modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/authz/AuthorizationManagerLocal.java
| 9 ++
modules/enterprise/server/jar/src/test/java/org/rhq/enterprise/server/authz/test/AuthorizationManagerBeanTest.java
| 34 ++++++++++
2 files changed, 43 insertions(+)
New commits:
commit f3b48e0c748335dfb3f170b7ab31264d5f17842e
Author: John Sanda <jsanda(a)redhat.com>
Date: Mon Mar 29 16:00:26 2010 -0400
[BZ 573983] Adding javadocs and another test for a scenario in which resources span
multiple groups
diff --git
a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/authz/AuthorizationManagerLocal.java
b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/authz/AuthorizationManagerLocal.java
index ce8ad68..8efe3c7 100644
---
a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/authz/AuthorizationManagerLocal.java
+++
b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/authz/AuthorizationManagerLocal.java
@@ -45,6 +45,15 @@ public interface AuthorizationManagerLocal {
*/
boolean canViewResource(Subject subject, int resourceId);
+ /**
+ * Returns true if the current user has a role attached to a group that contains the
specified resources. Note that
+ * this method will return true if the resources span multiple groups so long has the
user is in one or more roles
+ * granting view permission for those groups containing the resources.
+ *
+ * @param subject The current subject or caller
+ * @param resourceIds The resource ids against which we are checking whether the
subject has access
+ * @return true only if the subject has a role attached to a group that contains all
of the specified resources
+ */
boolean canViewResources(Subject subject, List<Integer> resourceIds);
/**
diff --git
a/modules/enterprise/server/jar/src/test/java/org/rhq/enterprise/server/authz/test/AuthorizationManagerBeanTest.java
b/modules/enterprise/server/jar/src/test/java/org/rhq/enterprise/server/authz/test/AuthorizationManagerBeanTest.java
index 4ce5e6e..a663b72 100644
---
a/modules/enterprise/server/jar/src/test/java/org/rhq/enterprise/server/authz/test/AuthorizationManagerBeanTest.java
+++
b/modules/enterprise/server/jar/src/test/java/org/rhq/enterprise/server/authz/test/AuthorizationManagerBeanTest.java
@@ -406,6 +406,40 @@ public class AuthorizationManagerBeanTest extends AbstractEJB3Test {
}
@Test
+ public void
testCanViewResourceWhenSubjectIsInMultipleRolesAndResourcesInMultipleGroups() throws
Exception {
+ getTransactionManager().begin();
+ EntityManager entityMgr = getEntityManager();
+
+ try {
+ Subject subject = SessionTestHelper.createNewSubject(entityMgr,
"testSubject");
+
+ Role role1 = SessionTestHelper.createNewRoleForSubject(entityMgr, subject,
"role1");
+ role1.addPermission(Permission.VIEW_RESOURCE);
+
+ Role role2 = SessionTestHelper.createNewRoleForSubject(entityMgr, subject,
"role2");
+ role2.addPermission(Permission.VIEW_RESOURCE);
+
+ ResourceGroup group1 =
SessionTestHelper.createNewCompatibleGroupForRole(entityMgr, role1, "group 1");
+ ResourceGroup group2 =
SessionTestHelper.createNewCompatibleGroupForRole(entityMgr, role2, "group 2");
+
+ Resource r1 = SessionTestHelper.createNewResourceForGroup(entityMgr, group1,
"r1");
+ Resource r2 = SessionTestHelper.createNewResourceForGroup(entityMgr, group2,
"r2");
+
+ entityMgr.flush();
+
+ List<Integer> resourceIds = Arrays.asList(r1.getId(), r2.getId());
+
+ assertTrue(
+ "The subject should have permission to view the resources in
different groups since the subject is in roles for those groups",
+ authorizationManager.canViewResources(subject, resourceIds)
+ );
+ }
+ finally {
+ getTransactionManager().rollback();
+ }
+ }
+
+ @Test
public void testCanViewResourcesWhenSubjectIsNotInRole() throws Exception {
getTransactionManager().begin();
EntityManager entityMgr = getEntityManager();
Show replies by date