Examples with UpdatePermission com.yahoo.elide.annotation.UpdatePermission used on opensource projects

Example 6 with UpdatePermission

use of com.yahoo.elide.annotation.UpdatePermission in project elide by yahoo.

the class PermissionExecutorTest method testFailOperationCheckAll.

@Test
public void testFailOperationCheckAll() throws Exception {
    @Entity
    @Include(rootLevel = false)
    @UpdatePermission(expression = "sampleOperation AND Prefab.Role.None")
    class Model implements SampleOperationModel {
    }
    PersistentResource resource = newResource(new Model(), Model.class, false);
    RequestScope requestScope = resource.getRequestScope();
    assertThrows(ForbiddenAccessException.class, () -> requestScope.getPermissionExecutor().checkPermission(UpdatePermission.class, resource));
}

Example 7 with UpdatePermission

use of com.yahoo.elide.annotation.UpdatePermission in project elide by yahoo.

the class JsonApiModelResolver method getUpdatePermission.

/**
 * Get the calculated {@link UpdatePermission} value for the field.
 *
 * @param clazz the entity class
 * @param fieldName the field
 * @return the update permissions for a field
 */
protected String getUpdatePermission(Type<?> clazz, String fieldName) {
    UpdatePermission classPermission = dictionary.getAnnotation(clazz, UpdatePermission.class);
    UpdatePermission fieldPermission = dictionary.getAttributeOrRelationAnnotation(clazz, UpdatePermission.class, fieldName);
    if (fieldPermission != null) {
        return fieldPermission.expression();
    }
    if (classPermission != null) {
        return classPermission.expression();
    }
    return null;
}

Example 8 with UpdatePermission

use of com.yahoo.elide.annotation.UpdatePermission in project elide by yahoo.

the class PermissionExecutorTest method testSuccessfulCommitChecks.

@Test
public void testSuccessfulCommitChecks() throws Exception {
    @Entity
    @Include(rootLevel = false)
    @UpdatePermission(expression = "sampleOperation")
    class Model implements SampleOperationModel {
    }
    PersistentResource resource = newResource(new Model(), Model.class, true);
    RequestScope requestScope = resource.getRequestScope();
    // Because the object is newly created, the check is DEFERRED.
    assertEquals(ExpressionResult.DEFERRED, requestScope.getPermissionExecutor().checkPermission(UpdatePermission.class, resource, ALL_FIELDS));
    requestScope.getPermissionExecutor().executeCommitChecks();
}

Example 9 with UpdatePermission

use of com.yahoo.elide.annotation.UpdatePermission in project elide by yahoo.

the class PermissionExecutorTest method testFailAllFieldAwareSuccessOperationFailCommit.

@Test
public void testFailAllFieldAwareSuccessOperationFailCommit() {
    @Entity
    @Include(rootLevel = false)
    @UpdatePermission(expression = "Prefab.Role.None")
    class Model {

        @Id
        public Long id;

        @UpdatePermission(expression = "Prefab.Role.All AND FailOp")
        public String field = "some data";
    }
    PersistentResource resource = newResource(new Model(), Model.class, true);
    RequestScope requestScope = resource.getRequestScope();
    assertEquals(ExpressionResult.DEFERRED, requestScope.getPermissionExecutor().checkPermission(UpdatePermission.class, resource));
    assertThrows(ForbiddenAccessException.class, () -> requestScope.getPermissionExecutor().executeCommitChecks());
}

Example 10 with UpdatePermission

use of com.yahoo.elide.annotation.UpdatePermission in project elide by yahoo.

the class PermissionExecutorTest method testPassAnyFieldAwareFailOperationSuccessCommit.

@Test
public void testPassAnyFieldAwareFailOperationSuccessCommit() {
    @Entity
    @Include(rootLevel = false)
    @UpdatePermission(expression = "Prefab.Role.None AND passingOp")
    class Model {

        @Id
        public Long id;

        @UpdatePermission(expression = "Prefab.Role.None OR passingOp")
        public String field = "some data";
    }
    PersistentResource resource = newResource(new Model(), Model.class, true);
    RequestScope requestScope = resource.getRequestScope();
    assertEquals(ExpressionResult.DEFERRED, requestScope.getPermissionExecutor().checkPermission(UpdatePermission.class, resource));
    requestScope.getPermissionExecutor().executeCommitChecks();
}