separated MockSecurityContext into SecurityContextMock+SecurityContextMock

src/main/java/org/hostsharing/hsadminng/service/accessfilter/JSonAccessFilter.java

@@ -4,7 +4,7 @@ package org.hostsharing.hsadminng.service.accessfilter;
 import static com.google.common.base.Verify.verify;
 import static com.google.common.collect.Sets.union;
 import static java.util.Collections.EMPTY_SET;
-import static org.thymeleaf.util.SetUtils.singletonSet;
+import static java.util.Collections.emptySet;
 
 import org.hostsharing.hsadminng.security.SecurityUtils;
 import org.hostsharing.hsadminng.service.IdToDtoResolver;
@@ -71,7 +71,7 @@ abstract class JSonAccessFilter<T> {
         final Field parentIdField = determineFieldWithAnnotation(dto.getClass(), ParentId.class);
 
         if (parentIdField == null) {
-            return singletonSet(Role.ANYBODY);
+            return emptySet();
         }
 
         final ParentId parentIdAnnot = parentIdField.getAnnotation(ParentId.class);
@@ -88,12 +88,12 @@ abstract class JSonAccessFilter<T> {
 
     private Set<Role> getLoginUserDirectRolesFor(final Class<?> dtoClass, final Long id) {
         if (!SecurityUtils.isAuthenticated()) {
-            return singletonSet(Role.ANYBODY);
+            return emptySet();
         }
 
         final EntityTypeId entityTypeId = dtoClass.getAnnotation(EntityTypeId.class);
         if (entityTypeId == null) {
-            return singletonSet(Role.ANYBODY); // TODO mhoennig: all of such singletonSets -> emptySet
+            return emptySet();
         }
 
         return userRoleAssignmentService.getEffectiveRoleOfCurrentUser(entityTypeId.value(), id);

src/main/java/org/hostsharing/hsadminng/service/accessfilter/JSonDeserializationWithAccessFilter.java

@@ -160,13 +160,13 @@ public class JSonDeserializationWithAccessFilter<T> extends JSonAccessFilter<T>
                                 if (!field.equals(parentIdField)) {
                                     throw new BadRequestAlertException(
                                             "Initialization of field " + toDisplay(field)
-                                                    + " prohibited for current user roles "
+                                                    + " prohibited for current user role(s): "
                                                     + Joiner.on("+").join(roles),
                                             toDisplay(field),
                                             "initializationProhibited");
                                 } else {
                                     throw new BadRequestAlertException(
-                                            "Referencing field " + toDisplay(field) + " prohibited for current user roles "
+                                            "Referencing field " + toDisplay(field) + " prohibited for current user role(s): "
                                                     + Joiner.on("+").join(roles),
                                             toDisplay(field),
                                             "referencingProhibited");
@@ -174,7 +174,7 @@ public class JSonDeserializationWithAccessFilter<T> extends JSonAccessFilter<T>
                             }
                         } else if (!Role.toBeIgnoredForUpdates(field) && !isAllowedToUpdate(getLoginUserRoles(), field)) {
                             throw new BadRequestAlertException(
-                                    "Update of field " + toDisplay(field) + " prohibited for current user roles "
+                                    "Update of field " + toDisplay(field) + " prohibited for current user role(s): "
                                             + Joiner.on("+").join(roles),
                                     toDisplay(field),
                                     "updateProhibited");

src/main/java/org/hostsharing/hsadminng/service/accessfilter/JSonSerializationWithAccessFilter.java

@@ -86,7 +86,7 @@ public class JSonSerializationWithAccessFilter<T> extends JSonAccessFilter<T> {
                 return true;
             }
         }
-        return false;
+        return Role.ANYBODY.isAllowedToRead(field);
     }
 
 }

src/main/java/org/hostsharing/hsadminng/service/accessfilter/Role.java

@@ -139,7 +139,7 @@ public enum Role {
      * @return true if this role is independent of a target object, false otherwise.
      */
     public boolean isIndependent() {
-        return this != NOBODY && covers(Role.SUPPORTER);
+        return this != NOBODY && (this == ANYBODY || covers(Role.SUPPORTER));
     }
 
     /**