Author: angela
Date: Fri Apr 26 10:26:13 2019
New Revision: 1858190
URL: http://svn.apache.org/viewvc?rev=1858190&view=rev
Log:
OAK-8281 : Improve coverage for
org.apache.jackrabbit.oak.security.authorization.composite
Added:
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositeProviderGetTreePermissionTest.java
(with props)
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositeProviderSupportedTest.java
(with props)
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositionTypeTest.java
(with props)
Modified:
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/AbstractCompositeProviderTest.java
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositeAccessControlManagerTest.java
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositeTreePermissionTest.java
Modified:
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/AbstractCompositeProviderTest.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/AbstractCompositeProviderTest.java?rev=1858190&r1=1858189&r2=1858190&view=diff
==============================================================================
---
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/AbstractCompositeProviderTest.java
(original)
+++
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/AbstractCompositeProviderTest.java
Fri Apr 26 10:26:13 2019
@@ -16,13 +16,6 @@
*/
package org.apache.jackrabbit.oak.security.authorization.composite;
-import java.security.Principal;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import javax.jcr.Session;
-import javax.jcr.security.AccessControlManager;
-
import com.google.common.collect.ImmutableList;
import com.google.common.collect.ImmutableMap;
import com.google.common.collect.ImmutableSet;
@@ -53,6 +46,13 @@ import org.jetbrains.annotations.NotNull
import org.jetbrains.annotations.Nullable;
import org.junit.Test;
+import javax.jcr.Session;
+import javax.jcr.security.AccessControlManager;
+import java.security.Principal;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertFalse;
import static org.junit.Assert.assertSame;
@@ -598,7 +598,7 @@ public abstract class AbstractCompositeP
}
@Test
- public void testGetRepositoryPermissionInstance() throws Exception {
+ public void testGetRepositoryPermissionInstance() {
RepositoryPermission rp =
createPermissionProvider().getRepositoryPermission();
assertTrue(rp.getClass().getName().endsWith("CompositeRepositoryPermission"));
RepositoryPermission rpO =
createPermissionProviderOR().getRepositoryPermission();
@@ -606,7 +606,7 @@ public abstract class AbstractCompositeP
}
@Test
- public void testRepositoryPermissionIsNotGranted() throws Exception {
+ public void testRepositoryPermissionIsNotGranted() {
RepositoryPermission rp =
createPermissionProvider().getRepositoryPermission();
assertFalse(rp.isGranted(Permissions.PRIVILEGE_MANAGEMENT));
assertFalse(rp.isGranted(Permissions.NAMESPACE_MANAGEMENT|Permissions.PRIVILEGE_MANAGEMENT));
Modified:
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositeAccessControlManagerTest.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositeAccessControlManagerTest.java?rev=1858190&r1=1858189&r2=1858190&view=diff
==============================================================================
---
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositeAccessControlManagerTest.java
(original)
+++
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositeAccessControlManagerTest.java
Fri Apr 26 10:26:13 2019
@@ -16,37 +16,51 @@
*/
package org.apache.jackrabbit.oak.security.authorization.composite;
-import java.util.Collections;
-import java.util.List;
-import java.util.Set;
-import javax.jcr.security.AccessControlException;
-import javax.jcr.security.AccessControlList;
-import javax.jcr.security.AccessControlManager;
-import javax.jcr.security.AccessControlPolicy;
-import javax.jcr.security.AccessControlPolicyIterator;
-import javax.jcr.security.Privilege;
-
import com.google.common.collect.ImmutableList;
import com.google.common.collect.ImmutableSet;
import com.google.common.collect.Sets;
import org.apache.jackrabbit.JcrConstants;
import org.apache.jackrabbit.api.security.JackrabbitAccessControlList;
+import org.apache.jackrabbit.api.security.JackrabbitAccessControlManager;
+import org.apache.jackrabbit.api.security.JackrabbitAccessControlPolicy;
import
org.apache.jackrabbit.commons.iterator.AccessControlPolicyIteratorAdapter;
import org.apache.jackrabbit.oak.AbstractSecurityTest;
import org.apache.jackrabbit.oak.api.Tree;
+import org.apache.jackrabbit.oak.commons.PathUtils;
import org.apache.jackrabbit.oak.namepath.NamePathMapper;
+import org.apache.jackrabbit.oak.plugins.tree.TreeUtil;
import org.apache.jackrabbit.oak.spi.nodetype.NodeTypeConstants;
import
org.apache.jackrabbit.oak.spi.security.authorization.accesscontrol.PolicyOwner;
import org.apache.jackrabbit.oak.spi.security.principal.EveryonePrincipal;
import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeConstants;
-import org.apache.jackrabbit.oak.util.NodeUtil;
import org.jetbrains.annotations.NotNull;
import org.junit.Test;
+import javax.jcr.security.AccessControlException;
+import javax.jcr.security.AccessControlList;
+import javax.jcr.security.AccessControlManager;
+import javax.jcr.security.AccessControlPolicy;
+import javax.jcr.security.AccessControlPolicyIterator;
+import javax.jcr.security.Privilege;
+import java.security.Principal;
+import java.util.Collections;
+import java.util.Set;
+
+import static org.junit.Assert.assertArrayEquals;
import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
import static org.junit.Assert.assertSame;
import static org.junit.Assert.assertTrue;
import static org.junit.Assert.fail;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyZeroInteractions;
+import static org.mockito.Mockito.when;
+import static org.mockito.Mockito.withSettings;
public class CompositeAccessControlManagerTest extends AbstractSecurityTest {
@@ -58,11 +72,10 @@ public class CompositeAccessControlManag
public void before() throws Exception {
super.before();
- List<AccessControlManager> acMgrs =
ImmutableList.of(getAccessControlManager(root), new TestAcMgr());
- acMgr = new CompositeAccessControlManager(root,
NamePathMapper.DEFAULT, getSecurityProvider(), acMgrs);
+ acMgr = createComposite(getAccessControlManager(root), new
TestAcMgr());
- NodeUtil node = new NodeUtil(root.getTree("/"));
- node.addChild("test", NodeTypeConstants.NT_OAK_UNSTRUCTURED);
+ Tree tree = root.getTree(PathUtils.ROOT_PATH);
+ TreeUtil.addChild(tree,"test", NodeTypeConstants.NT_OAK_UNSTRUCTURED);
root.commit();
}
@@ -78,6 +91,11 @@ public class CompositeAccessControlManag
}
}
+ @NotNull
+ private CompositeAccessControlManager createComposite(@NotNull
AccessControlManager... acMgrs) {
+ return new CompositeAccessControlManager(root, NamePathMapper.DEFAULT,
getSecurityProvider(), ImmutableList.copyOf(acMgrs));
+ }
+
@Test
public void testGetSupportedPrivileges() throws Exception {
Set<Privilege> expected =
ImmutableSet.copyOf(getPrivilegeManager(root).getRegisteredPrivileges());
@@ -104,6 +122,18 @@ public class CompositeAccessControlManag
}
@Test
+ public void testGetApplicablePoliciesNotPolicyOwner() throws Exception {
+ AccessControlPolicy policy = mock(AccessControlPolicy.class);
+ AccessControlManager mgr =
when(mock(AccessControlManager.class).getApplicablePolicies(anyString())).thenReturn(new
AccessControlPolicyIteratorAdapter(ImmutableSet.of(policy))).getMock();
+
+ CompositeAccessControlManager composite = createComposite(mgr);
+ AccessControlPolicyIterator it =
composite.getApplicablePolicies(PathUtils.ROOT_PATH);
+ assertFalse(it.hasNext());
+
+ verify(mgr, never()).getApplicablePolicies(PathUtils.ROOT_PATH);
+ }
+
+ @Test
public void testGetPolicies() throws Exception {
int len = 0;
AccessControlPolicy[] policies = acMgr.getPolicies(TEST_PATH);
@@ -181,6 +211,35 @@ public class CompositeAccessControlManag
assertEquals(2, cnt);
}
+ @Test(expected = AccessControlException.class)
+ public void testSetPoliciesNotPolicyOwner() throws Exception {
+ AccessControlPolicy policy = mock(AccessControlPolicy.class);
+ AccessControlManager mgr =
when(mock(AccessControlManager.class).getPolicies(anyString())).thenReturn(new
AccessControlPolicy[] {policy}).getMock();
+
+ try {
+ CompositeAccessControlManager composite = createComposite(mgr);
+ composite.setPolicy(PathUtils.ROOT_PATH, policy);
+ } finally {
+ verify(mgr, never()).setPolicy(PathUtils.ROOT_PATH, policy);
+ }
+ }
+
+ @Test(expected = AccessControlException.class)
+ public void testSetPoliciesPolicyOwnerPathNotDefined() throws Exception {
+ AccessControlPolicy policy = mock(AccessControlPolicy.class);
+ AccessControlManager mgr = mock(AccessControlManager.class,
withSettings().extraInterfaces(PolicyOwner.class));
+ when(mgr.getPolicies(anyString())).thenReturn(new
AccessControlPolicy[] {policy}).getMock();
+ when(((PolicyOwner) mgr).defines(anyString(),
any(AccessControlPolicy.class))).thenReturn(false);
+
+ try {
+ CompositeAccessControlManager composite = createComposite(mgr);
+ composite.setPolicy(PathUtils.ROOT_PATH, policy);
+ } finally {
+ verify(mgr, never()).setPolicy(PathUtils.ROOT_PATH, policy);
+ verify(((PolicyOwner) mgr), times(1)).defines(PathUtils.ROOT_PATH,
policy);
+ }
+ }
+
@Test
public void testRemovePolicy() throws Exception {
AccessControlPolicyIterator it =
acMgr.getApplicablePolicies(TEST_PATH);
@@ -201,6 +260,129 @@ public class CompositeAccessControlManag
assertEquals(0, acMgr.getPolicies(TEST_PATH).length);
}
+ @Test(expected = AccessControlException.class)
+ public void testRemovePoliciesNotPolicyOwner() throws Exception {
+ AccessControlPolicy policy = mock(AccessControlPolicy.class);
+ AccessControlManager mgr =
when(mock(AccessControlManager.class).getPolicies(anyString())).thenReturn(new
AccessControlPolicy[] {policy}).getMock();
+
+ try {
+ CompositeAccessControlManager composite = createComposite(mgr);
+ composite.removePolicy(PathUtils.ROOT_PATH, policy);
+ } finally {
+ verify(mgr, never()).removePolicy(PathUtils.ROOT_PATH, policy);
+ }
+ }
+
+ @Test(expected = AccessControlException.class)
+ public void testRemovePoliciesPolicyOwnerPathNotDefined() throws Exception
{
+ AccessControlPolicy policy = mock(AccessControlPolicy.class);
+ AccessControlManager mgr = mock(AccessControlManager.class,
withSettings().extraInterfaces(PolicyOwner.class));
+ when(mgr.getPolicies(anyString())).thenReturn(new
AccessControlPolicy[] {policy}).getMock();
+ when(((PolicyOwner) mgr).defines(anyString(),
any(AccessControlPolicy.class))).thenReturn(false);
+
+ try {
+ CompositeAccessControlManager composite = createComposite(mgr);
+ composite.removePolicy(PathUtils.ROOT_PATH, policy);
+ } finally {
+ verify(mgr, never()).removePolicy(PathUtils.ROOT_PATH, policy);
+ verify(((PolicyOwner) mgr), times(1)).defines(PathUtils.ROOT_PATH,
policy);
+ }
+ }
+
+ @Test
+ public void testGetApplicablePoliciesByPrincipalNotOwnerPolicy() throws
Exception {
+ JackrabbitAccessControlPolicy policy =
mock(JackrabbitAccessControlPolicy.class);
+ JackrabbitAccessControlManager mgr =
mock(JackrabbitAccessControlManager.class);
+ when(mgr.getApplicablePolicies(any(Principal.class))).thenReturn(new
JackrabbitAccessControlPolicy[] {policy}).getMock();
+
+ CompositeAccessControlManager composite = createComposite(mgr);
+ JackrabbitAccessControlPolicy[] applicable =
composite.getApplicablePolicies(EveryonePrincipal.getInstance());
+ assertEquals(0, applicable.length);
+
+ verify(mgr,
never()).getApplicablePolicies(EveryonePrincipal.getInstance());
+ }
+
+ @Test
+ public void testGetApplicablePoliciesByPrincipalNotJackrabbitAcMgr()
throws Exception {
+ AccessControlManager mgr = mock(AccessControlManager.class,
withSettings().extraInterfaces(PolicyOwner.class));
+
+ CompositeAccessControlManager composite = createComposite(mgr);
+ JackrabbitAccessControlPolicy[] applicable =
composite.getApplicablePolicies(EveryonePrincipal.getInstance());
+ assertEquals(0, applicable.length);
+
+ verifyZeroInteractions(mgr);
+ }
+
+ @Test
+ public void testGetApplicablePoliciesByPrincipal() throws Exception {
+ JackrabbitAccessControlPolicy policy =
mock(JackrabbitAccessControlPolicy.class);
+ JackrabbitAccessControlManager mgr =
mock(JackrabbitAccessControlManager.class,
withSettings().extraInterfaces(PolicyOwner.class));
+ when(mgr.getApplicablePolicies(any(Principal.class))).thenReturn(new
JackrabbitAccessControlPolicy[] {policy}).getMock();
+
+ CompositeAccessControlManager composite = createComposite(mgr);
+ JackrabbitAccessControlPolicy[] applicable =
composite.getApplicablePolicies(EveryonePrincipal.getInstance());
+ assertArrayEquals(new JackrabbitAccessControlPolicy[] {policy},
applicable);
+
+ verify(mgr,
times(1)).getApplicablePolicies(EveryonePrincipal.getInstance());
+ }
+
+ @Test
+ public void testGetPoliciesByPrincipalNotPolicyOwner() throws Exception {
+ AccessControlManager mgr = mock(AccessControlManager.class);
+
+ CompositeAccessControlManager composite = createComposite(mgr);
+ assertEquals(0,
composite.getPolicies(EveryonePrincipal.getInstance()).length);
+
+ verifyZeroInteractions(mgr);
+ }
+
+ @Test
+ public void testGetPoliciesByPrincipalNotJackrabbitAcMgr() throws
Exception {
+ JackrabbitAccessControlPolicy policy =
mock(JackrabbitAccessControlPolicy.class);
+ JackrabbitAccessControlManager mgr =
mock(JackrabbitAccessControlManager.class);
+ when(mgr.getPolicies(any(Principal.class))).thenReturn(new
JackrabbitAccessControlPolicy[] {policy}).getMock();
+
+ CompositeAccessControlManager composite = createComposite(mgr);
+ assertArrayEquals(new JackrabbitAccessControlPolicy[] {policy},
composite.getPolicies(EveryonePrincipal.getInstance()));
+
+ verify(mgr, times(1)).getPolicies(EveryonePrincipal.getInstance());
+ }
+
+ @Test
+ public void testGetPoliciesByPrincipal() throws Exception {
+ JackrabbitAccessControlPolicy policy =
mock(JackrabbitAccessControlPolicy.class);
+ JackrabbitAccessControlManager mgr =
mock(JackrabbitAccessControlManager.class,
withSettings().extraInterfaces(PolicyOwner.class));
+ when(mgr.getPolicies(any(Principal.class))).thenReturn(new
JackrabbitAccessControlPolicy[] {policy}).getMock();
+
+ CompositeAccessControlManager composite = createComposite(mgr);
+ assertArrayEquals(new JackrabbitAccessControlPolicy[] {policy},
composite.getPolicies(EveryonePrincipal.getInstance()));
+
+ verify(mgr, times(1)).getPolicies(EveryonePrincipal.getInstance());
+ }
+
+ @Test
+ public void testEffectivePoliciesByPrincipalNotJackrabbitAcMgr() throws
Exception {
+ AccessControlManager mgr = mock(AccessControlManager.class);
+
+ Set<Principal> principalSet =
ImmutableSet.of(EveryonePrincipal.getInstance());
+ CompositeAccessControlManager composite = createComposite(mgr);
+ assertEquals(0, composite.getEffectivePolicies(principalSet).length);
+
+ verifyZeroInteractions(mgr);
+ }
+
+ @Test
+ public void testEffectivePoliciesByPrincipal() throws Exception {
+ JackrabbitAccessControlPolicy policy =
mock(JackrabbitAccessControlPolicy.class);
+ JackrabbitAccessControlManager mgr =
mock(JackrabbitAccessControlManager.class,
withSettings().extraInterfaces(PolicyOwner.class));
+ when(mgr.getEffectivePolicies(any(Set.class))).thenReturn(new
JackrabbitAccessControlPolicy[] {policy});
+
+ Set<Principal> principalSet =
ImmutableSet.of(EveryonePrincipal.getInstance());
+ CompositeAccessControlManager composite = createComposite(mgr);
+ assertArrayEquals(new JackrabbitAccessControlPolicy[] {policy},
composite.getEffectivePolicies(principalSet));
+
+ verify(mgr, times(1)).getEffectivePolicies(principalSet);
+ }
private final static class TestAcMgr implements AccessControlManager,
PolicyOwner {
Added:
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositeProviderGetTreePermissionTest.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositeProviderGetTreePermissionTest.java?rev=1858190&view=auto
==============================================================================
---
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositeProviderGetTreePermissionTest.java
(added)
+++
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositeProviderGetTreePermissionTest.java
Fri Apr 26 10:26:13 2019
@@ -0,0 +1,140 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.jackrabbit.oak.security.authorization.composite;
+
+import com.google.common.collect.ImmutableList;
+import org.apache.jackrabbit.JcrConstants;
+import org.apache.jackrabbit.oak.AbstractSecurityTest;
+import org.apache.jackrabbit.oak.api.Tree;
+import org.apache.jackrabbit.oak.commons.PathUtils;
+import org.apache.jackrabbit.oak.plugins.tree.TreeType;
+import org.apache.jackrabbit.oak.plugins.tree.TreeTypeProvider;
+import org.apache.jackrabbit.oak.spi.nodetype.NodeTypeConstants;
+import org.apache.jackrabbit.oak.spi.security.Context;
+import
org.apache.jackrabbit.oak.spi.security.authorization.permission.AggregatedPermissionProvider;
+import
org.apache.jackrabbit.oak.spi.security.authorization.permission.TreePermission;
+import org.apache.jackrabbit.oak.spi.state.NodeState;
+import org.jetbrains.annotations.NotNull;
+import org.junit.Test;
+
+import static
org.apache.jackrabbit.oak.security.authorization.composite.CompositeAuthorizationConfiguration.CompositionType.AND;
+import static
org.apache.jackrabbit.oak.security.authorization.composite.CompositeAuthorizationConfiguration.CompositionType.OR;
+import static org.junit.Assert.assertSame;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+public class CompositeProviderGetTreePermissionTest extends
AbstractSecurityTest {
+
+ private CompositePermissionProvider createProvider(@NotNull
CompositeAuthorizationConfiguration.CompositionType compositionType,
+ @NotNull
AggregatedPermissionProvider... providers) {
+ return new CompositePermissionProvider(root,
ImmutableList.copyOf(providers), Context.DEFAULT, compositionType,
getRootProvider(), getTreeProvider());
+ }
+
+ @Test
+ public void testEmptyProvidersRootTree() {
+ AggregatedPermissionProvider composite = createProvider(OR);
+
+ Tree rootTree = root.getTree(PathUtils.ROOT_PATH);
+ assertSame(TreePermission.EMPTY, composite.getTreePermission(rootTree,
TreeType.DEFAULT, TreePermission.EMPTY));
+ }
+
+ @Test
+ public void testEmptyProvidersCompositeParentPermission() {
+ TreePermission tp = mock(TreePermission.class);
+ AggregatedPermissionProvider aggr =
when(mock(AggregatedPermissionProvider.class).getTreePermission(any(Tree.class),
any(TreeType.class), any(TreePermission.class))).thenReturn(tp).getMock();
+
+ // parent-TreePermission is CompositeTreePermission
+ Tree rootTree =
getRootProvider().createReadOnlyRoot(root).getTree(PathUtils.ROOT_PATH);
+ AggregatedPermissionProvider[] providers = new
AggregatedPermissionProvider[]{aggr, new FullScopeProvider(root)};
+ CompositeTreePermission parentTp = (CompositeTreePermission)
CompositeTreePermission.create(rootTree, getTreeProvider(), new
TreeTypeProvider(Context.DEFAULT), providers, OR);
+
+ // getTreePermission from compositePP -> aggregated-providers as taken
from parent-permission
+ AggregatedPermissionProvider composite = createProvider(AND);
+ Tree systemTree = rootTree.getChild(JcrConstants.JCR_SYSTEM);
+ assertTrue(composite.getTreePermission(systemTree, TreeType.HIDDEN,
parentTp) instanceof CompositeTreePermission);
+
+ verify(aggr, times(1)).getTreePermission(rootTree, TreeType.DEFAULT,
TreePermission.EMPTY);
+ verify(aggr, times(1)).getTreePermission(systemTree, TreeType.HIDDEN,
tp);
+ }
+
+ @Test
+ public void testEmptyProvidersMockParentPermission() {
+ TreePermission tp = mock(TreePermission.class);
+ when(tp.getChildPermission(anyString(),
any(NodeState.class))).thenReturn(tp);
+
+ AggregatedPermissionProvider composite = createProvider(OR);
+
+ Tree ntTree =
getRootProvider().createReadOnlyRoot(root).getTree(NodeTypeConstants.NODE_TYPES_PATH);
+ assertSame(tp, composite.getTreePermission(ntTree, TreeType.DEFAULT,
tp));
+
+ verify(tp, times(1)).getChildPermission(ntTree.getName(),
getTreeProvider().asNodeState(ntTree));
+ }
+
+ @Test
+ public void testSingleProvider() {
+ TreePermission tp = mock(TreePermission.class);
+ when(tp.getChildPermission(anyString(),
any(NodeState.class))).thenReturn(tp);
+ AggregatedPermissionProvider aggr =
when(mock(AggregatedPermissionProvider.class).getTreePermission(any(Tree.class),
any(TreeType.class), any(TreePermission.class))).thenReturn(tp).getMock();
+
+ AggregatedPermissionProvider composite = createProvider(AND, aggr);
+
+ Tree rootTree =
getRootProvider().createReadOnlyRoot(root).getTree(PathUtils.ROOT_PATH);
+ TreePermission rootTreePermission =
composite.getTreePermission(rootTree, TreeType.HIDDEN, TreePermission.EMPTY);
+ assertSame(tp, rootTreePermission);
+
+ // type param is ignored for the root tree
+ verify(aggr, times(1)).getTreePermission(rootTree, TreeType.DEFAULT,
TreePermission.EMPTY);
+ verify(aggr, never()).getTreePermission(rootTree, TreeType.HIDDEN,
TreePermission.EMPTY);
+
+ Tree systemTree = rootTree.getChild(JcrConstants.JCR_SYSTEM);
+ assertSame(tp, composite.getTreePermission(systemTree,
TreeType.INTERNAL, rootTreePermission));
+
+ verify(aggr, never()).getTreePermission(systemTree, TreeType.INTERNAL,
rootTreePermission);
+ verify(aggr, never()).getTreePermission(systemTree, TreeType.DEFAULT,
rootTreePermission);
+ verify(tp, times(1)).getChildPermission(systemTree.getName(),
getTreeProvider().asNodeState(systemTree));
+ }
+
+ @Test
+ public void testTwoProvider() {
+ TreePermission tp = mock(TreePermission.class);
+ when(tp.getChildPermission(anyString(),
any(NodeState.class))).thenReturn(tp);
+ AggregatedPermissionProvider aggr =
when(mock(AggregatedPermissionProvider.class).getTreePermission(any(Tree.class),
any(TreeType.class), any(TreePermission.class))).thenReturn(tp).getMock();
+
+ AggregatedPermissionProvider composite = createProvider(OR, aggr, new
FullScopeProvider(root));
+
+ Tree rootTree =
getRootProvider().createReadOnlyRoot(root).getTree(PathUtils.ROOT_PATH);
+ TreePermission rootTreePermission =
composite.getTreePermission(rootTree, TreeType.VERSION, TreePermission.EMPTY);
+ assertTrue(rootTreePermission instanceof CompositeTreePermission);
+
+ // type param is ignored for the root tree
+ verify(aggr, times(1)).getTreePermission(rootTree, TreeType.DEFAULT,
TreePermission.EMPTY);
+ verify(aggr, never()).getTreePermission(rootTree, TreeType.VERSION,
TreePermission.EMPTY);
+
+ Tree systemTree = rootTree.getChild(JcrConstants.JCR_SYSTEM);
+ assertTrue(composite.getTreePermission(systemTree,
TreeType.ACCESS_CONTROL, rootTreePermission) instanceof
CompositeTreePermission);
+
+ verify(aggr, times(1)).getTreePermission(systemTree,
TreeType.ACCESS_CONTROL, tp);
+ verify(aggr, never()).getTreePermission(systemTree, TreeType.DEFAULT,
rootTreePermission);
+ verify(tp, never()).getChildPermission(systemTree.getName(),
getTreeProvider().asNodeState(systemTree));
+ }
+}
\ No newline at end of file
Propchange:
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositeProviderGetTreePermissionTest.java
------------------------------------------------------------------------------
svn:eol-style = native
Added:
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositeProviderSupportedTest.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositeProviderSupportedTest.java?rev=1858190&view=auto
==============================================================================
---
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositeProviderSupportedTest.java
(added)
+++
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositeProviderSupportedTest.java
Fri Apr 26 10:26:13 2019
@@ -0,0 +1,137 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.jackrabbit.oak.security.authorization.composite;
+
+import com.google.common.collect.ImmutableList;
+import org.apache.jackrabbit.oak.AbstractSecurityTest;
+import org.apache.jackrabbit.oak.api.PropertyState;
+import org.apache.jackrabbit.oak.api.Tree;
+import org.apache.jackrabbit.oak.api.Type;
+import org.apache.jackrabbit.oak.commons.PathUtils;
+import org.apache.jackrabbit.oak.plugins.memory.PropertyStates;
+import org.apache.jackrabbit.oak.plugins.tree.TreeLocation;
+import org.apache.jackrabbit.oak.spi.security.Context;
+import
org.apache.jackrabbit.oak.spi.security.authorization.permission.AggregatedPermissionProvider;
+import
org.apache.jackrabbit.oak.spi.security.authorization.permission.Permissions;
+import
org.apache.jackrabbit.oak.spi.security.authorization.permission.TreePermission;
+import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeBits;
+import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeBitsProvider;
+import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeConstants;
+import org.jetbrains.annotations.NotNull;
+import org.junit.Test;
+
+import static
org.apache.jackrabbit.oak.security.authorization.composite.CompositeAuthorizationConfiguration.CompositionType.AND;
+import static
org.apache.jackrabbit.oak.security.authorization.composite.CompositeAuthorizationConfiguration.CompositionType.OR;
+import static
org.apache.jackrabbit.oak.spi.security.authorization.permission.Permissions.READ_ACCESS_CONTROL;
+import static
org.apache.jackrabbit.oak.spi.security.authorization.permission.Permissions.READ_NODE;
+import static org.junit.Assert.assertEquals;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyLong;
+import static org.mockito.ArgumentMatchers.isNull;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+public class CompositeProviderSupportedTest extends AbstractSecurityTest {
+
+ private long[] supportedPermissions = new long[] {READ_NODE, READ_NODE,
Permissions.NO_PERMISSION, READ_ACCESS_CONTROL};
+ private AggregatedPermissionProvider[] pps = new
AggregatedPermissionProvider[] {
+ mock(AggregatedPermissionProvider.class),
+ mock(AggregatedPermissionProvider.class),
+ mock(AggregatedPermissionProvider.class),
+ mock(AggregatedPermissionProvider.class)
+ };
+
+ private CompositePermissionProvider cppAND;
+ private CompositePermissionProvider cppOR;
+
+ private long expectedPermissions = READ_NODE|READ_ACCESS_CONTROL;
+ private PrivilegeBits expectedBits;
+
+ private PrivilegeBitsProvider pbp;
+
+ @Override
+ public void before() throws Exception {
+ super.before();
+
+ pbp = new PrivilegeBitsProvider(root);
+ for (int i = 0; i < pps.length; i++) {
+ when(pps[i].supportedPermissions(any(Tree.class),
any(PropertyState.class), anyLong())).thenReturn(supportedPermissions[i]);
+ when(pps[i].supportedPermissions(any(Tree.class), isNull(),
anyLong())).thenReturn(supportedPermissions[i]);
+ when(pps[i].supportedPermissions((Tree) isNull(), isNull(),
anyLong())).thenReturn(supportedPermissions[i]);
+ when(pps[i].supportedPermissions(any(TreePermission.class),
any(PropertyState.class), anyLong())).thenReturn(supportedPermissions[i]);
+ when(pps[i].supportedPermissions(any(TreePermission.class),
isNull(), anyLong())).thenReturn(supportedPermissions[i]);
+ when(pps[i].supportedPermissions(any(TreeLocation.class),
anyLong())).thenReturn(supportedPermissions[i]);
+
+ PropertyState ps = PropertyStates.createProperty("any",
supportedPermissions[i], Type.LONG);
+ PrivilegeBits bts = (supportedPermissions[i] ==
Permissions.NO_PERMISSION) ? PrivilegeBits.EMPTY :
PrivilegeBits.getInstance(ps);
+ when(pps[i].supportedPrivileges(any(Tree.class),
any(PrivilegeBits.class))).thenReturn(bts);
+ when(pps[i].supportedPrivileges(isNull(),
any(PrivilegeBits.class))).thenReturn(bts);
+ }
+
+ cppAND = createProvider(AND, pps);
+ cppOR = createProvider(OR, pps);
+
+ expectedBits =
PrivilegeBits.getInstance(PropertyStates.createProperty("any",
expectedPermissions, Type.LONG)).unmodifiable();
+ }
+
+ private CompositePermissionProvider createProvider(@NotNull
CompositeAuthorizationConfiguration.CompositionType compositionType, @NotNull
AggregatedPermissionProvider... aggregated) {
+ return new CompositePermissionProvider(root,
ImmutableList.copyOf(aggregated), Context.DEFAULT, compositionType,
getRootProvider(), getTreeProvider());
+ }
+
+ @Test
+ public void testSupportedPermissionsFromTree() {
+ Tree tree = mock(Tree.class);
+ PropertyState ps = mock(PropertyState.class);
+
+ for (CompositePermissionProvider ccp : new
CompositePermissionProvider[] {cppAND, cppOR}) {
+ assertEquals(expectedPermissions, ccp.supportedPermissions((Tree)
null, null, Permissions.ALL));
+ assertEquals(expectedPermissions, ccp.supportedPermissions(tree,
null, Permissions.ALL));
+ assertEquals(expectedPermissions, ccp.supportedPermissions(tree,
ps, Permissions.ALL));
+ }
+ }
+
+ @Test
+ public void testSupportedPermissionsFromTreePermission() {
+ TreePermission tp = mock(TreePermission.class);
+ PropertyState ps = mock(PropertyState.class);
+
+ for (CompositePermissionProvider ccp : new
CompositePermissionProvider[] {cppAND, cppOR}) {
+ assertEquals(expectedPermissions, ccp.supportedPermissions(tp,
null, Permissions.ALL));
+ assertEquals(expectedPermissions, ccp.supportedPermissions(tp, ps,
Permissions.ALL));
+ }
+ }
+
+ @Test
+ public void testSupportedPermissionsFromLocation() {
+ TreeLocation location = TreeLocation.create(root,
PathUtils.concat(PathUtils.ROOT_PATH, "any"));
+
+ for (CompositePermissionProvider ccp : new
CompositePermissionProvider[] {cppAND, cppOR}) {
+ assertEquals(expectedPermissions,
ccp.supportedPermissions(location, Permissions.ALL));
+ assertEquals(expectedPermissions,
ccp.supportedPermissions(location, Permissions.ALL));
+ }
+ }
+
+ @Test
+ public void testSupportedPrivilegeBits() {
+ PrivilegeBits all = pbp.getBits(PrivilegeConstants.JCR_ALL);
+ Tree tree = root.getTree(PathUtils.ROOT_PATH);
+ for (CompositePermissionProvider ccp : new
CompositePermissionProvider[] {cppAND, cppOR}) {
+ assertEquals(expectedBits, ccp.supportedPrivileges(null,
all).unmodifiable());
+ assertEquals(expectedBits, ccp.supportedPrivileges(tree,
all).unmodifiable());
+ }
+ }
+}
\ No newline at end of file
Propchange:
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositeProviderSupportedTest.java
------------------------------------------------------------------------------
svn:eol-style = native
Modified:
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositeTreePermissionTest.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositeTreePermissionTest.java?rev=1858190&r1=1858189&r2=1858190&view=diff
==============================================================================
---
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositeTreePermissionTest.java
(original)
+++
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositeTreePermissionTest.java
Fri Apr 26 10:26:13 2019
@@ -16,17 +16,16 @@
*/
package org.apache.jackrabbit.oak.security.authorization.composite;
-import java.lang.reflect.Field;
-import java.util.Arrays;
-
import org.apache.jackrabbit.oak.AbstractSecurityTest;
import org.apache.jackrabbit.oak.api.PropertyState;
import org.apache.jackrabbit.oak.api.Root;
import org.apache.jackrabbit.oak.api.Tree;
+import org.apache.jackrabbit.oak.commons.PathUtils;
import org.apache.jackrabbit.oak.plugins.memory.PropertyStates;
import org.apache.jackrabbit.oak.plugins.tree.TreeType;
-import org.apache.jackrabbit.oak.spi.nodetype.NodeTypeConstants;
+import org.apache.jackrabbit.oak.plugins.tree.TreeTypeProvider;
import org.apache.jackrabbit.oak.plugins.tree.TreeUtil;
+import org.apache.jackrabbit.oak.spi.nodetype.NodeTypeConstants;
import org.apache.jackrabbit.oak.spi.security.Context;
import
org.apache.jackrabbit.oak.spi.security.authorization.permission.AggregatedPermissionProvider;
import
org.apache.jackrabbit.oak.spi.security.authorization.permission.Permissions;
@@ -35,6 +34,8 @@ import org.apache.jackrabbit.oak.spi.sta
import org.jetbrains.annotations.NotNull;
import org.junit.Test;
+import java.lang.reflect.Field;
+
import static
org.apache.jackrabbit.oak.security.authorization.composite.CompositeAuthorizationConfiguration.CompositionType.AND;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertFalse;
@@ -51,7 +52,6 @@ import static org.mockito.Mockito.when;
public class CompositeTreePermissionTest extends AbstractSecurityTest {
- private Root readOnlyRoot;
private Tree rootTree;
private AggregatedPermissionProvider fullScopeProvider;
@@ -60,12 +60,12 @@ public class CompositeTreePermissionTest
public void before() throws Exception {
super.before();
- Tree rootNode = root.getTree("/");
+ Tree rootNode = root.getTree(PathUtils.ROOT_PATH);
TreeUtil.addChild(rootNode, "test",
NodeTypeConstants.NT_OAK_UNSTRUCTURED);
root.commit();
- readOnlyRoot = getRootProvider().createReadOnlyRoot(root);
- rootTree = readOnlyRoot.getTree("/");
+ Root readOnlyRoot = getRootProvider().createReadOnlyRoot(root);
+ rootTree = readOnlyRoot.getTree(PathUtils.ROOT_PATH);
fullScopeProvider = new FullScopeProvider(readOnlyRoot);
}
@@ -88,8 +88,7 @@ public class CompositeTreePermissionTest
@NotNull
TreePermission createRootTreePermission(@NotNull
AggregatedPermissionProvider... providers) {
- return new CompositePermissionProvider(readOnlyRoot,
Arrays.asList(providers), Context.DEFAULT, getCompositionType(),
getRootProvider(), getTreeProvider())
- .getTreePermission(rootTree, TreePermission.EMPTY);
+ return CompositeTreePermission.create(rootTree, getTreeProvider(), new
TreeTypeProvider(Context.DEFAULT), providers, getCompositionType());
}
private static void assertCompositeTreePermission(boolean expected,
@NotNull TreePermission tp) {
@@ -294,8 +293,63 @@ public class CompositeTreePermissionTest
}
@Test
- public void testParentNoRecourse() throws Exception {
+ public void testParentNoRecourse() {
TreePermission rootTp = createRootTreePermission(new
NoScopeProvider(root));
assertSame(TreePermission.NO_RECOURSE, rootTp);
}
+
+ @Test
+ public void testCreateWithTreeType() throws Exception {
+ TreePermission mockTp = mock(TreePermission.class);
+ AggregatedPermissionProvider mockPP =
mock(AggregatedPermissionProvider.class);
+ when(mockPP.getTreePermission(any(Tree.class), any(TreeType.class),
any(TreePermission.class))).thenReturn(mockTp);
+
+ TreePermission parent = createRootTreePermission(mockPP,
fullScopeProvider);
+ assertCompositeTreePermission(true, parent);
+
+ Tree t = rootTree.getChild("test");
+ TreePermission tp = CompositeTreePermission.create(t,
getTreeProvider(), (CompositeTreePermission) parent, TreeType.INTERNAL);
+ assertCompositeTreePermission(true, tp);
+
+ Field typeF = CompositeTreePermission.class.getDeclaredField("type");
+ typeF.setAccessible(true);
+ assertSame(TreeType.INTERNAL, typeF.get(tp));
+
+ verify(mockPP, times(1)).getTreePermission(rootTree, TreeType.DEFAULT,
TreePermission.EMPTY);
+ verify(mockPP, times(1)).getTreePermission(t, TreeType.INTERNAL,
mockTp);
+ verify(mockPP, never()).getTreePermission(t, TreeType.DEFAULT, parent);
+ }
+
+ @Test
+ public void testCreateSingleWithInvalidParent() {
+ AggregatedPermissionProvider mockPP =
mock(AggregatedPermissionProvider.class);
+ when(mockPP.getTreePermission(any(Tree.class), any(TreeType.class),
any(TreePermission.class))).thenReturn(TreePermission.NO_RECOURSE);
+
+ TreePermission parent = createRootTreePermission(mockPP,
fullScopeProvider);
+ Tree t = rootTree.getChild("test");
+ TreePermission tp = CompositeTreePermission.create(t,
getTreeProvider(), (CompositeTreePermission) parent, TreeType.DEFAULT);
+ assertCompositeTreePermission(false, tp);
+ }
+
+ @Test
+ public void testCreateMultipleWithInvalidParent() {
+ AggregatedPermissionProvider mockPP =
mock(AggregatedPermissionProvider.class);
+ when(mockPP.getTreePermission(any(Tree.class), any(TreeType.class),
any(TreePermission.class))).thenReturn(TreePermission.NO_RECOURSE);
+
+ TreePermission parent = createRootTreePermission(mockPP,
fullScopeProvider, fullScopeProvider);
+ Tree t = rootTree.getChild("test");
+ TreePermission tp = CompositeTreePermission.create(t,
getTreeProvider(), (CompositeTreePermission) parent, TreeType.DEFAULT);
+ assertCompositeTreePermission(true, tp);
+ }
+
+ @Test
+ public void testCreateWithInvalidParent() {
+ AggregatedPermissionProvider mockPP =
mock(AggregatedPermissionProvider.class);
+ when(mockPP.getTreePermission(any(Tree.class), any(TreeType.class),
any(TreePermission.class))).thenReturn(TreePermission.NO_RECOURSE);
+
+ TreePermission parent = createRootTreePermission(mockPP, mockPP,
mockPP);
+ Tree t = rootTree.getChild("test");
+ TreePermission tp = CompositeTreePermission.create(t,
getTreeProvider(), (CompositeTreePermission) parent, TreeType.DEFAULT);
+ assertSame(TreePermission.EMPTY, tp);
+ }
}
Added:
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositionTypeTest.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositionTypeTest.java?rev=1858190&view=auto
==============================================================================
---
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositionTypeTest.java
(added)
+++
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositionTypeTest.java
Fri Apr 26 10:26:13 2019
@@ -0,0 +1,42 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.jackrabbit.oak.security.authorization.composite;
+
+import org.junit.Test;
+
+import static
org.apache.jackrabbit.oak.security.authorization.composite.CompositeAuthorizationConfiguration.CompositionType.AND;
+import static
org.apache.jackrabbit.oak.security.authorization.composite.CompositeAuthorizationConfiguration.CompositionType.OR;
+import static org.junit.Assert.assertSame;
+
+public class CompositionTypeTest {
+
+ @Test
+ public void testOrFromString() {
+ String[] orNames = new String[] {OR.name(), OR.toString(),
OR.name().toLowerCase(), OR.name().toUpperCase()};
+ for (String s : orNames) {
+ assertSame(OR,
CompositeAuthorizationConfiguration.CompositionType.fromString(s));
+ }
+ }
+
+ @Test
+ public void testAndFromString() {
+ String[] andNames = new String[] {AND.name(), AND.toString(),
AND.name().toLowerCase(), AND.name().toUpperCase(), "any", ""};
+ for (String s : andNames) {
+ assertSame(AND,
CompositeAuthorizationConfiguration.CompositionType.fromString(s));
+ }
+ }
+}
\ No newline at end of file
Propchange:
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositionTypeTest.java
------------------------------------------------------------------------------
svn:eol-style = native
