Skip to content

Commit

Permalink
Make SecurityContextSwitch more intuitive (#1715)
Browse files Browse the repository at this point in the history
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
  • Loading branch information
avgustinmm committed Apr 12, 2024
1 parent 1f2dd28 commit da67193
Show file tree
Hide file tree
Showing 5 changed files with 13 additions and 17 deletions.
Expand Up @@ -611,7 +611,7 @@ private static byte[] randomBytes(final int len) {
}

private <T> T runAsTenant(final String tenant, final Callable<T> callable) throws Exception {
return SecurityContextSwitch.runAs(SecurityContextSwitch.withUserAndTenant("user", tenant), callable);
return SecurityContextSwitch.runAs(SecurityContextSwitch.withUserAndTenantAllSpPermissions("user", tenant), callable);
}

private SoftwareModule createSoftwareModuleForTenant(final String tenant) throws Exception {
Expand Down
Expand Up @@ -133,7 +133,7 @@ private byte[] createTestTenantsForSystemStatistics(final int tenants, final int

for (int i = 0; i < tenants; i++) {
final String tenantname = "tenant" + i;
SecurityContextSwitch.runAs(SecurityContextSwitch.withUserAndTenant("bumlux", tenantname, true, true, false,
SecurityContextSwitch.runAs(SecurityContextSwitch.withUserAndTenantAllSpPermissions("bumlux", tenantname, true, true, false,
SpringEvalExpressions.SYSTEM_ROLE), () -> {
systemManagement.getTenantMetadata();
if (artifactSize > 0) {
Expand Down
Expand Up @@ -188,23 +188,23 @@ void getTargetSecurityTokenOnlyWithCorrectPermission() throws Exception {

// retrieve security token only with READ_TARGET_SEC_TOKEN permission
final String securityTokenWithReadPermission = SecurityContextSwitch.runAs(
SecurityContextSwitch.withUser("OnlyTargetReadPermission", false, SpPermission.READ_TARGET_SEC_TOKEN),
SecurityContextSwitch.withUser("OnlyTargetReadPermission", SpPermission.READ_TARGET_SEC_TOKEN),
createdTarget::getSecurityToken);
// retrieve security token only with ROLE_TARGET_ADMIN permission
final String securityTokenWithTargetAdminPermission = SecurityContextSwitch.runAs(
SecurityContextSwitch.withUser("OnlyTargetAdminPermission", false, SpRole.TARGET_ADMIN),
SecurityContextSwitch.withUser("OnlyTargetAdminPermission", SpRole.TARGET_ADMIN),
createdTarget::getSecurityToken);
// retrieve security token only with ROLE_TENANT_ADMIN permission
final String securityTokenWithTenantAdminPermission = SecurityContextSwitch.runAs(
SecurityContextSwitch.withUser("OnlyTenantAdminPermission", false, SpRole.TENANT_ADMIN),
SecurityContextSwitch.withUser("OnlyTenantAdminPermission", SpRole.TENANT_ADMIN),
createdTarget::getSecurityToken);

// retrieve security token as system code execution
final String securityTokenAsSystemCode = systemSecurityContext.runAsSystem(createdTarget::getSecurityToken);

// retrieve security token without any permissions
final String securityTokenWithoutPermission = SecurityContextSwitch
.runAs(SecurityContextSwitch.withUser("NoPermission", false), createdTarget::getSecurityToken);
.runAs(SecurityContextSwitch.withUser("NoPermission"), createdTarget::getSecurityToken);

assertThat(createdTarget.getSecurityToken()).isEqualTo("token");
assertThat(securityTokenWithReadPermission).isNotNull();
Expand Down
Expand Up @@ -117,7 +117,7 @@ public void getTenanatMetdata() throws Exception {
// check that the cache is not getting in the way, i.e. "bumlux" results
// in bumlux and not
// mytenant
assertThat(SecurityContextSwitch.runAs(SecurityContextSwitch.withUserAndTenant("user", "bumlux"),
assertThat(SecurityContextSwitch.runAs(SecurityContextSwitch.withUserAndTenantAllSpPermissions("user", "bumlux"),
() -> systemManagement.getTenantMetadata().getTenant().toUpperCase()))
.isEqualTo("bumlux".toUpperCase());
}
Expand Down Expand Up @@ -171,7 +171,7 @@ public void createMultipleDistributionSetsWithSameNameForDifferentTenants() thro
}

private <T> T runAsTenant(final String tenant, final Callable<T> callable) throws Exception {
return SecurityContextSwitch.runAs(SecurityContextSwitch.withUserAndTenant("user", tenant), callable);
return SecurityContextSwitch.runAs(SecurityContextSwitch.withUserAndTenantAllSpPermissions("user", tenant), callable);
}

private Target createTargetForTenant(final String controllerId, final String tenant) throws Exception {
Expand Down
Expand Up @@ -64,22 +64,18 @@ private static void createTenant(final String tenantId) {
}

public static WithUser withController(final String principal, final String... authorities) {
return withUserAndTenant(principal, DEFAULT_TENANT, true, false, true, authorities);
return withUserAndTenantAllSpPermissions(principal, DEFAULT_TENANT, true, false, true, authorities);
}

public static WithUser withUser(final String principal, final String... authorities) {
return withUserAndTenant(principal, DEFAULT_TENANT, true, false, false, authorities);
return withUserAndTenantAllSpPermissions(principal, DEFAULT_TENANT, true, false, false, authorities);
}

public static WithUser withUser(final String principal, final boolean allSpPermision, final String... authorities) {
return withUserAndTenant(principal, DEFAULT_TENANT, true, allSpPermision, false, authorities);
public static WithUser withUserAndTenantAllSpPermissions(final String principal, final String tenant) {
return withUserAndTenantAllSpPermissions(principal, tenant, true, true, false);
}

public static WithUser withUserAndTenant(final String principal, final String tenant, final String... authorities) {
return withUserAndTenant(principal, tenant, true, true, false, authorities);
}

public static WithUser withUserAndTenant(final String principal, final String tenant,
public static WithUser withUserAndTenantAllSpPermissions(final String principal, final String tenant,
final boolean autoCreateTenant, final boolean allSpPermission, final boolean controller,
final String... authorities) {
return createWithUser(principal, tenant, autoCreateTenant, allSpPermission, controller, authorities);
Expand Down

0 comments on commit da67193

Please sign in to comment.