source.dussan.org Git - sonarqube.git/blob

   1 /*
   2  * SonarQube
   3  * Copyright (C) 2009-2022 SonarSource SA
   4  * mailto:info AT sonarsource DOT com
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 3 of the License, or (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public License
  17  * along with this program; if not, write to the Free Software Foundation,
  18  * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  19  */
  20 package org.sonar.server.permission.ws.template;
  21
  22 import java.util.stream.IntStream;
  23 import javax.annotation.Nullable;
  24 import org.junit.Test;
  25 import org.sonar.api.resources.Qualifiers;
  26 import org.sonar.api.resources.ResourceTypes;
  27 import org.sonar.api.server.ws.WebService;
  28 import org.sonar.api.web.UserRole;
  29 import org.sonar.core.permission.GlobalPermissions;
  30 import org.sonar.db.component.ResourceTypesRule;
  31 import org.sonar.db.permission.GlobalPermission;
  32 import org.sonar.db.permission.template.PermissionTemplateDto;
  33 import org.sonar.db.permission.template.PermissionTemplateUserDto;
  34 import org.sonar.db.user.UserDto;
  35 import org.sonar.server.exceptions.BadRequestException;
  36 import org.sonar.server.exceptions.ForbiddenException;
  37 import org.sonar.server.exceptions.NotFoundException;
  38 import org.sonar.server.exceptions.UnauthorizedException;
  39 import org.sonar.server.issue.AvatarResolverImpl;
  40 import org.sonar.server.permission.PermissionService;
  41 import org.sonar.server.permission.PermissionServiceImpl;
  42 import org.sonar.server.permission.RequestValidator;
  43 import org.sonar.server.permission.ws.BasePermissionWsTest;
  44 import org.sonar.server.permission.ws.WsParameters;
  45 import org.sonar.server.ws.TestRequest;
  46 import org.sonarqube.ws.Permissions;
  47
  48 import static org.assertj.core.api.Assertions.assertThat;
  49 import static org.assertj.core.api.Assertions.assertThatThrownBy;
  50 import static org.sonar.api.web.UserRole.ADMIN;
  51 import static org.sonar.api.web.UserRole.CODEVIEWER;
  52 import static org.sonar.api.web.UserRole.ISSUE_ADMIN;
  53 import static org.sonar.api.web.UserRole.USER;
  54 import static org.sonar.db.permission.GlobalPermission.SCAN;
  55 import static org.sonar.db.permission.PermissionQuery.DEFAULT_PAGE_SIZE;
  56 import static org.sonar.db.permission.template.PermissionTemplateTesting.newPermissionTemplateUserDto;
  57 import static org.sonar.db.user.UserTesting.newUserDto;
  58 import static org.sonar.test.JsonAssert.assertJson;
  59 import static org.sonarqube.ws.client.permission.PermissionsWsParameters.PARAM_PERMISSION;
  60 import static org.sonarqube.ws.client.permission.PermissionsWsParameters.PARAM_TEMPLATE_ID;
  61 import static org.sonarqube.ws.client.permission.PermissionsWsParameters.PARAM_TEMPLATE_NAME;
  62
  63 public class TemplateUsersActionTest extends BasePermissionWsTest<TemplateUsersAction> {
  64
  65   private final ResourceTypes resourceTypes = new ResourceTypesRule().setRootQualifiers(Qualifiers.PROJECT);
  66   private final PermissionService permissionService = new PermissionServiceImpl(resourceTypes);
  67   private final WsParameters wsParameters = new WsParameters(permissionService);
  68   private final RequestValidator requestValidator = new RequestValidator(permissionService);
  69
  70   @Override
  71   protected TemplateUsersAction buildWsAction() {
  72     return new TemplateUsersAction(db.getDbClient(), userSession, newPermissionWsSupport(), new AvatarResolverImpl(), wsParameters, requestValidator);
  73   }
  74
  75   @Test
  76   public void define_template_users() {
  77     WebService.Action action = wsTester.getDef();
  78
  79     assertThat(action).isNotNull();
  80     assertThat(action.key()).isEqualTo("template_users");
  81     assertThat(action.isPost()).isFalse();
  82     assertThat(action.isInternal()).isTrue();
  83     assertThat(action.since()).isEqualTo("5.2");
  84     WebService.Param permissionParam = action.param(PARAM_PERMISSION);
  85     assertThat(permissionParam).isNotNull();
  86     assertThat(permissionParam.isRequired()).isFalse();
  87   }
  88
  89   @Test
  90   public void search_for_users_with_response_example() {
  91     UserDto user1 = insertUser(newUserDto().setLogin("admin").setName("Administrator").setEmail("admin@admin.com"));
  92     UserDto user2 = insertUser(newUserDto().setLogin("george.orwell").setName("George Orwell").setEmail("george.orwell@1984.net"));
  93
  94     PermissionTemplateDto template1 = addTemplate();
  95     addUserToTemplate(newPermissionTemplateUser(CODEVIEWER, template1, user1), template1.getName());
  96     addUserToTemplate(newPermissionTemplateUser(CODEVIEWER, template1, user2), template1.getName());
  97     addUserToTemplate(newPermissionTemplateUser(ADMIN, template1, user2), template1.getName());
  98     loginAsAdmin();
  99
 100     String result = newRequest(null, template1.getUuid()).execute().getInput();
 101     assertJson(result).isSimilarTo(getClass().getResource("template_users-example.json"));
 102   }
 103
 104   @Test
 105   public void search_for_users_by_template_name() {
 106     loginAsAdmin();
 107
 108     UserDto user1 = insertUser(newUserDto().setLogin("login-1").setName("name-1").setEmail("email-1"));
 109     UserDto user2 = insertUser(newUserDto().setLogin("login-2").setName("name-2").setEmail("email-2"));
 110     UserDto user3 = insertUser(newUserDto().setLogin("login-3").setName("name-3").setEmail("email-3"));
 111
 112     PermissionTemplateDto template = addTemplate();
 113     addUserToTemplate(newPermissionTemplateUser(USER, template, user1), template.getName());
 114     addUserToTemplate(newPermissionTemplateUser(USER, template, user2), template.getName());
 115     addUserToTemplate(newPermissionTemplateUser(ISSUE_ADMIN, template, user1), template.getName());
 116     addUserToTemplate(newPermissionTemplateUser(ISSUE_ADMIN, template, user3), template.getName());
 117
 118     PermissionTemplateDto anotherTemplate = addTemplate();
 119     addUserToTemplate(newPermissionTemplateUser(USER, anotherTemplate, user1), anotherTemplate.getName());
 120
 121     Permissions.UsersWsResponse response = newRequest(null, null)
 122       .setParam(PARAM_TEMPLATE_NAME, template.getName())
 123       .executeProtobuf(Permissions.UsersWsResponse.class);
 124
 125     assertThat(response.getUsersList()).extracting("login").containsExactly("login-1", "login-2", "login-3");
 126     assertThat(response.getUsers(0).getPermissionsList()).containsOnly("issueadmin", "user");
 127     assertThat(response.getUsers(1).getPermissionsList()).containsOnly("user");
 128     assertThat(response.getUsers(2).getPermissionsList()).containsOnly("issueadmin");
 129   }
 130
 131   @Test
 132   public void search_using_text_query() {
 133     loginAsAdmin();
 134
 135     UserDto user1 = insertUser(newUserDto().setLogin("login-1").setName("name-1").setEmail("email-1"));
 136     UserDto user2 = insertUser(newUserDto().setLogin("login-2").setName("name-2").setEmail("email-2"));
 137     UserDto user3 = insertUser(newUserDto().setLogin("login-3").setName("name-3").setEmail("email-3"));
 138
 139     PermissionTemplateDto template = addTemplate();
 140     addUserToTemplate(newPermissionTemplateUser(USER, template, user1), template.getName());
 141     addUserToTemplate(newPermissionTemplateUser(USER, template, user2), template.getName());
 142     addUserToTemplate(newPermissionTemplateUser(ISSUE_ADMIN, template, user1), template.getName());
 143     addUserToTemplate(newPermissionTemplateUser(ISSUE_ADMIN, template, user3), template.getName());
 144
 145     PermissionTemplateDto anotherTemplate = addTemplate();
 146     addUserToTemplate(newPermissionTemplateUser(USER, anotherTemplate, user1), anotherTemplate.getName());
 147
 148     Permissions.UsersWsResponse response = newRequest(null, null)
 149       .setParam(PARAM_TEMPLATE_NAME, template.getName())
 150       .setParam(WebService.Param.TEXT_QUERY, "ame-1")
 151       .executeProtobuf(Permissions.UsersWsResponse.class);
 152
 153     assertThat(response.getUsersList()).extracting("login").containsOnly("login-1");
 154   }
 155
 156   @Test
 157   public void search_using_permission() {
 158     UserDto user1 = insertUser(newUserDto().setLogin("login-1").setName("name-1").setEmail("email-1"));
 159     UserDto user2 = insertUser(newUserDto().setLogin("login-2").setName("name-2").setEmail("email-2"));
 160     UserDto user3 = insertUser(newUserDto().setLogin("login-3").setName("name-3").setEmail("email-3"));
 161
 162     PermissionTemplateDto template = addTemplate();
 163     addUserToTemplate(newPermissionTemplateUser(USER, template, user1), template.getName());
 164     addUserToTemplate(newPermissionTemplateUser(USER, template, user2), template.getName());
 165     addUserToTemplate(newPermissionTemplateUser(ISSUE_ADMIN, template, user1), template.getName());
 166     addUserToTemplate(newPermissionTemplateUser(ISSUE_ADMIN, template, user3), template.getName());
 167
 168     PermissionTemplateDto anotherTemplate = addTemplate();
 169     addUserToTemplate(newPermissionTemplateUser(USER, anotherTemplate, user1), anotherTemplate.getName());
 170
 171     loginAsAdmin();
 172     Permissions.UsersWsResponse response = newRequest(USER, template.getUuid())
 173       .executeProtobuf(Permissions.UsersWsResponse.class);
 174     assertThat(response.getUsersList()).extracting("login").containsExactly("login-1", "login-2");
 175     assertThat(response.getUsers(0).getPermissionsList()).containsOnly("issueadmin", "user");
 176     assertThat(response.getUsers(1).getPermissionsList()).containsOnly("user");
 177   }
 178
 179   @Test
 180   public void search_with_pagination() {
 181     UserDto user1 = insertUser(newUserDto().setLogin("login-1").setName("name-1").setEmail("email-1"));
 182     UserDto user2 = insertUser(newUserDto().setLogin("login-2").setName("name-2").setEmail("email-2"));
 183     UserDto user3 = insertUser(newUserDto().setLogin("login-3").setName("name-3").setEmail("email-3"));
 184
 185     PermissionTemplateDto template = addTemplate();
 186     addUserToTemplate(newPermissionTemplateUser(USER, template, user1), template.getName());
 187     addUserToTemplate(newPermissionTemplateUser(USER, template, user2), template.getName());
 188     addUserToTemplate(newPermissionTemplateUser(ISSUE_ADMIN, template, user1), template.getName());
 189     addUserToTemplate(newPermissionTemplateUser(ISSUE_ADMIN, template, user3), template.getName());
 190
 191     PermissionTemplateDto anotherTemplate = addTemplate();
 192     addUserToTemplate(newPermissionTemplateUser(USER, anotherTemplate, user1), anotherTemplate.getName());
 193
 194     loginAsAdmin();
 195     Permissions.UsersWsResponse response = newRequest(USER, null)
 196       .setParam(PARAM_TEMPLATE_NAME, template.getName())
 197       .setParam(WebService.Param.SELECTED, "all")
 198       .setParam(WebService.Param.PAGE, "2")
 199       .setParam(WebService.Param.PAGE_SIZE, "1")
 200       .executeProtobuf(Permissions.UsersWsResponse.class);
 201
 202     assertThat(response.getUsersList()).extracting("login").containsOnly("login-2");
 203   }
 204
 205   @Test
 206   public void users_are_sorted_by_name() {
 207     UserDto user1 = insertUser(newUserDto().setLogin("login-2").setName("name-2"));
 208     UserDto user2 = insertUser(newUserDto().setLogin("login-3").setName("name-3"));
 209     UserDto user3 = insertUser(newUserDto().setLogin("login-1").setName("name-1"));
 210
 211     PermissionTemplateDto template = addTemplate();
 212     addUserToTemplate(newPermissionTemplateUser(USER, template, user1), template.getName());
 213     addUserToTemplate(newPermissionTemplateUser(USER, template, user2), template.getName());
 214     addUserToTemplate(newPermissionTemplateUser(ISSUE_ADMIN, template, user3), template.getName());
 215
 216     loginAsAdmin();
 217     Permissions.UsersWsResponse response = newRequest(null, null)
 218       .setParam(PARAM_TEMPLATE_NAME, template.getName())
 219       .executeProtobuf(Permissions.UsersWsResponse.class);
 220
 221     assertThat(response.getUsersList()).extracting("login").containsExactly("login-1", "login-2", "login-3");
 222   }
 223
 224   @Test
 225   public void search_ignores_other_template_and_is_ordered_by_users_with_permission_when_many_users() {
 226     PermissionTemplateDto template = addTemplate();
 227     // Add another template having some users with permission to make sure it's correctly ignored
 228     PermissionTemplateDto otherTemplate = db.permissionTemplates().insertTemplate();
 229     IntStream.rangeClosed(1, DEFAULT_PAGE_SIZE + 1).forEach(i -> {
 230       UserDto user = db.users().insertUser("User-" + i);
 231       db.permissionTemplates().addUserToTemplate(otherTemplate, user, UserRole.USER);
 232     });
 233     String lastLogin = "User-" + (DEFAULT_PAGE_SIZE + 1);
 234     db.permissionTemplates().addUserToTemplate(template, db.users().selectUserByLogin(lastLogin).get(), UserRole.USER);
 235     loginAsAdmin();
 236
 237     Permissions.UsersWsResponse response = newRequest(null, null)
 238       .setParam(PARAM_TEMPLATE_NAME, template.getName())
 239       .executeProtobuf(Permissions.UsersWsResponse.class);
 240
 241     assertThat(response.getUsersList())
 242       .extracting("login")
 243       .hasSize(DEFAULT_PAGE_SIZE)
 244       .startsWith(lastLogin);
 245   }
 246
 247   @Test
 248   public void fail_if_not_a_project_permission() {
 249     PermissionTemplateDto template = addTemplate();
 250     loginAsAdmin();
 251
 252     assertThatThrownBy(() ->  {
 253       newRequest(GlobalPermission.PROVISION_PROJECTS.getKey(), template.getUuid())
 254         .execute();
 255     })
 256       .isInstanceOf(IllegalArgumentException.class);
 257   }
 258
 259   @Test
 260   public void fail_if_no_template_param() {
 261     loginAsAdmin();
 262
 263     assertThatThrownBy(() ->  {
 264       newRequest(null, null)
 265         .execute();
 266     })
 267       .isInstanceOf(BadRequestException.class);
 268   }
 269
 270   @Test
 271   public void fail_if_template_does_not_exist() {
 272     loginAsAdmin();
 273
 274     assertThatThrownBy(() ->  {
 275       newRequest(null, "unknown-template-uuid")
 276         .execute();
 277     })
 278       .isInstanceOf(NotFoundException.class);
 279   }
 280
 281   @Test
 282   public void fail_if_template_uuid_and_name_provided() {
 283     PermissionTemplateDto template = addTemplate();
 284     loginAsAdmin();
 285
 286     assertThatThrownBy(() ->  {
 287       newRequest(null, template.getUuid())
 288         .setParam(PARAM_TEMPLATE_NAME, template.getName())
 289         .execute();
 290     })
 291       .isInstanceOf(BadRequestException.class);
 292   }
 293
 294   @Test
 295   public void fail_if_not_logged_in() {
 296     PermissionTemplateDto template = addTemplate();
 297     userSession.anonymous();
 298
 299     assertThatThrownBy(() ->  {
 300       newRequest(null, template.getUuid()).execute();
 301     })
 302       .isInstanceOf(UnauthorizedException.class);
 303   }
 304
 305   @Test
 306   public void fail_if_insufficient_privileges() {
 307     PermissionTemplateDto template = addTemplate();
 308     userSession.logIn().addPermission(SCAN);
 309
 310     assertThatThrownBy(() ->  {
 311       newRequest(null, template.getUuid()).execute();
 312     })
 313       .isInstanceOf(ForbiddenException.class);
 314   }
 315
 316   private UserDto insertUser(UserDto userDto) {
 317     db.users().insertUser(userDto);
 318     return userDto;
 319   }
 320
 321   private void addUserToTemplate(PermissionTemplateUserDto dto, String templateName) {
 322     db.getDbClient().permissionTemplateDao().insertUserPermission(db.getSession(), dto.getTemplateUuid(), dto.getUserUuid(),
 323       dto.getPermission(), templateName, dto.getUserLogin());
 324     db.commit();
 325   }
 326
 327   private static PermissionTemplateUserDto newPermissionTemplateUser(String permission, PermissionTemplateDto template, UserDto user) {
 328     return newPermissionTemplateUserDto()
 329       .setPermission(permission)
 330       .setTemplateUuid(template.getUuid())
 331       .setUserUuid(user.getUuid());
 332   }
 333
 334   private TestRequest newRequest(@Nullable String permission, @Nullable String templateUuid) {
 335     TestRequest request = newRequest();
 336     if (permission != null) {
 337       request.setParam(PARAM_PERMISSION, permission);
 338     }
 339     if (templateUuid != null) {
 340       request.setParam(PARAM_TEMPLATE_ID, templateUuid);
 341     }
 342     return request;
 343   }
 344
 345 }