Examples with IAuthorizationPolicy org.pentaho.platform.api.engine.IAuthorizationPolicy used on opensource projects

Example 26 with IAuthorizationPolicy

use of org.pentaho.platform.api.engine.IAuthorizationPolicy in project pentaho-platform by pentaho.

the class FileServiceTest method testDoGetFileOrDirAsDownloadException.

@Test
public void testDoGetFileOrDirAsDownloadException() {
    // Test 1
    IAuthorizationPolicy mockAuthPolicy = mock(IAuthorizationPolicy.class);
    doReturn(false).when(mockAuthPolicy).isAllowed(anyString());
    doReturn(mockAuthPolicy).when(fileService).getPolicy();
    try {
        fileService.doGetFileOrDirAsDownload("", "mock:path:fileName", "true");
        fail();
    } catch (PentahoAccessControlException e) {
    // Expected
    } catch (Throwable t) {
        fail();
    }
    // Test 2
    doReturn(true).when(mockAuthPolicy).isAllowed(anyString());
    try {
        fileService.doGetFileOrDirAsDownload("", "", "true");
        fail();
    } catch (InvalidParameterException e) {
    // Expected
    } catch (Throwable e) {
        fail();
    }
    // Test 3
    doReturn(false).when(fileService).isPathValid(anyString());
    try {
        fileService.doGetFileOrDirAsDownload("", "mock:path:fileName", "true");
        fail();
    } catch (IllegalSelectorException e) {
    // Expected
    } catch (Throwable t) {
        fail();
    }
    /*
     * Test 4
     */
    doReturn(true).when(fileService).isPathValid(anyString());
    doReturn(null).when(fileService.repository).getFile(anyString());
    try {
        fileService.doGetFileOrDirAsDownload("", "mock:path:fileName", "true");
        fail();
    } catch (FileNotFoundException e) {
    // Expected
    } catch (Throwable t) {
    }
}

Example 27 with IAuthorizationPolicy

use of org.pentaho.platform.api.engine.IAuthorizationPolicy in project pentaho-platform by pentaho.

the class FileServiceTest method testDoGetFileAsInlineException.

@Test
public void testDoGetFileAsInlineException() {
    /*
     * TEST 1
     */
    doReturn(true).when(fileService).isPath(anyString());
    doReturn(false).when(fileService).isPathValid(anyString());
    try {
        fileService.doGetFileAsInline("test");
        fail();
    } catch (IllegalArgumentException e) {
    // Excpected
    } catch (FileNotFoundException e) {
        fail();
    }
    /*
     * TEST 2
     */
    doReturn(true).when(fileService).isPathValid(anyString());
    doReturn(null).when(fileService.repository).getFile(anyString());
    try {
        fileService.doGetFileAsInline("test");
        fail();
    } catch (FileNotFoundException e) {
    // Expected
    }
    /*
     * TEST 3
     */
    RepositoryFile mockFile = mock(RepositoryFile.class);
    doReturn(mockFile).when(fileService.repository).getFile(anyString());
    RepositoryDownloadWhitelist mockWhiteList = mock(RepositoryDownloadWhitelist.class);
    doReturn(mockWhiteList).when(fileService).getWhitelist();
    doReturn(false).when(mockWhiteList).accept(anyString());
    IAuthorizationPolicy mockPolicy = mock(IAuthorizationPolicy.class);
    doReturn(mockPolicy).when(fileService).getPolicy();
    doReturn(false).when(mockPolicy).isAllowed(anyString());
    try {
        fileService.doGetFileAsInline("test");
        fail();
    } catch (IllegalArgumentException e) {
    // Excpected
    } catch (FileNotFoundException e) {
        fail();
    }
    /*
     * TEST 4
     */
    doReturn(true).when(mockWhiteList).accept(anyString());
    doThrow(new InternalError()).when(fileService.repository).getDataForRead(any(Serializable.class), any(Class.class));
    try {
        fileService.doGetFileAsInline("test");
        fail();
    } catch (InternalError e) {
    // Excpected
    } catch (FileNotFoundException e) {
        fail();
    }
}

Example 28 with IAuthorizationPolicy

use of org.pentaho.platform.api.engine.IAuthorizationPolicy in project pentaho-platform by pentaho.

the class FileServiceTest method assertDoGetFileOrDirAsDownload.

/**
 * @param fileName
 * @param withManifest
 * @param expectedEncodedFileName
 * @param expectedFileName
 * @throws Throwable
 */
public void assertDoGetFileOrDirAsDownload(final String fileName, final String withManifest, final String expectedEncodedFileName, final String expectedFileName) throws Throwable {
    IAuthorizationPolicy mockAuthPolicy = mock(IAuthorizationPolicy.class);
    when(mockAuthPolicy.isAllowed(anyString())).thenReturn(true);
    BaseExportProcessor mockExportProcessor = mock(BaseExportProcessor.class);
    File mockExportFile = mock(File.class);
    ExportHandler mockExportHandler = mock(ExportHandler.class);
    StreamingOutput mockStream = mock(StreamingOutput.class);
    RepositoryFile mockRepoFile = mock(RepositoryFile.class);
    doReturn(fileName).when(mockRepoFile).getName();
    doReturn(mockExportFile).when(mockExportProcessor).performExport(mockRepoFile);
    doReturn(mockRepoFile).when(fileService.repository).getFile(anyString());
    doReturn(mockAuthPolicy).when(fileService).getPolicy();
    doReturn(mockExportProcessor).when(fileService).getDownloadExportProcessor(anyString(), anyBoolean(), anyBoolean());
    doReturn(mockExportHandler).when(fileService).getDownloadExportHandler();
    doReturn(mockStream).when(fileService).getDownloadStream(mockRepoFile, mockExportProcessor);
    FileService.DownloadFileWrapper wrapper = fileService.doGetFileOrDirAsDownload("", "mock:path:" + fileName, withManifest);
    verify(fileService.repository, times(1)).getFile(anyString());
    ArgumentCaptor<String> captor = ArgumentCaptor.forClass(String.class);
    verify(mockAuthPolicy, times(3)).isAllowed(captor.capture());
    assertTrue(captor.getAllValues().contains(RepositoryReadAction.NAME));
    assertTrue(captor.getAllValues().contains(RepositoryCreateAction.NAME));
    assertEquals(mockStream, wrapper.getOutputStream());
    assertEquals(expectedEncodedFileName, wrapper.getEncodedFileName());
    assertEquals("attachment; filename=\"" + expectedFileName + "\"", wrapper.getAttachment());
}

Example 29 with IAuthorizationPolicy

use of org.pentaho.platform.api.engine.IAuthorizationPolicy in project pentaho-platform by pentaho.

the class FileServiceTest method testDoGetFileOrDirAsDownloadNonAdminUserHomeFolder.

@Test
public void testDoGetFileOrDirAsDownloadNonAdminUserHomeFolder() throws Throwable {
    IAuthorizationPolicy mockAuthPolicy = mock(IAuthorizationPolicy.class);
    doReturn(true).when(mockAuthPolicy).isAllowed(RepositoryReadAction.NAME);
    /* user has 'Read Content' */
    doReturn(true).when(mockAuthPolicy).isAllowed(RepositoryCreateAction.NAME);
    /* user has 'Create Content' */
    /* non-admin user */
    doReturn(false).when(mockAuthPolicy).isAllowed(AdministerSecurityAction.NAME);
    doReturn(mockAuthPolicy).when(fileService).getPolicy();
    // Test 1: in the home-folder
    try {
        fileService.doGetFileOrDirAsDownload("", "home:testUser:test_file", "true");
        fail();
    } catch (FileNotFoundException ex) {
    /* expected; this is a mock test, we don't actually have a 'test_file' to download :) */
    } catch (Throwable t) {
        fail();
    }
    // Test 2: in some home-folder sub-folders
    try {
        fileService.doGetFileOrDirAsDownload("", "home:testUser:subFolder1:subFolder2:test_file", "true");
        fail();
    } catch (FileNotFoundException ex) {
    /* expected; this is a mock test, we don't actually have a 'test_file' to download :) */
    } catch (Throwable t) {
        fail();
    }
    // Test 3: while still being on the user's home folder, user loses 'Read Content' permission
    try {
        doReturn(false).when(mockAuthPolicy).isAllowed(RepositoryReadAction.NAME);
        fileService.doGetFileOrDirAsDownload("", "home:testUser:test_file", "true");
        fail();
    } catch (PentahoAccessControlException e) {
    /* expected */
    } catch (Throwable t) {
        fail();
    } finally {
        doReturn(true).when(mockAuthPolicy).isAllowed(RepositoryReadAction.NAME);
    }
    // Test 4: while still being on the user's home folder, user loses 'Create Content' permission
    try {
        doReturn(false).when(mockAuthPolicy).isAllowed(RepositoryCreateAction.NAME);
        fileService.doGetFileOrDirAsDownload("", "home:testUser:test_file", "true");
        fail();
    } catch (PentahoAccessControlException e) {
    /* expected */
    } catch (Throwable t) {
        fail();
    } finally {
        doReturn(true).when(mockAuthPolicy).isAllowed(RepositoryCreateAction.NAME);
    }
}

Example 30 with IAuthorizationPolicy

use of org.pentaho.platform.api.engine.IAuthorizationPolicy in project pentaho-platform by pentaho.

the class PasswordResourceTest method testMustHaveAdminAccess.

@Test
public void testMustHaveAdminAccess() throws Exception {
    final IAuthorizationPolicy policy = Mockito.mock(IAuthorizationPolicy.class);
    PasswordResource resource = getPasswordResource(policy);
    Mockito.when(policy.isAllowed(AdministerSecurityAction.NAME)).thenReturn(false);
    Response response = resource.encryptPassword("password");
    Assert.assertEquals(401, response.getStatus());
    Assert.assertEquals(401, resource.encryptionForm().getStatus());
}