opendev/gerrit
Code Issues Proposed changes

Merge changes I08379862,Ieff95d1b,I5f9a084f,If01d2b0f

Browse Source 
* changes:
  SetAccess: Reject label permissions with invalid label names
  SetAccess: Reject invalid permission names
  SetAccess: Test adding a plugin project permission
  SetAccess: Test adding a plugin global capability
This commit is contained in:
David Pursehouse
2020-03-17 00:12:09 +00:00
committed by Gerrit Code Review
parent 72fd0e8cfa bd36fd822b
commit a4224ac50f
3 changed files with 145 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

99
javatests/com/google/gerrit/acceptance/rest/project/AccessIT.java
View File

@@ -44,6 +44,8 @@ import com.google.gerrit.extensions.client.ChangeStatus;
import com.google.gerrit.extensions.common.ChangeInfo;
import com.google.gerrit.extensions.common.GroupInfo;
import com.google.gerrit.extensions.common.WebLinkInfo;
import com.google.gerrit.extensions.config.CapabilityDefinition;
import com.google.gerrit.extensions.config.PluginProjectPermissionDefinition;
import com.google.gerrit.extensions.restapi.AuthException;
import com.google.gerrit.extensions.restapi.BadRequestException;
import com.google.gerrit.extensions.restapi.ResourceNotFoundException;
@@ -142,6 +144,68 @@ public class AccessIT extends AbstractDaemonTest {
newProjectName.get(), RefNames.REFS_CONFIG, null, initialHead, initialHead, updatedHead);
}
@Test
public void addAccessSectionForPluginPermission() throws Exception {
try (Registration registration =
extensionRegistry
.newRegistration()
.add(
new PluginProjectPermissionDefinition() {
@Override
public String getDescription() {
return "A Plugin Project Permission";
}
},
"fooPermission")) {
ProjectAccessInput accessInput = newProjectAccessInput();
AccessSectionInfo accessSectionInfo = newAccessSectionInfo();
PermissionInfo foo = newPermissionInfo();
PermissionRuleInfo pri = new PermissionRuleInfo(PermissionRuleInfo.Action.ALLOW, false);
foo.rules.put(SystemGroupBackend.REGISTERED_USERS.get(), pri);
accessSectionInfo.permissions.put(
"plugin-" + ExtensionRegistry.PLUGIN_NAME + "-fooPermission", foo);
accessInput.add.put(REFS_HEADS, accessSectionInfo);
ProjectAccessInfo updatedAccessSectionInfo = pApi().access(accessInput);
assertThat(updatedAccessSectionInfo.local).isEqualTo(accessInput.add);
assertThat(pApi().access().local).isEqualTo(accessInput.add);
}
}
@Test
public void addAccessSectionWithInvalidPermission() throws Exception {
ProjectAccessInput accessInput = newProjectAccessInput();
AccessSectionInfo accessSectionInfo = createDefaultAccessSectionInfo();
PermissionInfo push = newPermissionInfo();
PermissionRuleInfo pri = new PermissionRuleInfo(PermissionRuleInfo.Action.ALLOW, false);
push.rules.put(SystemGroupBackend.REGISTERED_USERS.get(), pri);
accessSectionInfo.permissions.put("Invalid Permission", push);
accessInput.add.put(REFS_HEADS, accessSectionInfo);
BadRequestException ex =
assertThrows(BadRequestException.class, () -> pApi().access(accessInput));
assertThat(ex).hasMessageThat().isEqualTo("Unknown permission: Invalid Permission");
}
@Test
public void addAccessSectionWithInvalidLabelPermission() throws Exception {
ProjectAccessInput accessInput = newProjectAccessInput();
AccessSectionInfo accessSectionInfo = createDefaultAccessSectionInfo();
PermissionInfo push = newPermissionInfo();
PermissionRuleInfo pri = new PermissionRuleInfo(PermissionRuleInfo.Action.ALLOW, false);
push.rules.put(SystemGroupBackend.REGISTERED_USERS.get(), pri);
accessSectionInfo.permissions.put("label-Invalid Permission", push);
accessInput.add.put(REFS_HEADS, accessSectionInfo);
BadRequestException ex =
assertThrows(BadRequestException.class, () -> pApi().access(accessInput));
assertThat(ex).hasMessageThat().isEqualTo("Unknown permission: label-Invalid Permission");
}
@Test
public void createAccessChangeNop() throws Exception {
ProjectAccessInput accessInput = newProjectAccessInput();
@@ -455,6 +519,41 @@ public class AccessIT extends AbstractDaemonTest {
.containsAtLeastElementsIn(accessSectionInfo.permissions.keySet());
}
@Test
public void addPluginGlobalCapability() throws Exception {
try (Registration registration =
extensionRegistry
.newRegistration()
.add(
new CapabilityDefinition() {
@Override
public String getDescription() {
return "A Plugin Global Capability";
}
},
"fooCapability")) {
ProjectAccessInput accessInput = newProjectAccessInput();
AccessSectionInfo accessSectionInfo = newAccessSectionInfo();
PermissionInfo foo = newPermissionInfo();
PermissionRuleInfo pri = new PermissionRuleInfo(PermissionRuleInfo.Action.ALLOW, false);
foo.rules.put(SystemGroupBackend.REGISTERED_USERS.get(), pri);
accessSectionInfo.permissions.put(ExtensionRegistry.PLUGIN_NAME + "-fooCapability", foo);
accessInput.add.put(AccessSection.GLOBAL_CAPABILITIES, accessSectionInfo);
ProjectAccessInfo updatedAccessSectionInfo =
gApi.projects().name(allProjects.get()).access(accessInput);
assertThat(
updatedAccessSectionInfo
.local
.get(AccessSection.GLOBAL_CAPABILITIES)
.permissions
.keySet())
.containsAtLeastElementsIn(accessSectionInfo.permissions.keySet());
}
}
@Test
public void addPermissionAsGlobalCapability() throws Exception {
ProjectAccessInput accessInput = newProjectAccessInput();