SONAR-8269 organization in WS api/permissions/add_group_to_template

diff --git a/server/sonar-server/src/main/java/org/sonar/server/permission/ws/PermissionsWsParametersBuilder.java b/server/sonar-server/src/main/java/org/sonar/server/permission/ws/PermissionsWsParametersBuilder.java
index cb9eeaf04e09268c316e37816e8ff48fee2d48d1..f9032be648a9262fe4485e576addd6f827b33ade 100644 (file)
--- a/server/sonar-server/src/main/java/org/sonar/server/permission/ws/PermissionsWsParametersBuilder.java
+++ b/server/sonar-server/src/main/java/org/sonar/server/permission/ws/PermissionsWsParametersBuilder.java
@@ -73,7 +73,6 @@ public class PermissionsWsParametersBuilder {
   }
 
   public static void createGroupNameParameter(NewAction action) {
-    createOrganizationParameter(action);
     action.createParam(PARAM_GROUP_NAME)
       .setDescription("Group name or 'anyone' (case insensitive)")
       .setExampleValue("sonar-administrators");
@@ -118,6 +117,7 @@ public class PermissionsWsParametersBuilder {
 
   public static void createTemplateParameters(NewAction action) {
     createTemplateIdParameter(action);
+    createOrganizationParameter(action);
     createTemplateNameParameter(action);
   }
 

diff --git a/server/sonar-server/src/main/java/org/sonar/server/permission/ws/template/AddGroupToTemplateAction.java b/server/sonar-server/src/main/java/org/sonar/server/permission/ws/template/AddGroupToTemplateAction.java
index 9ad70ff2a39ee90ac17a0bca050791807557a6c3..4466ba4a7a8911feefaf6f619cd5c4cd1659ce32 100644 (file)
--- a/server/sonar-server/src/main/java/org/sonar/server/permission/ws/template/AddGroupToTemplateAction.java
+++ b/server/sonar-server/src/main/java/org/sonar/server/permission/ws/template/AddGroupToTemplateAction.java
@@ -19,10 +19,10 @@
  */
 package org.sonar.server.permission.ws.template;
 
+import java.util.Optional;
 import org.sonar.api.server.ws.Request;
 import org.sonar.api.server.ws.Response;
 import org.sonar.api.server.ws.WebService;
-import org.sonar.core.permission.GlobalPermissions;
 import org.sonar.db.DbClient;
 import org.sonar.db.DbSession;
 import org.sonar.db.permission.template.PermissionTemplateDto;
@@ -32,7 +32,8 @@ import org.sonar.server.user.UserSession;
 import org.sonar.server.usergroups.ws.GroupIdOrAnyone;
 
 import static java.lang.String.format;
-import static org.sonar.server.permission.PermissionPrivilegeChecker.checkGlobalAdminUser;
+import static org.sonar.core.permission.GlobalPermissions.SYSTEM_ADMIN;
+import static org.sonar.server.permission.PermissionPrivilegeChecker.checkProjectAdmin;
 import static org.sonar.server.permission.ws.PermissionsWsParametersBuilder.createGroupIdParameter;
 import static org.sonar.server.permission.ws.PermissionsWsParametersBuilder.createGroupNameParameter;
 import static org.sonar.server.permission.ws.PermissionsWsParametersBuilder.createProjectPermissionParameter;
@@ -71,15 +72,14 @@ public class AddGroupToTemplateAction implements PermissionsWsAction {
 
   @Override
   public void handle(Request request, Response response) {
-    checkGlobalAdminUser(userSession);
-
     try (DbSession dbSession = dbClient.openSession(false)) {
       String permission = request.mandatoryParam(PARAM_PERMISSION);
       GroupIdOrAnyone groupId = support.findGroup(dbSession, request);
-      checkRequest(!GlobalPermissions.SYSTEM_ADMIN.equals(permission) || !groupId.isAnyone(),
+      checkRequest(!SYSTEM_ADMIN.equals(permission) || !groupId.isAnyone(),
         format("It is not possible to add the '%s' permission to the group 'Anyone'.", permission));
 
       PermissionTemplateDto template = support.findTemplate(dbSession, fromRequest(request));
+      checkProjectAdmin(userSession, template.getOrganizationUuid(), Optional.empty());
 
       if (!groupAlreadyAdded(dbSession, template.getId(), permission, groupId)) {
         dbClient.permissionTemplateDao().insertGroupPermission(dbSession, template.getId(), groupId.getId(), permission);

diff --git a/server/sonar-server/src/test/java/org/sonar/server/permission/ws/template/AddGroupToTemplateActionTest.java b/server/sonar-server/src/test/java/org/sonar/server/permission/ws/template/AddGroupToTemplateActionTest.java
index 1066d19281ac2930007e945c21e0ae2a75b21f1a..5bcd53b34b197a6e9d2bcc28893304345a55d19f 100644 (file)
--- a/server/sonar-server/src/test/java/org/sonar/server/permission/ws/template/AddGroupToTemplateActionTest.java
+++ b/server/sonar-server/src/test/java/org/sonar/server/permission/ws/template/AddGroupToTemplateActionTest.java
@@ -31,7 +31,6 @@ import org.sonar.db.user.GroupDto;
 import org.sonar.server.exceptions.BadRequestException;
 import org.sonar.server.exceptions.ForbiddenException;
 import org.sonar.server.exceptions.NotFoundException;
-import org.sonar.server.exceptions.UnauthorizedException;
 import org.sonar.server.permission.ws.BasePermissionWsTest;
 import org.sonar.server.ws.WsTester;
 
@@ -59,13 +58,14 @@ public class AddGroupToTemplateActionTest extends BasePermissionWsTest<AddGroupT
 
   @Before
   public void setUp() {
-    loginAsAdmin();
     template = insertTemplate();
     group = db.users().insertGroup(defaultOrganizationProvider.getDto(), "group-name");
   }
 
   @Test
   public void add_group_to_template() throws Exception {
+    loginAsAdminOnDefaultOrganization();
+
     newRequest(group.getName(), template.getUuid(), CODEVIEWER);
 
     assertThat(getGroupNamesInTemplateAndPermission(template.getId(), CODEVIEWER)).containsExactly(group.getName());
@@ -73,6 +73,8 @@ public class AddGroupToTemplateActionTest extends BasePermissionWsTest<AddGroupT
 
   @Test
   public void add_group_to_template_by_name() throws Exception {
+    loginAsAdminOnDefaultOrganization();
+
     newRequest()
       .setParam(PARAM_GROUP_NAME, group.getName())
       .setParam(PARAM_PERMISSION, CODEVIEWER)
@@ -84,6 +86,8 @@ public class AddGroupToTemplateActionTest extends BasePermissionWsTest<AddGroupT
 
   @Test
   public void add_with_group_id() throws Exception {
+    loginAsAdminOnDefaultOrganization();
+
     newRequest()
       .setParam(PARAM_TEMPLATE_ID, template.getUuid())
       .setParam(PARAM_PERMISSION, CODEVIEWER)
@@ -95,6 +99,8 @@ public class AddGroupToTemplateActionTest extends BasePermissionWsTest<AddGroupT
 
   @Test
   public void does_not_add_a_group_twice() throws Exception {
+    loginAsAdminOnDefaultOrganization();
+
     newRequest(group.getName(), template.getUuid(), ISSUE_ADMIN);
     newRequest(group.getName(), template.getUuid(), ISSUE_ADMIN);
 
@@ -103,6 +109,8 @@ public class AddGroupToTemplateActionTest extends BasePermissionWsTest<AddGroupT
 
   @Test
   public void add_anyone_group_to_template() throws Exception {
+    loginAsAdminOnDefaultOrganization();
+
     newRequest(ANYONE, template.getUuid(), CODEVIEWER);
 
     assertThat(getGroupNamesInTemplateAndPermission(template.getId(), CODEVIEWER)).containsExactly(ANYONE);
@@ -110,6 +118,8 @@ public class AddGroupToTemplateActionTest extends BasePermissionWsTest<AddGroupT
 
   @Test
   public void fail_if_add_anyone_group_to_admin_permission() throws Exception {
+    loginAsAdminOnDefaultOrganization();
+
     expectedException.expect(BadRequestException.class);
     expectedException.expectMessage(String.format("It is not possible to add the '%s' permission to the group 'Anyone'", UserRole.ADMIN));
 
@@ -118,30 +128,26 @@ public class AddGroupToTemplateActionTest extends BasePermissionWsTest<AddGroupT
 
   @Test
   public void fail_if_not_a_project_permission() throws Exception {
+    loginAsAdminOnDefaultOrganization();
+
     expectedException.expect(IllegalArgumentException.class);
 
     newRequest(group.getName(), template.getUuid(), GlobalPermissions.PROVISIONING);
   }
 
   @Test
-  public void fail_if_insufficient_privileges() throws Exception {
-    userSession.setGlobalPermissions(GlobalPermissions.QUALITY_PROFILE_ADMIN);
+  public void fail_if_not_admin_of_default_organization() throws Exception {
+    userSession.login();
 
     expectedException.expect(ForbiddenException.class);
 
     newRequest(group.getName(), template.getUuid(), CODEVIEWER);
   }
 
-  @Test
-  public void fail_if_not_logged_in() throws Exception {
-    expectedException.expect(UnauthorizedException.class);
-    userSession.anonymous();
-
-    newRequest(group.getName(), template.getUuid(), CODEVIEWER);
-  }
-
   @Test
   public void fail_if_group_params_missing() throws Exception {
+    loginAsAdminOnDefaultOrganization();
+
     expectedException.expect(BadRequestException.class);
 
     newRequest(null, template.getUuid(), CODEVIEWER);
@@ -149,6 +155,8 @@ public class AddGroupToTemplateActionTest extends BasePermissionWsTest<AddGroupT
 
   @Test
   public void fail_if_permission_missing() throws Exception {
+    loginAsAdminOnDefaultOrganization();
+
     expectedException.expect(IllegalArgumentException.class);
 
     newRequest(group.getName(), template.getUuid(), null);
@@ -156,6 +164,8 @@ public class AddGroupToTemplateActionTest extends BasePermissionWsTest<AddGroupT
 
   @Test
   public void fail_if_template_uuid_and_name_missing() throws Exception {
+    loginAsAdminOnDefaultOrganization();
+
     expectedException.expect(BadRequestException.class);
 
     newRequest(group.getName(), null, CODEVIEWER);
@@ -163,6 +173,8 @@ public class AddGroupToTemplateActionTest extends BasePermissionWsTest<AddGroupT
 
   @Test
   public void fail_if_group_does_not_exist() throws Exception {
+    loginAsAdminOnDefaultOrganization();
+
     expectedException.expect(NotFoundException.class);
     expectedException.expectMessage("No group with name 'unknown-group-name'");
 
@@ -171,6 +183,8 @@ public class AddGroupToTemplateActionTest extends BasePermissionWsTest<AddGroupT
 
   @Test
   public void fail_if_template_key_does_not_exist() throws Exception {
+    loginAsAdminOnDefaultOrganization();
+
     expectedException.expect(NotFoundException.class);
     expectedException.expectMessage("Permission template with id 'unknown-key' is not found");
 
@@ -201,8 +215,4 @@ public class AddGroupToTemplateActionTest extends BasePermissionWsTest<AddGroupT
   private WsTester.TestRequest newRequest() {
     return wsTester.newPostRequest(CONTROLLER, "add_group_to_template");
   }
-
-  private void loginAsAdmin() {
-    userSession.login().setGlobalPermissions(GlobalPermissions.SYSTEM_ADMIN);
-  }
 }