| // Copyright 2012 Google Inc. All Rights Reserved. |
| // |
| // Licensed under the Apache License, Version 2.0 (the "License"); |
| // you may not use this file except in compliance with the License. |
| // You may obtain a copy of the License at |
| // |
| // http://www.apache.org/licenses/LICENSE-2.0 |
| // |
| // Unless required by applicable law or agreed to in writing, software |
| // distributed under the License is distributed on an "AS IS" BASIS, |
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| // See the License for the specific language governing permissions and |
| // limitations under the License. |
| |
| package com.google.enterprise.adaptor; |
| |
| import static org.junit.Assert.*; |
| |
| import com.google.common.collect.Sets; |
| import org.junit.*; |
| import org.junit.rules.ExpectedException; |
| |
| import java.io.IOException; |
| import java.util.*; |
| |
| /** |
| * Test cases for {@link Acl}. |
| */ |
| public class AclTest { |
| @Rule |
| public ExpectedException thrown = ExpectedException.none(); |
| |
| private static Set<UserPrincipal> U(String... names) { |
| Set<UserPrincipal> set = new TreeSet<UserPrincipal>(); |
| for (String n : names) { |
| set.add(new UserPrincipal(n)); |
| } |
| return set; |
| } |
| |
| private static Set<GroupPrincipal> G(String... names) { |
| Set<GroupPrincipal> set = new TreeSet<GroupPrincipal>(); |
| for (String n : names) { |
| set.add(new GroupPrincipal(n)); |
| } |
| return set; |
| } |
| |
| @Test |
| public void testNonHierarchialUsage() { |
| Acl acl = new Acl.Builder() |
| .setPermitGroups(G("permitGroup")) |
| .setDenyGroups(G("denyGroup")) |
| .setPermitUsers(U("permitUser", "bothUser")) |
| .setDenyUsers(U("denyUser", "bothUser")) |
| .build(); |
| // Test all main combinations: |
| // (user permitted, denied, or indeterminate) x (group permitted, denied, |
| // indeterminate, no groups) |
| assertEquals(AuthzStatus.PERMIT, acl.isAuthorizedLocal( |
| createIdentity("permitUser", "permitGroup"))); |
| assertEquals(AuthzStatus.DENY, acl.isAuthorizedLocal( |
| createIdentity("permitUser", "denyGroup"))); |
| assertEquals(AuthzStatus.PERMIT, acl.isAuthorizedLocal( |
| createIdentity("permitUser", "unknownGroup"))); |
| assertEquals(AuthzStatus.PERMIT, acl.isAuthorizedLocal( |
| createIdentity("permitUser"))); |
| |
| assertEquals(AuthzStatus.DENY, acl.isAuthorizedLocal( |
| createIdentity("denyUser", "permitGroup"))); |
| assertEquals(AuthzStatus.DENY, acl.isAuthorizedLocal( |
| createIdentity("denyUser", "denyGroup"))); |
| assertEquals(AuthzStatus.DENY, acl.isAuthorizedLocal( |
| createIdentity("denyUser", "unknownGroup"))); |
| assertEquals(AuthzStatus.DENY, acl.isAuthorizedLocal( |
| createIdentity("denyUser"))); |
| |
| assertEquals(AuthzStatus.PERMIT, acl.isAuthorizedLocal( |
| createIdentity("unknownUser", "permitGroup"))); |
| assertEquals(AuthzStatus.DENY, acl.isAuthorizedLocal( |
| createIdentity("unknownUser", "denyGroup"))); |
| assertEquals(AuthzStatus.INDETERMINATE, acl.isAuthorizedLocal( |
| createIdentity("unknownUser", "unknownGroup"))); |
| assertEquals(AuthzStatus.INDETERMINATE, acl.isAuthorizedLocal( |
| createIdentity("unknownUser"))); |
| |
| // Make sure that deny wins. |
| assertEquals(AuthzStatus.DENY, acl.isAuthorizedLocal( |
| createIdentity("permitUser", "denyGroup", "permitGroup"))); |
| assertEquals(AuthzStatus.DENY, acl.isAuthorizedLocal( |
| createIdentity("bothUser", "permitGroup"))); |
| } |
| |
| @Test |
| public void testNullInheritanceType() { |
| thrown.expect(NullPointerException.class); |
| Acl.Builder builder = new Acl.Builder().setInheritanceType(null); |
| } |
| |
| @Test |
| public void testDefaults() { |
| Acl acl = Acl.EMPTY; |
| assertEquals(Collections.emptySet(), acl.getDenyGroups()); |
| assertEquals(Collections.emptySet(), acl.getPermitGroups()); |
| assertEquals(Collections.emptySet(), acl.getDenyUsers()); |
| assertEquals(Collections.emptySet(), acl.getPermitUsers()); |
| assertNull(acl.getInheritFrom()); |
| assertEquals(Acl.InheritanceType.LEAF_NODE, acl.getInheritanceType()); |
| } |
| |
| @Test |
| public void testAccessors() { |
| final Set<GroupPrincipal> goldenDenyGroups = Collections.unmodifiableSet( |
| new HashSet<GroupPrincipal>(G("dg1", "dg2", "g3"))); |
| final Set<GroupPrincipal> goldenPermitGroups = Collections.unmodifiableSet( |
| new HashSet<GroupPrincipal>(G("pg1", "pg2", "g3"))); |
| final Set<UserPrincipal> goldenDenyUsers = Collections.unmodifiableSet( |
| new HashSet<UserPrincipal>(U("du1", "du2", "du3", "u4"))); |
| final Set<UserPrincipal> goldenPermitUsers = Collections.unmodifiableSet( |
| new HashSet<UserPrincipal>(U("pu1", "pu2", "u4", "g3"))); |
| final DocId goldenInheritFrom = new DocId("something"); |
| final Acl.InheritanceType goldenInheritType |
| = Acl.InheritanceType.CHILD_OVERRIDES; |
| |
| Set<GroupPrincipal> denyGroups |
| = new HashSet<GroupPrincipal>(goldenDenyGroups); |
| Set<GroupPrincipal> permitGroups |
| = new HashSet<GroupPrincipal>(goldenPermitGroups); |
| Set<UserPrincipal> denyUsers |
| = new HashSet<UserPrincipal>(goldenDenyUsers); |
| Set<UserPrincipal> permitUsers |
| = new HashSet<UserPrincipal>(goldenPermitUsers); |
| Acl.Builder builder = new Acl.Builder() |
| .setDenyGroups(denyGroups).setPermitGroups(permitGroups) |
| .setDenyUsers(denyUsers).setPermitUsers(permitUsers) |
| .setInheritFrom(goldenInheritFrom) |
| .setInheritanceType(goldenInheritType); |
| Acl acl = builder.build(); |
| assertEquals(goldenDenyGroups, acl.getDenyGroups()); |
| assertEquals(goldenPermitGroups, acl.getPermitGroups()); |
| assertEquals(goldenDenyUsers, acl.getDenyUsers()); |
| assertEquals(goldenPermitUsers, acl.getPermitUsers()); |
| assertEquals(goldenInheritFrom, acl.getInheritFrom()); |
| assertEquals(goldenInheritType, acl.getInheritanceType()); |
| |
| // Verify the builder makes copies of provided data. |
| denyGroups.clear(); |
| permitGroups.clear(); |
| denyUsers.clear(); |
| permitUsers.clear(); |
| assertEquals(acl, builder.build()); |
| |
| // Verify that Acl doesn't mutate due to changes in Builder. |
| builder.setDenyGroups(Collections.<GroupPrincipal>emptySet()); |
| builder.setPermitGroups(Collections.<GroupPrincipal>emptySet()); |
| builder.setDenyUsers(Collections.<UserPrincipal>emptySet()); |
| builder.setPermitUsers(Collections.<UserPrincipal>emptySet()); |
| builder.setInheritFrom(null); |
| builder.setInheritanceType(Acl.InheritanceType.PARENT_OVERRIDES); |
| |
| assertEquals(goldenDenyGroups, acl.getDenyGroups()); |
| assertEquals(goldenPermitGroups, acl.getPermitGroups()); |
| assertEquals(goldenDenyUsers, acl.getDenyUsers()); |
| assertEquals(goldenPermitUsers, acl.getPermitUsers()); |
| assertEquals(goldenInheritFrom, acl.getInheritFrom()); |
| assertEquals(goldenInheritType, acl.getInheritanceType()); |
| } |
| |
| @Test |
| public void testTypeAgnosticAccessors() { |
| Acl acl = new Acl.Builder() |
| .setPermitUsers(U("todelete1")).setDenyUsers(U("todelete2")) |
| .setPermitGroups(G("todelete3")).setDenyGroups(G("todelete4")) |
| .setPermits(Sets.union(U("good1"), G("good2"))) |
| .setDenies(Sets.union(U("good3"), G("good4"))) |
| .build(); |
| assertEquals(new Acl.Builder() |
| .setPermitUsers(U("good1")).setDenyUsers(U("good3")) |
| .setPermitGroups(G("good2")).setDenyGroups(G("good4")) |
| .build(), acl); |
| assertEquals(Sets.union(U("good1"), G("good2")), acl.getPermits()); |
| assertEquals(Sets.union(U("good3"), G("good4")), acl.getDenies()); |
| } |
| |
| @Test |
| public void testDenyGroupsImmutability() { |
| Acl acl = new Acl.Builder().setEverythingCaseInsensitive() |
| .setDenyGroups(G("item")).build(); |
| thrown.expect(UnsupportedOperationException.class); |
| acl.getDenyGroups().clear(); |
| } |
| |
| @Test |
| public void testPermitGroupsImmutability() { |
| Acl acl = new Acl.Builder().setPermitGroups(G("item")).build(); |
| thrown.expect(UnsupportedOperationException.class); |
| acl.getPermitGroups().clear(); |
| } |
| |
| @Test |
| public void testDenyUsersImmutability() { |
| Acl acl = new Acl.Builder().setDenyUsers(U("item")).build(); |
| thrown.expect(UnsupportedOperationException.class); |
| acl.getDenyUsers().clear(); |
| } |
| |
| @Test |
| public void testPermitUsersImmutability() { |
| Acl acl = new Acl.Builder().setEverythingCaseInsensitive() |
| .setPermitUsers(U("item")).build(); |
| thrown.expect(UnsupportedOperationException.class); |
| acl.getPermitUsers().clear(); |
| } |
| |
| @Test |
| public void testNullUser() { |
| Acl.Builder builder = new Acl.Builder(); |
| thrown.expect(NullPointerException.class); |
| builder.setPermitUsers(Arrays.asList((UserPrincipal) null)); |
| } |
| |
| @Test |
| public void testEmptyGroup() { |
| Acl.Builder builder = new Acl.Builder(); |
| thrown.expect(IllegalArgumentException.class); |
| builder.setDenyGroups(G("")); |
| } |
| |
| @Test |
| public void testWhitespaceSurroundingUserBefore() { |
| Acl.Builder builder = new Acl.Builder(); |
| thrown.expect(IllegalArgumentException.class); |
| builder.setDenyUsers(U(" test")); |
| } |
| |
| @Test |
| public void testWhitespaceSurroundingUserAfter() { |
| Acl.Builder builder = new Acl.Builder(); |
| thrown.expect(IllegalArgumentException.class); |
| builder.setDenyUsers(U("test\t")); |
| } |
| |
| @Test |
| public void testToString() { |
| Acl acl = new Acl.Builder() |
| .setDenyGroups(new HashSet<GroupPrincipal>(G("dg1", "dg2", "g3"))) |
| .setPermitGroups(new HashSet<GroupPrincipal>(G("pg1", "pg2", "g3"))) |
| .setDenyUsers(new HashSet<UserPrincipal>(U("du1", "du2", "du3", "u4"))) |
| .setPermitUsers(new HashSet<UserPrincipal>(U("pu1", "pu2", "u4", "g3"))) |
| .setInheritFrom(new DocId("something")) |
| .setInheritanceType(Acl.InheritanceType.CHILD_OVERRIDES).build(); |
| |
| assertEquals("Acl(caseSensitive=true, " |
| + "inheritFrom=DocId(something), " |
| + "inheritType=CHILD_OVERRIDES, " |
| + "permitGroups=[Principal(Group,g3,Default), Principal(Group,pg1,Default), " |
| + "Principal(Group,pg2,Default)], " |
| + "denyGroups=[Principal(Group,dg1,Default), Principal(Group,dg2,Default), " |
| + "Principal(Group,g3,Default)], " |
| + "permitUsers=[Principal(User,g3,Default), Principal(User,pu1,Default), " |
| + "Principal(User,pu2,Default), Principal(User,u4,Default)], " |
| + "denyUsers=[Principal(User,du1,Default), Principal(User,du2,Default), " |
| + "Principal(User,du3,Default), Principal(User,u4,Default)])" |
| , acl.toString()); |
| } |
| |
| @Test |
| public void testEquals() { |
| Acl.Builder builder = new Acl.Builder(); |
| Acl base = builder.build(); |
| |
| builder.setPermitGroups(G("testing")); |
| Acl permitGroups = builder.build(); |
| builder.setPermitGroups(Collections.<GroupPrincipal>emptySet()); |
| |
| builder.setDenyGroups(G("testing")); |
| Acl denyGroups = builder.build(); |
| builder.setDenyGroups(Collections.<GroupPrincipal>emptySet()); |
| |
| builder.setPermitUsers(U("testing")); |
| Acl permitUsers = builder.build(); |
| builder.setPermitUsers(Collections.<UserPrincipal>emptySet()); |
| |
| builder.setDenyUsers(U("testing")); |
| Acl denyUsers = builder.build(); |
| builder.setDenyUsers(Collections.<UserPrincipal>emptySet()); |
| |
| builder.setInheritanceType(Acl.InheritanceType.PARENT_OVERRIDES); |
| builder.setInheritFrom(new DocId("testing")); |
| Acl inheritFrom1 = builder.build(); |
| |
| builder.setInheritFrom(new DocId("testing2")); |
| Acl inheritFrom2 = builder.build(); |
| |
| builder.setInheritanceType(Acl.InheritanceType.CHILD_OVERRIDES); |
| Acl childOverrides = builder.build(); |
| |
| builder.setInheritFrom(new DocId("testing2")); |
| Acl childOverridesAgain = builder.build(); |
| builder.setInheritanceType(Acl.InheritanceType.LEAF_NODE); |
| builder.setInheritFrom(null); |
| |
| Acl baseAgain = builder.build(); |
| |
| assertFalse(base.equals(null)); |
| assertTrue(base.equals(base)); |
| assertFalse(base.equals(permitGroups)); |
| assertFalse(base.equals(denyGroups)); |
| assertFalse(base.equals(permitUsers)); |
| assertFalse(base.equals(denyUsers)); |
| assertFalse(base.equals(inheritFrom1)); |
| assertFalse(base.equals(inheritFrom2)); |
| assertFalse(base.equals(childOverrides)); |
| assertTrue(base.equals(baseAgain)); |
| |
| assertFalse(inheritFrom1.equals(inheritFrom2)); |
| assertFalse(inheritFrom2.equals(childOverrides)); |
| assertTrue(childOverrides.equals(childOverridesAgain)); |
| |
| assertEquals(base.hashCode(), base.hashCode()); |
| assertEquals(base.hashCode(), baseAgain.hashCode()); |
| |
| builder.setPermitGroups(G("testing")); |
| builder.setDenyGroups(G("testing")); |
| builder.setPermitUsers(U("testing")); |
| builder.setDenyUsers(U("testing")); |
| Acl withCase = builder.build(); |
| Acl noCase = builder.setEverythingCaseInsensitive().build(); |
| Acl caseAgain = builder.setEverythingCaseSensitive().build(); |
| builder.setEverythingCaseInsensitive(); |
| Acl noCase2 = builder.setPermitUsers(U("TeSTiNg")).build(); |
| Acl noCase3 = builder.setPermitUsers(U("tEstInG")).build(); |
| assertEquals(withCase, caseAgain); |
| assertEquals(noCase2, noCase); |
| assertEquals(noCase2, noCase3); |
| assertFalse(withCase.equals(noCase)); |
| assertFalse(caseAgain.equals(noCase)); |
| assertEquals(withCase.hashCode(), caseAgain.hashCode()); |
| /* It is conceivable that hashCode of different object matches. |
| So this test could fail in the future; it is unlikely. */ |
| assertFalse(withCase.hashCode() == noCase.hashCode()); |
| assertFalse(caseAgain.hashCode() == noCase.hashCode()); |
| } |
| |
| @Test |
| public void testCopy() { |
| Set<GroupPrincipal> denyGroups = Collections.unmodifiableSet( |
| new HashSet<GroupPrincipal>(G("dg1", "dg2", "g3"))); |
| Set<GroupPrincipal> permitGroups = Collections.unmodifiableSet( |
| new HashSet<GroupPrincipal>(G("pg1", "pg2", "g3"))); |
| Set<UserPrincipal> denyUsers = Collections.unmodifiableSet( |
| new HashSet<UserPrincipal>(U("du1", "du2", "du3", "u4"))); |
| Set<UserPrincipal> permitUsers = Collections.unmodifiableSet( |
| new HashSet<UserPrincipal>(U("pu1", "pu2", "u4", "g3"))); |
| DocId inheritFrom = new DocId("something"); |
| Acl.InheritanceType inheritType = Acl.InheritanceType.CHILD_OVERRIDES; |
| |
| Acl aclOrig = new Acl.Builder() |
| .setDenyGroups(denyGroups).setPermitGroups(permitGroups) |
| .setDenyUsers(denyUsers).setPermitUsers(permitUsers) |
| .setInheritFrom(inheritFrom).setInheritanceType(inheritType).build(); |
| Acl acl = new Acl.Builder(aclOrig).build(); |
| assertEquals(denyGroups, acl.getDenyGroups()); |
| assertEquals(permitGroups, acl.getPermitGroups()); |
| assertEquals(denyUsers, acl.getDenyUsers()); |
| assertEquals(permitUsers, acl.getPermitUsers()); |
| assertEquals(inheritFrom, acl.getInheritFrom()); |
| assertEquals(inheritType, acl.getInheritanceType()); |
| assertTrue(aclOrig.equals(acl)); |
| assertEquals(aclOrig.hashCode(), acl.hashCode()); |
| } |
| |
| @Test |
| public void testInheritance() { |
| Acl root = new Acl.Builder().setPermitUsers(U("user")) |
| .setInheritanceType(Acl.InheritanceType.PARENT_OVERRIDES).build(); |
| Acl middle = new Acl.Builder() |
| .setInheritanceType(Acl.InheritanceType.CHILD_OVERRIDES) |
| .setInheritFrom(new DocId("parent")).build(); |
| Acl leaf = new Acl.Builder().setDenyUsers(U("user")) |
| .setInheritFrom(new DocId("parent")).build(); |
| Collection<String> empty |
| = Collections.unmodifiableList(Collections.<String>emptyList()); |
| |
| assertEquals(AuthzStatus.PERMIT, Acl.isAuthorized(createIdentity("user"), |
| Arrays.asList(root, middle, leaf))); |
| } |
| |
| @Test |
| public void testEmptyAclChain() { |
| thrown.expect(IllegalArgumentException.class); |
| Acl.isAuthorized(createIdentity("user"), Collections.<Acl>emptyList()); |
| } |
| |
| @Test |
| public void testInvalidRootAclChain() { |
| Acl acl = new Acl.Builder().setInheritFrom(new DocId("parent")).build(); |
| thrown.expect(IllegalArgumentException.class); |
| Acl.isAuthorized(createIdentity("user"), Collections.singletonList(acl)); |
| } |
| |
| @Test |
| public void testInvalidChildInChain() { |
| Acl.Builder builder = new Acl.Builder(); |
| Acl root = builder.build(); |
| Acl child = builder.setInheritFrom(new DocId("parent")).build(); |
| Acl broken = root; |
| |
| thrown.expect(IllegalArgumentException.class); |
| Acl.isAuthorized(createIdentity("user"), |
| Arrays.asList(root, child, broken)); |
| } |
| |
| @Test |
| public void testIsAuthorizedBatchNullEntry() throws IOException { |
| Map<DocId, Acl> acls = new HashMap<DocId, Acl>(); |
| acls.put(new DocId("1"), null); |
| Acl.BatchRetriever retriever = new MockBatchRetriever(acls); |
| |
| AuthnIdentity identity = createIdentity("alice", "eng"); |
| thrown.expect(NullPointerException.class); |
| Acl.isAuthorizedBatch(identity, Arrays.asList(new DocId("1")), |
| retriever); |
| } |
| |
| @Test |
| public void testIsAuthorizedBatchMissingCachedParent() throws IOException { |
| Map<DocId, Acl> acls = new HashMap<DocId, Acl>(); |
| DocId id = new DocId("1"); |
| DocId id2 = new DocId("2"); |
| acls.put(id, new Acl.Builder().setInheritFrom(id2) |
| .setPermitUsers(U("user")).build()); |
| Acl.BatchRetriever retriever = new MockBatchRetriever(acls); |
| |
| AuthnIdentity identity = createIdentity("user", "wrong group"); |
| assertEquals(AuthzStatus.INDETERMINATE, Acl.isAuthorizedBatch(identity, |
| Arrays.asList(id, id2), retriever).get(id)); |
| } |
| |
| @Test |
| public void testIsAuthorizedBatchOptimized() throws IOException { |
| final DocId file = new DocId("file1"); |
| final DocId parent = new DocId("parent"); |
| |
| final Map<DocId, Acl> acls = new HashMap<DocId, Acl>(); |
| acls.put(file, new Acl.Builder().setInheritFrom(parent).build()); |
| acls.put(parent, |
| new Acl.Builder().setPermitUsers(U("user")) |
| .setInheritanceType(Acl.InheritanceType.CHILD_OVERRIDES).build()); |
| |
| Acl.BatchRetriever retriever = new Acl.BatchRetriever() { |
| private boolean accessed = false; |
| |
| @Override |
| public Map<DocId, Acl> retrieveAcls(Set<DocId> ids) { |
| assertEquals(false, accessed); |
| accessed = true; |
| assertEquals(Arrays.asList(file), new ArrayList<DocId>(ids)); |
| return acls; |
| } |
| }; |
| AuthnIdentity identity = createIdentity("user"); |
| assertEquals(AuthzStatus.PERMIT, Acl.isAuthorizedBatch(identity, |
| Arrays.asList(file), retriever).get(file)); |
| } |
| |
| @Test |
| public void testIsAuthorizedBatchPoorOptimized() throws IOException { |
| final DocId file1 = new DocId("file1"); |
| final DocId file2 = new DocId("file2"); |
| final DocId missingParent = new DocId("missing parent"); |
| final DocId parent = new DocId("parent"); |
| final DocId root = new DocId("root"); |
| |
| final Map<DocId, Acl> acls = new HashMap<DocId, Acl>(); |
| acls.put(file1, new Acl.Builder().setInheritFrom(parent).build()); |
| acls.put(file2, new Acl.Builder().setInheritFrom(missingParent) |
| .setDenyUsers(U("unrelated")).build()); |
| acls.put(parent, new Acl.Builder().setInheritFrom(root) |
| .setInheritanceType(Acl.InheritanceType.PARENT_OVERRIDES).build()); |
| acls.put(root, |
| new Acl.Builder().setPermitUsers(U("user")) |
| .setInheritanceType(Acl.InheritanceType.PARENT_OVERRIDES).build()); |
| |
| Acl.BatchRetriever retriever = new Acl.BatchRetriever() { |
| @Override |
| public Map<DocId, Acl> retrieveAcls(Set<DocId> ids) { |
| Set<DocId> case1 = new HashSet<DocId>(Arrays.asList(file1, file2)); |
| Set<DocId> case2 |
| = new HashSet<DocId>(Arrays.asList(missingParent, parent)); |
| Set<DocId> case3 = new HashSet<DocId>(Arrays.asList(root)); |
| Map<DocId, Acl> result = new HashMap<DocId, Acl>(); |
| if (case1.equals(ids)) { |
| result.put(file1, acls.get(file1)); |
| result.put(file2, acls.get(file2)); |
| } else if (case2.equals(ids)) { |
| // Don't provide missingParent, since it is missing. |
| result.put(parent, acls.get(parent)); |
| // Be inefficient and re-provide some ACLs. |
| result.put(file1, acls.get(file1)); |
| } else if (case3.equals(ids)) { |
| // Provide results for something we didn't previously. This shouldn't |
| // change our results. |
| result.put(missingParent, acls.get(root)); |
| result.put(root, acls.get(root)); |
| } else { |
| fail(); |
| } |
| return result; |
| } |
| }; |
| |
| Map<DocId, AuthzStatus> golden = new HashMap<DocId, AuthzStatus>(); |
| golden.put(file1, AuthzStatus.PERMIT); |
| golden.put(file2, AuthzStatus.INDETERMINATE); |
| golden = Collections.unmodifiableMap(golden); |
| |
| AuthnIdentity identity = createIdentity("user"); |
| assertEquals(golden, Acl.isAuthorizedBatch(identity, |
| Arrays.asList(file1, file2), retriever)); |
| } |
| |
| @Test |
| public void testEmptyIsAuthorized() { |
| assertEquals(AuthzStatus.INDETERMINATE, Acl.isAuthorized( |
| createIdentity("user"), Arrays.asList(Acl.EMPTY))); |
| } |
| |
| @Test |
| public void testCommonForm() { |
| assertEquals("child-overrides", |
| Acl.InheritanceType.CHILD_OVERRIDES.getCommonForm()); |
| } |
| |
| private static String split(String usersOrGroups)[] { |
| if ("".equals(usersOrGroups)) { |
| return new String[0]; |
| } |
| return usersOrGroups.split(","); |
| } |
| |
| private static Acl buildAcl(String permitUsers, String permitGroups, |
| String denyUsers, String denyGroups) { |
| return new Acl.Builder() |
| .setPermitUsers(U(split(permitUsers))) |
| .setPermitGroups(G(split(permitGroups))) |
| .setDenyUsers(U(split(denyUsers))) |
| .setDenyGroups(G(split(denyGroups))) |
| .build(); |
| } |
| |
| private static Acl buildAcl(String permitUsers, String permitGroups, |
| String denyUsers, String denyGroups, |
| Acl.InheritanceType type) { |
| return new Acl.Builder( |
| buildAcl(permitUsers, permitGroups, denyUsers, denyGroups)) |
| .setInheritanceType(type).build(); |
| } |
| |
| private static Acl buildAcl(String permitUsers, String permitGroups, |
| String denyUsers, String denyGroups, |
| String inheritFrom) { |
| return new Acl.Builder( |
| buildAcl(permitUsers, permitGroups, denyUsers, denyGroups)) |
| .setInheritFrom(new DocId(inheritFrom)).build(); |
| } |
| |
| private static Acl buildAcl(String permitUsers, String permitGroups, |
| String denyUsers, String denyGroups, |
| Acl.InheritanceType type, String inheritFrom) { |
| return new Acl.Builder( |
| buildAcl(permitUsers, permitGroups, denyUsers, denyGroups)) |
| .setInheritanceType(type).setInheritFrom(new DocId(inheritFrom)) |
| .build(); |
| } |
| |
| private AuthzStatus callIsAuthorized(AuthnIdentity identity, DocId id, |
| Acl.BatchRetriever retriever) throws IOException { |
| return Acl.isAuthorizedBatch(identity, Arrays.asList(id), retriever) |
| .get(id); |
| } |
| |
| private void testRule(Acl.InheritanceType rule, AuthzStatus child, |
| AuthzStatus parent, AuthzStatus expectedResult) { |
| assertEquals(expectedResult, rule.isAuthorized( |
| new MockDecision(child), new MockDecision(parent))); |
| } |
| |
| // Port of test from GSA with similar name. Should be kept in sync. |
| @Test |
| public void testCombineChildOverrides() { |
| testRule(Acl.InheritanceType.CHILD_OVERRIDES, |
| AuthzStatus.PERMIT, AuthzStatus.PERMIT, |
| AuthzStatus.PERMIT); |
| testRule(Acl.InheritanceType.CHILD_OVERRIDES, |
| AuthzStatus.PERMIT, AuthzStatus.DENY, |
| AuthzStatus.PERMIT); |
| testRule(Acl.InheritanceType.CHILD_OVERRIDES, |
| AuthzStatus.PERMIT, AuthzStatus.INDETERMINATE, |
| AuthzStatus.PERMIT); |
| testRule(Acl.InheritanceType.CHILD_OVERRIDES, |
| AuthzStatus.DENY, AuthzStatus.PERMIT, |
| AuthzStatus.DENY); |
| testRule(Acl.InheritanceType.CHILD_OVERRIDES, |
| AuthzStatus.DENY, AuthzStatus.DENY, |
| AuthzStatus.DENY); |
| testRule(Acl.InheritanceType.CHILD_OVERRIDES, |
| AuthzStatus.DENY, AuthzStatus.INDETERMINATE, |
| AuthzStatus.DENY); |
| testRule(Acl.InheritanceType.CHILD_OVERRIDES, |
| AuthzStatus.INDETERMINATE, AuthzStatus.PERMIT, |
| AuthzStatus.PERMIT); |
| testRule(Acl.InheritanceType.CHILD_OVERRIDES, |
| AuthzStatus.INDETERMINATE, AuthzStatus.DENY, |
| AuthzStatus.DENY); |
| testRule(Acl.InheritanceType.CHILD_OVERRIDES, |
| AuthzStatus.INDETERMINATE, AuthzStatus.INDETERMINATE, |
| AuthzStatus.INDETERMINATE); |
| } |
| |
| // Port of test from GSA with similar name. Should be kept in sync. |
| @Test |
| public void testCombineParentOverrides() { |
| testRule(Acl.InheritanceType.PARENT_OVERRIDES, |
| AuthzStatus.PERMIT, AuthzStatus.PERMIT, |
| AuthzStatus.PERMIT); |
| testRule(Acl.InheritanceType.PARENT_OVERRIDES, |
| AuthzStatus.PERMIT, AuthzStatus.DENY, |
| AuthzStatus.DENY); |
| testRule(Acl.InheritanceType.PARENT_OVERRIDES, |
| AuthzStatus.PERMIT, AuthzStatus.INDETERMINATE, |
| AuthzStatus.PERMIT); |
| testRule(Acl.InheritanceType.PARENT_OVERRIDES, |
| AuthzStatus.DENY, AuthzStatus.PERMIT, |
| AuthzStatus.PERMIT); |
| testRule(Acl.InheritanceType.PARENT_OVERRIDES, |
| AuthzStatus.DENY, AuthzStatus.DENY, |
| AuthzStatus.DENY); |
| testRule(Acl.InheritanceType.PARENT_OVERRIDES, |
| AuthzStatus.DENY, AuthzStatus.INDETERMINATE, |
| AuthzStatus.DENY); |
| testRule(Acl.InheritanceType.PARENT_OVERRIDES, |
| AuthzStatus.INDETERMINATE, AuthzStatus.PERMIT, |
| AuthzStatus.PERMIT); |
| testRule(Acl.InheritanceType.PARENT_OVERRIDES, |
| AuthzStatus.INDETERMINATE, AuthzStatus.DENY, |
| AuthzStatus.DENY); |
| testRule(Acl.InheritanceType.PARENT_OVERRIDES, |
| AuthzStatus.INDETERMINATE, AuthzStatus.INDETERMINATE, |
| AuthzStatus.INDETERMINATE); |
| } |
| |
| // Port of test from GSA with similar name. Should be kept in sync. |
| @Test |
| public void testCombineAndBothPermit() { |
| testRule(Acl.InheritanceType.AND_BOTH_PERMIT, |
| AuthzStatus.PERMIT, AuthzStatus.PERMIT, |
| AuthzStatus.PERMIT); |
| testRule(Acl.InheritanceType.AND_BOTH_PERMIT, |
| AuthzStatus.PERMIT, AuthzStatus.DENY, |
| AuthzStatus.DENY); |
| testRule(Acl.InheritanceType.AND_BOTH_PERMIT, |
| AuthzStatus.PERMIT, AuthzStatus.INDETERMINATE, |
| AuthzStatus.DENY); |
| testRule(Acl.InheritanceType.AND_BOTH_PERMIT, |
| AuthzStatus.DENY, AuthzStatus.PERMIT, |
| AuthzStatus.DENY); |
| testRule(Acl.InheritanceType.AND_BOTH_PERMIT, |
| AuthzStatus.DENY, AuthzStatus.DENY, |
| AuthzStatus.DENY); |
| testRule(Acl.InheritanceType.AND_BOTH_PERMIT, |
| AuthzStatus.DENY, AuthzStatus.INDETERMINATE, |
| AuthzStatus.DENY); |
| testRule(Acl.InheritanceType.AND_BOTH_PERMIT, |
| AuthzStatus.INDETERMINATE, AuthzStatus.PERMIT, |
| AuthzStatus.DENY); |
| testRule(Acl.InheritanceType.AND_BOTH_PERMIT, |
| AuthzStatus.INDETERMINATE, AuthzStatus.DENY, |
| AuthzStatus.DENY); |
| testRule(Acl.InheritanceType.AND_BOTH_PERMIT, |
| AuthzStatus.INDETERMINATE, AuthzStatus.INDETERMINATE, |
| AuthzStatus.DENY); |
| } |
| |
| @Test |
| public void testCombineLeafNode() { |
| testRule(Acl.InheritanceType.LEAF_NODE, |
| AuthzStatus.PERMIT, AuthzStatus.PERMIT, |
| AuthzStatus.DENY); |
| testRule(Acl.InheritanceType.LEAF_NODE, |
| AuthzStatus.PERMIT, AuthzStatus.DENY, |
| AuthzStatus.DENY); |
| testRule(Acl.InheritanceType.LEAF_NODE, |
| AuthzStatus.PERMIT, AuthzStatus.INDETERMINATE, |
| AuthzStatus.DENY); |
| testRule(Acl.InheritanceType.LEAF_NODE, |
| AuthzStatus.DENY, AuthzStatus.PERMIT, |
| AuthzStatus.DENY); |
| testRule(Acl.InheritanceType.LEAF_NODE, |
| AuthzStatus.DENY, AuthzStatus.DENY, |
| AuthzStatus.DENY); |
| testRule(Acl.InheritanceType.LEAF_NODE, |
| AuthzStatus.DENY, AuthzStatus.INDETERMINATE, |
| AuthzStatus.DENY); |
| testRule(Acl.InheritanceType.LEAF_NODE, |
| AuthzStatus.INDETERMINATE, AuthzStatus.PERMIT, |
| AuthzStatus.DENY); |
| testRule(Acl.InheritanceType.LEAF_NODE, |
| AuthzStatus.INDETERMINATE, AuthzStatus.DENY, |
| AuthzStatus.DENY); |
| testRule(Acl.InheritanceType.LEAF_NODE, |
| AuthzStatus.INDETERMINATE, AuthzStatus.INDETERMINATE, |
| AuthzStatus.DENY); |
| } |
| |
| // Port of test from GSA with similar name. Should be kept in sync. |
| @Test |
| public void testAuthorizeNoInheritance() throws IOException { |
| // Test basic rule: DENY overrides PERMIT. |
| Acl expectedAcl1 = buildAcl("", "eng,hr", "", "eng,finance,interns"); |
| Acl expectedAcl2 = buildAcl("alice,bob", "", "bob,charlie,dave", ""); |
| Acl expectedAcl3 = buildAcl("alice,bob", "", "", ""); |
| Acl expectedAcl4 = buildAcl("", "", "bob,charlie,dave", ""); |
| Acl emptyAcl = Acl.EMPTY; |
| |
| Map<DocId, Acl> acls = new HashMap<DocId, Acl>(); |
| acls.put(new DocId("1"), expectedAcl1); |
| acls.put(new DocId("2"), expectedAcl2); |
| acls.put(new DocId("3"), expectedAcl3); |
| acls.put(new DocId("4"), expectedAcl4); |
| acls.put(new DocId("5"), emptyAcl); |
| Acl.BatchRetriever retriever = new MockBatchRetriever(acls); |
| |
| AuthnIdentity identity = createIdentity("alice", "eng"); |
| assertEquals(AuthzStatus.DENY, |
| callIsAuthorized(identity, new DocId("1"), retriever)); |
| |
| identity = createIdentity("bob", "hr"); |
| assertEquals(AuthzStatus.PERMIT, |
| callIsAuthorized(identity, new DocId("1"), retriever)); |
| assertEquals(AuthzStatus.DENY, |
| callIsAuthorized(identity, new DocId("2"), retriever)); |
| assertEquals(AuthzStatus.PERMIT, |
| callIsAuthorized(identity, new DocId("3"), retriever)); |
| assertEquals(AuthzStatus.DENY, |
| callIsAuthorized(identity, new DocId("4"), retriever)); |
| |
| identity = createIdentity("alice", "hr"); |
| assertEquals(AuthzStatus.PERMIT, |
| callIsAuthorized(identity, new DocId("1"), retriever)); |
| assertEquals(AuthzStatus.PERMIT, |
| callIsAuthorized(identity, new DocId("2"), retriever)); |
| assertEquals(AuthzStatus.PERMIT, |
| callIsAuthorized(identity, new DocId("3"), retriever)); |
| assertEquals(AuthzStatus.DENY, |
| callIsAuthorized(identity, new DocId("4"), retriever)); |
| |
| identity = createIdentity("eve"); |
| assertEquals(AuthzStatus.DENY, |
| callIsAuthorized(identity, new DocId("3"), retriever)); |
| assertEquals(AuthzStatus.DENY, |
| callIsAuthorized(identity, new DocId("4"), retriever)); |
| |
| identity = createIdentity("no-importante", "qa"); |
| assertEquals(AuthzStatus.DENY, |
| callIsAuthorized(identity, new DocId("3"), retriever)); |
| assertEquals(AuthzStatus.DENY, |
| callIsAuthorized(identity, new DocId("4"), retriever)); |
| |
| // Docs with empty ACLs should return INDETERMINATE. |
| assertEquals(AuthzStatus.INDETERMINATE, |
| callIsAuthorized(identity, new DocId("5"), retriever)); |
| assertEquals(AuthzStatus.INDETERMINATE, |
| callIsAuthorized(identity, new DocId("9"), retriever)); |
| } |
| |
| // Port of test from GSA with similar name. Should be kept in sync. |
| // A Windows filesystem-like scenario: |
| // a file has no ACL, inherits PERMIT from folder |
| @Test |
| public void testAuthorizeChildInheritsPermit() throws IOException { |
| Acl file = buildAcl("", "", "", "", "Folder"); |
| Acl folder = buildAcl("adam", "", "", "", |
| Acl.InheritanceType.CHILD_OVERRIDES); |
| |
| Map<DocId, Acl> acls = new HashMap<DocId, Acl>(); |
| acls.put(new DocId("1"), file); |
| acls.put(new DocId("Folder"), folder); |
| Acl.BatchRetriever retriever = new MockBatchRetriever(acls); |
| |
| AuthnIdentity identity = createIdentity("adam"); |
| assertEquals(AuthzStatus.PERMIT, |
| callIsAuthorized(identity, new DocId("1"), retriever)); |
| } |
| |
| // Port of test from GSA with similar name. Should be kept in sync. |
| // A Windows filesystem-like scenario: |
| // a file has no ACL, inherits DENY from folder |
| @Test |
| public void testAuthorizeChildInheritsDeny() throws IOException { |
| Acl file = buildAcl("", "", "", "", "Folder"); |
| Acl folder = buildAcl("", "", "adam", "", |
| Acl.InheritanceType.CHILD_OVERRIDES); |
| |
| Map<DocId, Acl> acls = new HashMap<DocId, Acl>(); |
| acls.put(new DocId("1"), file); |
| acls.put(new DocId("Folder"), folder); |
| Acl.BatchRetriever retriever = new MockBatchRetriever(acls); |
| |
| AuthnIdentity identity = createIdentity("adam"); |
| assertEquals(AuthzStatus.DENY, |
| callIsAuthorized(identity, new DocId("1"), retriever)); |
| } |
| |
| // Port of test from GSA with similar name. Should be kept in sync. |
| // A Windows filesystem-like scenario: |
| // a file has a PERMIT ACL, overrides folder's DENY |
| @Test |
| public void testAuthorizeChildOverridesDeny() throws IOException { |
| Acl file = buildAcl("adam", "", "", "", "Folder"); |
| Acl folder = buildAcl("", "", "", "eng", |
| Acl.InheritanceType.CHILD_OVERRIDES); |
| |
| Map<DocId, Acl> acls = new HashMap<DocId, Acl>(); |
| acls.put(new DocId("1"), file); |
| acls.put(new DocId("Folder"), folder); |
| Acl.BatchRetriever retriever = new MockBatchRetriever(acls); |
| |
| AuthnIdentity identity = createIdentity("adam", "eng"); |
| assertEquals(AuthzStatus.PERMIT, |
| callIsAuthorized(identity, new DocId("1"), retriever)); |
| } |
| |
| // Port of test from GSA with similar name. Should be kept in sync. |
| // A Windows filesystem-like scenario: |
| // a file has a DENY ACL, overrides folder's PERMIT |
| @Test |
| public void testAuthorizeChildOverridesPermit() throws IOException { |
| Acl file = buildAcl("", "", "eve", "", "Folder"); |
| Acl folder = buildAcl("", "qa", "", "", |
| Acl.InheritanceType.CHILD_OVERRIDES); |
| |
| Map<DocId, Acl> acls = new HashMap<DocId, Acl>(); |
| acls.put(new DocId("1"), file); |
| acls.put(new DocId("Folder"), folder); |
| Acl.BatchRetriever retriever = new MockBatchRetriever(acls); |
| |
| // eve is denied... |
| AuthnIdentity identity = createIdentity("eve", "qa"); |
| assertEquals(AuthzStatus.DENY, |
| callIsAuthorized(identity, new DocId("1"), retriever)); |
| // although qa is in general permitted. |
| identity = createIdentity("bob", "qa"); |
| assertEquals(AuthzStatus.PERMIT, |
| callIsAuthorized(identity, new DocId("1"), retriever)); |
| } |
| |
| // Port of test from GSA with similar name. Should be kept in sync. |
| // A Windows share-like scenario: |
| // - a share has a DENY ACL, which overrides any PERMITS underneath it. |
| // - a share has a PERMIT ACL, which matches a PERMIT from underneath |
| // - a share has a PERMIT ACL, but does not match INDETERMINATE from |
| // underneath. |
| @Test |
| public void testAuthorizeParentOverridesPermit() throws IOException { |
| Acl file = buildAcl("bob", "qa", "", "", "Folder"); |
| Acl folder = buildAcl("adam", "", "", "", |
| Acl.InheritanceType.CHILD_OVERRIDES, "Share"); |
| Acl share = buildAcl("charlie", "finance", "", "eng", |
| Acl.InheritanceType.AND_BOTH_PERMIT); |
| |
| Map<DocId, Acl> acls = new HashMap<DocId, Acl>(); |
| acls.put(new DocId("1"), file); |
| acls.put(new DocId("Folder"), folder); |
| acls.put(new DocId("Share"), share); |
| Acl.BatchRetriever retriever = new MockBatchRetriever(acls); |
| |
| // Permitted by Folder, but denied by Share |
| AuthnIdentity identity = createIdentity("adam", "eng"); |
| assertEquals(AuthzStatus.DENY, |
| callIsAuthorized(identity, new DocId("1"), retriever)); |
| |
| // Permitted by File (via group), but denied by Share (by omission) |
| identity = createIdentity("eve", "qa"); |
| assertEquals(AuthzStatus.DENY, |
| callIsAuthorized(identity, new DocId("1"), retriever)); |
| |
| // Permitted by File (via user), permitted by Share (via group) |
| identity = createIdentity("bob", "finance"); |
| assertEquals(AuthzStatus.PERMIT, |
| callIsAuthorized(identity, new DocId("1"), retriever)); |
| |
| // Permitted by Share (via user), but INDETERMINATE otherwise, so DENY |
| identity = createIdentity("charlie"); |
| assertEquals(AuthzStatus.DENY, |
| callIsAuthorized(identity, new DocId("1"), retriever)); |
| } |
| |
| // Port of test from GSA with similar name. Should be kept in sync. |
| // A somewhat contrived Windows share scenario: |
| // a file has a DENY ACL, does not agree with share's PERMIT |
| @Test |
| public void testAuthorizeParentOverridesDeny() throws IOException { |
| Acl file = buildAcl("", "", "eve", "", "Share"); |
| Acl share = buildAcl("", "qa", "", "", Acl.InheritanceType.AND_BOTH_PERMIT); |
| |
| Map<DocId, Acl> acls = new HashMap<DocId, Acl>(); |
| acls.put(new DocId("1"), file); |
| acls.put(new DocId("Share"), share); |
| Acl.BatchRetriever retriever = new MockBatchRetriever(acls); |
| |
| AuthnIdentity identity = createIdentity("eve", "qa"); |
| assertEquals(AuthzStatus.DENY, |
| callIsAuthorized(identity, new DocId("1"), retriever)); |
| } |
| |
| // Port of test from GSA with similar name. Should be kept in sync. |
| // A contrived Windows file system scenario: |
| // neither file nor folder has any ACLs |
| @Test |
| public void testAuthorizeInheritanceNoAcl() throws IOException { |
| Acl file = buildAcl("", "", "", "", "Folder"); |
| Acl folder = buildAcl("", "", "", "", Acl.InheritanceType.CHILD_OVERRIDES); |
| |
| Map<DocId, Acl> acls = new HashMap<DocId, Acl>(); |
| acls.put(new DocId("1"), file); |
| acls.put(new DocId("Folder"), folder); |
| Acl.BatchRetriever retriever = new MockBatchRetriever(acls); |
| |
| AuthnIdentity identity = createIdentity("eve", "qa"); |
| assertEquals(AuthzStatus.DENY, |
| callIsAuthorized(identity, new DocId("1"), retriever)); |
| } |
| |
| // Port of test from GSA with similar name. Should be kept in sync. |
| // A SharePoint example: a subsite grants PERMIT and website overrides a |
| // PERMIT |
| @Test |
| public void testAuthorizeSP() throws IOException { |
| Acl file = buildAcl("eve", "", "", "", "Subsite"); |
| Acl subsite = buildAcl("", "eng", "", "", |
| Acl.InheritanceType.CHILD_OVERRIDES, "Website"); |
| Acl website = buildAcl("", "", "", "qa", |
| Acl.InheritanceType.PARENT_OVERRIDES); |
| |
| Map<DocId, Acl> acls = new HashMap<DocId, Acl>(); |
| acls.put(new DocId("1"), file); |
| acls.put(new DocId("Subsite"), subsite); |
| acls.put(new DocId("Website"), website); |
| Acl.BatchRetriever retriever = new MockBatchRetriever(acls); |
| |
| AuthnIdentity identity = createIdentity("adam", "eng"); |
| assertEquals(AuthzStatus.PERMIT, |
| callIsAuthorized(identity, new DocId("1"), retriever)); |
| |
| identity = createIdentity("eve", "qa"); |
| assertEquals(AuthzStatus.DENY, |
| callIsAuthorized(identity, new DocId("1"), retriever)); |
| } |
| |
| // Port of test from GSA with similar name. Should be kept in sync. |
| // We hope the backend will not have cycles in inhertitance trees, |
| // but Authorize has to be robust against the possibility. |
| @Test |
| public void testAuthorizeInheritanceCycle() throws IOException { |
| Acl file = buildAcl("", "qa", "", "", "Folder"); |
| Acl folder = buildAcl("adam", "", "", "", |
| Acl.InheritanceType.CHILD_OVERRIDES, "Share"); |
| Acl share = buildAcl("", "", "", "eng", |
| Acl.InheritanceType.AND_BOTH_PERMIT, "File"); |
| |
| Map<DocId, Acl> acls = new HashMap<DocId, Acl>(); |
| DocId fid = new DocId("File"); |
| acls.put(fid, file); |
| acls.put(new DocId("Folder"), folder); |
| acls.put(new DocId("Share"), share); |
| Acl.BatchRetriever retriever = new MockBatchRetriever(acls); |
| |
| AuthnIdentity identity = createIdentity("adam", "eng"); |
| assertEquals(AuthzStatus.INDETERMINATE, |
| callIsAuthorized(identity, fid, retriever)); |
| |
| identity = createIdentity("eve", "qa"); |
| assertEquals(AuthzStatus.INDETERMINATE, |
| callIsAuthorized(identity, fid, retriever)); |
| } |
| |
| // Port of test from GSA with similar name. Should be kept in sync. |
| @Test |
| public void testAuthorizeInheritanceMissingAclNonEmpty() throws IOException { |
| Acl file = buildAcl("", "group", "", "", "Folder"); |
| |
| Map<DocId, Acl> acls = new HashMap<DocId, Acl>(); |
| acls.put(new DocId("1"), file); |
| // No "Folder" ACLs |
| Acl.BatchRetriever retriever = new MockBatchRetriever(acls); |
| |
| AuthnIdentity identity = createIdentity("user", "group"); |
| assertEquals(AuthzStatus.INDETERMINATE, |
| callIsAuthorized(identity, new DocId("1"), retriever)); |
| } |
| |
| // Port of test from GSA with similar name. Should be kept in sync. |
| @Test |
| public void testAuthorizeInheritanceMissingAclEmpty() throws IOException { |
| Acl file = buildAcl("", "", "", "", "Folder"); |
| |
| Map<DocId, Acl> acls = new HashMap<DocId, Acl>(); |
| acls.put(new DocId("1"), file); |
| // No "Folder" ACLs |
| Acl.BatchRetriever retriever = new MockBatchRetriever(acls); |
| |
| AuthnIdentity identity = createIdentity("user", "group"); |
| assertEquals(AuthzStatus.INDETERMINATE, |
| callIsAuthorized(identity, new DocId("1"), retriever)); |
| } |
| |
| // Port of test from GSA with similar name. Should be kept in sync. |
| // Illegal chain: it contains a LEAF_NODE in the middle |
| @Test |
| public void testAuthorizeIllegalChain() throws IOException { |
| Acl file = buildAcl("", "", "", "", "Folder1"); |
| Acl folder1 = buildAcl("adam", "", "", "", Acl.InheritanceType.LEAF_NODE, |
| "Folder2"); |
| Acl folder2 = buildAcl("", "", "", "", Acl.InheritanceType.CHILD_OVERRIDES); |
| |
| Map<DocId, Acl> acls = new HashMap<DocId, Acl>(); |
| acls.put(new DocId("1"), file); |
| acls.put(new DocId("Folder1"), folder1); |
| acls.put(new DocId("Folder2"), folder2); |
| Acl.BatchRetriever retriever = new MockBatchRetriever(acls); |
| |
| AuthnIdentity identity = createIdentity("adam"); |
| assertEquals(AuthzStatus.INDETERMINATE, |
| callIsAuthorized(identity, new DocId("1"), retriever)); |
| } |
| |
| @Test |
| public void testDefaultCaseSensitive() { |
| assertTrue(new Acl.Builder().build().isEverythingCaseSensitive()); |
| assertTrue(!new Acl.Builder().build().isEverythingCaseInsensitive()); |
| } |
| |
| @Test |
| public void testCanChangeCaseSensitivity() { |
| assertFalse(new Acl.Builder().setEverythingCaseInsensitive() |
| .build().isEverythingCaseSensitive()); |
| assertTrue(new Acl.Builder() |
| .setEverythingCaseInsensitive().setEverythingCaseSensitive() |
| .build().isEverythingCaseSensitive()); |
| } |
| |
| @Test |
| public void testCaseInsensitiveUsage() { |
| Acl acl = new Acl.Builder() |
| .setPermitGroups(G("PermiTGroup")) |
| .setDenyGroups(G("DenYGroup")) |
| .setPermitUsers(U("PermiTUser", "BotHUser")) |
| .setDenyUsers(U("DenYUser", "BotHUser")) |
| .setEverythingCaseInsensitive() |
| .build(); |
| assertEquals(AuthzStatus.PERMIT, acl.isAuthorizedLocal( |
| createIdentity("permitUser"))); |
| assertEquals(AuthzStatus.DENY, acl.isAuthorizedLocal( |
| createIdentity("denyUser"))); |
| assertEquals(AuthzStatus.INDETERMINATE, acl.isAuthorizedLocal( |
| createIdentity("unknownUser"))); |
| } |
| |
| private AuthnIdentity createIdentity(String username, String... groups) { |
| return createIdentity(username, Arrays.asList(groups)); |
| } |
| |
| private AuthnIdentity createIdentity(final String username, |
| List<String> groups) { |
| final UserPrincipal user = new UserPrincipal(username); |
| final Set<GroupPrincipal> groupSet = Collections.unmodifiableSet( |
| new TreeSet<GroupPrincipal>(GroupPrincipal.makeSet(groups))); |
| return new AuthnIdentity() { |
| @Override |
| public UserPrincipal getUser() { |
| return user; |
| } |
| |
| @Override |
| public String getPassword() { |
| return null; |
| } |
| |
| @Override |
| public Set<GroupPrincipal> getGroups() { |
| return groupSet; |
| } |
| }; |
| } |
| |
| private static class MockBatchRetriever implements Acl.BatchRetriever { |
| private Map<DocId, Acl> acls; |
| |
| public MockBatchRetriever(Map<DocId, Acl> acls) { |
| this.acls = acls; |
| } |
| |
| @Override |
| public Map<DocId, Acl> retrieveAcls(Set<DocId> ids) { |
| Map<DocId, Acl> result = new HashMap<DocId, Acl>(ids.size() * 2); |
| for (DocId docId : ids) { |
| if (acls.containsKey(docId)) { |
| result.put(docId, acls.get(docId)); |
| } |
| } |
| return Collections.unmodifiableMap(result); |
| } |
| } |
| |
| private static class MockDecision extends Acl.Decision { |
| private final AuthzStatus status; |
| |
| public MockDecision(AuthzStatus status) { |
| this.status = status; |
| } |
| |
| @Override |
| protected AuthzStatus computeDecision() { |
| return status; |
| } |
| } |
| } |
