* Select users by uuids, including disabled users. An empty list is returned
* if list of uuids is empty, without any db round trips.
*
- * @return
+ * @return a list of users, in the same order as input uuids
*/
public List<UserDto> selectByUuids(DbSession session, Collection<String> uuids) {
return executeLargeInputs(uuids, mapper(session)::selectByUuids);
userQuery.getUserUuids(),
partialSetOfUsers -> mapper(dbSession).selectUsers(
UserQuery.copyWithNewRangeOfUserUuids(userQuery, partialSetOfUsers),
- pagination)
- );
+ pagination));
}
return mapper(dbSession).selectUsers(userQuery, pagination);
}
/**
* Search for an active user with the given emailCaseInsensitive exits in database
- * Select is case insensitive. Result for searching 'mail@emailCaseInsensitive.com' or 'Mail@Email.com' is the same
+ * Select is case-insensitive. Result for searching 'mail@emailCaseInsensitive.com' or 'Mail@Email.com' is the same
*/
public List<UserDto> selectByEmail(DbSession dbSession, String emailCaseInsensitive) {
return mapper(dbSession).selectByEmail(emailCaseInsensitive.toLowerCase(ENGLISH));
--- /dev/null
+/*
+ * SonarQube
+ * Copyright (C) 2009-2024 SonarSource SA
+ * mailto:info AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ */
+package org.sonar.server.exceptions;
+
+import static java.net.HttpURLConnection.HTTP_NOT_FOUND;
+
+public class ResourceForbiddenException extends ServerException {
+
+ private static final String ERROR_MESSAGE = "You do not have access to this resource or it does not exist.";
+
+ public ResourceForbiddenException() {
+ super(HTTP_NOT_FOUND, ERROR_MESSAGE);
+ }
+
+}
--- /dev/null
+/*
+ * SonarQube
+ * Copyright (C) 2009-2024 SonarSource SA
+ * mailto:info AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ */
+package org.sonar.server.exceptions;
+
+import org.junit.Test;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+public class ResourceForbiddenExceptionTest {
+
+ // Test the default constructor
+ @Test
+ public void defaultConstructor_shouldSetDefaultErrorMessage() {
+ ResourceForbiddenException exception = new ResourceForbiddenException();
+
+ assertThat(exception.getMessage()).isEqualTo("You do not have access to this resource or it does not exist.");
+ }
+
+}
import org.sonar.db.permission.GlobalPermission;
import org.sonar.db.user.UserDto;
import org.sonar.server.exceptions.ForbiddenException;
+import org.sonar.server.exceptions.ResourceForbiddenException;
import org.sonar.server.exceptions.UnauthorizedException;
import static org.sonar.api.resources.Qualifiers.APP;
}
@Override
- public final <T extends EntityDto> List<T> keepAuthorizedEntities(String permission, Collection<T> projects) {
+ public final <T extends EntityDto> List<T> keepAuthorizedEntities(String permission, Collection<T> projects) {
return doKeepAuthorizedEntities(permission, projects);
}
/**
* Naive implementation, to be overridden if needed
*/
- protected <T extends EntityDto> List<T> doKeepAuthorizedEntities(String permission, Collection<T> entities) {
+ protected <T extends EntityDto> List<T> doKeepAuthorizedEntities(String permission, Collection<T> entities) {
boolean allowPublicComponent = PUBLIC_PERMISSIONS.contains(permission);
return entities.stream()
.filter(c -> (allowPublicComponent && !c.isPrivate()) || hasEntityPermission(permission, c.getUuid()))
throw new ForbiddenException(INSUFFICIENT_PRIVILEGES_MESSAGE);
}
+ @Override
+ public UserSession checkEntityPermissionOrElseThrowResourceForbiddenException(String projectPermission, EntityDto entity) {
+ if (hasEntityPermission(projectPermission, entity)) {
+ return this;
+ }
+
+ throw new ResourceForbiddenException();
+ }
+
@Override
public UserSession checkChildProjectsPermission(String projectPermission, ComponentDto component) {
if (!APP.equals(component.qualifier()) || hasChildProjectsPermission(projectPermission, component)) {
return this;
}
+ @Override
+ public UserSession checkEntityPermissionOrElseThrowResourceForbiddenException(String projectPermission, EntityDto entity) {
+ get().checkEntityPermissionOrElseThrowResourceForbiddenException(projectPermission, entity);
+ return this;
+ }
+
@Override
public UserSession checkChildProjectsPermission(String projectPermission, ComponentDto component) {
get().checkChildProjectsPermission(projectPermission, component);
enum IdentityProvider {
SONARQUBE("sonarqube"), GITHUB("github"), BITBUCKETCLOUD("bitbucket"), OTHER("other");
- String key;
+ final String key;
IdentityProvider(String key) {
this.key = key;
*/
UserSession checkEntityPermission(String projectPermission, EntityDto entity);
+ /**
+ * Ensures that {@link #hasEntityPermission(String, EntityDto)} is {@code true},
+ * otherwise throws a {@link org.sonar.server.exceptions.ResourceForbiddenException}.
+ * <p>
+ * Differs from {@link #checkEntityPermission(String, EntityDto)} by throwing a different exception (ensuring no resource listing is possible).
+ */
+ UserSession checkEntityPermissionOrElseThrowResourceForbiddenException(String projectPermission, EntityDto entity);
+
/**
* Ensures that {@link #hasChildProjectsPermission(String, ComponentDto)} is {@code true}
* otherwise throws a {@link org.sonar.server.exceptions.ForbiddenException}.
import org.junit.Test;
import org.sonar.api.resources.Qualifiers;
import org.sonar.db.component.ComponentDto;
+import org.sonar.db.entity.EntityDto;
import org.sonar.db.project.ProjectDto;
import org.sonar.db.user.GroupDto;
import org.sonar.db.user.GroupTesting;
import org.sonar.server.exceptions.ForbiddenException;
+import org.sonar.server.exceptions.ResourceForbiddenException;
import org.sonar.server.exceptions.UnauthorizedException;
import org.sonar.server.tester.AnonymousMockUserSession;
import org.sonar.server.tester.MockUserSession;
.isInstanceOf(UnauthorizedException.class);
}
+ @Test
+ public void checkEntityPermissionOrElseThrowResourceForbiddenException_returns_session_when_permission_to_entity() {
+ MockUserSession expected = new MockUserSession("jean-michel");
+
+ ProjectDto subProjectDto = new ProjectDto().setQualifier(Qualifiers.PROJECT).setUuid("subproject-uuid");
+ ProjectDto applicationAsProjectDto = new ProjectDto().setQualifier(Qualifiers.APP).setUuid("application-project-uuid");
+
+ expected.registerProjects(subProjectDto);
+ expected.registerApplication(applicationAsProjectDto, subProjectDto);
+ threadLocalUserSession.set(expected);
+
+ assertThat(threadLocalUserSession.checkEntityPermissionOrElseThrowResourceForbiddenException(USER, applicationAsProjectDto)).isEqualTo(threadLocalUserSession);
+ }
+
+ @Test
+ public void checkEntityPermissionOrElseThrowResourceForbiddenException_throws_ResourceForbiddenException_when_no_permission_to_entity() {
+ MockUserSession expected = new MockUserSession("jean-michel");
+ threadLocalUserSession.set(expected);
+ EntityDto entity = new ProjectDto();
+
+ assertThatThrownBy(() -> threadLocalUserSession.checkEntityPermissionOrElseThrowResourceForbiddenException(USER, entity))
+ .isInstanceOf(ResourceForbiddenException.class);
+ }
+
@Test
public void throw_ForbiddenException_when_no_access_to_applications_projects() {
GroupDto group = GroupTesting.newGroupDto();
return this;
}
+ @Override
+ public UserSession checkEntityPermissionOrElseThrowResourceForbiddenException(String projectPermission, EntityDto entity) {
+ currentUserSession.checkEntityPermissionOrElseThrowResourceForbiddenException(projectPermission, entity);
+ return this;
+ }
+
@Override
public UserSession checkChildProjectsPermission(String projectPermission, ComponentDto component) {
currentUserSession.checkChildProjectsPermission(projectPermission, component);
import org.sonar.server.user.UserSession;
import org.sonar.server.v2.api.membership.request.GroupMembershipCreateRestRequest;
import org.sonar.server.v2.api.membership.request.GroupsMembershipSearchRestRequest;
-import org.sonar.server.v2.api.membership.response.GroupsMembershipSearchRestResponse;
import org.sonar.server.v2.api.membership.response.GroupMembershipRestResponse;
+import org.sonar.server.v2.api.membership.response.GroupsMembershipSearchRestResponse;
import org.sonar.server.v2.api.model.RestPage;
import org.sonar.server.v2.api.response.PageRestResponse;
userSession.checkLoggedIn().checkIsSystemAdministrator();
SearchResults<UserGroupDto> groupMembershipSearchResults = searchMembership(groupsSearchRestRequest, restPage);
- List<GroupMembershipRestResponse> groupMembershipRestRespons = toRestGroupMembershipResponse(groupMembershipSearchResults);
- return new GroupsMembershipSearchRestResponse(groupMembershipRestRespons,
- new PageRestResponse(restPage.pageIndex(), restPage.pageSize(), groupMembershipSearchResults.total())
- );
+ List<GroupMembershipRestResponse> groupMembershipRestResponse = toRestGroupMembershipResponse(groupMembershipSearchResults);
+ return new GroupsMembershipSearchRestResponse(groupMembershipRestResponse,
+ new PageRestResponse(restPage.pageIndex(), restPage.pageSize(), groupMembershipSearchResults.total()));
}
private SearchResults<UserGroupDto> searchMembership(GroupsMembershipSearchRestRequest groupsSearchRestRequest, RestPage restPage) {
import org.sonar.server.common.projectbindings.service.ProjectBindingInformation;
import org.sonar.server.common.projectbindings.service.ProjectBindingsSearchRequest;
import org.sonar.server.common.projectbindings.service.ProjectBindingsService;
-import org.sonar.server.exceptions.NotFoundException;
+import org.sonar.server.exceptions.ResourceForbiddenException;
import org.sonar.server.user.UserSession;
import org.sonar.server.v2.api.model.RestPage;
import org.sonar.server.v2.api.projectbindings.model.ProjectBinding;
if (projectAlmSettingDto.isPresent()) {
ProjectDto projectDto = projectBindingsService.findProjectFromBinding(projectAlmSettingDto.get())
.orElseThrow(() -> new IllegalStateException(String.format("Project (uuid '%s') not found for binding '%s'", projectAlmSettingDto.get().getProjectUuid(), id)));
- userSession.checkEntityPermission(USER, projectDto);
+ userSession.checkEntityPermissionOrElseThrowResourceForbiddenException(USER, projectDto);
return toProjectBinding(projectDto, projectAlmSettingDto.get());
} else {
- throw new NotFoundException(String.format("Project binding '%s' not found", id));
+ throw new ResourceForbiddenException();
}
}
status().isNotFound(),
content().json("""
{
- "message": "Project binding 'uuid' not found"
+ "message": "You do not have access to this resource or it does not exist."
}
"""));
}
}
@Test
- void getProjectBinding_whenUserDoesntHaveProjectAdminPermissions_returnsForbidden() throws Exception {
+ void getProjectBinding_whenUserDoesntHaveProjectAdminPermissions_returnsNotFound() throws Exception {
userSession.logIn();
ProjectAlmSettingDto projectAlmSettingDto = mock();
when(projectBindingsService.findProjectBindingByUuid(UUID)).thenReturn(Optional.of(projectAlmSettingDto));
mockMvc
.perform(get(PROJECT_BINDINGS_ENDPOINT + "/uuid"))
.andExpectAll(
- status().isForbidden(),
+ status().isNotFound(),
content().json("""
{
- "message": "Insufficient privileges"
+ "message": "You do not have access to this resource or it does not exist."
}
"""));
}
projects / sonarqube.git / commitdiff