SONAR-6489 WS permissions/remove_user remove project permissions

diff --git a/server/sonar-server/src/main/java/org/sonar/server/permission/ws/AddGroupAction.java b/server/sonar-server/src/main/java/org/sonar/server/permission/ws/AddGroupAction.java
index cb2b6d9c2d1e755de8f2b3d1ee2520053f4b9b3a..a0f59e0d136bf2d0124ca20558ad88161a8c47ac 100644 (file)
--- a/server/sonar-server/src/main/java/org/sonar/server/permission/ws/AddGroupAction.java
+++ b/server/sonar-server/src/main/java/org/sonar/server/permission/ws/AddGroupAction.java
@@ -32,7 +32,7 @@ import org.sonar.server.permission.PermissionUpdater;
 import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_GROUP_ID;
 import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_GROUP_NAME;
 import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_PERMISSION;
-import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_PROJECT_ID;
+import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_PROJECT_UUID;
 import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_PROJECT_KEY;
 
 public class AddGroupAction implements PermissionsWsAction {
@@ -73,7 +73,7 @@ public class AddGroupAction implements PermissionsWsAction {
       .setDescription("Group id")
       .setExampleValue("42");
 
-    action.createParam(PARAM_PROJECT_ID)
+    action.createParam(PARAM_PROJECT_UUID)
       .setDescription("Project id")
       .setExampleValue("ce4c03d6-430f-40a9-b777-ad877c00aa4d");
 

diff --git a/server/sonar-server/src/main/java/org/sonar/server/permission/ws/AddUserAction.java b/server/sonar-server/src/main/java/org/sonar/server/permission/ws/AddUserAction.java
index b9f279b7486d85200c36377545d2cf4d80354c8f..8aff38fc470c884b79c1fe3baeb8dfb95136eecd 100644 (file)
--- a/server/sonar-server/src/main/java/org/sonar/server/permission/ws/AddUserAction.java
+++ b/server/sonar-server/src/main/java/org/sonar/server/permission/ws/AddUserAction.java
@@ -28,7 +28,7 @@ import org.sonar.server.permission.PermissionChange;
 import org.sonar.server.permission.PermissionUpdater;
 
 import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_PERMISSION;
-import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_PROJECT_ID;
+import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_PROJECT_UUID;
 import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_PROJECT_KEY;
 import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_USER_LOGIN;
 
@@ -47,7 +47,9 @@ public class AddUserAction implements PermissionsWsAction {
   @Override
   public void define(WebService.NewController context) {
     WebService.NewAction action = context.createAction(ACTION)
-      .setDescription("Add permission to a user.<br /> Requires 'Administer System' permission.")
+      .setDescription("Add permission to a user.<br /> " +
+        "If the project id or project key is provided, a project permission is created.<br />" +
+        "Requires 'Administer System' permission.")
       .setSince("5.2")
       .setPost(true)
       .setHandler(this);
@@ -62,7 +64,7 @@ public class AddUserAction implements PermissionsWsAction {
       .setDescription("User login")
       .setExampleValue("g.hopper");
 
-    action.createParam(PARAM_PROJECT_ID)
+    action.createParam(PARAM_PROJECT_UUID)
       .setDescription("Project id")
       .setExampleValue("ce4c03d6-430f-40a9-b777-ad877c00aa4d");
 

diff --git a/server/sonar-server/src/main/java/org/sonar/server/permission/ws/PermissionWsCommons.java b/server/sonar-server/src/main/java/org/sonar/server/permission/ws/PermissionWsCommons.java
index ed073557b8ee92975afac9047b19d106e1be502f..58d5e0b4649a42098f7f7eda8c196c4e31253550 100644 (file)
--- a/server/sonar-server/src/main/java/org/sonar/server/permission/ws/PermissionWsCommons.java
+++ b/server/sonar-server/src/main/java/org/sonar/server/permission/ws/PermissionWsCommons.java
@@ -36,7 +36,7 @@ public class PermissionWsCommons {
   public static final String PARAM_PERMISSION = "permission";
   public static final String PARAM_GROUP_NAME = "groupName";
   public static final String PARAM_GROUP_ID = "groupId";
-  public static final String PARAM_PROJECT_ID = "projectId";
+  public static final String PARAM_PROJECT_UUID = "projectId";
   public static final String PARAM_PROJECT_KEY = "projectKey";
   public static final String PARAM_USER_LOGIN = "login";
 
@@ -71,7 +71,7 @@ public class PermissionWsCommons {
       PermissionChange permissionChange = new PermissionChange()
         .setPermission(permission)
         .setUser(userLogin);
-      addProjectToPermissionChange(dbSession, permissionChange, request.param(PARAM_PROJECT_ID), request.param(PARAM_PROJECT_KEY));
+      addProjectToPermissionChange(dbSession, permissionChange, request.param(PARAM_PROJECT_UUID), request.param(PARAM_PROJECT_KEY));
 
       return permissionChange;
     } finally {
@@ -84,7 +84,7 @@ public class PermissionWsCommons {
     String permission = request.mandatoryParam(PARAM_PERMISSION);
     String groupNameParam = request.param(PARAM_GROUP_NAME);
     Long groupId = request.paramAsLong(PARAM_GROUP_ID);
-    String projectUuid = request.param(PARAM_PROJECT_ID);
+    String projectUuid = request.param(PARAM_PROJECT_UUID);
     String projectKey = request.param(PARAM_PROJECT_KEY);
 
     String groupName = searchGroupName(dbSession, groupNameParam, groupId);

diff --git a/server/sonar-server/src/main/java/org/sonar/server/permission/ws/RemoveGroupAction.java b/server/sonar-server/src/main/java/org/sonar/server/permission/ws/RemoveGroupAction.java
index 566befe07c8d77e60c6de7523b17c7617bb929ba..d375200ed1a1c08bb9206e3e7875e4c8c70e4795 100644 (file)
--- a/server/sonar-server/src/main/java/org/sonar/server/permission/ws/RemoveGroupAction.java
+++ b/server/sonar-server/src/main/java/org/sonar/server/permission/ws/RemoveGroupAction.java
@@ -32,7 +32,7 @@ import org.sonar.server.permission.PermissionUpdater;
 import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_GROUP_ID;
 import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_GROUP_NAME;
 import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_PERMISSION;
-import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_PROJECT_ID;
+import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_PROJECT_UUID;
 import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_PROJECT_KEY;
 
 public class RemoveGroupAction implements PermissionsWsAction {
@@ -72,7 +72,7 @@ public class RemoveGroupAction implements PermissionsWsAction {
       .setDescription("Group id")
       .setExampleValue("42");
 
-    action.createParam(PARAM_PROJECT_ID)
+    action.createParam(PARAM_PROJECT_UUID)
       .setDescription("Project id")
       .setExampleValue("ce4c03d6-430f-40a9-b777-ad877c00aa4d");
 

diff --git a/server/sonar-server/src/main/java/org/sonar/server/permission/ws/RemoveUserAction.java b/server/sonar-server/src/main/java/org/sonar/server/permission/ws/RemoveUserAction.java
index 519a523ed55d05b3b3fda9bc8e418c16e7343b5b..f3592876d3e9a008e3eaae8615fbf4150fa7b3eb 100644 (file)
--- a/server/sonar-server/src/main/java/org/sonar/server/permission/ws/RemoveUserAction.java
+++ b/server/sonar-server/src/main/java/org/sonar/server/permission/ws/RemoveUserAction.java
@@ -27,22 +27,29 @@ import org.sonar.core.permission.GlobalPermissions;
 import org.sonar.server.permission.PermissionChange;
 import org.sonar.server.permission.PermissionUpdater;
 
+import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_PERMISSION;
+import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_PROJECT_UUID;
+import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_PROJECT_KEY;
+import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_USER_LOGIN;
+
 public class RemoveUserAction implements PermissionsWsAction {
 
   public static final String ACTION = "remove_user";
-  public static final String PARAM_PERMISSION = "permission";
-  public static final String PARAM_USER_LOGIN = "login";
 
   private final PermissionUpdater permissionUpdater;
+  private final PermissionWsCommons permissionWsCommons;
 
-  public RemoveUserAction(PermissionUpdater permissionUpdater) {
+  public RemoveUserAction(PermissionUpdater permissionUpdater, PermissionWsCommons permissionWsCommons) {
     this.permissionUpdater = permissionUpdater;
+    this.permissionWsCommons = permissionWsCommons;
   }
 
   @Override
   public void define(WebService.NewController context) {
     WebService.NewAction action = context.createAction(ACTION)
-      .setDescription("Remove permission from a user.<br /> Requires 'Administer System' permission.")
+      .setDescription("Remove permission from a user.<br /> " +
+        "If the project id is provided, a project permission is removed.<br />" +
+        "Requires 'Administer System' permission.")
       .setSince("5.2")
       .setPost(true)
       .setHandler(this);
@@ -56,17 +63,20 @@ public class RemoveUserAction implements PermissionsWsAction {
       .setRequired(true)
       .setDescription("User login")
       .setExampleValue("g.hopper");
+
+    action.createParam(PARAM_PROJECT_UUID)
+      .setDescription("Project id")
+      .setExampleValue("ce4c03d6-430f-40a9-b777-ad877c00aa4d");
+
+    action.createParam(PARAM_PROJECT_KEY)
+      .setDescription("Project key")
+      .setExampleValue("org.apache.hbas:hbase");
   }
 
   @Override
   public void handle(Request request, Response response) throws Exception {
-    String permission = request.mandatoryParam(PARAM_PERMISSION);
-    String userLogin = request.mandatoryParam(PARAM_USER_LOGIN);
-    permissionUpdater.removePermission(
-      new PermissionChange()
-        .setPermission(permission)
-        .setUser(userLogin)
-    );
+    PermissionChange permissionChange = permissionWsCommons.buildUserPermissionChange(request);
+    permissionUpdater.removePermission(permissionChange);
 
     response.noContent();
   }

diff --git a/server/sonar-server/src/test/java/org/sonar/server/permission/ws/AddGroupActionTest.java b/server/sonar-server/src/test/java/org/sonar/server/permission/ws/AddGroupActionTest.java
index 9b3c5e25eb09793f2e188f3eca01c37d1edccf93..b94ab890dda935d41172c20386e821f7e380340f 100644 (file)
--- a/server/sonar-server/src/test/java/org/sonar/server/permission/ws/AddGroupActionTest.java
+++ b/server/sonar-server/src/test/java/org/sonar/server/permission/ws/AddGroupActionTest.java
@@ -50,7 +50,7 @@ import static org.sonar.server.permission.ws.AddGroupAction.ACTION;
 import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_GROUP_ID;
 import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_GROUP_NAME;
 import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_PERMISSION;
-import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_PROJECT_ID;
+import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_PROJECT_UUID;
 import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_PROJECT_KEY;
 import static org.sonar.server.permission.ws.PermissionsWs.ENDPOINT;
 
@@ -112,7 +112,7 @@ public class AddGroupActionTest {
 
     newRequest()
       .setParam(PARAM_GROUP_NAME, "sonar-administrators")
-      .setParam(PARAM_PROJECT_ID, "project-uuid")
+      .setParam(PARAM_PROJECT_UUID, "project-uuid")
       .setParam(PARAM_PERMISSION, SYSTEM_ADMIN)
       .execute();
 
@@ -150,7 +150,7 @@ public class AddGroupActionTest {
 
     newRequest()
       .setParam(PARAM_GROUP_NAME, "sonar-administrators")
-      .setParam(PARAM_PROJECT_ID, "unknown-project-uuid")
+      .setParam(PARAM_PROJECT_UUID, "unknown-project-uuid")
       .setParam(PARAM_PERMISSION, SYSTEM_ADMIN)
       .execute();
   }
@@ -167,7 +167,7 @@ public class AddGroupActionTest {
 
     newRequest()
       .setParam(PARAM_GROUP_NAME, "sonar-administrators")
-      .setParam(PARAM_PROJECT_ID, "file-uuid")
+      .setParam(PARAM_PROJECT_UUID, "file-uuid")
       .setParam(PARAM_PERMISSION, SYSTEM_ADMIN)
       .execute();
   }

diff --git a/server/sonar-server/src/test/java/org/sonar/server/permission/ws/AddUserActionTest.java b/server/sonar-server/src/test/java/org/sonar/server/permission/ws/AddUserActionTest.java
index f14acfec476dcae9c3901950f8d42d42db88387c..40e3fa5e6c69d126250ea541200adde82d0bf7e0 100644 (file)
--- a/server/sonar-server/src/test/java/org/sonar/server/permission/ws/AddUserActionTest.java
+++ b/server/sonar-server/src/test/java/org/sonar/server/permission/ws/AddUserActionTest.java
@@ -49,7 +49,7 @@ import static org.sonar.server.component.ComponentTesting.newFileDto;
 import static org.sonar.server.component.ComponentTesting.newProjectDto;
 import static org.sonar.server.permission.ws.AddUserAction.ACTION;
 import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_PERMISSION;
-import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_PROJECT_ID;
+import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_PROJECT_UUID;
 import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_PROJECT_KEY;
 import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_USER_LOGIN;
 
@@ -96,7 +96,7 @@ public class AddUserActionTest {
 
     ws.newPostRequest(PermissionsWs.ENDPOINT, ACTION)
       .setParam(PARAM_USER_LOGIN, "ray.bradbury")
-      .setParam(PARAM_PROJECT_ID, "project-uuid")
+      .setParam(PARAM_PROJECT_UUID, "project-uuid")
       .setParam(PermissionWsCommons.PARAM_PERMISSION, SYSTEM_ADMIN)
       .execute();
 
@@ -127,7 +127,7 @@ public class AddUserActionTest {
 
     ws.newPostRequest(PermissionsWs.ENDPOINT, ACTION)
       .setParam(PARAM_USER_LOGIN, "ray.bradbury")
-      .setParam(PARAM_PROJECT_ID, "unknown-project-uuid")
+      .setParam(PARAM_PROJECT_UUID, "unknown-project-uuid")
       .setParam(PermissionWsCommons.PARAM_PERMISSION, SYSTEM_ADMIN)
       .execute();
   }
@@ -140,7 +140,7 @@ public class AddUserActionTest {
 
     ws.newPostRequest(PermissionsWs.ENDPOINT, ACTION)
       .setParam(PARAM_USER_LOGIN, "ray.bradbury")
-      .setParam(PARAM_PROJECT_ID, "file-uuid")
+      .setParam(PARAM_PROJECT_UUID, "file-uuid")
       .setParam(PermissionWsCommons.PARAM_PERMISSION, SYSTEM_ADMIN)
       .execute();
   }

diff --git a/server/sonar-server/src/test/java/org/sonar/server/permission/ws/RemoveGroupActionTest.java b/server/sonar-server/src/test/java/org/sonar/server/permission/ws/RemoveGroupActionTest.java
index a9100e71a88067cc0424f1f3498fd5a4c9a0c876..a05964a4c0c992ea2427e9a96e471161c5f869d8 100644 (file)
--- a/server/sonar-server/src/test/java/org/sonar/server/permission/ws/RemoveGroupActionTest.java
+++ b/server/sonar-server/src/test/java/org/sonar/server/permission/ws/RemoveGroupActionTest.java
@@ -50,7 +50,7 @@ import static org.sonar.server.component.ComponentTesting.newProjectDto;
 import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_GROUP_ID;
 import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_GROUP_NAME;
 import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_PERMISSION;
-import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_PROJECT_ID;
+import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_PROJECT_UUID;
 import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_PROJECT_KEY;
 import static org.sonar.server.permission.ws.RemoveGroupAction.ACTION;
 
@@ -109,7 +109,7 @@ public class RemoveGroupActionTest {
 
     newRequest()
       .setParam(PARAM_GROUP_NAME, "sonar-administrators")
-      .setParam(PARAM_PROJECT_ID, "project-uuid")
+      .setParam(PARAM_PROJECT_UUID, "project-uuid")
       .setParam(PARAM_PERMISSION, SYSTEM_ADMIN)
       .execute();
 
@@ -140,7 +140,7 @@ public class RemoveGroupActionTest {
 
     newRequest()
       .setParam(PARAM_GROUP_NAME, "sonar-administrators")
-      .setParam(PARAM_PROJECT_ID, "unknown-project-uuid")
+      .setParam(PARAM_PROJECT_UUID, "unknown-project-uuid")
       .setParam(PARAM_PERMISSION, SYSTEM_ADMIN)
       .execute();
   }
@@ -153,7 +153,7 @@ public class RemoveGroupActionTest {
 
     newRequest()
       .setParam(PARAM_GROUP_NAME, "sonar-administrators")
-      .setParam(PARAM_PROJECT_ID, "file-uuid")
+      .setParam(PARAM_PROJECT_UUID, "file-uuid")
       .setParam(PARAM_PERMISSION, SYSTEM_ADMIN)
       .execute();
   }

diff --git a/server/sonar-server/src/test/java/org/sonar/server/permission/ws/RemoveUserActionTest.java b/server/sonar-server/src/test/java/org/sonar/server/permission/ws/RemoveUserActionTest.java
index 2081b627f4a4643e73adc4ae61dec3f01fa65056..3c8fb207e0666802cd0aa671e8af4ac49bfb6052 100644 (file)
--- a/server/sonar-server/src/test/java/org/sonar/server/permission/ws/RemoveUserActionTest.java
+++ b/server/sonar-server/src/test/java/org/sonar/server/permission/ws/RemoveUserActionTest.java
@@ -23,47 +23,66 @@ package org.sonar.server.permission.ws;
 import org.junit.Before;
 import org.junit.Rule;
 import org.junit.Test;
+import org.junit.experimental.categories.Category;
 import org.junit.rules.ExpectedException;
 import org.mockito.ArgumentCaptor;
 import org.sonar.api.utils.System2;
+import org.sonar.db.DbClient;
+import org.sonar.db.DbSession;
 import org.sonar.db.DbTester;
+import org.sonar.db.component.ComponentDto;
+import org.sonar.server.component.ComponentFinder;
+import org.sonar.server.exceptions.BadRequestException;
+import org.sonar.server.exceptions.NotFoundException;
 import org.sonar.server.exceptions.ServerException;
 import org.sonar.server.permission.PermissionChange;
 import org.sonar.server.permission.PermissionUpdater;
 import org.sonar.server.tester.UserSessionRule;
 import org.sonar.server.ws.WsTester;
+import org.sonar.test.DbTests;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.verify;
 import static org.sonar.core.permission.GlobalPermissions.SYSTEM_ADMIN;
+import static org.sonar.server.component.ComponentTesting.newFileDto;
+import static org.sonar.server.component.ComponentTesting.newProjectDto;
+import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_PERMISSION;
+import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_PROJECT_KEY;
+import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_PROJECT_UUID;
+import static org.sonar.server.permission.ws.PermissionWsCommons.PARAM_USER_LOGIN;
 import static org.sonar.server.permission.ws.RemoveUserAction.ACTION;
 
+@Category(DbTests.class)
 public class RemoveUserActionTest {
-  UserSessionRule userSession = UserSessionRule.standalone();
-  WsTester ws;
   @Rule
   public DbTester db = DbTester.create(System2.INSTANCE);
   @Rule
   public ExpectedException expectedException = ExpectedException.none();
-  private PermissionUpdater permissionUpdater;
+  UserSessionRule userSession = UserSessionRule.standalone();
+  WsTester ws;
+  PermissionUpdater permissionUpdater;
+  DbClient dbClient;
+  DbSession dbSession;
+  ArgumentCaptor<PermissionChange> permissionChangeCaptor = ArgumentCaptor.forClass(PermissionChange.class);
 
   @Before
   public void setUp() {
     permissionUpdater = mock(PermissionUpdater.class);
+    dbClient = db.getDbClient();
+    dbSession = db.getSession();
     ws = new WsTester(new PermissionsWs(
-      new RemoveUserAction(permissionUpdater)));
+      new RemoveUserAction(permissionUpdater, new PermissionWsCommons(dbClient, new ComponentFinder(dbClient)))));
     userSession.login("admin").setGlobalPermissions(SYSTEM_ADMIN);
   }
 
   @Test
   public void call_permission_service_with_right_data() throws Exception {
     ws.newPostRequest(PermissionsWs.ENDPOINT, ACTION)
-      .setParam(RemoveUserAction.PARAM_USER_LOGIN, "ray.bradbury")
-      .setParam(RemoveUserAction.PARAM_PERMISSION, SYSTEM_ADMIN)
+      .setParam(PARAM_USER_LOGIN, "ray.bradbury")
+      .setParam(PARAM_PERMISSION, SYSTEM_ADMIN)
       .execute();
 
-    ArgumentCaptor<PermissionChange> permissionChangeCaptor = ArgumentCaptor.forClass(PermissionChange.class);
     verify(permissionUpdater).removePermission(permissionChangeCaptor.capture());
     PermissionChange permissionChange = permissionChangeCaptor.getValue();
     assertThat(permissionChange.user()).isEqualTo("ray.bradbury");
@@ -71,12 +90,65 @@ public class RemoveUserActionTest {
   }
 
   @Test
-  public void get_request_are_not_authorized() throws Exception {
+  public void remove_with_project_uuid() throws Exception {
+    insertComponent(newProjectDto("project-uuid").setKey("project-key"));
+
+    ws.newPostRequest(PermissionsWs.ENDPOINT, ACTION)
+      .setParam(PARAM_USER_LOGIN, "ray.bradbury")
+      .setParam(PARAM_PROJECT_UUID, "project-uuid")
+      .setParam(PARAM_PERMISSION, SYSTEM_ADMIN)
+      .execute();
+
+    verify(permissionUpdater).removePermission(permissionChangeCaptor.capture());
+    PermissionChange permissionChange = permissionChangeCaptor.getValue();
+    assertThat(permissionChange.component()).isEqualTo("project-key");
+  }
+
+  @Test
+  public void remove_with_project_key() throws Exception {
+    insertComponent(newProjectDto("project-uuid").setKey("project-key"));
+
+    ws.newPostRequest(PermissionsWs.ENDPOINT, ACTION)
+      .setParam(PARAM_USER_LOGIN, "ray.bradbury")
+      .setParam(PARAM_PROJECT_KEY, "project-key")
+      .setParam(PARAM_PERMISSION, SYSTEM_ADMIN)
+      .execute();
+
+    verify(permissionUpdater).removePermission(permissionChangeCaptor.capture());
+    PermissionChange permissionChange = permissionChangeCaptor.getValue();
+    assertThat(permissionChange.component()).isEqualTo("project-key");
+  }
+
+  @Test
+  public void fail_when_project_does_not_exist() throws Exception {
+    expectedException.expect(NotFoundException.class);
+
+    ws.newPostRequest(PermissionsWs.ENDPOINT, ACTION)
+      .setParam(PARAM_USER_LOGIN, "ray.bradbury")
+      .setParam(PARAM_PROJECT_UUID, "unknown-project-uuid")
+      .setParam(PARAM_PERMISSION, SYSTEM_ADMIN)
+      .execute();
+  }
+
+  @Test
+  public void fail_when_component_is_not_a_project() throws Exception {
+    expectedException.expect(BadRequestException.class);
+    insertComponent(newFileDto(newProjectDto(), "file-uuid"));
+
+    ws.newPostRequest(PermissionsWs.ENDPOINT, ACTION)
+      .setParam(PARAM_USER_LOGIN, "ray.bradbury")
+      .setParam(PARAM_PROJECT_UUID, "file-uuid")
+      .setParam(PARAM_PERMISSION, SYSTEM_ADMIN)
+      .execute();
+  }
+
+  @Test
+  public void fail_when_get_request() throws Exception {
     expectedException.expect(ServerException.class);
 
     ws.newGetRequest(PermissionsWs.ENDPOINT, ACTION)
-      .setParam(RemoveUserAction.PARAM_USER_LOGIN, "george.orwell")
-      .setParam(RemoveUserAction.PARAM_PERMISSION, SYSTEM_ADMIN)
+      .setParam(PARAM_USER_LOGIN, "george.orwell")
+      .setParam(PARAM_PERMISSION, SYSTEM_ADMIN)
       .execute();
   }
 
@@ -85,7 +157,7 @@ public class RemoveUserActionTest {
     expectedException.expect(IllegalArgumentException.class);
 
     ws.newPostRequest(PermissionsWs.ENDPOINT, ACTION)
-      .setParam(RemoveUserAction.PARAM_PERMISSION, SYSTEM_ADMIN)
+      .setParam(PARAM_PERMISSION, SYSTEM_ADMIN)
       .execute();
   }
 
@@ -94,7 +166,12 @@ public class RemoveUserActionTest {
     expectedException.expect(IllegalArgumentException.class);
 
     ws.newPostRequest(PermissionsWs.ENDPOINT, ACTION)
-      .setParam(RemoveUserAction.PARAM_USER_LOGIN, "jrr.tolkien")
+      .setParam(PARAM_USER_LOGIN, "jrr.tolkien")
       .execute();
   }
+
+  private void insertComponent(ComponentDto component) {
+    dbClient.componentDao().insert(dbSession, component);
+    dbSession.commit();
+  }
 }