Modified: jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionProviderImplTest.java URL: http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionProviderImplTest.java?rev=1857999&r1=1857998&r2=1857999&view=diff ============================================================================== --- jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionProviderImplTest.java (original) +++ jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionProviderImplTest.java Tue Apr 23 09:34:55 2019 @@ -16,42 +16,40 @@ */ package org.apache.jackrabbit.oak.security.authorization.permission; -import java.util.Collections; -import java.util.Set; - import com.google.common.collect.ImmutableMap; import com.google.common.collect.ImmutableSet; import org.apache.jackrabbit.JcrConstants; -import org.apache.jackrabbit.api.security.user.Group; -import org.apache.jackrabbit.api.security.user.UserManager; import org.apache.jackrabbit.oak.AbstractSecurityTest; import org.apache.jackrabbit.oak.api.ContentSession; import org.apache.jackrabbit.oak.api.Root; import org.apache.jackrabbit.oak.api.Tree; +import org.apache.jackrabbit.oak.commons.PathUtils; +import org.apache.jackrabbit.oak.plugins.tree.TreeLocation; +import org.apache.jackrabbit.oak.security.authorization.AuthorizationConfigurationImpl; +import org.apache.jackrabbit.oak.security.authorization.composite.CompositeAuthorizationConfiguration; import org.apache.jackrabbit.oak.spi.namespace.NamespaceConstants; import org.apache.jackrabbit.oak.spi.nodetype.NodeTypeConstants; -import org.apache.jackrabbit.oak.plugins.tree.TreeLocation; -import org.apache.jackrabbit.oak.spi.version.VersionConstants; import org.apache.jackrabbit.oak.spi.security.ConfigurationParameters; import org.apache.jackrabbit.oak.spi.security.authorization.AuthorizationConfiguration; import org.apache.jackrabbit.oak.spi.security.authorization.accesscontrol.AccessControlConstants; import org.apache.jackrabbit.oak.spi.security.authorization.permission.PermissionConstants; -import org.apache.jackrabbit.oak.spi.security.authorization.permission.PermissionProvider; import org.apache.jackrabbit.oak.spi.security.authorization.permission.Permissions; import org.apache.jackrabbit.oak.spi.security.authorization.permission.RepositoryPermission; import org.apache.jackrabbit.oak.spi.security.authorization.permission.TreePermission; import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeConstants; +import org.apache.jackrabbit.oak.spi.version.VersionConstants; import org.junit.Test; +import java.util.Collections; +import java.util.Set; + import static org.apache.jackrabbit.oak.plugins.tree.TreeUtil.addChild; import static org.junit.Assert.assertEquals; import static org.junit.Assert.assertFalse; -import static org.junit.Assert.assertSame; import static org.junit.Assert.assertTrue; public class PermissionProviderImplTest extends AbstractSecurityTest implements AccessControlConstants { - private static final String ADMINISTRATOR_GROUP = "administrators"; private static final Set<String> READ_PATHS = ImmutableSet.of( NamespaceConstants.NAMESPACES_PATH, NodeTypeConstants.NODE_TYPES_PATH, @@ -59,28 +57,25 @@ public class PermissionProviderImplTest "/test" ); - private Group adminstrators; - private AuthorizationConfiguration config; + private ContentSession testSession; + private PermissionProviderImpl pp; @Override public void before() throws Exception { super.before(); addChild(root.getTree("/"), "test", JcrConstants.NT_UNSTRUCTURED); - UserManager uMgr = getUserManager(root); - adminstrators = uMgr.createGroup(ADMINISTRATOR_GROUP); root.commit(); - config = getSecurityProvider().getConfiguration(AuthorizationConfiguration.class); + + testSession = createTestSession(); + pp = createPermissionProvider(testSession); } @Override public void after() throws Exception { try { + testSession.close(); root.getTree("/test").remove(); - UserManager uMgr = getUserManager(root); - if (adminstrators != null) { - uMgr.getAuthorizable(adminstrators.getID()).remove(); - } if (root.hasPendingChanges()) { root.commit(); } @@ -92,145 +87,108 @@ public class PermissionProviderImplTest @Override protected ConfigurationParameters getSecurityConfigParameters() { ConfigurationParameters acConfig = ConfigurationParameters.of( - PermissionConstants.PARAM_READ_PATHS, READ_PATHS, - PermissionConstants.PARAM_ADMINISTRATIVE_PRINCIPALS, new String[] {ADMINISTRATOR_GROUP}); - + PermissionConstants.PARAM_READ_PATHS, READ_PATHS); return ConfigurationParameters.of(ImmutableMap.of(AuthorizationConfiguration.NAME, acConfig)); } - private PermissionProvider createPermissionProvider(ContentSession session) { - return config.getPermissionProvider(session.getLatestRoot(), session.getWorkspaceName(), session.getAuthInfo().getPrincipals()); + + private PermissionProviderImpl createPermissionProvider(ContentSession session) { + AuthorizationConfiguration config = getSecurityProvider().getConfiguration(AuthorizationConfiguration.class); + assertTrue(config instanceof CompositeAuthorizationConfiguration); + + AuthorizationConfiguration defConfig = ((CompositeAuthorizationConfiguration) config).getDefaultConfig(); + assertTrue(defConfig instanceof AuthorizationConfigurationImpl); + + return new PermissionProviderImpl(session.getLatestRoot(), session.getWorkspaceName(), session.getAuthInfo().getPrincipals(), config.getRestrictionProvider(), config.getParameters(), config.getContext(), (AuthorizationConfigurationImpl) defConfig); } @Test - public void testHasPrivileges() throws Exception { - ContentSession testSession = createTestSession(); - try { - PermissionProvider pp = createPermissionProvider(testSession); - - assertTrue(pp.hasPrivileges(null)); - assertTrue(pp.hasPrivileges(null, new String[0])); - assertFalse(pp.hasPrivileges(null, PrivilegeConstants.JCR_WORKSPACE_MANAGEMENT)); - } finally { - testSession.close(); - } + public void testHasPrivileges() { + assertTrue(pp.hasPrivileges(null)); + assertTrue(pp.hasPrivileges(null, new String[0])); + assertFalse(pp.hasPrivileges(null, PrivilegeConstants.JCR_WORKSPACE_MANAGEMENT)); } @Test - public void testReadPath() throws Exception { - ContentSession testSession = createTestSession(); - try { - Root r = testSession.getLatestRoot(); - PermissionProvider pp = createPermissionProvider(testSession); + public void testTreePermissionsForReadPaths() { + Root r = testSession.getLatestRoot(); + Tree tree = r.getTree(PathUtils.ROOT_PATH); + assertFalse(tree.exists()); + assertFalse(pp.getTreePermission(tree, TreePermission.EMPTY).canRead()); - Tree tree = r.getTree("/"); - assertFalse(tree.exists()); - assertFalse(pp.getTreePermission(tree, TreePermission.EMPTY).canRead()); - - for (String path : READ_PATHS) { - tree = r.getTree(path); - assertTrue(tree.exists()); - assertTrue(pp.getTreePermission(tree, TreePermission.EMPTY).canRead()); - } - } finally { - testSession.close(); + for (String path : READ_PATHS) { + tree = r.getTree(path); + assertTrue(tree.exists()); + assertTrue(pp.getTreePermission(tree, TreePermission.EMPTY).canRead()); } } @Test - public void testIsGrantedForReadPaths() throws Exception { - ContentSession testSession = createTestSession(); - try { - PermissionProvider pp = createPermissionProvider(testSession) ; - for (String path : READ_PATHS) { - assertTrue(pp.isGranted(path, Permissions.getString(Permissions.READ))); - assertTrue(pp.isGranted(path, Permissions.getString(Permissions.READ_NODE))); - assertTrue(pp.isGranted(path + '/' + JcrConstants.JCR_PRIMARYTYPE, Permissions.getString(Permissions.READ_PROPERTY))); - assertFalse(pp.isGranted(path, Permissions.getString(Permissions.READ_ACCESS_CONTROL))); - } - - for (String path : READ_PATHS) { - Tree tree = root.getTree(path); - assertTrue(pp.isGranted(tree, null, Permissions.READ)); - assertTrue(pp.isGranted(tree, null, Permissions.READ_NODE)); - assertTrue(pp.isGranted(tree, tree.getProperty(JcrConstants.JCR_PRIMARYTYPE), Permissions.READ_PROPERTY)); - assertFalse(pp.isGranted(tree, null, Permissions.READ_ACCESS_CONTROL)); - } - - RepositoryPermission rp = pp.getRepositoryPermission(); - assertFalse(rp.isGranted(Permissions.READ)); - assertFalse(rp.isGranted(Permissions.READ_NODE)); - assertFalse(rp.isGranted(Permissions.READ_PROPERTY)); - assertFalse(rp.isGranted(Permissions.READ_ACCESS_CONTROL)); - } finally { - testSession.close(); + public void testIsGrantedPathForReadPaths() { + for (String path : READ_PATHS) { + assertTrue(pp.isGranted(path, Permissions.getString(Permissions.READ))); + assertTrue(pp.isGranted(path, Permissions.getString(Permissions.READ_NODE))); + assertTrue(pp.isGranted(path + '/' + JcrConstants.JCR_PRIMARYTYPE, Permissions.getString(Permissions.READ_PROPERTY))); + assertFalse(pp.isGranted(path, Permissions.getString(Permissions.READ_ACCESS_CONTROL))); } } @Test - public void testGetPrivilegesForReadPaths() throws Exception { - ContentSession testSession = createTestSession(); - try { - PermissionProvider pp = createPermissionProvider(testSession) ; - for (String path : READ_PATHS) { - Tree tree = root.getTree(path); - assertEquals(Collections.singleton(PrivilegeConstants.JCR_READ), pp.getPrivileges(tree)); - } - assertEquals(Collections.<String>emptySet(), pp.getPrivileges(null)); - } finally { - testSession.close(); + public void testIsGrantedTreeForReadPaths() { + for (String path : READ_PATHS) { + Tree tree = root.getTree(path); + assertTrue(pp.isGranted(tree, null, Permissions.READ)); + assertTrue(pp.isGranted(tree, null, Permissions.READ_NODE)); + assertTrue(pp.isGranted(tree, tree.getProperty(JcrConstants.JCR_PRIMARYTYPE), Permissions.READ_PROPERTY)); + assertFalse(pp.isGranted(tree, null, Permissions.READ_ACCESS_CONTROL)); } } @Test - public void testHasPrivilegesForReadPaths() throws Exception { - ContentSession testSession = createTestSession(); - try { - PermissionProvider pp = createPermissionProvider(testSession) ; - for (String path : READ_PATHS) { - Tree tree = root.getTree(path); - assertTrue(pp.hasPrivileges(tree, PrivilegeConstants.JCR_READ)); - assertTrue(pp.hasPrivileges(tree, PrivilegeConstants.REP_READ_NODES)); - assertTrue(pp.hasPrivileges(tree, PrivilegeConstants.REP_READ_PROPERTIES)); - assertFalse(pp.hasPrivileges(tree, PrivilegeConstants.JCR_READ_ACCESS_CONTROL)); - } - assertFalse(pp.hasPrivileges(null, PrivilegeConstants.JCR_READ)); - } finally { - testSession.close(); + public void testRepositoryPermissions() { + RepositoryPermission rp = pp.getRepositoryPermission(); + assertFalse(rp.isGranted(Permissions.READ)); + assertFalse(rp.isGranted(Permissions.READ_NODE)); + assertFalse(rp.isGranted(Permissions.READ_PROPERTY)); + assertFalse(rp.isGranted(Permissions.READ_ACCESS_CONTROL)); + } + + @Test + public void testGetPrivilegesForReadPaths() { + for (String path : READ_PATHS) { + Tree tree = root.getTree(path); + assertEquals(Collections.singleton(PrivilegeConstants.JCR_READ), pp.getPrivileges(tree)); } + assertEquals(Collections.<String>emptySet(), pp.getPrivileges(null)); } @Test - public void testAdministatorConfig() throws Exception { - adminstrators.addMember(getTestUser()); - root.commit(); + public void testHasPrivilegesForReadPaths() { + for (String path : READ_PATHS) { + Tree tree = root.getTree(path); + assertTrue(pp.hasPrivileges(tree, PrivilegeConstants.JCR_READ)); + assertTrue(pp.hasPrivileges(tree, PrivilegeConstants.REP_READ_NODES)); + assertTrue(pp.hasPrivileges(tree, PrivilegeConstants.REP_READ_PROPERTIES)); + assertFalse(pp.hasPrivileges(tree, PrivilegeConstants.JCR_READ_ACCESS_CONTROL)); + } + assertFalse(pp.hasPrivileges(null, PrivilegeConstants.JCR_READ)); + } - ContentSession testSession = createTestSession(); - try { - Root r = testSession.getLatestRoot(); - Root immutableRoot = getRootProvider().createReadOnlyRoot(r); + @Test + public void testIsGrantedNonExistingLocation() { + // parent is readable + TreeLocation location = TreeLocation.create(testSession.getLatestRoot(), "/test/non/existing/tree"); + assertTrue(pp.isGranted(location, Permissions.READ)); - PermissionProvider pp = createPermissionProvider(testSession) ; - assertTrue(r.getTree("/").exists()); - TreePermission tp = pp.getTreePermission(immutableRoot.getTree("/"), TreePermission.EMPTY); - assertSame(TreePermission.ALL, tp); - - for (String path : READ_PATHS) { - Tree tree = r.getTree(path); - assertTrue(tree.exists()); - assertSame(TreePermission.ALL, pp.getTreePermission(tree, TreePermission.EMPTY)); - } - } finally { - testSession.close(); - } + // parent is not readable + location = TreeLocation.create(testSession.getLatestRoot(), "/non/existing/tree"); + assertFalse(pp.isGranted(location, Permissions.READ)); } @Test public void testIsGrantedNonExistingVersionStoreLocation() { - TreeLocation location = TreeLocation.create(root, VersionConstants.VERSION_STORE_PATH + "/non/existing/tree"); - PermissionProvider pp = createPermissionProvider(adminSession); + TreeLocation location = TreeLocation.create(testSession.getLatestRoot(), VersionConstants.VERSION_STORE_PATH + "/non/existing/tree"); - assertTrue(pp instanceof PermissionProviderImpl); - assertFalse(((PermissionProviderImpl) pp).isGranted(location, Permissions.ALL)); + assertFalse(pp.isGranted(location, Permissions.READ)); } } \ No newline at end of file
Modified: jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStoreImplTest.java URL: http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStoreImplTest.java?rev=1857999&r1=1857998&r2=1857999&view=diff ============================================================================== --- jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStoreImplTest.java (original) +++ jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStoreImplTest.java Tue Apr 23 09:34:55 2019 @@ -16,12 +16,6 @@ */ package org.apache.jackrabbit.oak.security.authorization.permission; -import java.lang.reflect.Method; -import java.security.Principal; -import java.util.Collection; -import javax.jcr.RepositoryException; -import javax.jcr.security.AccessControlManager; - import org.apache.jackrabbit.JcrConstants; import org.apache.jackrabbit.api.security.JackrabbitAccessControlList; import org.apache.jackrabbit.commons.jackrabbit.authorization.AccessControlUtils; @@ -40,6 +34,12 @@ import org.junit.After; import org.junit.Before; import org.junit.Test; +import javax.jcr.RepositoryException; +import javax.jcr.security.AccessControlManager; +import java.lang.reflect.Method; +import java.security.Principal; +import java.util.Collection; + import static org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeConstants.REP_READ_NODES; import static org.junit.Assert.assertEquals; import static org.junit.Assert.assertFalse; @@ -114,7 +114,6 @@ public class PermissionStoreImplTest ext everyoneTree.removeProperty(REP_NUM_PERMISSIONS); for (Tree child : everyoneTree.getChildren()) { if (child.hasProperty(REP_ACCESS_CONTROLLED_PATH)) { - String name = child.getName(); Tree collision = TreeUtil.addChild(child, "c_"+child.getName(), NT_REP_PERMISSION_STORE); collision.setProperty(REP_ACCESS_CONTROLLED_PATH, "/another/path"); Tree entry = TreeUtil.addChild(collision, "1", NT_REP_PERMISSIONS); @@ -134,6 +133,30 @@ public class PermissionStoreImplTest ext } @Test + public void testLoadWithNestingMissingAccessControlledPath() throws Exception { + try { + Tree everyoneTree = getPermissionRoot(EveryonePrincipal.NAME); + everyoneTree.removeProperty(REP_NUM_PERMISSIONS); + for (Tree child : everyoneTree.getChildren()) { + if (child.hasProperty(REP_ACCESS_CONTROLLED_PATH)) { + Tree collision = TreeUtil.addChild(child, "c_"+child.getName(), NT_REP_PERMISSION_STORE); + Tree entry = TreeUtil.addChild(collision, "1", NT_REP_PERMISSIONS); + entry.setProperty(PrivilegeBits.BUILT_IN.get(REP_READ_NODES).asPropertyState(REP_PRIVILEGE_BITS)); + entry.setProperty(REP_IS_ALLOW, false); + break; + } + } + + PrincipalPermissionEntries entries = permissionStore.load(EveryonePrincipal.NAME); + assertNotNull(entries); + assertTrue(entries.isFullyLoaded()); + assertEquals(2, entries.getSize()); + } finally { + root.refresh(); + } + } + + @Test public void testLoadByPath() { Collection<PermissionEntry> entries = permissionStore.load(EveryonePrincipal.NAME, testPath); assertNotNull(entries); @@ -151,6 +174,56 @@ public class PermissionStoreImplTest ext } @Test + public void testLoadByPathWithCollision() throws Exception { + try { + Tree everyoneTree = getPermissionRoot(EveryonePrincipal.NAME); + Tree aa = TreeUtil.addChild(everyoneTree, "/Aa".hashCode() +"", NT_REP_PERMISSION_STORE); + aa.setProperty(REP_ACCESS_CONTROLLED_PATH, "/Aa"); + Tree entry = TreeUtil.addChild(aa, "1", NT_REP_PERMISSIONS); + entry.setProperty(PrivilegeBits.BUILT_IN.get(REP_READ_NODES).asPropertyState(REP_PRIVILEGE_BITS)); + entry.setProperty(REP_IS_ALLOW, false); + + Tree collision = TreeUtil.addChild(aa, "c_"+"/BB".hashCode(), NT_REP_PERMISSION_STORE); + collision.setProperty(REP_ACCESS_CONTROLLED_PATH, "/BB"); + Tree entryBB = TreeUtil.addChild(collision, "1", NT_REP_PERMISSIONS); + entryBB.setProperty(PrivilegeBits.BUILT_IN.get(REP_READ_NODES).asPropertyState(REP_PRIVILEGE_BITS)); + entryBB.setProperty(REP_IS_ALLOW, true); + + // a single allow entry for /BB (must descend to collision tree) + Collection<PermissionEntry> entries = permissionStore.load(EveryonePrincipal.NAME, "/BB"); + assertNotNull(entries); + assertEquals(1, entries.size()); + assertTrue(entries.iterator().next().isAllow); + + // a single deny entry for /Aa + entries = permissionStore.load(EveryonePrincipal.NAME, "/Aa"); + assertNotNull(entries); + assertFalse(entries.iterator().next().isAllow); + + } finally { + root.refresh(); + } + } + + @Test + public void testLoadByPathWithCollisionMissingAccessControlledProperty() throws Exception { + try { + Tree everyoneTree = getPermissionRoot(EveryonePrincipal.NAME); + Tree aa = TreeUtil.addChild(everyoneTree, "/Aa".hashCode() +"", NT_REP_PERMISSION_STORE); + aa.setProperty(REP_ACCESS_CONTROLLED_PATH, "/Aa"); + Tree collision = TreeUtil.addChild(aa, "c_"+"/BB".hashCode(), NT_REP_PERMISSION_STORE); + Tree entry = TreeUtil.addChild(collision, "1", NT_REP_PERMISSIONS); + entry.setProperty(PrivilegeBits.BUILT_IN.get(REP_READ_NODES).asPropertyState(REP_PRIVILEGE_BITS)); + entry.setProperty(REP_IS_ALLOW, false); + + Collection<PermissionEntry> entries = permissionStore.load(EveryonePrincipal.NAME, "/BB"); + assertNull(entries); + } finally { + root.refresh(); + } + } + + @Test public void testGetNumEntries() { assertEquals(NumEntries.valueOf(2, true), permissionStore.getNumEntries(EveryonePrincipal.NAME, Long.MAX_VALUE)); } Added: jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionUtilTest.java URL: http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionUtilTest.java?rev=1857999&view=auto ============================================================================== --- jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionUtilTest.java (added) +++ jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionUtilTest.java Tue Apr 23 09:34:55 2019 @@ -0,0 +1,152 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.jackrabbit.oak.security.authorization.permission; + +import com.google.common.collect.ImmutableSet; +import org.apache.jackrabbit.oak.api.PropertyState; +import org.apache.jackrabbit.oak.api.Root; +import org.apache.jackrabbit.oak.api.Tree; +import org.apache.jackrabbit.oak.commons.PathUtils; +import org.apache.jackrabbit.oak.plugins.memory.PropertyStates; +import org.apache.jackrabbit.oak.plugins.tree.ReadOnly; +import org.apache.jackrabbit.oak.spi.security.ConfigurationParameters; +import org.apache.jackrabbit.oak.spi.security.principal.AdminPrincipal; +import org.apache.jackrabbit.oak.spi.security.principal.PrincipalImpl; +import org.apache.jackrabbit.oak.spi.security.principal.SystemPrincipal; +import org.apache.jackrabbit.oak.spi.state.NodeBuilder; +import org.junit.Test; + +import java.security.Principal; +import java.util.Set; + +import static org.apache.jackrabbit.oak.spi.security.authorization.permission.PermissionConstants.PARAM_ADMINISTRATIVE_PRINCIPALS; +import static org.apache.jackrabbit.oak.spi.security.authorization.permission.PermissionConstants.REP_ACCESS_CONTROLLED_PATH; +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertNull; +import static org.junit.Assert.assertSame; +import static org.junit.Assert.assertTrue; +import static org.mockito.ArgumentMatchers.anyString; +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.never; +import static org.mockito.Mockito.times; +import static org.mockito.Mockito.verify; +import static org.mockito.Mockito.when; +import static org.mockito.Mockito.withSettings; + +public class PermissionUtilTest { + + @Test + public void testParentPathOrNull() { + for (String path : new String[] {"", PathUtils.ROOT_PATH, "a"}) { + assertNull(PermissionUtil.getParentPathOrNull(path)); + } + + assertEquals(PathUtils.ROOT_PATH, PermissionUtil.getParentPathOrNull("/single")); + + for (String path : new String[] {"/a/path", "/a/longer/path"}) { + assertEquals(PathUtils.getParentPath(path), PermissionUtil.getParentPathOrNull(path)); + } + } + + @Test + public void testCheckACLPath() { + Tree tree = mock(Tree.class); + String path = "/path"; + + when(tree.getProperty(REP_ACCESS_CONTROLLED_PATH)).thenReturn(null); + assertFalse(PermissionUtil.checkACLPath(tree, path)); + + PropertyState nonMatching = PropertyStates.createProperty(REP_ACCESS_CONTROLLED_PATH, "/another"); + when(tree.getProperty(REP_ACCESS_CONTROLLED_PATH)).thenReturn(nonMatching); + assertFalse(PermissionUtil.checkACLPath(tree, path)); + + PropertyState matching = PropertyStates.createProperty(REP_ACCESS_CONTROLLED_PATH, "/path"); + when(tree.getProperty(REP_ACCESS_CONTROLLED_PATH)).thenReturn(matching); + assertTrue(PermissionUtil.checkACLPath(tree, path)); + } + + @Test + public void testCheckACLPath2() { + NodeBuilder nb = mock(NodeBuilder.class); + String path = "/path"; + + when(nb.getProperty(REP_ACCESS_CONTROLLED_PATH)).thenReturn(null); + assertFalse(PermissionUtil.checkACLPath(nb, path)); + + PropertyState nonMatching = PropertyStates.createProperty(REP_ACCESS_CONTROLLED_PATH, "/another"); + when(nb.getProperty(REP_ACCESS_CONTROLLED_PATH)).thenReturn(nonMatching); + assertFalse(PermissionUtil.checkACLPath(nb, path)); + + PropertyState matching = PropertyStates.createProperty(REP_ACCESS_CONTROLLED_PATH, "/path"); + when(nb.getProperty(REP_ACCESS_CONTROLLED_PATH)).thenReturn(matching); + assertTrue(PermissionUtil.checkACLPath(nb, path)); + } + + @Test + public void testIsAdminOrSystem() { + ConfigurationParameters params = ConfigurationParameters.of(PARAM_ADMINISTRATIVE_PRINCIPALS, ImmutableSet.of("administrative")); + + Set<Principal> principals = ImmutableSet.of(new PrincipalImpl("name"), new PrincipalImpl("administrative")); + assertTrue(PermissionUtil.isAdminOrSystem(principals, params)); + assertFalse(PermissionUtil.isAdminOrSystem(principals, ConfigurationParameters.EMPTY)); + } + + @Test + public void testIsAdminOrSystemForAdminPrincipal() { + assertTrue(PermissionUtil.isAdminOrSystem(ImmutableSet.of(mock(AdminPrincipal.class)), ConfigurationParameters.EMPTY)); + assertTrue(PermissionUtil.isAdminOrSystem(ImmutableSet.of(new PrincipalImpl("name"), mock(AdminPrincipal.class)), ConfigurationParameters.EMPTY)); + } + + @Test + public void testIsAdminOrSystemForSystemPrincial() { + assertTrue(PermissionUtil.isAdminOrSystem(ImmutableSet.of(SystemPrincipal.INSTANCE), ConfigurationParameters.EMPTY)); + assertTrue(PermissionUtil.isAdminOrSystem(ImmutableSet.of(new PrincipalImpl("name"), SystemPrincipal.INSTANCE), ConfigurationParameters.EMPTY)); + } + + @Test + public void testGetPath() { + Tree t = when(mock(Tree.class).getPath()).thenReturn("/path").getMock(); + + assertNull(PermissionUtil.getPath(null, null)); + assertEquals("/path", PermissionUtil.getPath(t, null)); + assertEquals("/path", PermissionUtil.getPath(null, t)); + + Tree afterT = when(mock(Tree.class).getPath()).thenReturn("/afterPath").getMock(); + assertEquals("/path", PermissionUtil.getPath(t, afterT)); + } + + @Test + public void testGetReadOnlyTree() { + Tree readOnlyTree = mock(Tree.class, withSettings().extraInterfaces(ReadOnly.class)); + Root r = mock(Root.class); + + assertSame(readOnlyTree, PermissionUtil.getReadOnlyTree(readOnlyTree, r)); + verify(r, never()).getTree(anyString()); + } + + @Test + public void testGetReadOnlyTreeFromTree() { + Tree readOnlyTree = mock(Tree.class, withSettings().extraInterfaces(ReadOnly.class)); + + Root r = when(mock(Root.class).getTree("/path")).thenReturn(readOnlyTree).getMock(); + Tree t = when(mock(Tree.class).getPath()).thenReturn("/path").getMock(); + + assertSame(readOnlyTree, PermissionUtil.getReadOnlyTree(t, r)); + verify(r, times(1)).getTree("/path"); + } +} \ No newline at end of file Propchange: jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionUtilTest.java ------------------------------------------------------------------------------ svn:eol-style = native Modified: jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionValidatorTest.java URL: http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionValidatorTest.java?rev=1857999&r1=1857998&r2=1857999&view=diff ============================================================================== --- jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionValidatorTest.java (original) +++ jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionValidatorTest.java Tue Apr 23 09:34:55 2019 @@ -17,38 +17,58 @@ package org.apache.jackrabbit.oak.security.authorization.permission; import java.security.Principal; +import java.util.Set; import javax.jcr.security.AccessControlManager; import com.google.common.collect.ImmutableList; +import com.google.common.collect.ImmutableSet; +import jdk.nashorn.internal.runtime.regexp.joni.constants.NodeType; import org.apache.jackrabbit.JcrConstants; import org.apache.jackrabbit.api.security.JackrabbitAccessControlList; import org.apache.jackrabbit.commons.jackrabbit.authorization.AccessControlUtils; import org.apache.jackrabbit.oak.AbstractSecurityTest; import org.apache.jackrabbit.oak.api.CommitFailedException; import org.apache.jackrabbit.oak.api.ContentSession; +import org.apache.jackrabbit.oak.api.PropertyState; import org.apache.jackrabbit.oak.api.Root; import org.apache.jackrabbit.oak.api.Tree; import org.apache.jackrabbit.oak.api.Type; +import org.apache.jackrabbit.oak.commons.PathUtils; import org.apache.jackrabbit.oak.plugins.memory.PropertyStates; +import org.apache.jackrabbit.oak.plugins.tree.TreeUtil; +import org.apache.jackrabbit.oak.security.authorization.ProviderCtx; +import org.apache.jackrabbit.oak.spi.commit.MoveTracker; +import org.apache.jackrabbit.oak.spi.namespace.NamespaceConstants; +import org.apache.jackrabbit.oak.spi.nodetype.NodeTypeConstants; +import org.apache.jackrabbit.oak.spi.security.authorization.AuthorizationConfiguration; import org.apache.jackrabbit.oak.spi.security.authorization.accesscontrol.AccessControlConstants; +import org.apache.jackrabbit.oak.spi.security.authorization.permission.PermissionProvider; +import org.apache.jackrabbit.oak.spi.security.authorization.permission.TreePermission; import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeConstants; +import org.apache.jackrabbit.oak.spi.state.NodeState; +import org.apache.jackrabbit.oak.spi.version.VersionConstants; import org.apache.jackrabbit.oak.util.NodeUtil; +import org.jetbrains.annotations.NotNull; +import org.jetbrains.annotations.Nullable; import org.junit.After; import org.junit.Before; import org.junit.Test; import static org.apache.jackrabbit.JcrConstants.JCR_PRIMARYTYPE; import static org.apache.jackrabbit.JcrConstants.NT_UNSTRUCTURED; +import static org.apache.jackrabbit.oak.spi.version.VersionConstants.REP_VERSIONSTORAGE; +import static org.apache.jackrabbit.oak.spi.version.VersionConstants.VERSION_STORE_PATH; import static org.junit.Assert.assertEquals; import static org.junit.Assert.assertTrue; import static org.junit.Assert.fail; +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.when; public class PermissionValidatorTest extends AbstractSecurityTest { private static final String TEST_ROOT_PATH = "/testRoot"; private static final String TEST_CHILD_PATH = "/testRoot/child"; - private NodeUtil testRootNode; private Principal testPrincipal; @Before @@ -56,12 +76,16 @@ public class PermissionValidatorTest ext public void before() throws Exception { super.before(); - NodeUtil rootNode = new NodeUtil(root.getTree("/")); - testRootNode = rootNode.addChild("testRoot", NT_UNSTRUCTURED); - testRootNode.addChild("child", NT_UNSTRUCTURED); + Tree rootNode = root.getTree("/"); + Tree testTree = TreeUtil.addChild(rootNode, "testRoot", NT_UNSTRUCTURED); + TreeUtil.addChild(testTree, "child", NT_UNSTRUCTURED); root.commit(); testPrincipal = getTestUser().getPrincipal(); + + // grant the test session the ability to read/write that node but don't + // allow to modify access control content + grant(TEST_ROOT_PATH, PrivilegeConstants.JCR_READ, PrivilegeConstants.JCR_READ_ACCESS_CONTROL, PrivilegeConstants.REP_WRITE); } @After @@ -79,7 +103,7 @@ public class PermissionValidatorTest ext } } - private void grant(String path, String... privilegeNames) throws Exception { + private void grant(@Nullable String path, @NotNull String... privilegeNames) throws Exception { AccessControlManager acMgr = getAccessControlManager(root); JackrabbitAccessControlList acl = AccessControlUtils.getAccessControlList(acMgr, path); acl.addEntry(testPrincipal, AccessControlUtils.privilegesFromNames(acMgr, privilegeNames), true); @@ -87,21 +111,139 @@ public class PermissionValidatorTest ext root.commit(); } - @Test + private PermissionValidator createValidator(@NotNull Set<Principal> principals, @NotNull String path) { + Tree t = root.getTree(PathUtils.ROOT_PATH); + NodeState ns = getTreeProvider().asNodeState(t); + ProviderCtx ctx = mock(ProviderCtx.class); + when(ctx.getSecurityProvider()).thenReturn(getSecurityProvider()); + when(ctx.getTreeProvider()).thenReturn(getTreeProvider()); + + String wspName = root.getContentSession().getWorkspaceName(); + PermissionProvider pp = getConfig(AuthorizationConfiguration.class).getPermissionProvider(root, wspName, principals); + + PermissionValidatorProvider pvp = new PermissionValidatorProvider(wspName, principals, new MoveTracker(), ctx); + PermissionValidator validator = new PermissionValidator(ns, ns, pp, pvp); + TreePermission tp = pp.getTreePermission(t, TreePermission.EMPTY); + for (String name : PathUtils.elements(path)) { + t = t.getChild(name); + ns = ns.getChildNode(name); + tp = tp.getChildPermission(name, ns); + validator = new PermissionValidator(t, t, tp, validator); + } + return validator; + } + + @Test(expected = CommitFailedException.class) + public void testLockPermissions() throws Exception { + try (ContentSession testSession = createTestSession()) { + Root testRoot = testSession.getLatestRoot(); + Tree testChild = testRoot.getTree(TEST_CHILD_PATH); + testChild.setProperty(PropertyStates.createProperty(JcrConstants.JCR_LOCKOWNER, "lockOwner")); + testRoot.commit(); + } catch (CommitFailedException e) { + assertTrue(e.isAccessViolation()); + assertEquals(0, e.getCode()); + throw e; + } + } + + @Test(expected = CommitFailedException.class) + public void testRepositoryPermissionsNamespaces() throws Exception { + try (ContentSession testSession = createTestSession()) { + PermissionValidator validator = createValidator(testSession.getAuthInfo().getPrincipals(), NamespaceConstants.NAMESPACES_PATH); + validator.childNodeAdded("any", mock(NodeState.class)); + } catch (CommitFailedException e) { + assertTrue(e.isAccessViolation()); + assertEquals(0, e.getCode()); + throw e; + } + } + + @Test(expected = CommitFailedException.class) + public void testRepositoryPermissionsNodeTypes() throws Exception { + try (ContentSession testSession = createTestSession()) { + PermissionValidator validator = createValidator(testSession.getAuthInfo().getPrincipals(), NodeTypeConstants.NODE_TYPES_PATH); + validator.childNodeDeleted("any", mock(NodeState.class)); + } catch (CommitFailedException e) { + assertTrue(e.isAccessViolation()); + assertEquals(0, e.getCode()); + throw e; + } + } + + @Test(expected = CommitFailedException.class) + public void testRepositoryPermissionsPrivileges() throws Exception { + try (ContentSession testSession = createTestSession()) { + PermissionValidator validator = createValidator(testSession.getAuthInfo().getPrincipals(), PrivilegeConstants.PRIVILEGES_PATH); + validator.propertyAdded(PropertyStates.createProperty("any", "value")); + } catch (CommitFailedException e) { + assertTrue(e.isAccessViolation()); + assertEquals(0, e.getCode()); + throw e; + } + } + + @Test(expected = CommitFailedException.class) + public void testRemoveVersionStorageTree() throws Exception { + Tree t = root.getTree(PathUtils.ROOT_PATH); + NodeState ns = getTreeProvider().asNodeState(t); + ProviderCtx ctx = mock(ProviderCtx.class); + when(ctx.getSecurityProvider()).thenReturn(getSecurityProvider()); + when(ctx.getTreeProvider()).thenReturn(getTreeProvider()); + + PermissionValidatorProvider pvp = new PermissionValidatorProvider("wspName", ImmutableSet.of(), new MoveTracker(), ctx); + PermissionValidator validator = new PermissionValidator(ns, ns, mock(PermissionProvider.class), pvp); + for (String name : PathUtils.elements(VERSION_STORE_PATH)) { + t = t.getChild(name); + ns = ns.getChildNode(name); + validator = new PermissionValidator(t, t, TreePermission.EMPTY, validator); + } + try { + TreeUtil.addChild(t, "any", REP_VERSIONSTORAGE); + validator.childNodeDeleted("any", mock(NodeState.class)); + } catch (CommitFailedException e) { + assertTrue(e.isAccessViolation()); + assertEquals(22, e.getCode()); + throw e; + } + } + + @Test(expected = CommitFailedException.class) + public void testAddVersionStorageTreeWithoutHistory() throws Exception { + PermissionValidator validator = createValidator(ImmutableSet.of(), VERSION_STORE_PATH); + try { + Tree t = root.getTree(VERSION_STORE_PATH); + TreeUtil.addChild(t, "any", REP_VERSIONSTORAGE); + validator.childNodeAdded("any", mock(NodeState.class)); + } catch (CommitFailedException e) { + assertTrue(e.isAccessViolation()); + assertEquals(21, e.getCode()); + throw e; + } + } + + @Test(expected = CommitFailedException.class) + public void testAddVersionStorageTreeUnexpectedNode() throws Exception { + PermissionValidator validator = createValidator(ImmutableSet.of(), VERSION_STORE_PATH); + try { + Tree t = root.getTree(VERSION_STORE_PATH); + Tree storageT = TreeUtil.addChild(t, "any", REP_VERSIONSTORAGE); + Tree unexpectedType = TreeUtil.addChild(storageT, "unexpected", NT_UNSTRUCTURED); + validator.childNodeAdded("any", mock(NodeState.class)); + } catch (CommitFailedException e) { + assertTrue(e.isOfType("Misc")); + assertEquals(0, e.getCode()); + throw e; + } + } + + @Test(expected = CommitFailedException.class) public void testChangePrimaryTypeToPolicyNode() throws Exception { // create a rep:policy node that is not detected as access control content - testRootNode.getChild("child").addChild(AccessControlConstants.REP_POLICY, NT_UNSTRUCTURED); + TreeUtil.addChild(root.getTree(TEST_CHILD_PATH), AccessControlConstants.REP_POLICY, NT_UNSTRUCTURED); root.commit(); - // grant the test session the ability to read/write that node but don't - // allow to modify access control content - grant(TEST_ROOT_PATH, - PrivilegeConstants.JCR_READ, - PrivilegeConstants.JCR_READ_ACCESS_CONTROL, - PrivilegeConstants.REP_WRITE); - - ContentSession testSession = createTestSession(); - try { + try (ContentSession testSession = createTestSession()) { Root testRoot = testSession.getLatestRoot(); Tree testChild = testRoot.getTree(TEST_CHILD_PATH); @@ -111,12 +253,10 @@ public class PermissionValidatorTest ext testPolicy.setOrderableChildren(true); testPolicy.setProperty(JCR_PRIMARYTYPE, AccessControlConstants.NT_REP_ACL, Type.NAME); testRoot.commit(); - fail("Turning a false policy node into access control content requires the ability to write AC content."); } catch (CommitFailedException e) { assertTrue(e.isAccessViolation()); assertEquals(0, e.getCode()); - } finally { - testSession.close(); + throw e; } } } \ No newline at end of file Modified: jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/PrincipalPermissionEntriesTest.java URL: http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/PrincipalPermissionEntriesTest.java?rev=1857999&r1=1857998&r2=1857999&view=diff ============================================================================== --- jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/PrincipalPermissionEntriesTest.java (original) +++ jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/PrincipalPermissionEntriesTest.java Tue Apr 23 09:34:55 2019 @@ -199,10 +199,27 @@ public class PrincipalPermissionEntriesT assertEquals(2, ppe.getSize()); } - private static final long inspectExpectedSize(@NotNull PrincipalPermissionEntries ppe) throws Exception { + @Test + public void testEmptyPathsWithMaxSize() throws Exception { + PrincipalPermissionEntries ppe = new PrincipalPermissionEntries(); + assertEquals(0, inspectEmptyPathSize(ppe)); + for (int i = 0; i<1010; i++) { + ppe.rememberNotAccessControlled("/path" +i); + } + assertEquals(1000, inspectEmptyPathSize(ppe)); + } + + private static long inspectExpectedSize(@NotNull PrincipalPermissionEntries ppe) throws Exception { Field f = PrincipalPermissionEntries.class.getDeclaredField("expectedSize"); f.setAccessible(true); return (long) f.get(ppe); } + + private static int inspectEmptyPathSize(@NotNull PrincipalPermissionEntries ppe) throws Exception { + Field f = PrincipalPermissionEntries.class.getDeclaredField("emptyPaths"); + f.setAccessible(true); + + return ((Map)f.get(ppe)).size(); + } } Added: jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/ReadStatusTest.java URL: http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/ReadStatusTest.java?rev=1857999&view=auto ============================================================================== --- jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/ReadStatusTest.java (added) +++ jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/ReadStatusTest.java Tue Apr 23 09:34:55 2019 @@ -0,0 +1,177 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.jackrabbit.oak.security.authorization.permission; + +import org.apache.jackrabbit.oak.AbstractSecurityTest; +import org.apache.jackrabbit.oak.spi.security.authorization.permission.Permissions; +import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionPattern; +import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeBitsProvider; +import org.jetbrains.annotations.NotNull; +import org.junit.Before; +import org.junit.Test; + +import static org.apache.jackrabbit.oak.security.authorization.permission.ReadStatus.ALLOW_ALL; +import static org.apache.jackrabbit.oak.security.authorization.permission.ReadStatus.DENY_ALL; +import static org.apache.jackrabbit.oak.security.authorization.permission.ReadStatus.DENY_THIS; +import static org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeConstants.JCR_ALL; +import static org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeConstants.JCR_READ; +import static org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeConstants.REP_READ_NODES; +import static org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeConstants.REP_READ_PROPERTIES; +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertSame; +import static org.junit.Assert.assertTrue; +import static org.mockito.Mockito.mock; + +public class ReadStatusTest extends AbstractSecurityTest { + + private PrivilegeBitsProvider bitsProvider; + + private PermissionEntry grantAll; + private PermissionEntry denyAll; + + @Before + @Override + public void before() throws Exception { + super.before(); + bitsProvider = new PrivilegeBitsProvider(root); + + grantAll = createPermissionEntry(true, JCR_ALL); + denyAll = createPermissionEntry(false, JCR_ALL); + } + + @NotNull + private PermissionEntry createPermissionEntry(boolean isAllow, @NotNull String... privNames) { + return createPermissionEntry(isAllow, RestrictionPattern.EMPTY, privNames); + } + + @NotNull + private PermissionEntry createPermissionEntry(boolean isAllow, @NotNull RestrictionPattern pattern, @NotNull String... privNames) { + return new PermissionEntry("/path", isAllow, 0, bitsProvider.getBits(privNames), pattern); + } + + private static void assertDenied(@NotNull ReadStatus rs) { + assertFalse(rs.allowsThis()); + assertFalse(rs.allowsProperties()); + assertFalse(rs.allowsAll()); + } + + private static void assertAllowed(@NotNull ReadStatus rs, boolean canReadProperties) { + assertTrue(rs.allowsThis()); + assertEquals(canReadProperties, rs.allowsProperties()); + assertFalse(rs.allowsAll()); + } + + @Test + public void testSkippedAllowed() { + ReadStatus rs = ReadStatus.create(grantAll, Permissions.ALL, true); + + assertAllowed(rs, false); + assertSame(rs, ReadStatus.create(grantAll, Permissions.READ, true)); + } + + @Test + public void testSkippedDenied() { + ReadStatus rs = ReadStatus.create(denyAll, Permissions.ALL, true); + + assertDenied(rs); + assertSame(rs, ReadStatus.create(denyAll, Permissions.READ, true)); + } + + @Test + public void testReadAcTargetPermissionAllow() { + ReadStatus rs = ReadStatus.create(grantAll, Permissions.READ_ACCESS_CONTROL, false); + + assertAllowed(rs, false); + assertSame(rs, ReadStatus.create(grantAll, Permissions.READ_ACCESS_CONTROL, true)); + } + + @Test + public void testReadAcTargetPermissionDeny() { + ReadStatus rs = ReadStatus.create(denyAll, Permissions.READ_ACCESS_CONTROL, false); + + assertDenied(rs); + assertSame(rs, ReadStatus.create(denyAll, Permissions.READ_ACCESS_CONTROL, true)); + } + + @Test + public void testNonEmptyPatternAllow() { + PermissionEntry entry = createPermissionEntry(true, mock(RestrictionPattern.class), JCR_ALL); + ReadStatus rs = ReadStatus.create(entry, Permissions.ALL, false); + + assertAllowed(rs, false); + } + + @Test + public void testNonEmptyPatternDeny() { + PermissionEntry entry = createPermissionEntry(false, mock(RestrictionPattern.class), JCR_ALL); + ReadStatus rs = ReadStatus.create(entry, Permissions.ALL, false); + + assertDenied(rs); + } + + @Test + public void testOnlyReadNodesGranted() { + PermissionEntry entry = createPermissionEntry(true, REP_READ_NODES); + ReadStatus rs = ReadStatus.create(entry, Permissions.ALL, false); + + assertAllowed(rs, false); + } + + @Test + public void testOnlyReadNodesDenied() { + PermissionEntry entry = createPermissionEntry(false, REP_READ_NODES); + ReadStatus rs = ReadStatus.create(entry, Permissions.ALL, false); + + assertDenied(rs); + assertSame(DENY_THIS, rs); + } + + @Test + public void testOnlyReadPropertiesGranted() { + PermissionEntry entry = createPermissionEntry(true, REP_READ_PROPERTIES); + ReadStatus rs = ReadStatus.create(entry, Permissions.ALL, false); + + assertAllowed(rs, true); + } + + @Test + public void testOnlyReadPropertiesDenied() { + PermissionEntry entry = createPermissionEntry(false, REP_READ_PROPERTIES); + ReadStatus rs = ReadStatus.create(entry, Permissions.ALL, false); + + assertDenied(rs); + } + + @Test + public void testReadGranted() { + PermissionEntry entry = createPermissionEntry(true, JCR_READ); + ReadStatus rs = ReadStatus.create(entry, Permissions.ALL, false); + + assertAllowed(rs, true); + assertSame(ALLOW_ALL, rs); + } + + @Test + public void testReadDenied() { + PermissionEntry entry = createPermissionEntry(false, JCR_READ); + ReadStatus rs = ReadStatus.create(entry, Permissions.ALL, false); + + assertDenied(rs); + assertSame(DENY_ALL, rs); + } +} \ No newline at end of file Propchange: jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/ReadStatusTest.java ------------------------------------------------------------------------------ svn:eol-style = native Modified: jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/VersionTreePermissionTest.java URL: http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/VersionTreePermissionTest.java?rev=1857999&r1=1857998&r2=1857999&view=diff ============================================================================== --- jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/VersionTreePermissionTest.java (original) +++ jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/VersionTreePermissionTest.java Tue Apr 23 09:34:55 2019 @@ -25,6 +25,7 @@ import javax.jcr.security.AccessControlM import com.google.common.collect.ImmutableSet; import org.apache.jackrabbit.commons.jackrabbit.authorization.AccessControlUtils; import org.apache.jackrabbit.oak.AbstractSecurityTest; +import org.apache.jackrabbit.oak.api.PropertyState; import org.apache.jackrabbit.oak.api.Root; import org.apache.jackrabbit.oak.api.Tree; import org.apache.jackrabbit.oak.commons.PathUtils; @@ -48,6 +49,9 @@ import static com.google.common.base.Pre import static org.junit.Assert.assertEquals; import static org.junit.Assert.assertFalse; import static org.junit.Assert.assertTrue; +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.times; +import static org.mockito.Mockito.verify; public class VersionTreePermissionTest extends AbstractSecurityTest implements NodeTypeConstants { @@ -261,4 +265,61 @@ public class VersionTreePermissionTest e tp = pp.getTreePermission(frozenC, tp); assertVersionPermission(tp, "/test/a/b/c", true); } + + @Test + public void testCanRead() { + TreePermission versionableTreePermission = mock(TreePermission.class); + VersionTreePermission vtp = new VersionTreePermission(mock(Tree.class), versionableTreePermission, getTreeProvider()); + + vtp.canRead(); + verify(versionableTreePermission, times(1)).canRead(); + } + + @Test + public void testCanReadProperty() { + TreePermission versionableTreePermission = mock(TreePermission.class); + VersionTreePermission vtp = new VersionTreePermission(mock(Tree.class), versionableTreePermission, getTreeProvider()); + + PropertyState ps = mock(PropertyState.class); + vtp.canRead(ps); + verify(versionableTreePermission, times(1)).canRead(ps); + } + + @Test + public void testCanReadAll() { + TreePermission versionableTreePermission = mock(TreePermission.class); + VersionTreePermission vtp = new VersionTreePermission(mock(Tree.class), versionableTreePermission, getTreeProvider()); + + vtp.canReadAll(); + verify(versionableTreePermission, times(1)).canReadAll(); + } + + @Test + public void testCanReadProperties() { + TreePermission versionableTreePermission = mock(TreePermission.class); + VersionTreePermission vtp = new VersionTreePermission(mock(Tree.class), versionableTreePermission, getTreeProvider()); + + vtp.canReadProperties(); + verify(versionableTreePermission, times(1)).canReadProperties(); + } + + @Test + public void testIsGranted() { + TreePermission versionableTreePermission = mock(TreePermission.class); + VersionTreePermission vtp = new VersionTreePermission(mock(Tree.class), versionableTreePermission, getTreeProvider()); + + vtp.isGranted(Permissions.ALL); + verify(versionableTreePermission, times(1)).isGranted(Permissions.ALL); + } + + @Test + public void testIsGrantedProperty() { + TreePermission versionableTreePermission = mock(TreePermission.class); + VersionTreePermission vtp = new VersionTreePermission(mock(Tree.class), versionableTreePermission, getTreeProvider()); + + PropertyState ps = mock(PropertyState.class); + + vtp.isGranted(Permissions.ALL, ps); + verify(versionableTreePermission, times(1)).isGranted(Permissions.ALL, ps); + } }
