Skip to content

Commit

Permalink
SONAR-9444 make private at least one missing perm user or codeviewer
Browse files Browse the repository at this point in the history
  • Loading branch information
@sns-seb
sns-seb committed Jun 29, 2017
1 parent 71b58bc commit b8a687d
Show file tree
Hide file tree
Showing 2 changed files with 102 additions and 31 deletions.
27 changes: 19 additions & 8 deletions ...nar/server/platform/db/migration/version/v64/MakeComponentsPrivateBasedOnPermissions.java
View file
Expand Up @@ -68,14 +68,25 @@ private static void makePrivateComponent(Context context) throws SQLException {
" p.scope = ?" + " p.scope = ?" +
" and p.qualifier in (?, ?)" + " and p.qualifier in (?, ?)" +
" and p.private = ?" + " and p.private = ?" +
" and not exists (" + " and (" +
" select" + " not exists (" +
" 1" + " select" +
" from group_roles gr" + " 1" +
" where " + " from group_roles gr" +
" gr.resource_id = p.id" + " where " +
" and gr.group_id is null" + " gr.resource_id = p.id" +
" and gr.role in (?, ?)" + " and gr.group_id is null" +
" and gr.role = ?" +
" ) " +
" or not exists (" +
" select" +
" 1" +
" from group_roles gr" +
" where " +
" gr.resource_id = p.id" +
" and gr.group_id is null" +
" and gr.role = ?" +
" )" +
" )" + " )" +
// trees with only permissions to group must not be made private // trees with only permissions to group must not be made private
" and (" + " and (" +
Expand Down
106 changes: 83 additions & 23 deletions ...server/platform/db/migration/version/v64/MakeComponentsPrivateBasedOnPermissionsTest.java
View file
Expand Up @@ -46,8 +46,6 @@ public class MakeComponentsPrivateBasedOnPermissionsTest {
private final String randomPublicConditionRole = random.nextBoolean() ? ROLE_CODEVIEWER : ROLE_USER; private final String randomPublicConditionRole = random.nextBoolean() ? ROLE_CODEVIEWER : ROLE_USER;
private final String randomQualifier = random.nextBoolean() ? PROJECT_QUALIFIER : VIEW_QUALIFIER; private final String randomQualifier = random.nextBoolean() ? PROJECT_QUALIFIER : VIEW_QUALIFIER;
private final String randomRole = "role_" + random.nextInt(12); private final String randomRole = "role_" + random.nextInt(12);
private final int randomUserId = random.nextInt(500);
private final int randomGroupId = random.nextInt(500);
private MakeComponentsPrivateBasedOnPermissions underTest = new MakeComponentsPrivateBasedOnPermissions(db.database()); private MakeComponentsPrivateBasedOnPermissions underTest = new MakeComponentsPrivateBasedOnPermissions(db.database());


@Test @Test
Expand All @@ -56,79 +54,138 @@ public void execute_does_nothing_on_empty_tables() throws SQLException {
} }


@Test @Test
public void execute_makes_project_private_if_group_AnyOne_has_global_permission_USER() throws SQLException { public void execute_makes_project_private_if_Anyone_has_only_user_permission_and_project_has_at_least_one_other_group_permission() throws SQLException {
long pId = insertRootComponent("p1", false); long pId1 = insertRootComponent("p1", false);
insertGroupPermission(ROLE_USER, null, null); insertGroupPermission(ROLE_USER, pId1, null);
insertGroupPermission(randomRole, pId, randomGroupId); insertGroupPermission("foo", pId1, random.nextInt(10));


underTest.execute(); underTest.execute();


assertThat(isPrivate("p1")).isTrue(); assertThat(isPrivate("p1")).isTrue();
} }


@Test @Test
public void execute_makes_project_private_if_group_AnyOne_has_global_permission_BROWSE() throws SQLException { public void execute_makes_project_private_if_Anyone_has_only_user_permission_and_project_has_one_user_permission() throws SQLException {
long pId = insertRootComponent("p1", false); long pId1 = insertRootComponent("p1", false);
insertGroupPermission(ROLE_CODEVIEWER, null, null); insertGroupPermission(ROLE_USER, pId1, null);
insertUserPermission(randomRole, pId, randomUserId); insertUserPermission("foo", pId1, random.nextInt(10));


underTest.execute(); underTest.execute();


assertThat(isPrivate("p1")).isTrue(); assertThat(isPrivate("p1")).isTrue();
} }


@Test @Test
public void execute_makes_project_private_if_group_other_than_AnyOne_has_permission_BROWSE_on_other_project() throws SQLException { public void execute_keeps_project_public_if_Anyone_has_only_user_permission_and_project_has_no_user_nor_other_group_permission() throws SQLException {
long pId1 = insertRootComponent("p1", false);
insertGroupPermission(ROLE_USER, pId1, null);

underTest.execute();

assertThat(isPrivate("p1")).isFalse();
}

@Test
public void execute_makes_project_private_if_Anyone_has_only_codeviewer_permission_and_project_has_one_other_group_permission() throws SQLException {
long pId1 = insertRootComponent("p1", false); long pId1 = insertRootComponent("p1", false);
insertGroupPermission(ROLE_CODEVIEWER, pId1, random.nextInt(30)); insertGroupPermission(ROLE_CODEVIEWER, pId1, null);
insertGroupPermission("foo", pId1, random.nextInt(10));


underTest.execute(); underTest.execute();


assertThat(isPrivate("p1")).isTrue(); assertThat(isPrivate("p1")).isTrue();
} }


@Test @Test
public void execute_makes_project_private_if_group_other_than_AnyOne_has_permission_USER_on_other_project() throws SQLException { public void execute_makes_project_private_if_Anyone_has_only_codeviewer_permission_and_project_has_one_user_permission() throws SQLException {
long pId1 = insertRootComponent("p1", false); long pId1 = insertRootComponent("p1", false);
insertGroupPermission(ROLE_USER, pId1, random.nextInt(30)); insertGroupPermission(ROLE_CODEVIEWER, pId1, null);
insertUserPermission("foo", pId1, random.nextInt(10));


underTest.execute(); underTest.execute();


assertThat(isPrivate("p1")).isTrue(); assertThat(isPrivate("p1")).isTrue();
} }


@Test @Test
public void execute_keeps_project_public_if_group_AnyOne_has_permission_USER_on_it() throws SQLException { public void execute_keeps_project_public_if_Anyone_has_only_codeviewer_permission_and_project_has_no_user_nor_other_group_permission() throws SQLException {
long pId1 = insertRootComponent("p1", false);
insertGroupPermission(ROLE_CODEVIEWER, pId1, null);

underTest.execute();

assertThat(isPrivate("p1")).isFalse();
}

@Test
public void execute_makes_project_private_if_Anyone_has_neither_user_nor_codeviewer_permission_and_project_has_one_other_group_permission() throws SQLException {
long pId1 = insertRootComponent("p1", false);
insertGroupPermission(randomRole, pId1, null);
insertGroupPermission("foo", pId1, random.nextInt(10));

underTest.execute();

assertThat(isPrivate("p1")).isTrue();
}

@Test
public void execute_makes_project_private_if_Anyone_has_neither_user_nor_codeviewer_permission_and_project_has_one_user_permission() throws SQLException {
long pId1 = insertRootComponent("p1", false);
insertGroupPermission(randomRole, pId1, null);
insertUserPermission("foo", pId1, random.nextInt(10));

underTest.execute();

assertThat(isPrivate("p1")).isTrue();
}

@Test
public void execute_keeps_project_public_if_Anyone_has_neither_user_nor_codeviewer_permission_and_project_has_no_user_nor_other_group_permission() throws SQLException {
long pId1 = insertRootComponent("p1", false);
insertGroupPermission("foo", pId1, null);

underTest.execute();

assertThat(isPrivate("p1")).isFalse();
}

@Test
public void execute_keeps_project_public_if_Anyone_has_both_user_and_codeviewer_permission_and_project_has_one_other_group_permission() throws SQLException {
long pId1 = insertRootComponent("p1", false); long pId1 = insertRootComponent("p1", false);
insertGroupPermission(ROLE_USER, pId1, null); insertGroupPermission(ROLE_USER, pId1, null);
insertGroupPermission(ROLE_CODEVIEWER, pId1, null);
insertGroupPermission("foo", pId1, random.nextInt(10));


underTest.execute(); underTest.execute();


assertThat(isPrivate("p1")).isFalse(); assertThat(isPrivate("p1")).isFalse();
} }


@Test @Test
public void execute_keeps_project_public_if_group_AnyOne_has_permission_BROWSE_on_it() throws SQLException { public void execute_keeps_project_public_if_Anyone_has_both_user_and_codeviewer_permission_and_project_has_user_permission() throws SQLException {
long pId1 = insertRootComponent("p1", false); long pId1 = insertRootComponent("p1", false);
insertGroupPermission(ROLE_USER, pId1, null);
insertGroupPermission(ROLE_CODEVIEWER, pId1, null); insertGroupPermission(ROLE_CODEVIEWER, pId1, null);
insertUserPermission("foo", pId1, random.nextInt(10));


underTest.execute(); underTest.execute();


assertThat(isPrivate("p1")).isFalse(); assertThat(isPrivate("p1")).isFalse();
} }


@Test @Test
public void execute_keeps_project_public_if_only_group_AnyOne_has_permission_on_it() throws SQLException { public void execute_keeps_project_public_if_Anyone_has_both_user_and_codeviewer_permission_and_project_has_no_user_nor_other_group_permission() throws SQLException {
long pId1 = insertRootComponent("p1", false); long pId1 = insertRootComponent("p1", false);
insertGroupPermission(randomRole, pId1, null); insertGroupPermission(ROLE_USER, pId1, null);
insertGroupPermission(ROLE_CODEVIEWER, pId1, null);


underTest.execute(); underTest.execute();


assertThat(isPrivate("p1")).isFalse(); assertThat(isPrivate("p1")).isFalse();
} }


@Test @Test
public void execute_keeps_project_public_if_project_has_no_permission() throws SQLException { public void execute_keeps_project_public_if_it_has_no_user_nor_group_permission_at_all() throws SQLException {
insertRootComponent("p1", false); insertRootComponent("p1", false);


underTest.execute(); underTest.execute();
Expand All @@ -137,20 +194,23 @@ public void execute_keeps_project_public_if_project_has_no_permission() throws S
} }


@Test @Test
public void execute_does_not_change_private_projects_to_public_when_they_actually_should_be_because_they_have_USER_or_BROWSE_on_group_Anyone() throws SQLException { public void execute_does_not_change_private_projects_to_public_when_they_actually_should_be() throws SQLException {
long p1Id = insertRootComponent("p1", true); long p1Id = insertRootComponent("p1", true); // both user and codeviewer
long p2Id = insertRootComponent("p2", true); long p2Id = insertRootComponent("p2", true); // only user but no other permission
long p3Id = insertRootComponent("p3", true); long p3Id = insertRootComponent("p3", true); // only codeviewer but no other permission
long p4Id = insertRootComponent("p4", true); // neither codeviewer nor user but no other permission
insertGroupPermission(ROLE_CODEVIEWER, p1Id, null); insertGroupPermission(ROLE_CODEVIEWER, p1Id, null);
insertGroupPermission(ROLE_USER, p1Id, null); insertGroupPermission(ROLE_USER, p1Id, null);
insertGroupPermission(ROLE_CODEVIEWER, p2Id, null); insertGroupPermission(ROLE_CODEVIEWER, p2Id, null);
insertGroupPermission(ROLE_USER, p3Id, null); insertGroupPermission(ROLE_USER, p3Id, null);
insertGroupPermission(randomRole, p4Id, null);


underTest.execute(); underTest.execute();


assertThat(isPrivate("p1")).isTrue(); assertThat(isPrivate("p1")).isTrue();
assertThat(isPrivate("p2")).isTrue(); assertThat(isPrivate("p2")).isTrue();
assertThat(isPrivate("p3")).isTrue(); assertThat(isPrivate("p3")).isTrue();
assertThat(isPrivate("p4")).isTrue();
} }


@Test @Test
Expand Down

0 comments on commit b8a687d

Please sign in to comment.