Examples with ChangeSpec com.yahoo.elide.core.security.ChangeSpec used on opensource projects

Example 1 with ChangeSpec

use of com.yahoo.elide.core.security.ChangeSpec in project elide by yahoo.

the class LifeCycleTest method testRemoveFromCollectionTrigger.

@Test
public void testRemoveFromCollectionTrigger() {
    PropertyTestModel mockModel = mock(PropertyTestModel.class);
    DataStoreTransaction tx = mock(DataStoreTransaction.class);
    RequestScope scope = buildRequestScope(dictionary, tx);
    when(tx.createNewObject(ClassType.of(PropertyTestModel.class), scope)).thenReturn(mockModel);
    PropertyTestModel childModel1 = mock(PropertyTestModel.class);
    PropertyTestModel childModel2 = mock(PropertyTestModel.class);
    PropertyTestModel childModel3 = mock(PropertyTestModel.class);
    when(childModel1.getId()).thenReturn("2");
    when(childModel2.getId()).thenReturn("3");
    when(childModel3.getId()).thenReturn("4");
    // First we test removing from a newly created object.
    PersistentResource resource = PersistentResource.createObject(ClassType.of(PropertyTestModel.class), scope, Optional.of("1"));
    PersistentResource childResource1 = new PersistentResource(childModel1, "2", scope);
    PersistentResource childResource2 = new PersistentResource(childModel2, "3", scope);
    PersistentResource childResource3 = new PersistentResource(childModel3, "3", scope);
    resource.updateRelation("models", new HashSet<>(Arrays.asList(childResource1, childResource2)));
    scope.runQueuedPreSecurityTriggers();
    scope.runQueuedPreCommitTriggers();
    scope.runQueuedPostCommitTriggers();
    verify(mockModel, never()).relationCallback(eq(UPDATE), any(), any());
    ArgumentCaptor<ChangeSpec> changes = ArgumentCaptor.forClass(ChangeSpec.class);
    verify(mockModel, times(1)).relationCallback(eq(CREATE), eq(POSTCOMMIT), changes.capture());
    changes.getValue().getModified().equals(List.of(childModel1, childModel2));
    changes.getValue().getOriginal().equals(List.of());
    // Build another resource, scope & reset the mock to do a pure update (no create):
    scope = buildRequestScope(dictionary, tx);
    resource = new PersistentResource(mockModel, scope.getUUIDFor(mockModel), scope);
    reset(mockModel);
    Relationship relationship = Relationship.builder().projection(EntityProjection.builder().type(PropertyTestModel.class).build()).name("models").build();
    when(tx.getToManyRelation(tx, mockModel, relationship, scope)).thenReturn(new DataStoreIterableBuilder<Object>(Arrays.asList(childModel1, childModel2)).build());
    when(mockModel.getModels()).thenReturn(new HashSet<>(Arrays.asList(childModel1, childModel2)));
    resource.updateRelation("models", new HashSet<>(Arrays.asList(childResource1, childResource3)));
    scope.runQueuedPreSecurityTriggers();
    scope.runQueuedPreCommitTriggers();
    scope.runQueuedPostCommitTriggers();
    verify(mockModel, never()).relationCallback(eq(CREATE), any(), any());
    changes = ArgumentCaptor.forClass(ChangeSpec.class);
    verify(mockModel, times(1)).relationCallback(eq(UPDATE), eq(POSTCOMMIT), changes.capture());
    changes.getValue().getModified().equals(List.of(childModel1, childModel3));
    changes.getValue().getOriginal().equals(List.of(childModel1, childModel2));
}

Example 2 with ChangeSpec

use of com.yahoo.elide.core.security.ChangeSpec in project elide by yahoo.

the class PermissionExpressionBuilderTest method testSpecificFieldExpressionText.

@Test
public void testSpecificFieldExpressionText() {
    @Entity
    @Include(rootLevel = false)
    @UpdatePermission(expression = "user has no access")
    class Model {

        @Id
        private long id;

        @UpdatePermission(expression = "user has all access OR user has no access")
        private int foo;
    }
    dictionary.bindEntity(Model.class);
    PersistentResource resource = newResource(new Model(), Model.class);
    ChangeSpec changes = new ChangeSpec(resource, "foo", 1, 2);
    Expression expression = builder.buildSpecificFieldExpressions(resource, UpdatePermission.class, "foo", changes);
    assertEquals("UPDATE PERMISSION WAS INVOKED ON PersistentResource{type=model, id=0} WITH CHANGES ChangeSpec { " + "resource=PersistentResource{type=model, id=0}, field=foo, original=1, modified=2} " + "FOR EXPRESSION [FIELD(((user has all access " + "\u001B[34mWAS UNEVALUATED\u001B[m)) OR ((user has no access " + "\u001B[34mWAS UNEVALUATED\u001B[m)))]", expression.toString());
    expression.evaluate(Expression.EvaluationMode.ALL_CHECKS);
    assertEquals("UPDATE PERMISSION WAS INVOKED ON PersistentResource{type=model, id=0} WITH CHANGES ChangeSpec { " + "resource=PersistentResource{type=model, id=0}, field=foo, original=1, modified=2} " + "FOR EXPRESSION [FIELD(((user has all access " + "\u001B[32mPASSED\u001B[m)) OR ((user has no access " + "\u001B[34mWAS UNEVALUATED\u001B[m)))]", expression.toString());
}

Example 3 with ChangeSpec

use of com.yahoo.elide.core.security.ChangeSpec in project elide by yahoo.

the class PersistentResourceTest method testClassLevelAudit.

@Test
public void testClassLevelAudit() throws Exception {
    Child child = newChild(5);
    Parent parent = newParent(7);
    TestAuditLogger logger = new TestAuditLogger();
    RequestScope requestScope = getUserScope(goodUser, logger);
    PersistentResource<Parent> parentResource = new PersistentResource<>(parent, requestScope.getUUIDFor(parent), requestScope);
    PersistentResource<Child> childResource = new PersistentResource<>(child, parentResource, "children", requestScope.getUUIDFor(child), requestScope);
    childResource.auditClass(Audit.Action.CREATE, new ChangeSpec(childResource, null, null, childResource.getObject()));
    assertEquals(1, logger.getMessages().size(), "One message should be logged");
    LogMessage message = logger.getMessages().get(0);
    assertEquals("CREATE Child 5 Parent 7", message.getMessage(), "Logging template should match");
    assertEquals(0, message.getOperationCode(), "Operation code should match");
    // tidy up this thread's messages
    logger.clear();
}

Example 4 with ChangeSpec

use of com.yahoo.elide.core.security.ChangeSpec in project elide by yahoo.

the class PersistentResourceTest method testFieldLevelAudit.

@Test
public void testFieldLevelAudit() throws Exception {
    Child child = newChild(5);
    Parent parent = newParent(7);
    TestAuditLogger logger = new TestAuditLogger();
    RequestScope requestScope = getUserScope(goodUser, logger);
    PersistentResource<Parent> parentResource = new PersistentResource<>(parent, requestScope.getUUIDFor(parent), requestScope);
    PersistentResource<Child> childResource = new PersistentResource<>(child, parentResource, "children", requestScope.getUUIDFor(child), requestScope);
    childResource.auditField(new ChangeSpec(childResource, "name", parent, null));
    assertEquals(1, logger.getMessages().size(), "One message should be logged");
    LogMessage message = logger.getMessages().get(0);
    assertEquals("UPDATE Child 5 Parent 7", message.getMessage(), "Logging template should match");
    assertEquals(1, message.getOperationCode(), "Operation code should match");
    // tidy up this thread's messages
    logger.clear();
}

Example 5 with ChangeSpec

use of com.yahoo.elide.core.security.ChangeSpec in project elide by yahoo.

the class PersistentResource method deleteResource.

/**
 * Delete an existing entity.
 *
 * @throws ForbiddenAccessException the forbidden access exception
 */
public void deleteResource() throws ForbiddenAccessException {
    checkPermission(DeletePermission.class, this);
    /*
         * Search for bidirectional relationships.  For each bidirectional relationship,
         * we need to remove ourselves from that relationship
         */
    Type<?> resourceClass = getResourceType();
    List<String> relationships = dictionary.getRelationships(resourceClass);
    for (String relationName : relationships) {
        /* Skip updating inverse relationships for deletes which are cascaded */
        if (dictionary.cascadeDeletes(resourceClass, relationName)) {
            continue;
        }
        String inverseRelationName = dictionary.getRelationInverse(resourceClass, relationName);
        if (!"".equals(inverseRelationName)) {
            for (PersistentResource inverseResource : getRelationUncheckedUnfiltered(relationName).toList().blockingGet()) {
                if (hasInverseRelation(relationName)) {
                    deleteInverseRelation(relationName, inverseResource.getObject());
                    inverseResource.markDirty();
                }
            }
        }
    }
    transaction.delete(getObject(), requestScope);
    auditClass(Audit.Action.DELETE, new ChangeSpec(this, null, getObject(), null));
    requestScope.publishLifecycleEvent(this, DELETE);
    requestScope.getDeletedResources().add(this);
}