import org.apache.archiva.scheduler.indexing.DownloadRemoteIndexScheduler;
import org.apache.archiva.scheduler.repository.RepositoryArchivaTaskScheduler;
import org.apache.archiva.scheduler.repository.RepositoryTask;
+import org.apache.archiva.security.ArchivaSecurityException;
import org.apache.archiva.security.common.ArchivaRoleConstants;
import org.apache.archiva.xml.XMLException;
import org.apache.commons.io.FilenameUtils;
import javax.inject.Inject;
import javax.inject.Named;
+import javax.ws.rs.core.Response;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
public Boolean deleteArtifact( Artifact artifact, String repositoryId )
throws ArchivaRestServiceException
{
- String userName = (String) getAuditInformation().getUser().getUsername();
- if ( StringUtils.isBlank( userName ) )
+
+ if ( StringUtils.isEmpty( repositoryId ) )
{
- // TODO use constants from a class instead of magic number
- throw new ArchivaRestServiceException( "deleteArtifact call: userName not found", 403 );
+ throw new ArchivaRestServiceException( "repositoryId cannot be null", 400 );
+ }
+ if ( !isAuthorizedToDeleteArtifacts( repositoryId ) )
+ {
+ throw new ArchivaRestServiceException( "not authorized to delete artifacts", 403 );
}
+
if ( artifact == null )
{
throw new ArchivaRestServiceException( "artifact cannot be null", 400 );
throw new ArchivaRestServiceException( "artifact.artifactId cannot be null", 400 );
}
- if ( StringUtils.isEmpty( repositoryId ) )
- {
- throw new ArchivaRestServiceException( "repositoryId cannot be null", 400 );
- }
-
// TODO more control on artifact fields
RepositorySession repositorySession = repositorySessionFactory.createSession();
return Boolean.TRUE;
}
+ public Boolean isAuthorizedToDeleteArtifacts( String repoId )
+ throws ArchivaRestServiceException
+ {
+ String userName =
+ getAuditInformation().getUser() == null ? "guest" : getAuditInformation().getUser().getUsername();
+
+ try
+ {
+ boolean res = userRepositories.isAuthorizedToDeleteArtifacts( userName, repoId );
+ return res;
+ }
+ catch ( ArchivaSecurityException e )
+ {
+ throw new ArchivaRestServiceException( e.getMessage(),
+ Response.Status.INTERNAL_SERVER_ERROR.getStatusCode() );
+ }
+ }
+
public RepositoryScanStatistics scanRepositoryDirectoriesNow( String repositoryId )
throws ArchivaRestServiceException
{
}
}
+ @Test
+ public void authorizedToDeleteArtifacts()
+ throws Exception
+ {
+ ManagedRepository managedRepository = getTestManagedRepository( "SOURCE_REPO_ID", "SOURCE_REPO_ID" );
+ try
+ {
+ getManagedRepositoriesService( authorizationHeader ).addManagedRepository( managedRepository );
+ RepositoriesService repositoriesService = getRepositoriesService( authorizationHeader );
+ assertTrue( repositoriesService.isAuthorizedToDeleteArtifacts( managedRepository.getId() ) );
+ }
+ finally
+ {
+ getManagedRepositoriesService( authorizationHeader ).deleteManagedRepository( managedRepository.getId(),
+ true );
+ }
+ }
+
+ @Test
+ public void notAuthorizedToDeleteArtifacts()
+ throws Exception
+ {
+ ManagedRepository managedRepository = getTestManagedRepository( "SOURCE_REPO_ID", "SOURCE_REPO_ID" );
+ try
+ {
+ getManagedRepositoriesService( authorizationHeader ).addManagedRepository( managedRepository );
+ RepositoriesService repositoriesService = getRepositoriesService( guestAuthzHeader );
+ assertFalse( repositoriesService.isAuthorizedToDeleteArtifacts( managedRepository.getId() ) );
+ }
+ finally
+ {
+ getManagedRepositoriesService( authorizationHeader ).deleteManagedRepository( managedRepository.getId(),
+ true );
+ }
+ }
+
+ protected ManagedRepository getTestManagedRepository( String id, String path )
+ {
+ String location = new File( FileUtil.getBasedir(), "target/" + path ).getAbsolutePath();
+ return new ManagedRepository( id, id, location, "default", true, true, true, "2 * * * * ?", null, false, 80, 80,
+ true, false );
+ }
protected ManagedRepository getTestManagedRepository()
{
- String location = new File( FileUtil.getBasedir(), "target/test-repo" ).getAbsolutePath();
- return new ManagedRepository( "TEST", "test", location, "default", true, true, true, "2 * * * * ?", null, false,
- 80, 80, true, false );
+ return getTestManagedRepository( "TEST", "test-repo" );
}
}