Examples with ACL hudson.security.ACL used on opensource projects

Example 6 with ACL

use of hudson.security.ACL in project blueocean-plugin by jenkinsci.

the class UserImplPermissionTest method useTestAgainstJenkinsRoot.

/**
 * Tests against jenkins
 */
@Test
public void useTestAgainstJenkinsRoot() {
    try {
        // https://github.com/powermock/powermock/issues/428
        OrganizationImpl baseOrg = new OrganizationImpl("jenkins", jenkins);
        UserImpl userImpl = new UserImpl(baseOrg, user, baseOrg);
        checkPermissions(userImpl.getPermission(), false, false);
        when(jenkins.getACL()).thenReturn(new ACL() {

            public boolean hasPermission(Authentication a, Permission permission) {
                return true;
            }
        });
        checkPermissions(userImpl.getPermission(), true, true);
    } catch (AssumptionViolatedException x) {
        System.err.println(x);
    }
}

Example 7 with ACL

use of hudson.security.ACL in project blueocean-plugin by jenkinsci.

the class UserImplPermissionTest method setup.

@Before
public void setup() throws IOException {
    testOrganization = new TestOrganization("org", "orgDisplayName");
    user = mock(User.class);
    when(user.getId()).thenReturn("some_user");
    authentication = new Authentication() {

        public String getName() {
            return "some_user";
        }

        public GrantedAuthority[] getAuthorities() {
            return null;
        }

        public Object getCredentials() {
            return null;
        }

        public Object getDetails() {
            return null;
        }

        public Object getPrincipal() {
            return null;
        }

        public boolean isAuthenticated() {
            return false;
        }

        public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException {
        }
    };
    jenkins = mock(Jenkins.class);
    when(jenkins.getACL()).thenReturn(new ACL() {

        public boolean hasPermission(Authentication a, Permission permission) {
            return false;
        }
    });
    mockStatic(Jenkins.class);
    when(Jenkins.getAuthentication()).thenReturn(authentication);
    when(Jenkins.get()).thenReturn(jenkins);
    try {
        // After Jenkins 2.77 hasPermission is no longer in Node.class and is not final so we need to mock it
        // prior to it is called as being final and mocking it will fail for the same reason.
        // TODO remove after core base line is >= 2.77
        Node.class.getDeclaredMethod("hasPermission", Permission.class);
    } catch (NoSuchMethodException e) {
        when(jenkins.hasPermission(Mockito.any())).thenAnswer(new Answer<Boolean>() {

            public Boolean answer(InvocationOnMock invocation) {
                Permission permission = invocation.getArgument(0);
                Jenkins j = (Jenkins) invocation.getMock();
                ACL acl = j.getACL();
                try {
                    return acl.hasPermission(permission);
                } catch (NullPointerException x) {
                    throw new AssumptionViolatedException("TODO cannot be made to work prior to Spring Security update", x);
                }
            }
        });
    }
    mockStatic(User.class);
    when(User.get("some_user", false, Collections.EMPTY_MAP)).thenReturn(user);
}

Example 8 with ACL

use of hudson.security.ACL in project blueocean-plugin by jenkinsci.

the class AbstractPipelineCreateRequestImpl method create.

@Nonnull
public TopLevelItem create(ModifiableTopLevelItemGroup parent, String name, String descriptorName, Class<? extends TopLevelItemDescriptor> descriptorClass) throws IOException {
    ACL acl = Jenkins.getInstance().getACL();
    Authentication a = Jenkins.getAuthentication();
    if (!acl.hasPermission(a, Item.CREATE)) {
        throw new ServiceException.ForbiddenException(String.format("Failed to create pipeline: %s. User %s doesn't have Job create permission", name, a.getName()));
    }
    TopLevelItemDescriptor descriptor = Items.all().findByName(descriptorName);
    if (descriptor == null || !(descriptorClass.isAssignableFrom(descriptor.getClass()))) {
        throw new ServiceException.BadRequestExpception(String.format("Failed to create pipeline: %s, descriptor %s is not found", name, descriptorName));
    }
    ItemGroup p = Jenkins.getInstance();
    if (!descriptor.isApplicableIn(p)) {
        throw new ServiceException.ForbiddenException(String.format("Failed to create pipeline: %s. pipeline can't be created in Jenkins root folder", name));
    }
    if (!acl.hasCreatePermission(a, p, descriptor)) {
        throw new ServiceException.ForbiddenException("Missing permission: " + Item.CREATE.group.title + "/" + Item.CREATE.name + Item.CREATE + "/" + descriptor.getDisplayName());
    }
    return parent.createProject(descriptor, name, true);
}

Example 9 with ACL

use of hudson.security.ACL in project blueocean-plugin by jenkinsci.

the class GithubPipelineUpdateRequest method update.

@Nonnull
@Override
public BluePipeline update(BluePipeline pipeline) throws IOException {
    ACL acl = Jenkins.getInstance().getACL();
    Authentication a = Jenkins.getAuthentication();
    if (!acl.hasPermission(a, Item.CONFIGURE)) {
        throw new ServiceException.ForbiddenException(String.format("Failed to update Git pipeline: %s. User %s doesn't have Job configure permission", pipeline.getName(), a.getName()));
    }
    User user = User.current();
    if (user == null) {
        throw new ServiceException.UnauthorizedException("User is not authenticated");
    }
    Item item = Jenkins.getInstance().getItemByFullName(pipeline.getFullName());
    if (item instanceof OrganizationFolder) {
        OrganizationFolder folder = (OrganizationFolder) item;
        GitHubSCMNavigator gitHubSCMNavigator = getNavigator(folder);
        if (gitHubSCMNavigator != null) {
            folder.getNavigators().replace(gitHubSCMNavigator);
            if (repos.size() == 1) {
                SCMSourceEvent.fireNow(new GithubPipelineCreateRequest.SCMSourceEventImpl(repos.get(0), item, gitHubSCMNavigator.getApiUri(), gitHubSCMNavigator));
            } else {
                folder.scheduleBuild(new Cause.UserIdCause());
            }
        }
    }
    return pipeline;
}

Example 10 with ACL

use of hudson.security.ACL in project blueocean-plugin by jenkinsci.

the class GitPipelineUpdateRequest method update.

@CheckForNull
@Override
@SuppressWarnings("unchecked")
public BluePipeline update(BluePipeline pipeline) throws IOException {
    Item item = Jenkins.getInstance().getItemByFullName(pipeline.getFullName());
    if (item instanceof MultiBranchProject) {
        ACL acl = Jenkins.getInstance().getACL();
        Authentication a = Jenkins.getAuthentication();
        if (!acl.hasPermission(a, Item.CONFIGURE)) {
            throw new ServiceException.ForbiddenException(String.format("Failed to update Git pipeline: %s. User %s doesn't have Job configure permission", pipeline.getName(), a.getName()));
        }
        MultiBranchProject mbp = (MultiBranchProject) item;
        BranchSource branchSource = getGitScmSource(mbp);
        if (branchSource != null) {
            mbp.getSourcesList().replaceBy(Collections.singleton(branchSource));
            mbp.scheduleBuild2(0, new CauseAction(new Cause.UserIdCause()));
        }
    }
    return pipeline;
}