hostsharing/hs.hsadmin.ng
1
0
Fork 0
Code Activity

#112 [RightsModule] use UserRoleAssignments from database

Browse Source
This commit is contained in:
Michael Hoennig
2019-05-10 11:18:15 +02:00
parent 01d28a85d4
commit 72e79e2134
36 changed files with 680 additions and 289 deletions
Download Patch File Download Diff File Expand all files Collapse all files

95
src/test/java/org/hostsharing/hsadminng/service/UserRoleAssignmentServiceUnitTest.java Normal file
View File

@@ -0,0 +1,95 @@
// Licensed under Apache-2.0
package org.hostsharing.hsadminng.service;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.catchThrowable;
import static org.mockito.BDDMockito.given;
import org.hostsharing.hsadminng.domain.UserRoleAssignment;
import org.hostsharing.hsadminng.repository.UserRoleAssignmentRepository;
import org.hostsharing.hsadminng.service.accessfilter.MockSecurityContext;
import org.hostsharing.hsadminng.service.accessfilter.Role;
import com.google.common.base.VerifyException;
import org.junit.Rule;
import org.junit.Test;
import org.mockito.InjectMocks;
import org.mockito.Mock;
import org.mockito.junit.MockitoJUnit;
import org.mockito.junit.MockitoRule;
import java.util.Arrays;
import java.util.Set;
public class UserRoleAssignmentServiceUnitTest {
@Rule
public MockitoRule mockitoRule = MockitoJUnit.rule();
@Mock
private UserRoleAssignmentRepository userRoleAssignmentRepository;
@InjectMocks
private UserRoleAssignmentService userRoleAssignmentService;
@Test
public void getEffectiveRoleOfCurrentUserReturnsEmptySetIfUserNotAuthenticated() {
// when
final Set<Role> actual = userRoleAssignmentService.getEffectiveRoleOfCurrentUser("test.Something", 1L);
// then
assertThat(actual).isEmpty();
}
@Test
public void getEffectiveRoleOfCurrentUserReturnsEmptySetIfUserAuthenticatedButNoRolesAssigned() {
// given
new MockSecurityContext().havingAuthenticatedUser();
// when
final Set<Role> actual = userRoleAssignmentService.getEffectiveRoleOfCurrentUser("test.Something", 1L);
// then
assertThat(actual).isEmpty();
}
@Test
public void getEffectiveRoleOfCurrentUserReturnsExactlyAssignedRoles() {
// given
final String givenUserLogin = "someUser";
new MockSecurityContext().havingAuthenticatedUser(givenUserLogin);
final long givenEntityObjectId = 2L;
final String givenEntityTypeId = "test.Something";
given(userRoleAssignmentRepository.findByLogin(givenUserLogin)).willReturn(
Arrays.asList(
new UserRoleAssignment().entityTypeId("test.SomethingElse")
.entityObjectId(givenEntityObjectId)
.assignedRole(Role.CONTRACTUAL_CONTACT),
new UserRoleAssignment().entityTypeId(givenEntityTypeId)
.entityObjectId(givenEntityObjectId)
.assignedRole(Role.FINANCIAL_CONTACT),
new UserRoleAssignment().entityTypeId(givenEntityTypeId)
.entityObjectId(givenEntityObjectId)
.assignedRole(Role.TECHNICAL_CONTACT),
new UserRoleAssignment().entityTypeId(givenEntityTypeId)
.entityObjectId(3L)
.assignedRole(Role.CONTRACTUAL_CONTACT)));
// when
final Set<Role> actual = userRoleAssignmentService
.getEffectiveRoleOfCurrentUser(givenEntityTypeId, givenEntityObjectId);
// then
assertThat(actual).containsExactlyInAnyOrder(Role.FINANCIAL_CONTACT, Role.TECHNICAL_CONTACT);
}
@Test
public void getEffectiveRoleOfCurrentUserThrowsExceptionIfEntityTypeIdIsMissing() {
// when
final Throwable actual = catchThrowable(() -> userRoleAssignmentService.getEffectiveRoleOfCurrentUser(null, 1L));
// then
assertThat(actual).isInstanceOf(VerifyException.class);
}
}

2
src/test/java/org/hostsharing/hsadminng/service/accessfilter/JSonAccessFilterTestFixture.java
View File

@@ -33,6 +33,7 @@ public class JSonAccessFilterTestFixture {
return dto;
}
@EntityTypeId("test.GivenCustomer")
static class GivenCustomerDto implements FluentBuilder<GivenCustomerDto> {
@SelfId(resolver = GivenService.class)
@@ -47,6 +48,7 @@ public class JSonAccessFilterTestFixture {
static abstract class GivenCustomerService implements IdToDtoResolver<GivenCustomerDto> {
}
@EntityTypeId("test.Given")
static class GivenDto implements FluentBuilder<GivenDto> {
@SelfId(resolver = GivenService.class)

147
src/test/java/org/hostsharing/hsadminng/service/accessfilter/JSonDeserializationWithAccessFilterUnitTest.java
View File

@@ -6,10 +6,9 @@ import static org.assertj.core.api.Assertions.catchThrowable;
import static org.assertj.core.api.Assumptions.assumeThat;
import static org.hostsharing.hsadminng.service.accessfilter.JSonAccessFilterTestFixture.*;
import static org.hostsharing.hsadminng.service.accessfilter.JSonBuilder.asJSon;
import static org.hostsharing.hsadminng.service.accessfilter.MockSecurityContext.givenAuthenticatedUser;
import static org.hostsharing.hsadminng.service.accessfilter.MockSecurityContext.givenUserHavingRole;
import static org.mockito.BDDMockito.given;
import org.hostsharing.hsadminng.service.UserRoleAssignmentService;
import org.hostsharing.hsadminng.web.rest.errors.BadRequestAlertException;
import com.fasterxml.jackson.core.JsonParser;
@@ -61,6 +60,9 @@ public class JSonDeserializationWithAccessFilterUnitTest {
@Mock
private TreeNode treeNode;
@Mock
private UserRoleAssignmentService userRoleAssignmentService;
@Mock
private GivenService givenService;
@@ -70,10 +72,12 @@ public class JSonDeserializationWithAccessFilterUnitTest {
@Mock
private GivenCustomerService givenCustomerService;
private MockSecurityContext givenSecurityContext;
@Before
public void init() {
givenAuthenticatedUser();
givenUserHavingRole(GivenDto.class, 1234L, Role.ACTUAL_CUSTOMER_USER);
givenSecurityContext = new MockSecurityContext(userRoleAssignmentService);
givenSecurityContext.havingAuthenticatedUser().withRole(GivenDto.class, 1234L, Role.ACTUAL_CUSTOMER_USER);
given(ctx.getAutowireCapableBeanFactory()).willReturn(autowireCapableBeanFactory);
given(autowireCapableBeanFactory.createBean(GivenService.class)).willReturn(givenService);
@@ -113,7 +117,12 @@ public class JSonDeserializationWithAccessFilterUnitTest {
ImmutablePair.of("openStringField", null)));
// when
GivenDto actualDto = new JSonDeserializationWithAccessFilter<>(ctx, jsonParser, null, GivenDto.class).deserialize();
GivenDto actualDto = new JSonDeserializationWithAccessFilter<>(
ctx,
userRoleAssignmentService,
jsonParser,
null,
GivenDto.class).deserialize();
// then
assertThat(actualDto.openStringField).isNull();
@@ -129,7 +138,12 @@ public class JSonDeserializationWithAccessFilterUnitTest {
ImmutablePair.of("openStringField", "String Value")));
// when
GivenDto actualDto = new JSonDeserializationWithAccessFilter<>(ctx, jsonParser, null, GivenDto.class).deserialize();
GivenDto actualDto = new JSonDeserializationWithAccessFilter<>(
ctx,
userRoleAssignmentService,
jsonParser,
null,
GivenDto.class).deserialize();
// then
assertThat(actualDto.openStringField).isEqualTo("String Value");
@@ -145,7 +159,12 @@ public class JSonDeserializationWithAccessFilterUnitTest {
ImmutablePair.of("openIntegerField", 1234)));
// when
GivenDto actualDto = new JSonDeserializationWithAccessFilter<>(ctx, jsonParser, null, GivenDto.class).deserialize();
GivenDto actualDto = new JSonDeserializationWithAccessFilter<>(
ctx,
userRoleAssignmentService,
jsonParser,
null,
GivenDto.class).deserialize();
// then
assertThat(actualDto.openIntegerField).isEqualTo(1234);
@@ -162,7 +181,12 @@ public class JSonDeserializationWithAccessFilterUnitTest {
ImmutablePair.of("restrictedBigDecimalField", SOME_BIG_DECIMAL_WITH_ANOTHER_SCALE)));
// when
GivenDto actualDto = new JSonDeserializationWithAccessFilter<>(ctx, jsonParser, null, GivenDto.class).deserialize();
GivenDto actualDto = new JSonDeserializationWithAccessFilter<>(
ctx,
userRoleAssignmentService,
jsonParser,
null,
GivenDto.class).deserialize();
// then
assertThat(actualDto.restrictedBigDecimalField).isEqualByComparingTo(SOME_BIG_DECIMAL);
@@ -192,7 +216,12 @@ public class JSonDeserializationWithAccessFilterUnitTest {
ImmutablePair.of("openEnumField", TestEnum.GREEN)));
// when
GivenDto actualDto = new JSonDeserializationWithAccessFilter<>(ctx, jsonParser, null, GivenDto.class).deserialize();
GivenDto actualDto = new JSonDeserializationWithAccessFilter<>(
ctx,
userRoleAssignmentService,
jsonParser,
null,
GivenDto.class).deserialize();
// then
assertThat(actualDto.openIntegerField).isEqualTo(11);
@@ -218,7 +247,12 @@ public class JSonDeserializationWithAccessFilterUnitTest {
// when
Throwable exception = catchThrowable(
() -> new JSonDeserializationWithAccessFilter<>(ctx, jsonParser, null, GivenDto.class).deserialize());
() -> new JSonDeserializationWithAccessFilter<>(
ctx,
userRoleAssignmentService,
jsonParser,
null,
GivenDto.class).deserialize());
// then
assertThat(exception).isInstanceOf(NotImplementedException.class);
@@ -227,8 +261,7 @@ public class JSonDeserializationWithAccessFilterUnitTest {
@Test
public void shouldDeserializeStringFieldIfRequiredRoleIsCoveredByUser() throws IOException {
// given
givenAuthenticatedUser();
givenUserHavingRole(GivenCustomerDto.class, 888L, Role.FINANCIAL_CONTACT);
givenSecurityContext.havingAuthenticatedUser().withRole(GivenCustomerDto.class, 888L, Role.FINANCIAL_CONTACT);
givenJSonTree(
asJSon(
ImmutablePair.of("id", 1234L),
@@ -236,7 +269,12 @@ public class JSonDeserializationWithAccessFilterUnitTest {
ImmutablePair.of("restrictedField", "update value of restricted field")));
// when
GivenDto actualDto = new JSonDeserializationWithAccessFilter<>(ctx, jsonParser, null, GivenDto.class).deserialize();
GivenDto actualDto = new JSonDeserializationWithAccessFilter<>(
ctx,
userRoleAssignmentService,
jsonParser,
null,
GivenDto.class).deserialize();
// then
assertThat(actualDto.restrictedField).isEqualTo("update value of restricted field");
@@ -245,8 +283,7 @@ public class JSonDeserializationWithAccessFilterUnitTest {
@Test
public void shouldDeserializeUnchangedStringFieldIfRequiredRoleIsNotCoveredByUser() throws IOException {
// given
givenAuthenticatedUser();
givenUserHavingRole(GivenCustomerDto.class, 888L, Role.ACTUAL_CUSTOMER_USER);
givenSecurityContext.havingAuthenticatedUser().withRole(GivenCustomerDto.class, 888L, Role.ACTUAL_CUSTOMER_USER);
givenJSonTree(
asJSon(
ImmutablePair.of("id", 1234L),
@@ -254,7 +291,12 @@ public class JSonDeserializationWithAccessFilterUnitTest {
ImmutablePair.of("restrictedField", "initial value of restricted field")));
// when
GivenDto actualDto = new JSonDeserializationWithAccessFilter<>(ctx, jsonParser, null, GivenDto.class).deserialize();
GivenDto actualDto = new JSonDeserializationWithAccessFilter<>(
ctx,
userRoleAssignmentService,
jsonParser,
null,
GivenDto.class).deserialize();
// then
assertThat(actualDto.restrictedField).isEqualTo("initial value of restricted field");
@@ -263,8 +305,7 @@ public class JSonDeserializationWithAccessFilterUnitTest {
@Test
public void shouldNotDeserializeUpatedStringFieldIfRequiredRoleIsNotCoveredByUser() throws IOException {
// given
givenAuthenticatedUser();
givenUserHavingRole(GivenCustomerDto.class, 888L, Role.ACTUAL_CUSTOMER_USER);
givenSecurityContext.havingAuthenticatedUser().withRole(GivenCustomerDto.class, 888L, Role.ACTUAL_CUSTOMER_USER);
givenJSonTree(
asJSon(
ImmutablePair.of("customerId", 888L),
@@ -272,7 +313,12 @@ public class JSonDeserializationWithAccessFilterUnitTest {
// when
Throwable exception = catchThrowable(
() -> new JSonDeserializationWithAccessFilter<>(ctx, jsonParser, null, GivenDto.class).deserialize());
() -> new JSonDeserializationWithAccessFilter<>(
ctx,
userRoleAssignmentService,
jsonParser,
null,
GivenDto.class).deserialize());
// then
assertThat(exception).isInstanceOfSatisfying(BadRequestAlertException.class, badRequestAlertException -> {
@@ -284,8 +330,7 @@ public class JSonDeserializationWithAccessFilterUnitTest {
@Test
public void shouldInitializeFieldIfRequiredRoleIsNotCoveredByUser() throws IOException {
// given
givenAuthenticatedUser();
givenUserHavingRole(GivenCustomerDto.class, 888L, Role.ACTUAL_CUSTOMER_USER);
givenSecurityContext.havingAuthenticatedUser().withRole(GivenCustomerDto.class, 888L, Role.ACTUAL_CUSTOMER_USER);
givenJSonTree(
asJSon(
ImmutablePair.of("customerId", 888L),
@@ -293,7 +338,12 @@ public class JSonDeserializationWithAccessFilterUnitTest {
// when
Throwable exception = catchThrowable(
() -> new JSonDeserializationWithAccessFilter<>(ctx, jsonParser, null, GivenDto.class).deserialize());
() -> new JSonDeserializationWithAccessFilter<>(
ctx,
userRoleAssignmentService,
jsonParser,
null,
GivenDto.class).deserialize());
// then
assertThat(exception).isInstanceOfSatisfying(BadRequestAlertException.class, badRequestAlertException -> {
@@ -305,15 +355,19 @@ public class JSonDeserializationWithAccessFilterUnitTest {
@Test
public void shouldNotCreateIfRoleRequiredByParentEntityIsNotCoveredByUser() throws IOException {
// given
givenAuthenticatedUser();
givenUserHavingRole(GivenDto.class, 9999L, Role.CONTRACTUAL_CONTACT);
givenSecurityContext.havingAuthenticatedUser().withRole(GivenCustomerDto.class, 9999L, Role.CONTRACTUAL_CONTACT);
givenJSonTree(
asJSon(
ImmutablePair.of("parentId", 1234L)));
// when
Throwable exception = catchThrowable(
() -> new JSonDeserializationWithAccessFilter<>(ctx, jsonParser, null, GivenChildDto.class).deserialize());
() -> new JSonDeserializationWithAccessFilter<>(
ctx,
userRoleAssignmentService,
jsonParser,
null,
GivenChildDto.class).deserialize());
// then
assertThat(exception).isInstanceOfSatisfying(BadRequestAlertException.class, badRequestAlertException -> {
@@ -325,15 +379,19 @@ public class JSonDeserializationWithAccessFilterUnitTest {
@Test
public void shouldCreateIfRoleRequiredByReferencedEntityIsCoveredByUser() throws IOException {
// given
givenAuthenticatedUser();
givenUserHavingRole(GivenDto.class, 1234L, Role.CONTRACTUAL_CONTACT);
givenSecurityContext.havingAuthenticatedUser().withRole(GivenCustomerDto.class, 888L, Role.CONTRACTUAL_CONTACT);
givenJSonTree(
asJSon(
ImmutablePair.of("parentId", 1234L)));
// when
final GivenChildDto actualDto = new JSonDeserializationWithAccessFilter<>(ctx, jsonParser, null, GivenChildDto.class)
.deserialize();
final GivenChildDto actualDto = new JSonDeserializationWithAccessFilter<>(
ctx,
userRoleAssignmentService,
jsonParser,
null,
GivenChildDto.class)
.deserialize();
// then
assertThat(actualDto.parentId).isEqualTo(1234L);
@@ -342,8 +400,7 @@ public class JSonDeserializationWithAccessFilterUnitTest {
@Test
public void shouldNotUpdateFieldIfRequiredRoleIsNotCoveredByUser() throws IOException {
// given
givenAuthenticatedUser();
givenUserHavingRole(GivenCustomerDto.class, 888L, Role.ACTUAL_CUSTOMER_USER);
givenSecurityContext.havingAuthenticatedUser().withRole(GivenCustomerDto.class, 888L, Role.ACTUAL_CUSTOMER_USER);
givenJSonTree(
asJSon(
ImmutablePair.of("id", 1234L),
@@ -352,7 +409,12 @@ public class JSonDeserializationWithAccessFilterUnitTest {
// when
Throwable exception = catchThrowable(
() -> new JSonDeserializationWithAccessFilter<>(ctx, jsonParser, null, GivenDto.class).deserialize());
() -> new JSonDeserializationWithAccessFilter<>(
ctx,
userRoleAssignmentService,
jsonParser,
null,
GivenDto.class).deserialize());
// then
assertThat(exception).isInstanceOfSatisfying(BadRequestAlertException.class, badRequestAlertException -> {
@@ -368,8 +430,13 @@ public class JSonDeserializationWithAccessFilterUnitTest {
// when
Throwable exception = catchThrowable(
() -> new JSonDeserializationWithAccessFilter<>(ctx, jsonParser, null, GivenDtoWithMultipleSelfId.class)
.deserialize());
() -> new JSonDeserializationWithAccessFilter<>(
ctx,
userRoleAssignmentService,
jsonParser,
null,
GivenDtoWithMultipleSelfId.class)
.deserialize());
// then
assertThat(exception).isInstanceOf(AssertionError.class)
@@ -379,14 +446,18 @@ public class JSonDeserializationWithAccessFilterUnitTest {
@Test
public void shouldDetectUnknownFieldType() throws IOException {
// given
givenAuthenticatedUser();
givenUserHavingRole(Role.ADMIN);
givenSecurityContext.havingAuthenticatedUser().withRole(Role.ADMIN);
givenJSonTree(asJSon(ImmutablePair.of("unknown", new Arbitrary())));
// when
Throwable exception = catchThrowable(
() -> new JSonDeserializationWithAccessFilter<>(ctx, jsonParser, null, GivenDtoWithUnknownFieldType.class)
.deserialize());
() -> new JSonDeserializationWithAccessFilter<>(
ctx,
userRoleAssignmentService,
jsonParser,
null,
GivenDtoWithUnknownFieldType.class)
.deserialize());
// then
assertThat(exception).isInstanceOf(NotImplementedException.class)

50
src/test/java/org/hostsharing/hsadminng/service/accessfilter/JSonSerializationWithAccessFilterUnitTest.java
View File

@@ -8,6 +8,8 @@ import static org.mockito.BDDMockito.given;
import static org.mockito.Mockito.never;
import static org.mockito.Mockito.verify;
import org.hostsharing.hsadminng.service.UserRoleAssignmentService;
import com.fasterxml.jackson.core.JsonGenerator;
import org.apache.commons.lang3.NotImplementedException;
@@ -37,15 +39,20 @@ public class JSonSerializationWithAccessFilterUnitTest {
@Mock
private JsonGenerator jsonGenerator;
@Mock
private UserRoleAssignmentService userRoleAssignmentService;
@Mock
private GivenCustomerService givenCustomerService;
private MockSecurityContext securityContext;
private final GivenDto givenDTO = createSampleDto();
@Before
public void init() {
MockSecurityContext.givenAuthenticatedUser();
MockSecurityContext.givenUserHavingRole(GivenCustomerDto.class, 888L, Role.ANY_CUSTOMER_USER);
securityContext = new MockSecurityContext(userRoleAssignmentService).havingAuthenticatedUser()
.withRole(GivenCustomerDto.class, 888L, Role.ANY_CUSTOMER_USER);
given(ctx.getAutowireCapableBeanFactory()).willReturn(autowireCapableBeanFactory);
given(autowireCapableBeanFactory.createBean(GivenCustomerService.class)).willReturn(givenCustomerService);
@@ -58,7 +65,7 @@ public class JSonSerializationWithAccessFilterUnitTest {
@Test
public void shouldSerializeStringField() throws IOException {
// when
new JSonSerializationWithAccessFilter<>(ctx, jsonGenerator, null, givenDTO).serialize();
new JSonSerializationWithAccessFilter<>(ctx, userRoleAssignmentService, jsonGenerator, null, givenDTO).serialize();
// then
verify(jsonGenerator).writeStringField("openStringField", givenDTO.openStringField);
@@ -67,7 +74,7 @@ public class JSonSerializationWithAccessFilterUnitTest {
@Test
public void shouldSerializeIntegerField() throws IOException {
// when
new JSonSerializationWithAccessFilter<>(ctx, jsonGenerator, null, givenDTO).serialize();
new JSonSerializationWithAccessFilter<>(ctx, userRoleAssignmentService, jsonGenerator, null, givenDTO).serialize();
// then
verify(jsonGenerator).writeNumberField("openIntegerField", givenDTO.openIntegerField);
@@ -76,7 +83,7 @@ public class JSonSerializationWithAccessFilterUnitTest {
@Test
public void shouldSerializePrimitiveIntField() throws IOException {
// when
new JSonSerializationWithAccessFilter<>(ctx, jsonGenerator, null, givenDTO).serialize();
new JSonSerializationWithAccessFilter<>(ctx, userRoleAssignmentService, jsonGenerator, null, givenDTO).serialize();
// then
verify(jsonGenerator).writeNumberField("openPrimitiveIntField", givenDTO.openPrimitiveIntField);
@@ -85,7 +92,7 @@ public class JSonSerializationWithAccessFilterUnitTest {
@Test
public void shouldSerializeLongField() throws IOException {
// when
new JSonSerializationWithAccessFilter<>(ctx, jsonGenerator, null, givenDTO).serialize();
new JSonSerializationWithAccessFilter<>(ctx, userRoleAssignmentService, jsonGenerator, null, givenDTO).serialize();
// then
verify(jsonGenerator).writeNumberField("openLongField", givenDTO.openLongField);
@@ -94,7 +101,7 @@ public class JSonSerializationWithAccessFilterUnitTest {
@Test
public void shouldSerializePrimitiveLongField() throws IOException {
// when
new JSonSerializationWithAccessFilter<>(ctx, jsonGenerator, null, givenDTO).serialize();
new JSonSerializationWithAccessFilter<>(ctx, userRoleAssignmentService, jsonGenerator, null, givenDTO).serialize();
// then
verify(jsonGenerator).writeNumberField("openPrimitiveLongField", givenDTO.openPrimitiveLongField);
@@ -103,7 +110,7 @@ public class JSonSerializationWithAccessFilterUnitTest {
@Test
public void shouldSerializeBooleanField() throws IOException {
// when
new JSonSerializationWithAccessFilter<>(ctx, jsonGenerator, null, givenDTO).serialize();
new JSonSerializationWithAccessFilter<>(ctx, userRoleAssignmentService, jsonGenerator, null, givenDTO).serialize();
// then
verify(jsonGenerator).writeBooleanField("openBooleanField", givenDTO.openBooleanField);
@@ -112,7 +119,7 @@ public class JSonSerializationWithAccessFilterUnitTest {
@Test
public void shouldSerializePrimitiveBooleanField() throws IOException {
// when
new JSonSerializationWithAccessFilter<>(ctx, jsonGenerator, null, givenDTO).serialize();
new JSonSerializationWithAccessFilter<>(ctx, userRoleAssignmentService, jsonGenerator, null, givenDTO).serialize();
// then
verify(jsonGenerator).writeBooleanField("openPrimitiveBooleanField", givenDTO.openPrimitiveBooleanField);
@@ -121,7 +128,7 @@ public class JSonSerializationWithAccessFilterUnitTest {
@Test
public void shouldSerializeBigDecimalField() throws IOException {
// when
new JSonSerializationWithAccessFilter<>(ctx, jsonGenerator, null, givenDTO).serialize();
new JSonSerializationWithAccessFilter<>(ctx, userRoleAssignmentService, jsonGenerator, null, givenDTO).serialize();
// then
verify(jsonGenerator).writeNumberField("openBigDecimalField", givenDTO.openBigDecimalField);
@@ -130,7 +137,7 @@ public class JSonSerializationWithAccessFilterUnitTest {
@Test
public void shouldSerializeLocalDateField() throws IOException {
// when
new JSonSerializationWithAccessFilter<>(ctx, jsonGenerator, null, givenDTO).serialize();
new JSonSerializationWithAccessFilter<>(ctx, userRoleAssignmentService, jsonGenerator, null, givenDTO).serialize();
// then
verify(jsonGenerator).writeStringField("openLocalDateField", givenDTO.openLocalDateFieldAsString);
@@ -139,7 +146,7 @@ public class JSonSerializationWithAccessFilterUnitTest {
@Test
public void shouldSerializeEnumField() throws IOException {
// when
new JSonSerializationWithAccessFilter<>(ctx, jsonGenerator, null, givenDTO).serialize();
new JSonSerializationWithAccessFilter<>(ctx, userRoleAssignmentService, jsonGenerator, null, givenDTO).serialize();
// then
verify(jsonGenerator).writeStringField("openEnumField", givenDTO.openEnumFieldAsString);
@@ -149,11 +156,10 @@ public class JSonSerializationWithAccessFilterUnitTest {
public void shouldSerializeRestrictedFieldIfRequiredRoleIsCoveredByUser() throws IOException {
// given
MockSecurityContext.givenAuthenticatedUser();
MockSecurityContext.givenUserHavingRole(GivenCustomerDto.class, 888L, Role.FINANCIAL_CONTACT);
securityContext.havingAuthenticatedUser().withRole(GivenCustomerDto.class, 888L, Role.FINANCIAL_CONTACT);
// when
new JSonSerializationWithAccessFilter<>(ctx, jsonGenerator, null, givenDTO).serialize();
new JSonSerializationWithAccessFilter<>(ctx, userRoleAssignmentService, jsonGenerator, null, givenDTO).serialize();
// then
verify(jsonGenerator).writeStringField("restrictedField", givenDTO.restrictedField);
@@ -163,11 +169,10 @@ public class JSonSerializationWithAccessFilterUnitTest {
public void shouldNotSerializeRestrictedFieldIfRequiredRoleIsNotCoveredByUser() throws IOException {
// given
MockSecurityContext.givenAuthenticatedUser();
MockSecurityContext.givenUserHavingRole(GivenCustomerDto.class, 888L, Role.ANY_CUSTOMER_USER);
securityContext.havingAuthenticatedUser().withRole(GivenCustomerDto.class, 888L, Role.ANY_CUSTOMER_USER);
// when
new JSonSerializationWithAccessFilter<>(ctx, jsonGenerator, null, givenDTO).serialize();
new JSonSerializationWithAccessFilter<>(ctx, userRoleAssignmentService, jsonGenerator, null, givenDTO).serialize();
// then
verify(jsonGenerator, never()).writeStringField("restrictedField", givenDTO.restrictedField);
@@ -188,8 +193,13 @@ public class JSonSerializationWithAccessFilterUnitTest {
// when
final Throwable actual = catchThrowable(
() -> new JSonSerializationWithAccessFilter<>(ctx, jsonGenerator, null, givenDtoWithUnimplementedFieldType)
.serialize());
() -> new JSonSerializationWithAccessFilter<>(
ctx,
userRoleAssignmentService,
jsonGenerator,
null,
givenDtoWithUnimplementedFieldType)
.serialize());
// then
assertThat(actual).isInstanceOf(NotImplementedException.class);

86
src/test/java/org/hostsharing/hsadminng/service/accessfilter/MockSecurityContext.java
View File

@@ -2,33 +2,95 @@
package org.hostsharing.hsadminng.service.accessfilter;
import static org.assertj.core.api.Assumptions.assumeThat;
import static org.mockito.BDDMockito.given;
import org.hostsharing.hsadminng.security.SecurityUtils;
import org.hostsharing.hsadminng.service.UserRoleAssignmentService;
import org.mockito.Mockito;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextHolder;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collection;
import java.util.HashSet;
public class MockSecurityContext {
public static void givenAuthenticatedUser() {
private final UserRoleAssignmentService userRoleAssignmentService;
private final Collection<GrantedAuthority> authorities;
// TODO mhoennig: refactor this ctor to method withMock(...) returning a subclass to avoid null checks
public MockSecurityContext(final UserRoleAssignmentService userRoleAssignmentService) {
this.userRoleAssignmentService = userRoleAssignmentService;
this.authorities = new ArrayList<>();
}
public MockSecurityContext() {
this(null);
}
public MockSecurityContext havingAuthenticatedUser() {
return havingAuthenticatedUser("dummyUser");
}
public MockSecurityContext havingAuthenticatedUser(final String login) {
SecurityContext securityContext = SecurityContextHolder.createEmptyContext();
securityContext.setAuthentication(new UsernamePasswordAuthenticationToken("dummyUser", "dummyPassword"));
securityContext.setAuthentication(new UsernamePasswordAuthenticationToken(login, "dummyPassword") {
@Override
public Collection<GrantedAuthority> getAuthorities() {
return authorities;
}
});
SecurityContextHolder.setContext(securityContext);
SecurityUtils.clearUserRoles();
assumeThat(SecurityUtils.getCurrentUserLogin()).hasValue("dummyUser");
}
public static void givenUserHavingRole(final Class<?> onClass, final Long onId, final Role role) {
if ((onClass == null || onId == null) && !role.isIndependent()) {
throw new IllegalArgumentException("dependent role " + role + " needs DtoClass and ID");
assumeThat(SecurityUtils.getCurrentUserLogin()).hasValue(login);
if (userRoleAssignmentService != null) {
Mockito.reset(userRoleAssignmentService);
}
SecurityUtils.addUserRole(onClass, onId, role);
authorities.clear();
return this;
}
public static void givenUserHavingRole(final Role role) {
givenUserHavingRole(null, null, role);
public MockSecurityContext withRole(final Class<?> onClass, final Long onId, final Role... roles) {
if (userRoleAssignmentService == null) {
throw new IllegalStateException("mock not registered for: " + UserRoleAssignmentService.class.getSimpleName());
}
final EntityTypeId entityTypeId = onClass.getAnnotation(EntityTypeId.class);
assumeThat(entityTypeId).as("@" + EntityTypeId.class.getSimpleName() + " missing on class " + onClass.toString())
.isNotNull();
given(userRoleAssignmentService.getEffectiveRoleOfCurrentUser(entityTypeId.value(), onId))
.willReturn(new HashSet(Arrays.asList(roles)));
return this;
}
public MockSecurityContext withRole(final Role role) {
authorities.add(new GrantedAuthority() {
@Override
public String getAuthority() {
return role.asAuthority();
}
});
return this;
}
private static class FakePrincipal {
private final String username;
public FakePrincipal(final String username) {
this.username = username;
}
@Override
public String toString() {
return username;
}
}
}

8
src/test/java/org/hostsharing/hsadminng/service/accessfilter/RoleUnitTest.java
View File

@@ -123,6 +123,14 @@ public class RoleUnitTest {
assertThat(Role.ANY_CUSTOMER_USER.isIndependent()).isFalse();
}
@Test
public void asAuthority() {
assertThat(Role.HOSTMASTER.asAuthority()).isEqualTo("ROLE_HOSTMASTER");
assertThat(Role.ADMIN.asAuthority()).isEqualTo("ROLE_ADMIN");
assertThat(Role.SUPPORTER.asAuthority()).isEqualTo("ROLE_SUPPORTER");
assertThat(Role.CONTRACTUAL_CONTACT.asAuthority()).isEqualTo("ROLE_USER");
}
@Test
public void isBroadest() {
assertThat(Role.broadest(Role.HOSTMASTER, Role.CONTRACTUAL_CONTACT)).isEqualTo(Role.HOSTMASTER);

26
src/test/java/org/hostsharing/hsadminng/service/dto/AssetDTOIntTest.java
View File

@@ -3,8 +3,6 @@ package org.hostsharing.hsadminng.service.dto;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.catchThrowable;
import static org.hostsharing.hsadminng.service.accessfilter.MockSecurityContext.givenAuthenticatedUser;
import static org.hostsharing.hsadminng.service.accessfilter.MockSecurityContext.givenUserHavingRole;
import static org.junit.Assert.assertEquals;
import static org.mockito.BDDMockito.given;
@@ -18,7 +16,9 @@ import org.hostsharing.hsadminng.repository.MembershipRepository;
import org.hostsharing.hsadminng.service.AssetService;
import org.hostsharing.hsadminng.service.AssetValidator;
import org.hostsharing.hsadminng.service.MembershipValidator;
import org.hostsharing.hsadminng.service.UserRoleAssignmentService;
import org.hostsharing.hsadminng.service.accessfilter.JSonBuilder;
import org.hostsharing.hsadminng.service.accessfilter.MockSecurityContext;
import org.hostsharing.hsadminng.service.accessfilter.Role;
import org.hostsharing.hsadminng.service.mapper.AssetMapper;
import org.hostsharing.hsadminng.service.mapper.AssetMapperImpl;
@@ -110,19 +110,25 @@ public class AssetDTOIntTest {
@MockBean
private EntityManager em;
@MockBean
private UserRoleAssignmentService userRoleAssignmentService;
private MockSecurityContext securityContext;
@Before
public void init() {
given(customerRepository.findById(SOME_CUSTOMER_ID)).willReturn(Optional.of(SOME_CUSTOMER));
given(membershipRepository.findById(SOME_MEMBERSHIP_ID)).willReturn(Optional.of(SOME_MEMBERSHIP));
given(assetRepository.findById(SOME_ASSET_ID)).willReturn((Optional.of(SOME_ASSET)));
securityContext = new MockSecurityContext(userRoleAssignmentService);
}
@Test
public void shouldSerializePartiallyForFinancialCustomerContact() throws JsonProcessingException {
// given
givenAuthenticatedUser();
givenUserHavingRole(CustomerDTO.class, SOME_CUSTOMER_ID, Role.FINANCIAL_CONTACT);
securityContext.havingAuthenticatedUser().withRole(CustomerDTO.class, SOME_CUSTOMER_ID, Role.FINANCIAL_CONTACT);
final AssetDTO given = createSomeAssetDTO(SOME_ASSET_ID);
// when
@@ -137,8 +143,7 @@ public class AssetDTOIntTest {
public void shouldSerializeCompletelyForSupporter() throws JsonProcessingException {
// given
givenAuthenticatedUser();
givenUserHavingRole(Role.SUPPORTER);
securityContext.havingAuthenticatedUser().withRole(Role.SUPPORTER);
final AssetDTO given = createSomeAssetDTO(SOME_ASSET_ID);
// when
@@ -151,8 +156,7 @@ public class AssetDTOIntTest {
@Test
public void shouldNotDeserializeForContractualCustomerContact() {
// given
givenAuthenticatedUser();
givenUserHavingRole(CustomerDTO.class, SOME_CUSTOMER_ID, Role.CONTRACTUAL_CONTACT);
securityContext.havingAuthenticatedUser().withRole(CustomerDTO.class, SOME_CUSTOMER_ID, Role.CONTRACTUAL_CONTACT);
final String json = new JSonBuilder()
.withFieldValue("id", SOME_ASSET_ID)
.withFieldValue("remark", "Updated Remark")
@@ -165,14 +169,14 @@ public class AssetDTOIntTest {
assertThat(actual).isInstanceOfSatisfying(
BadRequestAlertException.class,
bre -> assertThat(bre.getMessage())
.isEqualTo("Update of field AssetDTO.remark prohibited for current user role CONTRACTUAL_CONTACT"));
.isEqualTo(
"Update of field AssetDTO.remark prohibited for current user roles CONTRACTUAL_CONTACT+ANYBODY"));
}
@Test
public void shouldDeserializeForAdminIfRemarkIsChanged() throws IOException {
// given
givenAuthenticatedUser();
givenUserHavingRole(Role.ADMIN);
securityContext.havingAuthenticatedUser().withRole(Role.ADMIN);
final String json = new JSonBuilder()
.withFieldValue("id", SOME_ASSET_ID)
.withFieldValue("remark", "Updated Remark")

27
src/test/java/org/hostsharing/hsadminng/service/dto/CustomerDTOUnitTest.java
View File

@@ -2,8 +2,6 @@
package org.hostsharing.hsadminng.service.dto;
import static org.assertj.core.api.Assertions.assertThat;
import static org.hostsharing.hsadminng.service.accessfilter.MockSecurityContext.givenAuthenticatedUser;
import static org.hostsharing.hsadminng.service.accessfilter.MockSecurityContext.givenUserHavingRole;
import static org.junit.Assert.assertEquals;
import static org.mockito.BDDMockito.given;
@@ -12,7 +10,9 @@ import org.hostsharing.hsadminng.domain.enumeration.CustomerKind;
import org.hostsharing.hsadminng.domain.enumeration.VatRegion;
import org.hostsharing.hsadminng.repository.CustomerRepository;
import org.hostsharing.hsadminng.service.CustomerService;
import org.hostsharing.hsadminng.service.UserRoleAssignmentService;
import org.hostsharing.hsadminng.service.accessfilter.JSonBuilder;
import org.hostsharing.hsadminng.service.accessfilter.MockSecurityContext;
import org.hostsharing.hsadminng.service.accessfilter.Role;
import org.hostsharing.hsadminng.service.mapper.CustomerMapper;
import org.hostsharing.hsadminng.service.mapper.CustomerMapperImpl;
@@ -20,6 +20,7 @@ import org.hostsharing.hsadminng.service.mapper.CustomerMapperImpl;
import com.fasterxml.jackson.core.JsonProcessingException;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.junit.Before;
import org.junit.Rule;
import org.junit.Test;
import org.junit.runner.RunWith;
@@ -60,12 +61,21 @@ public class CustomerDTOUnitTest {
@MockBean
private CustomerService customerService;
@MockBean
private UserRoleAssignmentService userRoleAssignmentService;
private MockSecurityContext securityContext;
@Before
public void init() {
securityContext = new MockSecurityContext(userRoleAssignmentService);
}
@Test
public void testSerializationAsContractualCustomerContact() throws JsonProcessingException {
// given
givenAuthenticatedUser();
givenUserHavingRole(CustomerDTO.class, 1234L, Role.CONTRACTUAL_CONTACT);
securityContext.havingAuthenticatedUser().withRole(CustomerDTO.class, 1234L, Role.CONTRACTUAL_CONTACT);
CustomerDTO given = createSomeCustomerDTO(1234L);
// when
@@ -80,8 +90,7 @@ public class CustomerDTOUnitTest {
public void testSerializationAsTechnicalCustomerUser() throws JsonProcessingException {
// given
givenAuthenticatedUser();
givenUserHavingRole(CustomerDTO.class, 1234L, Role.TECHNICAL_CONTACT);
securityContext.havingAuthenticatedUser().withRole(CustomerDTO.class, 1234L, Role.TECHNICAL_CONTACT);
CustomerDTO given = createSomeCustomerDTO(1234L);
// when
@@ -102,8 +111,7 @@ public class CustomerDTOUnitTest {
public void testSerializationAsSupporter() throws JsonProcessingException {
// given
givenAuthenticatedUser();
givenUserHavingRole(CustomerDTO.class, null, Role.SUPPORTER);
securityContext.havingAuthenticatedUser().withRole(Role.SUPPORTER);
CustomerDTO given = createSomeCustomerDTO(1234L);
// when
@@ -116,8 +124,7 @@ public class CustomerDTOUnitTest {
@Test
public void testDeserializeAsContractualCustomerContact() throws IOException {
// given
givenAuthenticatedUser();
givenUserHavingRole(CustomerDTO.class, 1234L, Role.CONTRACTUAL_CONTACT);
securityContext.havingAuthenticatedUser().withRole(CustomerDTO.class, 1234L, Role.CONTRACTUAL_CONTACT);
given(customerRepository.findById(1234L)).willReturn(Optional.of(new Customer().id(1234L)));
String json = "{\"id\":1234,\"contractualSalutation\":\"Hallo Updated\",\"billingSalutation\":\"Moin Updated\"}";

33
src/test/java/org/hostsharing/hsadminng/service/dto/MembershipDTOUnitTest.java
View File

@@ -4,13 +4,13 @@ package org.hostsharing.hsadminng.service.dto;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.catchThrowable;
import static org.hostsharing.hsadminng.service.accessfilter.JSonBuilder.asJSon;
import static org.hostsharing.hsadminng.service.accessfilter.MockSecurityContext.givenAuthenticatedUser;
import static org.hostsharing.hsadminng.service.accessfilter.MockSecurityContext.givenUserHavingRole;
import static org.mockito.BDDMockito.given;
import org.hostsharing.hsadminng.service.CustomerService;
import org.hostsharing.hsadminng.service.MembershipService;
import org.hostsharing.hsadminng.service.UserRoleAssignmentService;
import org.hostsharing.hsadminng.service.accessfilter.JSonDeserializationWithAccessFilter;
import org.hostsharing.hsadminng.service.accessfilter.MockSecurityContext;
import org.hostsharing.hsadminng.service.accessfilter.Role;
import org.hostsharing.hsadminng.web.rest.errors.BadRequestAlertException;
@@ -52,12 +52,17 @@ public class MembershipDTOUnitTest {
@Mock
private TreeNode treeNode;
@Mock
private UserRoleAssignmentService userRoleAssignmentService;
@Mock
private MembershipService membershipService;
@Mock
private CustomerService customerService;
private MockSecurityContext securityContext;
@Before
public void init() {
given(jsonParser.getCodec()).willReturn(codec);
@@ -69,17 +74,23 @@ public class MembershipDTOUnitTest {
Optional.of(
new CustomerDTO()
.with(dto -> dto.setId(1234L))));
securityContext = new MockSecurityContext(userRoleAssignmentService);
}
@Test
public void adminShouldHaveRightToCreate() throws IOException {
givenAuthenticatedUser();
givenUserHavingRole(null, null, Role.ADMIN);
securityContext.havingAuthenticatedUser().withRole(Role.ADMIN);
givenJSonTree(asJSon(ImmutablePair.of("customerId", 1234L)));
// when
final MembershipDTO actualDto = new JSonDeserializationWithAccessFilter<>(ctx, jsonParser, null, MembershipDTO.class)
.deserialize();
final MembershipDTO actualDto = new JSonDeserializationWithAccessFilter<>(
ctx,
userRoleAssignmentService,
jsonParser,
null,
MembershipDTO.class)
.deserialize();
// then
assertThat(actualDto.getCustomerId()).isEqualTo(1234L);
@@ -87,13 +98,17 @@ public class MembershipDTOUnitTest {
@Test
public void contractualContactShouldNotHaveRightToCreate() throws IOException {
givenAuthenticatedUser();
givenUserHavingRole(CustomerDTO.class, 1234L, Role.CONTRACTUAL_CONTACT);
securityContext.havingAuthenticatedUser().withRole(CustomerDTO.class, 1234L, Role.CONTRACTUAL_CONTACT);
givenJSonTree(asJSon(ImmutablePair.of("customerId", 1234L)));
// when
Throwable exception = catchThrowable(
() -> new JSonDeserializationWithAccessFilter<>(ctx, jsonParser, null, MembershipDTO.class).deserialize());
() -> new JSonDeserializationWithAccessFilter<>(
ctx,
userRoleAssignmentService,
jsonParser,
null,
MembershipDTO.class).deserialize());
// then
assertThat(exception).isInstanceOfSatisfying(BadRequestAlertException.class, badRequestAlertException -> {

25
src/test/java/org/hostsharing/hsadminng/service/dto/SepaMandateDTOIntTest.java
View File

@@ -3,8 +3,6 @@ package org.hostsharing.hsadminng.service.dto;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.catchThrowable;
import static org.hostsharing.hsadminng.service.accessfilter.MockSecurityContext.givenAuthenticatedUser;
import static org.hostsharing.hsadminng.service.accessfilter.MockSecurityContext.givenUserHavingRole;
import static org.hostsharing.hsadminng.service.dto.SepaMandateDTOUnitTest.createSampleDTO;
import static org.junit.Assert.assertEquals;
import static org.mockito.BDDMockito.given;
@@ -16,7 +14,9 @@ import org.hostsharing.hsadminng.repository.MembershipRepository;
import org.hostsharing.hsadminng.repository.SepaMandateRepository;
import org.hostsharing.hsadminng.service.MembershipValidator;
import org.hostsharing.hsadminng.service.SepaMandateService;
import org.hostsharing.hsadminng.service.UserRoleAssignmentService;
import org.hostsharing.hsadminng.service.accessfilter.JSonBuilder;
import org.hostsharing.hsadminng.service.accessfilter.MockSecurityContext;
import org.hostsharing.hsadminng.service.accessfilter.Role;
import org.hostsharing.hsadminng.service.mapper.CustomerMapperImpl;
import org.hostsharing.hsadminng.service.mapper.MembershipMapperImpl;
@@ -98,18 +98,24 @@ public class SepaMandateDTOIntTest {
@MockBean
private EntityManager em;
@MockBean
public UserRoleAssignmentService userRoleAssignmentService;
private MockSecurityContext securityContext;
@Before
public void init() {
given(customerRepository.findById(SOME_CUSTOMER_ID)).willReturn(Optional.of(SOME_CUSTOMER));
given(sepaMandateRepository.findById(SOME_SEPA_MANDATE_ID)).willReturn((Optional.of(SOME_SEPA_MANDATE)));
securityContext = new MockSecurityContext(userRoleAssignmentService);
}
@Test
public void shouldSerializePartiallyForFinancialCustomerContact() throws JsonProcessingException {
// given
givenAuthenticatedUser();
givenUserHavingRole(CustomerDTO.class, SOME_CUSTOMER_ID, Role.FINANCIAL_CONTACT);
securityContext.havingAuthenticatedUser().withRole(CustomerDTO.class, SOME_CUSTOMER_ID, Role.FINANCIAL_CONTACT);
final SepaMandateDTO given = createSampleDTO(SOME_SEPA_MANDATE_ID, SOME_CUSTOMER_ID);
// when
@@ -124,8 +130,7 @@ public class SepaMandateDTOIntTest {
public void shouldSerializeCompletelyForSupporter() throws JsonProcessingException {
// given
givenAuthenticatedUser();
givenUserHavingRole(Role.SUPPORTER);
securityContext.havingAuthenticatedUser().withRole(Role.SUPPORTER);
final SepaMandateDTO given = createSampleDTO(SOME_SEPA_MANDATE_ID, SOME_CUSTOMER_ID);
// when
@@ -138,8 +143,7 @@ public class SepaMandateDTOIntTest {
@Test
public void shouldNotDeserializeForContractualCustomerContact() {
// given
givenAuthenticatedUser();
givenUserHavingRole(CustomerDTO.class, SOME_CUSTOMER_ID, Role.CONTRACTUAL_CONTACT);
securityContext.havingAuthenticatedUser().withRole(CustomerDTO.class, SOME_CUSTOMER_ID, Role.CONTRACTUAL_CONTACT);
final String json = new JSonBuilder()
.withFieldValue("id", SOME_SEPA_MANDATE_ID)
.withFieldValue("remark", "Updated Remark")
@@ -152,14 +156,13 @@ public class SepaMandateDTOIntTest {
assertThat(actual).isInstanceOfSatisfying(
BadRequestAlertException.class,
bre -> assertThat(bre.getMessage()).isEqualTo(
"Update of field SepaMandateDTO.remark prohibited for current user role CONTRACTUAL_CONTACT"));
"Update of field SepaMandateDTO.remark prohibited for current user roles CONTRACTUAL_CONTACT+ANYBODY"));
}
@Test
public void shouldDeserializeForAdminIfRemarkIsChanged() throws IOException {
// given
givenAuthenticatedUser();
givenUserHavingRole(Role.ADMIN);
securityContext.havingAuthenticatedUser().withRole(Role.ADMIN);
final String json = new JSonBuilder()
.withFieldValue("id", SOME_SEPA_MANDATE_ID)
.withFieldValue("remark", "Updated Remark")

26
src/test/java/org/hostsharing/hsadminng/service/dto/ShareDTOIntTest.java
View File

@@ -3,8 +3,6 @@ package org.hostsharing.hsadminng.service.dto;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.catchThrowable;
import static org.hostsharing.hsadminng.service.accessfilter.MockSecurityContext.givenAuthenticatedUser;
import static org.hostsharing.hsadminng.service.accessfilter.MockSecurityContext.givenUserHavingRole;
import static org.junit.Assert.assertEquals;
import static org.mockito.BDDMockito.given;
@@ -18,7 +16,9 @@ import org.hostsharing.hsadminng.repository.ShareRepository;
import org.hostsharing.hsadminng.service.MembershipValidator;
import org.hostsharing.hsadminng.service.ShareService;
import org.hostsharing.hsadminng.service.ShareValidator;
import org.hostsharing.hsadminng.service.UserRoleAssignmentService;
import org.hostsharing.hsadminng.service.accessfilter.JSonBuilder;
import org.hostsharing.hsadminng.service.accessfilter.MockSecurityContext;
import org.hostsharing.hsadminng.service.accessfilter.Role;
import org.hostsharing.hsadminng.service.mapper.CustomerMapperImpl;
import org.hostsharing.hsadminng.service.mapper.MembershipMapperImpl;
@@ -109,19 +109,25 @@ public class ShareDTOIntTest {
@MockBean
private EntityManager em;
@MockBean
private UserRoleAssignmentService userRoleAssignmentService;
private MockSecurityContext securityContext;
@Before
public void init() {
given(customerRepository.findById(SOME_CUSTOMER_ID)).willReturn(Optional.of(SOME_CUSTOMER));
given(membershipRepository.findById(SOME_MEMBERSHIP_ID)).willReturn(Optional.of(SOME_MEMBERSHIP));
given(shareRepository.findById(SOME_SHARE_ID)).willReturn((Optional.of(SOME_SHARE)));
securityContext = new MockSecurityContext(userRoleAssignmentService);
}
@Test
public void shouldSerializePartiallyForFinancialCustomerContact() throws JsonProcessingException {
// given
givenAuthenticatedUser();
givenUserHavingRole(CustomerDTO.class, SOME_CUSTOMER_ID, Role.FINANCIAL_CONTACT);
securityContext.havingAuthenticatedUser().withRole(CustomerDTO.class, SOME_CUSTOMER_ID, Role.FINANCIAL_CONTACT);
final ShareDTO given = createSomeShareDTO(SOME_SHARE_ID);
// when
@@ -136,8 +142,7 @@ public class ShareDTOIntTest {
public void shouldSerializeCompletelyForSupporter() throws JsonProcessingException {
// given
givenAuthenticatedUser();
givenUserHavingRole(Role.SUPPORTER);
securityContext.havingAuthenticatedUser().withRole(Role.SUPPORTER);
final ShareDTO given = createSomeShareDTO(SOME_SHARE_ID);
// when
@@ -150,8 +155,7 @@ public class ShareDTOIntTest {
@Test
public void shouldNotDeserializeForContractualCustomerContact() {
// given
givenAuthenticatedUser();
givenUserHavingRole(CustomerDTO.class, SOME_CUSTOMER_ID, Role.CONTRACTUAL_CONTACT);
securityContext.havingAuthenticatedUser().withRole(CustomerDTO.class, SOME_CUSTOMER_ID, Role.CONTRACTUAL_CONTACT);
final String json = new JSonBuilder()
.withFieldValue("id", SOME_SHARE_ID)
.withFieldValue("remark", "Updated Remark")
@@ -164,14 +168,14 @@ public class ShareDTOIntTest {
assertThat(actual).isInstanceOfSatisfying(
BadRequestAlertException.class,
bre -> assertThat(bre.getMessage())
.isEqualTo("Update of field ShareDTO.remark prohibited for current user role CONTRACTUAL_CONTACT"));
.isEqualTo(
"Update of field ShareDTO.remark prohibited for current user roles CONTRACTUAL_CONTACT+ANYBODY"));
}
@Test
public void shouldDeserializeForAdminIfRemarkIsChanged() throws IOException {
// given
givenAuthenticatedUser();
givenUserHavingRole(Role.ADMIN);
securityContext.havingAuthenticatedUser().withRole(Role.ADMIN);
final String json = new JSonBuilder()
.withFieldValue("id", SOME_SHARE_ID)
.withFieldValue("remark", "Updated Remark")

10
src/test/java/org/hostsharing/hsadminng/web/rest/AssetResourceIntTest.java
View File

@@ -14,6 +14,7 @@ import org.hostsharing.hsadminng.domain.enumeration.AssetAction;
import org.hostsharing.hsadminng.repository.AssetRepository;
import org.hostsharing.hsadminng.service.AssetQueryService;
import org.hostsharing.hsadminng.service.AssetService;
import org.hostsharing.hsadminng.service.UserRoleAssignmentService;
import org.hostsharing.hsadminng.service.accessfilter.MockSecurityContext;
import org.hostsharing.hsadminng.service.accessfilter.Role;
import org.hostsharing.hsadminng.service.dto.AssetDTO;
@@ -26,6 +27,7 @@ import org.junit.runner.RunWith;
import org.mockito.MockitoAnnotations;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.boot.test.mock.mockito.MockBean;
import org.springframework.data.web.PageableHandlerMethodArgumentResolver;
import org.springframework.http.MediaType;
import org.springframework.http.converter.json.MappingJackson2HttpMessageConverter;
@@ -94,14 +96,18 @@ public class AssetResourceIntTest {
@Autowired
private Validator validator;
@MockBean
private UserRoleAssignmentService userRoleAssignmentService;
private MockSecurityContext securityContext;
private MockMvc restAssetMockMvc;
private Asset asset;
@Before
public void setup() {
MockSecurityContext.givenAuthenticatedUser();
MockSecurityContext.givenUserHavingRole(Role.ADMIN);
securityContext = new MockSecurityContext(userRoleAssignmentService).havingAuthenticatedUser().withRole(Role.ADMIN);
MockitoAnnotations.initMocks(this);
final AssetResource assetResource = new AssetResource(assetService, assetQueryService);

23
src/test/java/org/hostsharing/hsadminng/web/rest/CustomerResourceIntTest.java
View File

@@ -3,8 +3,6 @@ package org.hostsharing.hsadminng.web.rest;
import static org.assertj.core.api.Assertions.assertThat;
import static org.hamcrest.Matchers.hasItem;
import static org.hostsharing.hsadminng.service.accessfilter.MockSecurityContext.givenAuthenticatedUser;
import static org.hostsharing.hsadminng.service.accessfilter.MockSecurityContext.givenUserHavingRole;
import static org.hostsharing.hsadminng.web.rest.TestUtil.createFormattingConversionService;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.*;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;
@@ -18,6 +16,7 @@ import org.hostsharing.hsadminng.domain.enumeration.VatRegion;
import org.hostsharing.hsadminng.repository.CustomerRepository;
import org.hostsharing.hsadminng.service.CustomerQueryService;
import org.hostsharing.hsadminng.service.CustomerService;
import org.hostsharing.hsadminng.service.UserRoleAssignmentService;
import org.hostsharing.hsadminng.service.accessfilter.MockSecurityContext;
import org.hostsharing.hsadminng.service.accessfilter.Role;
import org.hostsharing.hsadminng.service.dto.CustomerDTO;
@@ -30,9 +29,12 @@ import org.junit.runner.RunWith;
import org.mockito.MockitoAnnotations;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.boot.test.mock.mockito.MockBean;
import org.springframework.context.annotation.Bean;
import org.springframework.data.web.PageableHandlerMethodArgumentResolver;
import org.springframework.http.MediaType;
import org.springframework.http.converter.json.MappingJackson2HttpMessageConverter;
import org.springframework.security.data.repository.query.SecurityEvaluationContextExtension;
import org.springframework.test.context.junit4.SpringRunner;
import org.springframework.test.web.servlet.MockMvc;
import org.springframework.test.web.servlet.setup.MockMvcBuilders;
@@ -107,6 +109,11 @@ public class CustomerResourceIntTest {
private static int otherCounter = 0;
@Bean
public SecurityEvaluationContextExtension securityEvaluationContextExtension() {
return new SecurityEvaluationContextExtension();
}
@Autowired
private CustomerRepository customerRepository;
@@ -134,19 +141,19 @@ public class CustomerResourceIntTest {
@Autowired
private Validator validator;
@MockBean
private UserRoleAssignmentService userRoleAssignmentService;
private MockSecurityContext securityContext;
private MockMvc restCustomerMockMvc;
private Customer customer;
@Before
public void setup() {
MockSecurityContext.givenAuthenticatedUser();
MockSecurityContext.givenUserHavingRole(Role.ADMIN);
MockitoAnnotations.initMocks(this);
givenAuthenticatedUser();
givenUserHavingRole(Role.ADMIN);
securityContext = new MockSecurityContext(userRoleAssignmentService).havingAuthenticatedUser().withRole(Role.ADMIN);
final CustomerResource customerResource = new CustomerResource(customerService, customerQueryService);
this.restCustomerMockMvc = MockMvcBuilders.standaloneSetup(customerResource)

10
src/test/java/org/hostsharing/hsadminng/web/rest/MembershipResourceIntTest.java
View File

@@ -15,6 +15,7 @@ import org.hostsharing.hsadminng.domain.Share;
import org.hostsharing.hsadminng.repository.MembershipRepository;
import org.hostsharing.hsadminng.service.MembershipQueryService;
import org.hostsharing.hsadminng.service.MembershipService;
import org.hostsharing.hsadminng.service.UserRoleAssignmentService;
import org.hostsharing.hsadminng.service.accessfilter.MockSecurityContext;
import org.hostsharing.hsadminng.service.accessfilter.Role;
import org.hostsharing.hsadminng.service.dto.MembershipDTO;
@@ -27,6 +28,7 @@ import org.junit.runner.RunWith;
import org.mockito.MockitoAnnotations;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.boot.test.mock.mockito.MockBean;
import org.springframework.data.web.PageableHandlerMethodArgumentResolver;
import org.springframework.http.MediaType;
import org.springframework.http.converter.json.MappingJackson2HttpMessageConverter;
@@ -100,14 +102,18 @@ public class MembershipResourceIntTest {
@Autowired
private Validator validator;
@MockBean
private UserRoleAssignmentService userRoleAssignmentService;
private MockSecurityContext securityContext;
private MockMvc restMembershipMockMvc;
private Membership membership;
@Before
public void setup() {
MockSecurityContext.givenAuthenticatedUser();
MockSecurityContext.givenUserHavingRole(Role.ADMIN);
securityContext = new MockSecurityContext(userRoleAssignmentService).havingAuthenticatedUser().withRole(Role.ADMIN);
MockitoAnnotations.initMocks(this);
final MembershipResource membershipResource = new MembershipResource(membershipService, membershipQueryService);

14
src/test/java/org/hostsharing/hsadminng/web/rest/SepaMandateResourceIntTest.java
View File

@@ -13,6 +13,7 @@ import org.hostsharing.hsadminng.domain.SepaMandate;
import org.hostsharing.hsadminng.repository.SepaMandateRepository;
import org.hostsharing.hsadminng.service.SepaMandateQueryService;
import org.hostsharing.hsadminng.service.SepaMandateService;
import org.hostsharing.hsadminng.service.UserRoleAssignmentService;
import org.hostsharing.hsadminng.service.accessfilter.MockSecurityContext;
import org.hostsharing.hsadminng.service.accessfilter.Role;
import org.hostsharing.hsadminng.service.dto.CustomerDTO;
@@ -26,6 +27,7 @@ import org.junit.runner.RunWith;
import org.mockito.MockitoAnnotations;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.boot.test.mock.mockito.MockBean;
import org.springframework.data.web.PageableHandlerMethodArgumentResolver;
import org.springframework.http.MediaType;
import org.springframework.http.converter.json.MappingJackson2HttpMessageConverter;
@@ -104,14 +106,18 @@ public class SepaMandateResourceIntTest {
@Autowired
private Validator validator;
@MockBean
private UserRoleAssignmentService userRoleAssignmentService;
private MockSecurityContext securityContext;
private MockMvc restSepaMandateMockMvc;
private SepaMandate sepaMandate;
@Before
public void setup() {
MockSecurityContext.givenAuthenticatedUser();
MockSecurityContext.givenUserHavingRole(Role.ADMIN);
securityContext = new MockSecurityContext(userRoleAssignmentService).havingAuthenticatedUser().withRole(Role.ADMIN);
MockitoAnnotations.initMocks(this);
final SepaMandateResource sepaMandateResource = new SepaMandateResource(sepaMandateService, sepaMandateQueryService);
@@ -187,8 +193,8 @@ public class SepaMandateResourceIntTest {
sepaMandateDTO.setRemark(null);
sepaMandateDTO.setRevokationDocumentDate(null);
sepaMandateDTO.setLastUsedDate(null);
MockSecurityContext.givenAuthenticatedUser();
MockSecurityContext.givenUserHavingRole(CustomerDTO.class, sepaMandateDTO.getCustomerId(), Role.FINANCIAL_CONTACT);
securityContext.havingAuthenticatedUser()
.withRole(CustomerDTO.class, sepaMandateDTO.getCustomerId(), Role.FINANCIAL_CONTACT);
restSepaMandateMockMvc.perform(
post("/api/sepa-mandates")

10
src/test/java/org/hostsharing/hsadminng/web/rest/ShareResourceIntTest.java
View File

@@ -14,6 +14,7 @@ import org.hostsharing.hsadminng.domain.enumeration.ShareAction;
import org.hostsharing.hsadminng.repository.ShareRepository;
import org.hostsharing.hsadminng.service.ShareQueryService;
import org.hostsharing.hsadminng.service.ShareService;
import org.hostsharing.hsadminng.service.UserRoleAssignmentService;
import org.hostsharing.hsadminng.service.accessfilter.MockSecurityContext;
import org.hostsharing.hsadminng.service.accessfilter.Role;
import org.hostsharing.hsadminng.service.dto.ShareDTO;
@@ -26,6 +27,7 @@ import org.junit.runner.RunWith;
import org.mockito.MockitoAnnotations;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.boot.test.mock.mockito.MockBean;
import org.springframework.data.web.PageableHandlerMethodArgumentResolver;
import org.springframework.http.MediaType;
import org.springframework.http.converter.json.MappingJackson2HttpMessageConverter;
@@ -92,14 +94,18 @@ public class ShareResourceIntTest {
@Autowired
private Validator validator;
@MockBean
private UserRoleAssignmentService userRoleAssignmentService;
private MockSecurityContext securityContext;
private MockMvc restShareMockMvc;
private Share share;
@Before
public void setup() {
MockSecurityContext.givenAuthenticatedUser();
MockSecurityContext.givenUserHavingRole(Role.ADMIN);
securityContext = new MockSecurityContext(userRoleAssignmentService).havingAuthenticatedUser().withRole(Role.ADMIN);
MockitoAnnotations.initMocks(this);
final ShareResource shareResource = new ShareResource(shareService, shareQueryService);

6
src/test/java/org/hostsharing/hsadminng/web/rest/UserRoleAssignmentResourceIntTest.java
View File

@@ -10,10 +10,10 @@ import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.
import org.hostsharing.hsadminng.HsadminNgApp;
import org.hostsharing.hsadminng.domain.User;
import org.hostsharing.hsadminng.domain.UserRoleAssignment;
import org.hostsharing.hsadminng.domain.enumeration.UserRole;
import org.hostsharing.hsadminng.repository.UserRoleAssignmentRepository;
import org.hostsharing.hsadminng.service.UserRoleAssignmentQueryService;
import org.hostsharing.hsadminng.service.UserRoleAssignmentService;
import org.hostsharing.hsadminng.service.accessfilter.Role;
import org.hostsharing.hsadminng.web.rest.errors.ExceptionTranslator;
import org.junit.Before;
@@ -50,8 +50,8 @@ public class UserRoleAssignmentResourceIntTest {
private static final Long DEFAULT_ENTITY_OBJECT_ID = 1L;
private static final Long UPDATED_ENTITY_OBJECT_ID = 2L;
private static final UserRole DEFAULT_ASSIGNED_ROLE = UserRole.HOSTMASTER;
private static final UserRole UPDATED_ASSIGNED_ROLE = UserRole.ADMIN;
private static final Role DEFAULT_ASSIGNED_ROLE = Role.HOSTMASTER;
private static final Role UPDATED_ASSIGNED_ROLE = Role.ADMIN;
@Autowired
private UserRoleAssignmentRepository userRoleAssignmentRepository;