feat(portal): add all permissions for admin on API/APP

fix gravitee-io/issues#3302
gravitee-io · Mar 6, 2020 · 48dba0d · 48dba0d
1 parent 7ee6eb5
commit 48dba0d
Show file tree

Hide file tree

Showing 7 changed files with 53 additions and 11 deletions.
diff --git a/...rest/src/main/java/io/gravitee/rest/api/portal/rest/resource/ApiRatingAnswerResource.java b/...rest/src/main/java/io/gravitee/rest/api/portal/rest/resource/ApiRatingAnswerResource.java
@@ -54,7 +54,7 @@ public Response deleteApiRatingAnswer(@PathParam("apiId") String apiId, @PathPar
         if (userApis.stream().anyMatch(a -> a.getId().equals(apiId))) {
 
             RatingEntity ratingEntity = ratingService.findById(ratingId);
-            if (ratingEntity != null && ratingEntity.getId().equals(ratingId)) {
+            if (ratingEntity != null && ratingEntity.getApi().equals(apiId)) {
 
                 if (ratingEntity.getAnswers().stream().anyMatch(answer -> answer.getId().equals(answerId))){
                     ratingService.deleteAnswer(ratingId, answerId);

diff --git a/...est/src/main/java/io/gravitee/rest/api/portal/rest/resource/ApiRatingAnswersResource.java b/...est/src/main/java/io/gravitee/rest/api/portal/rest/resource/ApiRatingAnswersResource.java
@@ -69,7 +69,7 @@ public Response createApiRatingAnswer(@PathParam("apiId") String apiId, @PathPar
         if (userApis.stream().anyMatch(a -> a.getId().equals(apiId))) {
 
             RatingEntity ratingEntity = ratingService.findById(ratingId);
-            if (ratingEntity!= null) {
+            if (ratingEntity!= null && ratingEntity.getApi().equals(apiId)) {
 
                 NewRatingAnswerEntity ratingAnswerEntity = new NewRatingAnswerEntity();
                 ratingAnswerEntity.setComment(ratingAnswerInput.getComment());

diff --git a/...ortal-rest/src/main/java/io/gravitee/rest/api/portal/rest/resource/ApiRatingResource.java b/...ortal-rest/src/main/java/io/gravitee/rest/api/portal/rest/resource/ApiRatingResource.java
@@ -62,8 +62,11 @@ public class ApiRatingResource extends AbstractResource {
     public Response deleteApiRating(@PathParam("apiId") String apiId, @PathParam("ratingId") String ratingId) {
         Collection<ApiEntity> userApis = apiService.findPublishedByUser(getAuthenticatedUserOrNull());
         if (userApis.stream().anyMatch(a -> a.getId().equals(apiId))) {
-            RatingEntity ratingEntity = ratingService.findByApiForConnectedUser(apiId);
-            if (ratingEntity!= null && ratingEntity.getId().equals(ratingId)) {
+
+            RatingEntity ratingEntity = ratingService.findById(ratingId);
+
+            if (ratingEntity!= null && ratingEntity.getApi().equals(apiId)) {
+
                 ratingService.delete(ratingId);
                 return Response
                         .status(Status.NO_CONTENT)
@@ -87,8 +90,8 @@ public Response updateApiRating(@PathParam("apiId") String apiId, @PathParam("ra
         Collection<ApiEntity> userApis = apiService.findPublishedByUser(getAuthenticatedUserOrNull());
         if (userApis.stream().anyMatch(a -> a.getId().equals(apiId))) {
 
-            RatingEntity ratingEntity = ratingService.findByApiForConnectedUser(apiId);
-            if (ratingEntity!= null && ratingEntity.getId().equals(ratingId)) {
+            RatingEntity ratingEntity = ratingService.findById(ratingId);
+            if (ratingEntity!= null && ratingEntity.getApi().equals(apiId)) {
                 UpdateRatingEntity rating = new UpdateRatingEntity();
                 rating.setId(ratingId);
                 rating.setApi(apiId);

diff --git a/...tal-rest/src/main/java/io/gravitee/rest/api/portal/rest/resource/PermissionsResource.java b/...tal-rest/src/main/java/io/gravitee/rest/api/portal/rest/resource/PermissionsResource.java
@@ -21,6 +21,8 @@
 import io.gravitee.rest.api.model.api.ApiEntity;
 import io.gravitee.rest.api.model.api.ApiQuery;
 import io.gravitee.rest.api.model.application.ApplicationListItem;
+import io.gravitee.rest.api.model.permissions.ApiPermission;
+import io.gravitee.rest.api.model.permissions.ApplicationPermission;
 import io.gravitee.rest.api.service.ApiService;
 import io.gravitee.rest.api.service.ApplicationService;
 import io.gravitee.rest.api.service.MembershipService;
@@ -31,8 +33,13 @@
 import javax.ws.rs.*;
 import javax.ws.rs.core.Response;
 import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
 import java.util.Set;
 
+import static io.gravitee.rest.api.model.permissions.RolePermissionAction.*;
+import static io.gravitee.rest.api.model.permissions.RolePermissionAction.DELETE;
+
 /**
  * @author Guillaume CUSNIEUX (guillaume.cusnieux at graviteesource.com)
  * @author GraviteeSource Team
@@ -57,8 +64,19 @@ public Response getCurrentUserPermissions(@QueryParam("apiId") String apiId, @Qu
             apiQuery.setIds(Collections.singletonList(apiId));
             Set<ApiEntity> publishedByUser = apiService.findPublishedByUser(getAuthenticatedUserOrNull(), apiQuery);
             ApiEntity apiEntity = publishedByUser.stream().filter(a -> a.getId().equals(apiId)).findFirst().orElseThrow(() -> new ApiNotFoundException(apiId));
+            Map<String, char[]> permissions;
+            if (isAdmin()) {
+                permissions = new HashMap<>();
+                final char[] rights = new char[]{CREATE.getId(), READ.getId(), UPDATE.getId(), DELETE.getId()};
+                for (ApiPermission perm : ApiPermission.values()) {
+                    permissions.put(perm.getName(), rights);
+                }
+            } else {
+                permissions = membershipService.getMemberPermissions(apiEntity, userId);
+            }
+
             return Response
-                    .ok(membershipService.getMemberPermissions(apiEntity, userId))
+                    .ok(permissions)
                     .build();
 
         } else if (applicationId != null) {
@@ -68,11 +86,31 @@ public Response getCurrentUserPermissions(@QueryParam("apiId") String apiId, @Qu
                     .findFirst().orElseThrow(() -> new ApplicationNotFoundException(applicationId));
 
             ApplicationEntity application = applicationService.findById(applicationListItem.getId());
+
+            Map<String, char[]> permissions;
+            if (isAdmin()) {
+                permissions = new HashMap<>();
+                final char[] rights = new char[]{CREATE.getId(), READ.getId(), UPDATE.getId(), DELETE.getId()};
+                for (ApplicationPermission perm : ApplicationPermission.values()) {
+                    permissions.put(perm.getName(), rights);
+                }
+            } else {
+                permissions = membershipService.getMemberPermissions(application, userId);
+            }
+
             return Response
-                    .ok(membershipService.getMemberPermissions(application, userId))
+                    .ok(permissions)
                     .build();
         }
         throw new BadRequestException("One of the two parameters appId or applicationId must not be null.");
     }
 
+    protected boolean isAdmin() {
+        return isUserInRole(PORTAL_ADMIN);
+    }
+
+    private boolean isUserInRole(String role) {
+        return securityContext.isUserInRole(role);
+    }
+
 }
diff --git a/.../src/test/java/io/gravitee/rest/api/portal/rest/resource/ApiRatingAnswerResourceTest.java b/.../src/test/java/io/gravitee/rest/api/portal/rest/resource/ApiRatingAnswerResourceTest.java
@@ -65,11 +65,11 @@ public void init() {
         RatingEntity ratingEntity = new RatingEntity();
         ratingEntity.setId(RATING);
         ratingEntity.setComment(RATING);
+        ratingEntity.setApi(API);
         ratingEntity.setRate(Integer.valueOf(1).byteValue());
         RatingAnswerEntity answer = new RatingAnswerEntity();
         answer.setId(ANSWER);
         ratingEntity.setAnswers(Arrays.asList(answer));
-        doReturn(ratingEntity).when(ratingService).findByApiForConnectedUser(eq(API));
         doReturn(ratingEntity).when(ratingService).findById(eq(RATING));
         doReturn(ratingEntity).when(ratingService).createAnswer(any());
     }

diff --git a/...src/test/java/io/gravitee/rest/api/portal/rest/resource/ApiRatingAnswersResourceTest.java b/...src/test/java/io/gravitee/rest/api/portal/rest/resource/ApiRatingAnswersResourceTest.java
@@ -57,9 +57,9 @@ public void init() {
 
         RatingEntity ratingEntity = new RatingEntity();
         ratingEntity.setId(RATING);
+        ratingEntity.setApi(API);
         ratingEntity.setComment(RATING);
         ratingEntity.setRate(Integer.valueOf(1).byteValue());
-        doReturn(ratingEntity).when(ratingService).findByApiForConnectedUser(eq(API));
         doReturn(ratingEntity).when(ratingService).findById(eq(RATING));
         doReturn(ratingEntity).when(ratingService).createAnswer(any());
 

diff --git a/...l-rest/src/test/java/io/gravitee/rest/api/portal/rest/resource/ApiRatingResourceTest.java b/...l-rest/src/test/java/io/gravitee/rest/api/portal/rest/resource/ApiRatingResourceTest.java
@@ -61,8 +61,9 @@ public void init() {
         RatingEntity ratingEntity = new RatingEntity();
         ratingEntity.setId(RATING);
         ratingEntity.setComment(RATING);
+        ratingEntity.setApi(API);
         ratingEntity.setRate(Integer.valueOf(1).byteValue());
-        doReturn(ratingEntity).when(ratingService).findByApiForConnectedUser(eq(API));
+        doReturn(ratingEntity).when(ratingService).findById(eq(RATING));
         doReturn(ratingEntity).when(ratingService).update(any());
     }