Examples with Permission com.aws.greengrass.authorization.Permission used on opensource projects

Example 21 with Permission

use of com.aws.greengrass.authorization.Permission in project aws-greengrass-nucleus by aws-greengrass.

the class LifecycleIPCEventStreamAgentTest method GIVEN_pause_component_request_WHEN_unauthorized_THEN_return_auth_error.

@Test
@EnabledOnOs(OS.LINUX)
void GIVEN_pause_component_request_WHEN_unauthorized_THEN_return_auth_error() throws AuthorizationException, ServiceException {
    when(authorizationHandler.isAuthorized(any(), any())).thenThrow(new AuthorizationException("Unauthorized"));
    PauseComponentRequest request = new PauseComponentRequest();
    request.setComponentName(TEST_TARGET_COMPONENT);
    assertThrows(UnauthorizedError.class, () -> lifecycleIPCEventStreamAgent.getPauseComponentHandler(mockContext).handleRequest(request));
    ArgumentCaptor<Permission> permissionArg = ArgumentCaptor.forClass(Permission.class);
    verify(authorizationHandler).isAuthorized(eq(LIFECYCLE_SERVICE_NAME), permissionArg.capture());
    Permission permission = permissionArg.getValue();
    assertThat(permission.getOperation(), is(GreengrassCoreIPCService.PAUSE_COMPONENT));
    assertThat(permission.getPrincipal(), is(TEST_SERVICE));
    assertThat(permission.getResource(), is(TEST_TARGET_COMPONENT));
    verify(kernel, never()).locate(TEST_TARGET_COMPONENT);
    verify(targetComponent, never()).getState();
    verify(targetComponent, never()).pause();
}

Example 22 with Permission

use of com.aws.greengrass.authorization.Permission in project aws-greengrass-nucleus by aws-greengrass.

the class IPCPubSubRemovalTest method GIVEN_pubsubclient_WHEN_authorized_THEN_ACL_parameter_removed_via_deployment_THEN_updates.

@Test
void GIVEN_pubsubclient_WHEN_authorized_THEN_ACL_parameter_removed_via_deployment_THEN_updates(ExtensionContext context) throws Exception {
    try (EventStreamRPCConnection connection = IPCTestUtils.getEventStreamRpcConnection(kernel, "SubscribeAndPublish")) {
        GreengrassCoreIPCClient ipcClient = new GreengrassCoreIPCClient(connection);
        Permission policyId1 = Permission.builder().principal("SubscribeAndPublish").operation("*").resource("*").build();
        Permission policyId2 = Permission.builder().principal("PublishNotSubscribe").operation("aws.greengrass#PublishToTopic").resource("*").build();
        assertTrue(kernel.getContext().get(AuthorizationModule.class).isPresent(PUB_SUB_SERVICE_NAME, policyId1));
        assertTrue(kernel.getContext().get(AuthorizationModule.class).isPresent(PUB_SUB_SERVICE_NAME, policyId2));
        assertTrue(kernel.getContext().get(AuthorizationModule.class).isPresent(TOKEN_EXCHANGE_SERVICE_TOPICS, TES_DEFAULT_POLICY));
        Pair<CompletableFuture<Void>, Consumer<byte[]>> cb = asyncAssertOnConsumer((m) -> {
            assertEquals("some message", new String(m, StandardCharsets.UTF_8));
        });
        // this should succeed
        subscribeToTopicOveripcForBinaryMessages(ipcClient, "a", cb.getRight());
        publishToTopicOverIpcAsBinaryMessage(ipcClient, "a", "some message");
        cb.getLeft().get(TIMEOUT_FOR_PUBSUB_SECONDS, TimeUnit.SECONDS);
        ignoreExceptionOfType(context, PackageDownloadException.class);
        // Remove ACL parameter from component SubscribeAndPublish
        Topics aclNode = kernel.getConfig().lookupTopics(SERVICES_NAMESPACE_TOPIC, "SubscribeAndPublish", CONFIGURATION_CONFIG_KEY);
        aclNode.remove(aclNode.lookupTopics("accessControl"));
        kernel.getContext().waitForPublishQueueToClear();
        assertFalse(kernel.getContext().get(AuthorizationModule.class).isPresent(PUB_SUB_SERVICE_NAME, policyId1));
        // GG_NEEDS_REVIEW: TODO: convert all these integ tests to use only recipe merging instead of loading a kernel config file
        // Otherwise the removal of "SubscribeAndPublish" also inadvertently results in the "PublishNotSubscribe"
        // component (and all other components) and its policies being removed, since it is not part of the deployment.
        // Hence the next line is commented out
        // assertTrue(kernel.getContext().get(AuthorizationModule.class).isPresent(PUB_SUB_SERVICE_NAME,policyId2));
        assertTrue(kernel.getContext().get(AuthorizationModule.class).isPresent(TOKEN_EXCHANGE_SERVICE_TOPICS, TES_DEFAULT_POLICY));
        // Now the authorization policies should have been removed and these should fail
        ExecutionException ee = assertThrows(ExecutionException.class, () -> subscribeToTopicOveripcForBinaryMessages(ipcClient, "a", cb.getRight()));
        assertTrue(ee.getCause() instanceof UnauthorizedError);
        ExecutionException ee1 = assertThrows(ExecutionException.class, () -> publishToTopicOverIpcAsBinaryMessage(ipcClient, "a", "some message"));
        assertTrue(ee1.getCause() instanceof UnauthorizedError);
    }
}