermission.WRITE, new PrincipalSid("scott"), true);
|
|
|
rootAcl.insertAce(2, BasePermission.WRITE, new PrincipalSid("rod"), false);
|
|
|
rootAcl.insertAce(3, BasePermission.WRITE, new GrantedAuthoritySid("WRITE_ACCESS_ROLE"), true);
|
|
|
-
|
|
|
// Check permissions granting
|
|
|
List<Permission> permissions = Arrays.asList(BasePermission.READ, BasePermission.CREATE);
|
|
|
List<Sid> sids = Arrays.asList(new PrincipalSid("ben"), new GrantedAuthoritySid("ROLE_GUEST"));
|
|
@@ -320,7 +308,6 @@ public class AclImplTests {
|
|
|
ObjectIdentity parentOid2 = new ObjectIdentityImpl(TARGET_CLASS, 102);
|
|
|
ObjectIdentity childOid1 = new ObjectIdentityImpl(TARGET_CLASS, 103);
|
|
|
ObjectIdentity childOid2 = new ObjectIdentityImpl(TARGET_CLASS, 104);
|
|
|
-
|
|
|
// Create ACLs
|
|
|
PrincipalSid joe = new PrincipalSid("joe");
|
|
|
MutableAcl grandParentAcl = new AclImpl(grandParentOid, 1, this.authzStrategy, this.pgs, null, null, false,
|
|
@@ -329,13 +316,11 @@ public class AclImplTests {
|
|
|
MutableAcl parentAcl2 = new AclImpl(parentOid2, 3, this.authzStrategy, this.pgs, null, null, true, joe);
|
|
|
MutableAcl childAcl1 = new AclImpl(childOid1, 4, this.authzStrategy, this.pgs, null, null, true, joe);
|
|
|
MutableAcl childAcl2 = new AclImpl(childOid2, 4, this.authzStrategy, this.pgs, null, null, false, joe);
|
|
|
-
|
|
|
// Create hierarchies
|
|
|
childAcl2.setParent(childAcl1);
|
|
|
childAcl1.setParent(parentAcl1);
|
|
|
parentAcl2.setParent(grandParentAcl);
|
|
|
parentAcl1.setParent(grandParentAcl);
|
|
|
-
|
|
|
// Add some permissions
|
|
|
grandParentAcl.insertAce(0, BasePermission.READ, new GrantedAuthoritySid("ROLE_USER_READ"), true);
|
|
|
grandParentAcl.insertAce(1, BasePermission.WRITE, new PrincipalSid("ben"), true);
|
|
@@ -345,7 +330,6 @@ public class AclImplTests {
|
|
|
parentAcl1.insertAce(1, BasePermission.DELETE, new PrincipalSid("scott"), false);
|
|
|
parentAcl2.insertAce(0, BasePermission.CREATE, new PrincipalSid("ben"), true);
|
|
|
childAcl1.insertAce(0, BasePermission.CREATE, new PrincipalSid("scott"), true);
|
|
|
-
|
|
|
// Check granting process for parent1
|
|
|
assertThat(parentAcl1.isGranted(READ, SCOTT, false)).isTrue();
|
|
|
assertThat(parentAcl1.isGranted(READ, Arrays.asList((Sid) new GrantedAuthoritySid("ROLE_USER_READ")), false))
|
|
@@ -353,18 +337,15 @@ public class AclImplTests {
|
|
|
assertThat(parentAcl1.isGranted(WRITE, BEN, false)).isTrue();
|
|
|
assertThat(parentAcl1.isGranted(DELETE, BEN, false)).isFalse();
|
|
|
assertThat(parentAcl1.isGranted(DELETE, SCOTT, false)).isFalse();
|
|
|
-
|
|
|
// Check granting process for parent2
|
|
|
assertThat(parentAcl2.isGranted(CREATE, BEN, false)).isTrue();
|
|
|
assertThat(parentAcl2.isGranted(WRITE, BEN, false)).isTrue();
|
|
|
assertThat(parentAcl2.isGranted(DELETE, BEN, false)).isFalse();
|
|
|
-
|
|
|
// Check granting process for child1
|
|
|
assertThat(childAcl1.isGranted(CREATE, SCOTT, false)).isTrue();
|
|
|
assertThat(childAcl1.isGranted(READ, Arrays.asList((Sid) new GrantedAuthoritySid("ROLE_USER_READ")), false))
|
|
|
.isTrue();
|
|
|
assertThat(childAcl1.isGranted(DELETE, BEN, false)).isFalse();
|
|
|
-
|
|
|
// Check granting process for child2 (doesn't inherit the permissions from its
|
|
|
// parent)
|
|
|
try {
|
|
@@ -389,21 +370,17 @@ public class AclImplTests {
|
|
|
MutableAcl acl = new AclImpl(this.objectIdentity, 1, this.authzStrategy, this.pgs, null, null, false,
|
|
|
new PrincipalSid("joe"));
|
|
|
MockAclService service = new MockAclService();
|
|
|
-
|
|
|
acl.insertAce(0, BasePermission.READ, new GrantedAuthoritySid("ROLE_USER_READ"), true);
|
|
|
acl.insertAce(1, BasePermission.WRITE, new GrantedAuthoritySid("ROLE_USER_READ"), true);
|
|
|
acl.insertAce(2, BasePermission.CREATE, new PrincipalSid("ben"), true);
|
|
|
service.updateAcl(acl);
|
|
|
-
|
|
|
assertThat(BasePermission.READ).isEqualTo(acl.getEntries().get(0).getPermission());
|
|
|
assertThat(BasePermission.WRITE).isEqualTo(acl.getEntries().get(1).getPermission());
|
|
|
assertThat(BasePermission.CREATE).isEqualTo(acl.getEntries().get(2).getPermission());
|
|
|
-
|
|
|
// Change each permission
|
|
|
acl.updateAce(0, BasePermission.CREATE);
|
|
|
acl.updateAce(1, BasePermission.DELETE);
|
|
|
acl.updateAce(2, BasePermission.READ);
|
|
|
-
|
|
|
// Check the change was successfully made
|
|
|
assertThat(BasePermission.CREATE).isEqualTo(acl.getEntries().get(0).getPermission());
|
|
|
assertThat(BasePermission.DELETE).isEqualTo(acl.getEntries().get(1).getPermission());
|
|
@@ -418,20 +395,16 @@ public class AclImplTests {
|
|
|
MutableAcl acl = new AclImpl(this.objectIdentity, 1, this.authzStrategy, this.pgs, null, null, false,
|
|
|
new PrincipalSid("joe"));
|
|
|
MockAclService service = new MockAclService();
|
|
|
-
|
|
|
acl.insertAce(0, BasePermission.READ, new GrantedAuthoritySid("ROLE_USER_READ"), true);
|
|
|
acl.insertAce(1, BasePermission.WRITE, new GrantedAuthoritySid("ROLE_USER_READ"), true);
|
|
|
service.updateAcl(acl);
|
|
|
-
|
|
|
assertThat(((AuditableAccessControlEntry) acl.getEntries().get(0)).isAuditFailure()).isFalse();
|
|
|
assertThat(((AuditableAccessControlEntry) acl.getEntries().get(1)).isAuditFailure()).isFalse();
|
|
|
assertThat(((AuditableAccessControlEntry) acl.getEntries().get(0)).isAuditSuccess()).isFalse();
|
|
|
assertThat(((AuditableAccessControlEntry) acl.getEntries().get(1)).isAuditSuccess()).isFalse();
|
|
|
-
|
|
|
// Change each permission
|
|
|
((AuditableAcl) acl).updateAuditing(0, true, true);
|
|
|
((AuditableAcl) acl).updateAuditing(1, true, true);
|
|
|
-
|
|
|
// Check the change was successfuly made
|
|
|
assertThat(acl.getEntries()).extracting("auditSuccess").containsOnly(true, true);
|
|
|
assertThat(acl.getEntries()).extracting("auditFailure").containsOnly(true, true);
|
|
@@ -452,20 +425,16 @@ public class AclImplTests {
|
|
|
acl.insertAce(0, BasePermission.READ, new GrantedAuthoritySid("ROLE_USER_READ"), true);
|
|
|
acl.insertAce(1, BasePermission.WRITE, new GrantedAuthoritySid("ROLE_USER_READ"), true);
|
|
|
service.updateAcl(acl);
|
|
|
-
|
|
|
assertThat(1).isEqualTo(acl.getId());
|
|
|
assertThat(identity).isEqualTo(acl.getObjectIdentity());
|
|
|
assertThat(new PrincipalSid("joe")).isEqualTo(acl.getOwner());
|
|
|
assertThat(acl.getParentAcl()).isNull();
|
|
|
assertThat(acl.isEntriesInheriting()).isTrue();
|
|
|
assertThat(acl.getEntries()).hasSize(2);
|
|
|
-
|
|
|
acl.setParent(parentAcl);
|
|
|
assertThat(parentAcl).isEqualTo(acl.getParentAcl());
|
|
|
-
|
|
|
acl.setEntriesInheriting(false);
|
|
|
assertThat(acl.isEntriesInheriting()).isFalse();
|
|
|
-
|
|
|
acl.setOwner(new PrincipalSid("ben"));
|
|
|
assertThat(new PrincipalSid("ben")).isEqualTo(acl.getOwner());
|
|
|
}
|
|
@@ -475,7 +444,6 @@ public class AclImplTests {
|
|
|
List<Sid> loadedSids = Arrays.asList(new PrincipalSid("ben"), new GrantedAuthoritySid("ROLE_IGNORED"));
|
|
|
MutableAcl acl = new AclImpl(this.objectIdentity, 1, this.authzStrategy, this.pgs, null, loadedSids, true,
|
|
|
new PrincipalSid("joe"));
|
|
|
-
|
|
|
assertThat(acl.isSidLoaded(loadedSids)).isTrue();
|
|
|
assertThat(acl.isSidLoaded(Arrays.asList(new GrantedAuthoritySid("ROLE_IGNORED"), new PrincipalSid("ben"))))
|
|
|
.isTrue();
|
|
@@ -534,7 +502,6 @@ public class AclImplTests {
|
|
|
AclImpl parentAcl = new AclImpl(this.objectIdentity, 1L, this.authzStrategy, this.mockAuditLogger);
|
|
|
AclImpl childAcl = new AclImpl(this.objectIdentity, 2L, this.authzStrategy, this.mockAuditLogger);
|
|
|
AclImpl changeParentAcl = new AclImpl(this.objectIdentity, 3L, this.authzStrategy, this.mockAuditLogger);
|
|
|
-
|
|
|
childAcl.setParent(parentAcl);
|
|
|
childAcl.setParent(changeParentAcl);
|
|
|
}
|
|
@@ -562,10 +529,8 @@ public class AclImplTests {
|
|
|
ObjectIdentity oid = new ObjectIdentityImpl("type", 1);
|
|
|
AclAuthorizationStrategy authStrategy = new AclAuthorizationStrategyImpl(new SimpleGrantedAuthority("role"));
|
|
|
PermissionGrantingStrategy grantingStrategy = new DefaultPermissionGrantingStrategy(new ConsoleAuditLogger());
|
|
|
-
|
|
|
AclImpl acl = new AclImpl(oid, 1L, authStrategy, grantingStrategy, null, null, false, sid);
|
|
|
AccessControlEntryImpl ace = new AccessControlEntryImpl(1L, acl, sid, BasePermission.READ, true, true, true);
|
|
|
-
|
|
|
Field fieldAces = FieldUtils.getField(AclImpl.class, "aces");
|
|
|
fieldAces.setAccessible(true);
|
|
|
List<AccessControlEntryImpl> aces = (List<AccessControlEntryImpl>) fieldAces.get(acl);
|
|
@@ -617,7 +582,6 @@ public class AclImplTests {
|
|
|
try {
|
|
|
newAces = (List) acesField.get(acl);
|
|
|
newAces.clear();
|
|
|
-
|
|
|
for (int i = 0; i < oldAces.size(); i++) {
|
|
|
AccessControlEntry ac = oldAces.get(i);
|
|
|
// Just give an ID to all this acl's aces, rest of the fields are just
|
|
@@ -630,7 +594,6 @@ public class AclImplTests {
|
|
|
catch (IllegalAccessException ex) {
|
|
|
ex.printStackTrace();
|
|
|
}
|
|
|
-
|
|
|
return acl;
|
|
|
}
|
|
|
|