diff --git a/source/java/org/alfresco/rest/api/impl/NodesImpl.java b/source/java/org/alfresco/rest/api/impl/NodesImpl.java index 7458eb6c44..16c026cbbb 100644 --- a/source/java/org/alfresco/rest/api/impl/NodesImpl.java +++ b/source/java/org/alfresco/rest/api/impl/NodesImpl.java @@ -2254,10 +2254,19 @@ public class NodesImpl implements Nodes accessStatus = AccessStatus.valueOf(nodePerm.getAccessStatus()); } - if ((authorityId == null) || - ((! authorityId.equals(PermissionService.ALL_AUTHORITIES) && (! authorityService.authorityExists(authorityId))))) + if (authorityId == null || authorityId.isEmpty()) { - throw new InvalidArgumentException("Cannot set permissions on this node - unknown authority: "+authorityId); + throw new InvalidArgumentException("Authority Id is expected."); + } + + if (permName == null || permName.isEmpty()) + { + throw new InvalidArgumentException("Permission name is expected."); + } + + if (((!authorityId.equals(PermissionService.ALL_AUTHORITIES) && (!authorityService.authorityExists(authorityId))))) + { + throw new InvalidArgumentException("Cannot set permissions on this node - unknown authority: " + authorityId); } AccessPermission existing = null; diff --git a/source/java/org/alfresco/rest/api/model/NodePermissions.java b/source/java/org/alfresco/rest/api/model/NodePermissions.java index ad37e4a9f4..afbc50f329 100644 --- a/source/java/org/alfresco/rest/api/model/NodePermissions.java +++ b/source/java/org/alfresco/rest/api/model/NodePermissions.java @@ -154,16 +154,17 @@ public class NodePermissions NodePermission that = (NodePermission) o; - if (!authorityId.equals(that.authorityId)) + if (authorityId != null ? !authorityId.equals(that.authorityId) : that.authorityId != null) return false; - return name.equals(that.name); + return name != null ? name.equals(that.name) : that.name == null; + } @Override public int hashCode() { - int result = authorityId.hashCode(); - result = 31 * result + name.hashCode(); + int result = authorityId != null ? authorityId.hashCode() : 0; + result = 31 * result + (name != null ? name.hashCode() : 0); return result; } } diff --git a/source/test-java/org/alfresco/rest/api/tests/NodeApiTest.java b/source/test-java/org/alfresco/rest/api/tests/NodeApiTest.java index f77d322d73..db5a0d374c 100644 --- a/source/test-java/org/alfresco/rest/api/tests/NodeApiTest.java +++ b/source/test-java/org/alfresco/rest/api/tests/NodeApiTest.java @@ -4255,6 +4255,9 @@ public class NodeApiTest extends AbstractSingleNetworkSiteTest testUpdatePermissionInvalidAccessStatus(); testUpdatePermissionAddDuplicate(); + // required permission properties missing + testUpdatePermissionMissingFields(); + // 'Permission Denied' tests testUpdatePermissionsPermissionDeniedUser(); testUpdatePermissionsOnSpecialNodes(); @@ -4438,6 +4441,42 @@ public class NodeApiTest extends AbstractSingleNetworkSiteTest put(URL_NODES, dId, toJsonAsStringNonNull(dUpdate), null, 400); } + /** + * Tests updating permissions on a node without providing mandatory + * properties + * + * @throws Exception + */ + private void testUpdatePermissionMissingFields() throws Exception + { + // create folder with an empty document + String postUrl = createFolder(); + String dId = createDocument(postUrl); + + // update permissions + Document dUpdate = new Document(); + // Add same permission with different access status + NodePermissions nodePermissions = new NodePermissions(); + List locallySetPermissions = new ArrayList<>(); + locallySetPermissions.add(new NodePermissions.NodePermission(null, PermissionService.CONSUMER, AccessStatus.ALLOWED.toString())); + nodePermissions.setLocallySet(locallySetPermissions); + dUpdate.setPermissions(nodePermissions); + + // "Authority Id is expected." + put(URL_NODES, dId, toJsonAsStringNonNull(dUpdate), null, 400); + locallySetPermissions.clear(); + locallySetPermissions.add(new NodePermissions.NodePermission("", PermissionService.CONSUMER, AccessStatus.ALLOWED.toString())); + put(URL_NODES, dId, toJsonAsStringNonNull(dUpdate), null, 400); + + locallySetPermissions.clear(); + locallySetPermissions.add(new NodePermissions.NodePermission(groupA, null, AccessStatus.ALLOWED.toString())); + // "Permission name is expected." + put(URL_NODES, dId, toJsonAsStringNonNull(dUpdate), null, 400); + locallySetPermissions.clear(); + locallySetPermissions.add(new NodePermissions.NodePermission(groupA, "", AccessStatus.ALLOWED.toString())); + put(URL_NODES, dId, toJsonAsStringNonNull(dUpdate), null, 400); + } + /** * Tests updating permissions on a node that user doesn't have permission for *