SONAR-9022 Prevent updating name and description of 'sonar-users' group

diff --git a/server/sonar-server/src/main/java/org/sonar/server/usergroups/ws/GroupWsSupport.java b/server/sonar-server/src/main/java/org/sonar/server/usergroups/ws/GroupWsSupport.java
index d219bb1027c7f4ec08b7610f33e617a0c143789d..2fa8788bc5b5fb77b466aeec0ad6eb3ced80b18f 100644 (file)
--- a/server/sonar-server/src/main/java/org/sonar/server/usergroups/ws/GroupWsSupport.java
+++ b/server/sonar-server/src/main/java/org/sonar/server/usergroups/ws/GroupWsSupport.java
@@ -34,6 +34,7 @@ import org.sonar.server.organization.DefaultOrganizationProvider;
 import org.sonarqube.ws.WsUserGroups;
 
 import static com.google.common.base.Preconditions.checkArgument;
+import static org.sonar.server.user.UserUpdater.SONAR_USERS_GROUP_NAME;
 import static org.sonar.server.ws.WsUtils.checkFound;
 import static org.sonar.server.ws.WsUtils.checkFoundWithOptional;
 import static org.sonar.server.ws.WsUtils.checkRequest;
@@ -147,6 +148,10 @@ public class GroupWsSupport {
     checkRequest(!dbClient.groupDao().selectByName(dbSession, organizationUuid, name).isPresent(), "Group '%s' already exists", name);
   }
 
+  void checkGroupIsNotDefault(GroupDto groupDto) {
+    checkArgument(!SONAR_USERS_GROUP_NAME.equals(groupDto.getName()), "Default group '%s' cannot be used to perform this action", SONAR_USERS_GROUP_NAME);
+  }
+
   static WsUserGroups.Group.Builder toProtobuf(OrganizationDto organization, GroupDto group, int membersCount) {
     WsUserGroups.Group.Builder wsGroup = WsUserGroups.Group.newBuilder()
       .setId(group.getId())

diff --git a/server/sonar-server/src/main/java/org/sonar/server/usergroups/ws/UpdateAction.java b/server/sonar-server/src/main/java/org/sonar/server/usergroups/ws/UpdateAction.java
index 2e92f8e9f7a509ffdb49f28445b2e4076b77107e..62615cbd84704235d335083a00ee1d179b18a87e 100644 (file)
--- a/server/sonar-server/src/main/java/org/sonar/server/usergroups/ws/UpdateAction.java
+++ b/server/sonar-server/src/main/java/org/sonar/server/usergroups/ws/UpdateAction.java
@@ -20,6 +20,7 @@
 package org.sonar.server.usergroups.ws;
 
 import java.util.Optional;
+import org.sonar.api.server.ws.Change;
 import org.sonar.api.server.ws.Request;
 import org.sonar.api.server.ws.Response;
 import org.sonar.api.server.ws.WebService.NewAction;
@@ -35,6 +36,7 @@ import org.sonarqube.ws.WsUserGroups;
 
 import static org.sonar.api.user.UserGroupValidation.GROUP_NAME_MAX_LENGTH;
 import static org.sonar.db.permission.OrganizationPermission.ADMINISTER;
+import static org.sonar.server.user.UserUpdater.SONAR_USERS_GROUP_NAME;
 import static org.sonar.server.usergroups.ws.GroupWsSupport.DESCRIPTION_MAX_LENGTH;
 import static org.sonar.server.usergroups.ws.GroupWsSupport.PARAM_GROUP_DESCRIPTION;
 import static org.sonar.server.usergroups.ws.GroupWsSupport.PARAM_GROUP_ID;
@@ -64,7 +66,8 @@ public class UpdateAction implements UserGroupsWsAction {
       .setHandler(this)
       .setPost(true)
       .setResponseExample(getClass().getResource("example-update.json"))
-      .setSince("5.2");
+      .setSince("5.2")
+      .setChangelog(new Change("6.4", "The default group is no longer editable"));
 
     action.createParam(PARAM_GROUP_ID)
       .setDescription("Identifier of the group.")
@@ -73,8 +76,9 @@ public class UpdateAction implements UserGroupsWsAction {
 
     action.createParam(PARAM_GROUP_NAME)
       .setDescription(String.format("New optional name for the group. A group name cannot be larger than %d characters and must be unique. " +
-        "The value 'anyone' (whatever the case) is reserved and cannot be used. If value is empty or not defined, then name is not changed.", GROUP_NAME_MAX_LENGTH))
-      .setExampleValue("sonar-users");
+        "Value 'anyone' and '%s' (whatever the case) are reserved and cannot be used. If value is empty or not defined, then name is not changed.", GROUP_NAME_MAX_LENGTH,
+        SONAR_USERS_GROUP_NAME))
+      .setExampleValue("my-group");
 
     action.createParam(PARAM_GROUP_DESCRIPTION)
       .setDescription(String.format("New optional description for the group. A group description cannot be larger than %d characters. " +
@@ -91,6 +95,7 @@ public class UpdateAction implements UserGroupsWsAction {
       Optional<OrganizationDto> org = dbClient.organizationDao().selectByUuid(dbSession, group.getOrganizationUuid());
       checkFoundWithOptional(org, "Could not find organization with id '%s'.", group.getOrganizationUuid());
       userSession.checkPermission(ADMINISTER, org.get());
+      support.checkGroupIsNotDefault(group);
 
       boolean changed = false;
       String newName = request.param(PARAM_GROUP_NAME);
@@ -128,4 +133,5 @@ public class UpdateAction implements UserGroupsWsAction {
     respBuilder.setGroup(toProtobuf(organization, group, membersCount));
     writeProtobuf(respBuilder.build(), request, response);
   }
+
 }

diff --git a/server/sonar-server/src/test/java/org/sonar/server/usergroups/ws/UpdateActionTest.java b/server/sonar-server/src/test/java/org/sonar/server/usergroups/ws/UpdateActionTest.java
index d996c4b8d0363ddcad25d9f8e4e598e59f8d3bdd..3705abd0381b749636ce4656244655d39047b7cb 100644 (file)
--- a/server/sonar-server/src/test/java/org/sonar/server/usergroups/ws/UpdateActionTest.java
+++ b/server/sonar-server/src/test/java/org/sonar/server/usergroups/ws/UpdateActionTest.java
@@ -113,17 +113,6 @@ public class UpdateActionTest {
       "}");
   }
 
-  @Test
-  public void update_default_group_name_also_update_default_group_property() throws Exception {
-    GroupDto group = db.users().insertGroup(db.getDefaultOrganization(), DEFAULT_GROUP_NAME_VALUE);
-    loginAsAdminOnDefaultOrganization();
-
-    newRequest()
-      .setParam("id", group.getId().toString())
-      .setParam("name", "new-name")
-      .execute();
-  }
-
   @Test
   public void require_admin_permission_on_organization() throws Exception {
     GroupDto group = db.users().insertGroup();
@@ -240,6 +229,34 @@ public class UpdateActionTest {
       .execute();
   }
 
+  @Test
+  public void fail_to_update_default_group_name() throws Exception {
+    GroupDto group = db.users().insertGroup(db.getDefaultOrganization(), DEFAULT_GROUP_NAME_VALUE);
+    loginAsAdminOnDefaultOrganization();
+
+    expectedException.expect(IllegalArgumentException.class);
+    expectedException.expectMessage("Default group 'sonar-users' cannot be used to perform this action");
+
+    newRequest()
+      .setParam("id", group.getId().toString())
+      .setParam("name", "new name")
+      .execute();
+  }
+
+  @Test
+  public void fail_to_update_default_group_description() throws Exception {
+    GroupDto group = db.users().insertGroup(db.getDefaultOrganization(), DEFAULT_GROUP_NAME_VALUE);
+    loginAsAdminOnDefaultOrganization();
+
+    expectedException.expect(IllegalArgumentException.class);
+    expectedException.expectMessage("Default group 'sonar-users' cannot be used to perform this action");
+
+    newRequest()
+      .setParam("id", group.getId().toString())
+      .setParam("description", "new description")
+      .execute();
+  }
+
   private TestRequest newRequest() {
     return ws.newRequest();
   }