package jnpf.elnService.template;
|
|
import jnpf.elnEntity.template.ElnTemplateVersionEntity;
|
import jnpf.util.JsonUtil;
|
import org.junit.Test;
|
|
import java.lang.reflect.Field;
|
import java.lang.reflect.Modifier;
|
import java.util.ArrayList;
|
import java.util.Arrays;
|
import java.util.LinkedHashMap;
|
import java.util.List;
|
import java.util.Map;
|
import java.util.concurrent.atomic.AtomicInteger;
|
import java.util.concurrent.atomic.AtomicReference;
|
|
import static org.junit.Assert.assertEquals;
|
import static org.junit.Assert.assertFalse;
|
import static org.junit.Assert.assertNull;
|
import static org.junit.Assert.assertTrue;
|
import static org.junit.Assert.fail;
|
|
public class TemplateAnnotationAuthorizerTest {
|
|
@Test
|
public void successfulAuthorizationKeepsTenantUntilOuterExecutionCompletes() {
|
List<String> events = new ArrayList<>();
|
RecordingTenantRoute tenants = new RecordingTenantRoute(events);
|
TemplateAnnotationAuthorizer authorizer = authorizer(validPayload("tenant-a", "template-1", "file-1"),
|
template("tenant-a", "template-1", "file-1", "DRAFT", "enabled"), true, tenants, events);
|
|
TemplateAnnotationAuthorization result = authorizer.authorize("ticket-1", "template-1");
|
|
assertEquals(Arrays.asList("access:tenant-a:user-1:template-1:file-1",
|
"switch:tenant-a", "lookup:tenant-a:template-1"), events);
|
assertEquals("tenant-a", tenants.currentTenant);
|
assertEquals("tenant-a", result.getTenantId());
|
assertEquals("user-1", result.getUserId());
|
assertEquals("template-1", result.getTemplateId());
|
assertEquals("file-1", result.getFileId());
|
for (Field field : TemplateAnnotationAuthorization.class.getDeclaredFields()) {
|
if (!field.isSynthetic()) {
|
assertTrue(Modifier.isFinal(field.getModifiers()));
|
}
|
}
|
|
events.add("service:" + tenants.currentTenant);
|
tenants.clear();
|
assertEquals(Arrays.asList("access:tenant-a:user-1:template-1:file-1",
|
"switch:tenant-a", "lookup:tenant-a:template-1", "service:tenant-a", "clear"), events);
|
assertNull(tenants.currentTenant);
|
}
|
|
@Test
|
public void requestCannotOverrideSignedTenantAndSequentialTenantsDoNotLeak() {
|
List<String> events = new ArrayList<>();
|
RecordingTenantRoute tenants = new RecordingTenantRoute(events);
|
AtomicReference<String> routedTenant = new AtomicReference<>();
|
TemplateAnnotationTicketService tickets = new TemplateAnnotationTicketService(ticket ->
|
JsonUtil.getObjectToString(validPayload(ticket, "template-1", "file-1")));
|
TemplateAnnotationAuthorizer authorizer = new TemplateAnnotationAuthorizer(tickets,
|
templateId -> {
|
routedTenant.set(tenants.currentTenant);
|
return template(tenants.currentTenant, templateId, "file-1", "DRAFT", "enabled");
|
}, (tenantId, userId, templateId, fileId) -> true, tenants);
|
|
authorizer.authorize("tenant-a", "template-1");
|
assertEquals("tenant-a", routedTenant.get());
|
assertEquals("tenant-a", tenants.currentTenant);
|
tenants.clear();
|
assertNull(tenants.currentTenant);
|
authorizer.authorize("tenant-b", "template-1");
|
assertEquals("tenant-b", routedTenant.get());
|
assertEquals("tenant-b", tenants.currentTenant);
|
tenants.clear();
|
assertNull(tenants.currentTenant);
|
assertEquals(Arrays.asList("tenant-a", "tenant-b"), tenants.switchedTenants);
|
assertEquals(2, tenants.clearCount);
|
}
|
|
@Test
|
public void tenantSwitchFailureDoesNotQueryTemplateAndStillClears() {
|
List<String> events = new ArrayList<>();
|
RecordingTenantRoute tenants = new RecordingTenantRoute(events);
|
tenants.failSwitch = true;
|
AtomicInteger queries = new AtomicInteger();
|
TemplateAnnotationAuthorizer authorizer = new TemplateAnnotationAuthorizer(ticketService(validPayload()),
|
templateId -> {
|
queries.incrementAndGet();
|
return template("tenant-a", templateId, "file-1", "DRAFT", "enabled");
|
}, (tenantId, userId, templateId, fileId) -> true, tenants);
|
|
assertStatus(401, () -> authorizer.authorize("ticket-1", "template-1"));
|
|
assertEquals(0, queries.get());
|
assertEquals(Arrays.asList("switch:tenant-a", "clear"), events);
|
assertNull(tenants.currentTenant);
|
}
|
|
@Test
|
public void templateAndFileMustMatchSignedTicket() {
|
RecordingTenantRoute tenants = new RecordingTenantRoute(new ArrayList<>());
|
TemplateAnnotationAuthorizer authorizer = authorizer(validPayload(),
|
template("tenant-a", "template-1", "other-file", "DRAFT", "enabled"), true, tenants,
|
new ArrayList<>());
|
|
assertStatus(401, () -> authorizer.authorize("ticket-1", "template-2"));
|
assertStatus(401, () -> authorizer.authorize("ticket-1", "template-1"));
|
assertNull(tenants.currentTenant);
|
}
|
|
@Test
|
public void attachmentMustContainExactlyOneDocx() {
|
RecordingTenantRoute tenants = new RecordingTenantRoute(new ArrayList<>());
|
ElnTemplateVersionEntity template = template("tenant-a", "template-1", "file-1", "DRAFT", "enabled");
|
template.setMubanFile("[{\"fileId\":\"file-1\",\"fileExtension\":\"docx\"},"
|
+ "{\"fileId\":\"file-2\",\"fileExtension\":\"DOCX\"}]");
|
TemplateAnnotationAuthorizer authorizer = authorizer(validPayload(), template, true, tenants,
|
new ArrayList<>());
|
|
assertStatus(409, () -> authorizer.authorize("ticket-1", "template-1"));
|
assertNull(tenants.currentTenant);
|
}
|
|
@Test
|
public void templateMustRemainDraftAndEnabled() {
|
RecordingTenantRoute tenants = new RecordingTenantRoute(new ArrayList<>());
|
assertStatus(409, () -> authorizer(validPayload(),
|
template("tenant-a", "template-1", "file-1", "PUBLISHED", "enabled"), true, tenants,
|
new ArrayList<>()).authorize("ticket-1", "template-1"));
|
assertStatus(409, () -> authorizer(validPayload(),
|
template("tenant-a", "template-1", "file-1", "DRAFT", "disabled"), true, tenants,
|
new ArrayList<>()).authorize("ticket-1", "template-1"));
|
assertNull(tenants.currentTenant);
|
}
|
|
@Test
|
public void deletedTemplateCannotBeAnnotated() {
|
RecordingTenantRoute tenants = new RecordingTenantRoute(new ArrayList<>());
|
ElnTemplateVersionEntity template = template("tenant-a", "template-1", "file-1", "DRAFT", "enabled");
|
template.setFDeleteMark(1);
|
|
assertStatus(409, () -> authorizer(validPayload(), template, true, tenants,
|
new ArrayList<>()).authorize("ticket-1", "template-1"));
|
assertNull(tenants.currentTenant);
|
}
|
|
@Test
|
public void revokedAnnotationAccessIsForbidden() {
|
RecordingTenantRoute tenants = new RecordingTenantRoute(new ArrayList<>());
|
ElnTemplateVersionEntity template = template("tenant-a", "template-1", "file-1", "DRAFT", "enabled");
|
assertStatus(403, () -> authorizer(validPayload(), template, false, tenants,
|
new ArrayList<>()).authorize("ticket-1", "template-1"));
|
assertNull(tenants.currentTenant);
|
}
|
|
@Test
|
public void malformedTicketAlsoClearsExistingTenantContext() {
|
List<String> events = new ArrayList<>();
|
RecordingTenantRoute tenants = new RecordingTenantRoute(events);
|
tenants.currentTenant = "stale-tenant";
|
TemplateAnnotationAuthorizer authorizer = new TemplateAnnotationAuthorizer(
|
new TemplateAnnotationTicketService(ticket -> null), templateId -> null,
|
(tenantId, userId, templateId, fileId) -> true, tenants);
|
|
assertStatus(401, () -> authorizer.authorize("expired", "template-1"));
|
|
assertNull(tenants.currentTenant);
|
assertEquals(Arrays.asList("clear"), events);
|
}
|
|
private TemplateAnnotationAuthorizer authorizer(Map<String, String> payload,
|
ElnTemplateVersionEntity template,
|
boolean allowed,
|
RecordingTenantRoute tenants,
|
List<String> events) {
|
return new TemplateAnnotationAuthorizer(ticketService(payload), templateId -> {
|
events.add("lookup:" + tenants.currentTenant + ":" + templateId);
|
return template;
|
}, (tenantId, userId, templateId, fileId) -> {
|
events.add("access:" + tenantId + ":" + userId + ":" + templateId + ":" + fileId);
|
return allowed;
|
}, tenants);
|
}
|
|
private TemplateAnnotationTicketService ticketService(Map<String, String> payload) {
|
return new TemplateAnnotationTicketService(ticket -> JsonUtil.getObjectToString(payload));
|
}
|
|
private ElnTemplateVersionEntity template(String tenantId, String templateId, String fileId,
|
String status, String enabled) {
|
ElnTemplateVersionEntity template = new ElnTemplateVersionEntity();
|
template.setFTenantId(tenantId);
|
template.setId(templateId);
|
template.setMubanFile("[{\"fileId\":\"" + fileId + "\",\"fileExtension\":\"docx\"}]");
|
template.setBizStatus(status);
|
template.setBizEnabled(enabled);
|
return template;
|
}
|
|
private Map<String, String> validPayload() {
|
return validPayload("tenant-a", "template-1", "file-1");
|
}
|
|
private Map<String, String> validPayload(String tenantId, String templateId, String fileId) {
|
Map<String, String> payload = new LinkedHashMap<>();
|
payload.put("scope", "onlyoffice:eln-template-annotate");
|
payload.put("tenantId", tenantId);
|
payload.put("userId", "user-1");
|
payload.put("fileId", fileId);
|
payload.put("bizDataId", templateId);
|
payload.put("bizModule", "eln.template");
|
payload.put("bizScene", "eln.template.annotate");
|
payload.put("pluginGuid", "asc.{2D6D6CB6-F6FC-45B7-8EC7-0CC1940F1A6F}");
|
return payload;
|
}
|
|
private void assertStatus(int expected, ThrowingRunnable operation) {
|
try {
|
operation.run();
|
fail("expected authorization failure");
|
} catch (TemplateAnnotationTicketService.InvalidAnnotationTicketException e) {
|
assertEquals(expected, e.getStatus());
|
} catch (TemplateAnnotationAuthorizer.AnnotationAuthorizationException e) {
|
assertEquals(expected, e.getStatus());
|
assertFalse(e.getMessage().contains("module-template"));
|
assertFalse(e.getMessage().contains("tenant-a"));
|
}
|
}
|
|
private interface ThrowingRunnable {
|
void run();
|
}
|
|
private static class RecordingTenantRoute implements TemplateAnnotationAuthorizer.TenantRoute {
|
private final List<String> events;
|
private final List<String> switchedTenants = new ArrayList<>();
|
private String currentTenant;
|
private boolean failSwitch;
|
private int clearCount;
|
|
private RecordingTenantRoute(List<String> events) {
|
this.events = events;
|
}
|
|
@Override
|
public void switchTo(String tenantId) {
|
events.add("switch:" + tenantId);
|
switchedTenants.add(tenantId);
|
if (failSwitch) {
|
throw new IllegalStateException("switch failed");
|
}
|
currentTenant = tenantId;
|
}
|
|
@Override
|
public void clear() {
|
events.add("clear");
|
clearCount++;
|
currentTenant = null;
|
}
|
}
|
}
|
