RM-722 (REST API - Add and remove authorities from roles)

git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/modules/recordsmanagement/HEAD@50355 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261

rm-server/test/java/org/alfresco/module/org_alfresco_module_rm/test/webscript/RmAuthoritiesRestApiTest.java

@@ -20,10 +20,15 @@ package org.alfresco.module.org_alfresco_module_rm.test.webscript;
 
 import java.io.IOException;
 import java.io.UnsupportedEncodingException;
+import java.util.HashSet;
 import java.util.Set;
 
+import org.alfresco.module.org_alfresco_module_rm.capability.Capability;
+import org.alfresco.module.org_alfresco_module_rm.capability.RMPermissionModel;
 import org.alfresco.module.org_alfresco_module_rm.role.FilePlanRoleService;
 import org.alfresco.module.org_alfresco_module_rm.test.util.BaseRMWebScriptTestCase;
+import org.alfresco.repo.security.authentication.AuthenticationUtil;
+import org.alfresco.repo.transaction.RetryingTransactionHelper.RetryingTransactionCallback;
 import org.alfresco.service.cmr.repository.StoreRef;
 import org.alfresco.service.cmr.security.AuthorityType;
 import org.alfresco.util.GUID;
@@ -48,6 +53,82 @@ public class RmAuthoritiesRestApiTest extends BaseRMWebScriptTestCase
     /** Constant for the content type */
     private static final String APPLICATION_JSON = "application/json";
 
+    /** Constant for users and groups */
+    private static final String USER_WITH_CAPABILITY = GUID.generate();
+    private static final String USER_WITHOUT_CAPABILITY = GUID.generate();
+    private static final String ROLE_INCLUDING_CAPABILITY = GUID.generate();
+    private static final String ROLE_NOT_INCLUDING_CAPABILITY = GUID.generate();
+    private static final String USER_TO_ADD_TO_ROLE = GUID.generate();
+    private static final String GROUP_TO_ADD_TO_ROLE = GUID.generate();
+
+    /**
+     * @see org.alfresco.module.org_alfresco_module_rm.test.util.BaseRMWebScriptTestCase#setupTestData()
+     */
+    @Override
+    protected void setupTestData()
+    {
+        super.setupTestData();
+
+        retryingTransactionHelper.doInTransaction(new RetryingTransactionCallback<Object>()
+        {
+            @Override
+            public Object execute() throws Throwable
+            {
+                AuthenticationUtil.setFullyAuthenticatedUser(AuthenticationUtil.getSystemUserName());
+
+                // Create test user WITH required capability
+                createUser(USER_WITH_CAPABILITY);
+                // Create test role
+                Set<Capability> capabilities = new HashSet<Capability>(2);
+                capabilities.add(capabilityService.getCapability(RMPermissionModel.VIEW_RECORDS));
+                capabilities.add(capabilityService.getCapability(RMPermissionModel.CREATE_MODIFY_DESTROY_USERS_AND_GROUPS));
+                filePlanRoleService.createRole(filePlan, ROLE_INCLUDING_CAPABILITY, ROLE_INCLUDING_CAPABILITY, capabilities);
+                // Add user to the role
+                filePlanRoleService.assignRoleToAuthority(filePlan, ROLE_INCLUDING_CAPABILITY, USER_WITH_CAPABILITY);
+
+                // Create test user WITHOUT required capability
+                createUser(USER_WITHOUT_CAPABILITY);
+                // Create test role
+                filePlanRoleService.createRole(filePlan, ROLE_NOT_INCLUDING_CAPABILITY, ROLE_NOT_INCLUDING_CAPABILITY, new HashSet<Capability>(1));
+                // Add user to the role
+                filePlanRoleService.assignRoleToAuthority(filePlan, ROLE_NOT_INCLUDING_CAPABILITY, USER_WITHOUT_CAPABILITY);
+
+                // Create a test user to add to role
+                createUser(USER_TO_ADD_TO_ROLE);
+
+                // Create a group to add to role
+                createGroup(GROUP_TO_ADD_TO_ROLE);
+
+                return null;
+            }
+        });
+    }
+
+    /**
+     * @see org.alfresco.module.org_alfresco_module_rm.test.util.BaseRMWebScriptTestCase#tearDownImpl()
+     */
+    @Override
+    protected void tearDownImpl()
+    {
+        super.tearDownImpl();
+
+        // Delete test user WITH required capability
+        deleteUser(USER_WITH_CAPABILITY);
+        // Delete test role
+        filePlanRoleService.deleteRole(filePlan, ROLE_INCLUDING_CAPABILITY);
+
+        // Delete test user WITHOUT required capability
+        deleteUser(USER_WITHOUT_CAPABILITY);
+        // Add user to the role
+        filePlanRoleService.deleteRole(filePlan, ROLE_NOT_INCLUDING_CAPABILITY);
+
+        // Delete the user which was added to the role
+        deleteUser(getTestUserName());
+
+        // Delete the group which was added to the role
+        deleteGroup(getTestGroupName());
+    }
+
     /**
      * Test the REST API to add/remove a user to/from a role
      *
@@ -56,37 +137,33 @@ public class RmAuthoritiesRestApiTest extends BaseRMWebScriptTestCase
      */
     public void testRmAddRemoveUser() throws IOException, JSONException
     {
-        // Create a test user
+        // Do the positive test with a user with the needed capabilities
-        String userName = GUID.generate();
+        AuthenticationUtil.setFullyAuthenticatedUser(USER_WITH_CAPABILITY);
-        createUser(userName);
 
-        // Get the name
+        // Get the user name
-        String name = authorityService.getName(AuthorityType.USER, userName);
+        String userName = getTestUserName();
 
         // Check if the user is already assigned to the role
-        assertFalse(getUsersAssignedToRole().contains(name));
+        assertFalse(getUsersAssignedToRole().contains(userName));
 
-        // Format url and send request
+        // Format url, send the request and check the content
-        String url = getFormattedUrlString(name);
+        String url = getFormattedUrlString(userName);
-        Response response = postRequestSuccess(url);
+        checkContent(postRequestSuccess(url));
-
-        // Check the content from the response
-        checkContent(response);
 
         // The user should be added to the role
-        assertTrue(getUsersAssignedToRole().contains(name));
+        assertTrue(getUsersAssignedToRole().contains(userName));
 
-        // Remove the user from the role
+        // Remove the user from the role and check the content
-        response = deleteRequestSuccess(url);
+        checkContent(deleteRequestSuccess(url));
-
-        // Check the content from the response
-        checkContent(response);
 
         // The user should be removed from the role
-        assertFalse(getUsersAssignedToRole().contains(name));
+        assertFalse(getUsersAssignedToRole().contains(userName));
 
-        // Delete the user
+        // Do the negative test with a user without any capabilities
-        deleteUser(name);
+        AuthenticationUtil.setFullyAuthenticatedUser(USER_WITHOUT_CAPABILITY);
+
+        // Send a request. The expectation is an internal server error
+        postRequestFailure(url);
     }
 
     /**
@@ -97,37 +174,53 @@ public class RmAuthoritiesRestApiTest extends BaseRMWebScriptTestCase
      */
     public void testRmAddRemoveGroup() throws IOException, JSONException
     {
-        // Create a group
+        // Do the positive test with a user with the needed capabilities
-        String groupName = GUID.generate();
+        AuthenticationUtil.setFullyAuthenticatedUser(USER_WITH_CAPABILITY);
-        createGroup(groupName);
 
-        // Get the name
+        // Get the group name
-        String name = authorityService.getName(AuthorityType.GROUP, groupName);
+        String groupName = getTestGroupName();
 
         // Check if the group is already assigned to the role
-        assertFalse(getGroupsAssignedToRole().contains(name));
+        assertFalse(getGroupsAssignedToRole().contains(groupName));
 
-        // Format url and send request
+        // Format url, send the request and check the content
-        String url = getFormattedUrlString(name);
+        String url = getFormattedUrlString(groupName);
-        Response response = postRequestSuccess(url);
+        checkContent(postRequestSuccess(url));
-
-        // Check the content from the response
-        checkContent(response);
 
         // The group should be added to the role
-        assertTrue(getGroupsAssignedToRole().contains(name));
+        assertTrue(getGroupsAssignedToRole().contains(groupName));
 
-        // Remove the group from the role
+        // Remove the group from the role and check the content
-        response = deleteRequestSuccess(url);
+        checkContent(deleteRequestSuccess(url));
-
-        // Check the content from the response
-        checkContent(response);
 
         // The user should be removed from the role
-        assertFalse(getGroupsAssignedToRole().contains(name));
+        assertFalse(getGroupsAssignedToRole().contains(groupName));
 
-        // Delete the group
+        // Do the negative test with a user without any capabilities
-        deleteGroup(name);
+        AuthenticationUtil.setFullyAuthenticatedUser(USER_WITHOUT_CAPABILITY);
+
+        // Send a request. The expectation is an internal server error
+        deleteRequestFailure(url);
+    }
+
+    /**
+     * Util method to get the user name which will be added/removed to/from the role
+     *
+     * @return Returns the user name which will be added/removed to/from the role
+     */
+    private String getTestUserName()
+    {
+        return authorityService.getName(AuthorityType.USER, USER_TO_ADD_TO_ROLE);
+    }
+
+    /**
+     * Util method to get the group name which will be added/removed to/from the role
+     *
+     * @return Returns the user group which will be added/removed to/from the role
+     */
+    private String getTestGroupName()
+    {
+        return authorityService.getName(AuthorityType.GROUP, GROUP_TO_ADD_TO_ROLE);
     }
 
     /**
@@ -184,7 +277,7 @@ public class RmAuthoritiesRestApiTest extends BaseRMWebScriptTestCase
     }
 
     /**
-     * Util method to send a post request
+     * Util method to send a post request. The expected status is success.
      *
      * @param url The url which should be used to make the post request
      * @return Returns the response from the server
@@ -197,7 +290,20 @@ public class RmAuthoritiesRestApiTest extends BaseRMWebScriptTestCase
     }
 
     /**
-     * Util method to send a delete request
+     * Util method to send a post request. The expected status is an internal server error.
+     *
+     * @param url The url which should be used to make the post request
+     * @return Returns the response from the server
+     * @throws UnsupportedEncodingException
+     * @throws IOException
+     */
+    private Response postRequestFailure(String url) throws UnsupportedEncodingException, IOException
+    {
+        return sendRequest(new PostRequest(url, new JSONObject().toString(), APPLICATION_JSON), Status.STATUS_INTERNAL_SERVER_ERROR);
+    }
+
+    /**
+     * Util method to send a delete request. The expected status is success.
      *
      * @param url The url which should be used to make the delete request
      * @return Returns the response from the server
@@ -208,6 +314,18 @@ public class RmAuthoritiesRestApiTest extends BaseRMWebScriptTestCase
         return sendRequest(new DeleteRequest(url), Status.STATUS_OK);
     }
 
+    /**
+     * Util method to send a delete request. The expected status is an internal server error.
+     *
+     * @param url The url which should be used to make the delete request
+     * @return Returns the response from the server
+     * @throws IOException
+     */
+    private Response deleteRequestFailure(String url) throws IOException
+    {
+        return sendRequest(new DeleteRequest(url), Status.STATUS_INTERNAL_SERVER_ERROR);
+    }
+
     /**
      * Util method to check the server response
      *