Skip to content

ESB-1231 cms/contentmodels controller access control relaxed #371

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
MEM2677 wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

ESB-1231 cms/contentmodels controller access control relaxed #371

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,3 +8,5 @@ target
work
*.tgz
derby.log
/testing/
/.testing/
18 changes: 9 additions & 9 deletions ...va/org/entando/entando/plugins/jacms/web/contentmodel/ContentModelResourceController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@ public ContentModelResourceController(ContentModelService contentModelService,
}

@Override
@RestAccessControl(permission = Permission.SUPERUSER)
@RestAccessControl(permission = {Permission.SUPERUSER, Permission.CONTENT_EDITOR, Permission.CONTENT_SUPERVISOR})
@GetMapping(produces = MediaType.APPLICATION_JSON_VALUE)
public ResponseEntity<PagedRestResponse<ContentModelDto>> getContentModels(RestListRequest requestList,
BindingResult bindingResult) {
Expand All @@ -84,7 +84,7 @@ public ResponseEntity<PagedRestResponse<ContentModelDto>> getContentModels(RestL
}

@Override
@RestAccessControl(permission = Permission.SUPERUSER)
@RestAccessControl(permission = {Permission.SUPERUSER, Permission.CONTENT_EDITOR, Permission.CONTENT_SUPERVISOR})
@GetMapping(value = "/{modelId}", produces = MediaType.APPLICATION_JSON_VALUE)
public ResponseEntity<SimpleRestResponse<ContentModelDto>> getContentModel(@PathVariable Long modelId) {
logger.debug("loading contentModel {}", modelId);
Expand All @@ -93,7 +93,7 @@ public ResponseEntity<SimpleRestResponse<ContentModelDto>> getContentModel(@Path
}

@Override
@RestAccessControl(permission = Permission.SUPERUSER)
@RestAccessControl(permission = {Permission.SUPERUSER, Permission.CONTENT_EDITOR, Permission.CONTENT_SUPERVISOR})
@PostMapping(produces = MediaType.APPLICATION_JSON_VALUE)
public ResponseEntity<SimpleRestResponse<ContentModelDto>> addContentModel(@Valid @RequestBody ContentModelDto contentModel, BindingResult bindingResult) {
logger.debug("adding content model");
Expand All @@ -105,7 +105,7 @@ public ResponseEntity<SimpleRestResponse<ContentModelDto>> addContentModel(@Vali
}

@Override
@RestAccessControl(permission = Permission.SUPERUSER)
@RestAccessControl(permission = {Permission.SUPERUSER, Permission.CONTENT_EDITOR, Permission.CONTENT_SUPERVISOR})
@PutMapping(value = "/{modelId}", produces = MediaType.APPLICATION_JSON_VALUE)
public ResponseEntity<SimpleRestResponse<ContentModelDto>> updateContentModel(@PathVariable Long modelId, @Valid @RequestBody ContentModelDto contentModel, BindingResult bindingResult) {
logger.debug("updating contentModel {}", modelId);
Expand All @@ -124,7 +124,7 @@ public ResponseEntity<SimpleRestResponse<ContentModelDto>> updateContentModel(@P
}

@Override
@RestAccessControl(permission = Permission.SUPERUSER)
@RestAccessControl(permission = {Permission.SUPERUSER, Permission.CONTENT_EDITOR, Permission.CONTENT_SUPERVISOR})
@DeleteMapping(value = "/{modelId}", produces = MediaType.APPLICATION_JSON_VALUE)
public ResponseEntity<SimpleRestResponse<Map<String, String>>> deleteContentModel(@PathVariable Long modelId) {
logger.info("deleting content model {}", modelId);
Expand All @@ -134,7 +134,7 @@ public ResponseEntity<SimpleRestResponse<Map<String, String>>> deleteContentMode
}

@Override
@RestAccessControl(permission = Permission.SUPERUSER)
@RestAccessControl(permission = {Permission.SUPERUSER, Permission.CONTENT_EDITOR, Permission.CONTENT_SUPERVISOR})
@GetMapping(value = "/{modelId}/pagereferences", produces = MediaType.APPLICATION_JSON_VALUE)
public ResponseEntity<PagedRestResponse<ContentModelReferenceDTO>> getReferences(@PathVariable Long modelId,RestListRequest requestList) {
logger.debug("loading contentModel references for model {}", modelId);
Expand All @@ -144,7 +144,7 @@ public ResponseEntity<PagedRestResponse<ContentModelReferenceDTO>> getReferences
}

@Override
@RestAccessControl(permission = Permission.SUPERUSER)
@RestAccessControl(permission = {Permission.SUPERUSER, Permission.CONTENT_EDITOR, Permission.CONTENT_SUPERVISOR})
@GetMapping(value = "/{modelId}/usage", produces = MediaType.APPLICATION_JSON_VALUE)
public ResponseEntity<SimpleRestResponse<ComponentUsage>> getComponentUsage(@PathVariable Long modelId) {
logger.debug("loading contentModel usage for model {}", modelId);
Expand All @@ -153,7 +153,7 @@ public ResponseEntity<SimpleRestResponse<ComponentUsage>> getComponentUsage(@Pat
}

@Override
@RestAccessControl(permission = Permission.SUPERUSER)
@RestAccessControl(permission = {Permission.SUPERUSER, Permission.CONTENT_EDITOR, Permission.CONTENT_SUPERVISOR})
@GetMapping(value = "/{modelId}/usage/details", produces = MediaType.APPLICATION_JSON_VALUE)
public ResponseEntity<PagedRestResponse<ComponentUsageEntity>> getComponentUsageDetails(@PathVariable Long modelId, RestListRequest restListRequest) {
logger.debug("get contentModel usage details for model {}", modelId);
Expand All @@ -163,7 +163,7 @@ public ResponseEntity<PagedRestResponse<ComponentUsageEntity>> getComponentUsage
}

@Override
@RestAccessControl(permission = Permission.SUPERUSER)
@RestAccessControl(permission = {Permission.SUPERUSER, Permission.CONTENT_EDITOR, Permission.CONTENT_SUPERVISOR})
@GetMapping(value = "/dictionary", produces = MediaType.APPLICATION_JSON_VALUE)
public ResponseEntity<SimpleRestResponse<IEntityModelDictionary>> getDictionary(@RequestParam(value = "typeCode", required = false) String typeCode) {
logger.debug("loading contentModel dictionary for type {}", typeCode);
Expand Down
58 changes: 57 additions & 1 deletion ...va/org/entando/entando/plugins/jacms/web/contentmodel/ContentModelControllerUnitTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,8 @@
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;

import com.agiletec.aps.system.services.group.Group;
import com.agiletec.aps.system.services.role.Permission;
import com.agiletec.aps.system.services.user.UserDetails;
import com.agiletec.plugins.jacms.aps.system.services.content.model.Content;
import com.agiletec.plugins.jacms.aps.system.services.contentmodel.dictionary.ContentModelDictionary;
Expand Down Expand Up @@ -39,6 +41,8 @@
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.extension.ExtendWith;
import org.junit.jupiter.params.ParameterizedTest;
import org.junit.jupiter.params.provider.ValueSource;
import org.mockito.InjectMocks;
import org.mockito.Mock;
import org.mockito.Mockito;
Expand Down Expand Up @@ -224,6 +228,54 @@ public void shouldGetDictionary() throws Exception {
result.andExpect(jsonPath("$.payload.$content").exists());
}

@ParameterizedTest
@ValueSource(strings = {Permission.SUPERUSER, Permission.CONTENT_EDITOR, Permission.CONTENT_SUPERVISOR})
public void shouldAllowAccessToEveryEndpointForRelaxedPermissions(String permission) throws Exception {
UserDetails user = createUserWithPermission(permission);
ContentModelDto contentModelDto = buildContentModelDto(1l, "AAA");

performRequest(get(BASE_URI), null, user).andExpect(status().isOk());
performRequest(get(BASE_URI + "/{id}", 1), null, user).andExpect(status().isOk());
performRequest(post(BASE_URI), mapper.writeValueAsString(contentModelDto), user).andExpect(status().isOk());
performRequest(put(BASE_URI + "/{id}", 1), mapper.writeValueAsString(contentModelDto), user).andExpect(status().isOk());
performRequest(get(BASE_URI + "/{id}/pagereferences", 1), null, user).andExpect(status().isOk());
performRequest(get(BASE_URI + "/{id}/usage", 1), null, user).andExpect(status().isOk());
performRequest(get(BASE_URI + "/{id}/usage/details", 1), null, user).andExpect(status().isOk());
performRequest(get(BASE_URI + "/dictionary"), null, user).andExpect(status().isOk());
performRequest(delete(BASE_URI + "/{id}", 1), null, user).andExpect(status().isOk());
}

@Test
public void shouldForbidAccessToEveryEndpointForUnrelatedPermission() throws Exception {
UserDetails user = createUserWithPermission(Permission.MANAGE_PAGES);
ContentModelDto contentModelDto = buildContentModelDto(1l, "AAA");

performRequest(get(BASE_URI), null, user).andExpect(status().isForbidden());
performRequest(get(BASE_URI + "/{id}", 1), null, user).andExpect(status().isForbidden());
performRequest(post(BASE_URI), mapper.writeValueAsString(contentModelDto), user).andExpect(status().isForbidden());
performRequest(put(BASE_URI + "/{id}", 1), mapper.writeValueAsString(contentModelDto), user).andExpect(status().isForbidden());
performRequest(get(BASE_URI + "/{id}/pagereferences", 1), null, user).andExpect(status().isForbidden());
performRequest(get(BASE_URI + "/{id}/usage", 1), null, user).andExpect(status().isForbidden());
performRequest(get(BASE_URI + "/{id}/usage/details", 1), null, user).andExpect(status().isForbidden());
performRequest(get(BASE_URI + "/dictionary"), null, user).andExpect(status().isForbidden());
performRequest(delete(BASE_URI + "/{id}", 1), null, user).andExpect(status().isForbidden());
}

private UserDetails createUserWithPermission(String permission) {
return new OAuth2TestUtils.UserBuilder("jack_bauer", "0x24")
.withAuthorization(Group.FREE_GROUP_NAME, "roletest", permission)
.build();
}

private ContentModelDto buildContentModelDto(long id, String contentType) {
ContentModelDto contentModelDto = new ContentModelDto();
contentModelDto.setId(id);
contentModelDto.setContentType(contentType);
contentModelDto.setContentShape("contentShape");
contentModelDto.setDescr("description");
return contentModelDto;
}

private ResultActions performRequest(MockHttpServletRequestBuilder requestBuilder, ContentModelDto contentModelDto) throws Exception {
String payload = mapper.writeValueAsString(contentModelDto);
return performRequest(requestBuilder, payload);
Expand All @@ -234,8 +286,12 @@ private ResultActions performRequest(MockHttpServletRequestBuilder requestBuilde
}

private ResultActions performRequest(MockHttpServletRequestBuilder requestBuilder, String payload) throws Exception {

UserDetails user = new OAuth2TestUtils.UserBuilder("jack_bauer", "0x24").grantedToRoleAdmin().build();
return performRequest(requestBuilder, payload, user);
}

private ResultActions performRequest(MockHttpServletRequestBuilder requestBuilder, String payload, UserDetails user) throws Exception {

String accessToken = mockOAuthInterceptor(user);

requestBuilder = requestBuilder
Expand Down
Loading