import org.camunda.bpm.engine.authorization.Authorization; //导入依赖的package包/类
@Test
public void mock_authorizationQuery() {
  final AuthorizationQuery query = null; //QueryMocks1.mockAuthorizationQuery(serviceMock).singleResult(authorization);

  // @formatter:off
  final Authorization result = serviceMock.createAuthorizationQuery()
    .authorizationId("foo")
    .authorizationType(1)
    .userIdIn("user")
    .singleResult();
  // @formatter:on

  assertThat(result).isEqualTo(authorization);

  verify(query).userIdIn("user");
  verify(query).authorizationId("foo");
  verify(query).authorizationType(1);
}
 

import org.camunda.bpm.engine.authorization.Authorization; //导入依赖的package包/类
public void testGroupQueryPaginationWithAuthenticatedUserWithAuthorizations() {
  createGrantAuthorization(GROUP, "management", "oscar", READ);
  createGrantAuthorization(GROUP, "consulting", "oscar", READ);
  createGrantAuthorization(GROUP, "external", "oscar", READ);

  try {
    processEngineConfiguration.setAuthorizationEnabled(true);

    identityService.setAuthenticatedUserId("oscar");
    testGroupPaging(identityService);

  } finally {
    processEngineConfiguration.setAuthorizationEnabled(false);
    identityService.clearAuthentication();

    for (Authorization authorization : authorizationService.createAuthorizationQuery().list()) {
      authorizationService.deleteAuthorization(authorization.getId());
    }

  }
}
 

import org.camunda.bpm.engine.authorization.Authorization; //导入依赖的package包/类
@Test
public void testCompleteGetParameters() {

  List<Authorization> mockAuthorizations = MockProvider.createMockGlobalAuthorizations();
  AuthorizationQuery mockQuery = setUpMockQuery(mockAuthorizations);

  Map<String, String> queryParameters = getCompleteStringQueryParameters();

  RequestSpecification requestSpecification = given().contentType(POST_JSON_CONTENT_TYPE);
  for (Entry<String, String> paramEntry : queryParameters.entrySet()) {
    requestSpecification.parameter(paramEntry.getKey(), paramEntry.getValue());
  }

  requestSpecification.expect().statusCode(Status.OK.getStatusCode())
    .when().get(SERVICE_PATH);

  verify(mockQuery).authorizationId(MockProvider.EXAMPLE_AUTHORIZATION_ID);
  verify(mockQuery).authorizationType(MockProvider.EXAMPLE_AUTHORIZATION_TYPE);
  verify(mockQuery).userIdIn(new String[]{MockProvider.EXAMPLE_USER_ID, MockProvider.EXAMPLE_USER_ID2});
  verify(mockQuery).groupIdIn(new String[]{MockProvider.EXAMPLE_GROUP_ID, MockProvider.EXAMPLE_GROUP_ID2});
  verify(mockQuery).resourceType(MockProvider.EXAMPLE_RESOURCE_TYPE_ID);
  verify(mockQuery).resourceId(MockProvider.EXAMPLE_RESOURCE_ID);

  verify(mockQuery).list();

}
 

import org.camunda.bpm.engine.authorization.Authorization; //导入依赖的package包/类
@Test
public void testSaveAuthorizationThrowsAuthorizationException() {
  String message = "expected authorization exception";
  when(authorizationServiceMock.saveAuthorization(any(Authorization.class))).thenThrow(new AuthorizationException(message));

  Authorization authorization = MockProvider.createMockGrantAuthorization();
  when(authorizationServiceMock.createNewAuthorization(Authorization.AUTH_TYPE_GRANT)).thenReturn(authorization);
  AuthorizationDto dto = AuthorizationDto.fromAuthorization(authorization);

  given()
      .body(dto)
      .contentType(ContentType.JSON)
  .then().expect()
      .statusCode(Status.FORBIDDEN.getStatusCode())
      .contentType(ContentType.JSON)
      .body("type", equalTo(AuthorizationException.class.getSimpleName()))
      .body("message", equalTo(message))
  .when()
      .post(AUTH_CREATE_PATH);
}
 

import org.camunda.bpm.engine.authorization.Authorization; //导入依赖的package包/类
public void testQueryWithRevokedReadPermission() {
  // given
  // given user gets all permissions on any process definition
  createGrantAuthorization(PROCESS_DEFINITION, ANY, userId, ALL);

  Authorization authorization = createRevokeAuthorization(PROCESS_DEFINITION, ONE_TASK_PROCESS_KEY);
  authorization.setUserId(userId);
  authorization.removePermission(READ);
  saveAuthorization(authorization);

  // when
  ProcessDefinitionQuery query = repositoryService.createProcessDefinitionQuery();

  // then
  verifyQueryResults(query, 1);

  ProcessDefinition definition = query.singleResult();
  assertNotNull(definition);
  assertEquals(TWO_TASKS_PROCESS_KEY, definition.getKey());
}
 

import org.camunda.bpm.engine.authorization.Authorization; //导入依赖的package包/类
public void testDeleteProcessInstanceByModifyingWithoutDeleteInstancePermissionOnProcessDefinition() {
  // given
  String processInstanceId = startProcessInstanceByKey(MESSAGE_BOUNDARY_PROCESS_KEY).getId();
  Authorization authorization = createGrantAuthorization(PROCESS_DEFINITION, MESSAGE_BOUNDARY_PROCESS_KEY);
  authorization.setUserId(userId);
  authorization.addPermission(UPDATE_INSTANCE);
  authorization.addPermission(DELETE_INSTANCE);
  saveAuthorization(authorization);

  // when
  runtimeService.createProcessInstanceModification(processInstanceId)
    .cancelAllForActivity("task")
    .execute();

  // then
  assertProcessEnded(processInstanceId);
}
 

import org.camunda.bpm.engine.authorization.Authorization; //导入依赖的package包/类
public void testDeleteProcessInstanceClearAuthorization() {
  // given
  String processInstanceId = startProcessInstanceByKey(PROCESS_KEY).getId();
  createGrantAuthorization(PROCESS_INSTANCE, processInstanceId, userId, ALL);

  disableAuthorization();
  Authorization authorization = authorizationService
      .createAuthorizationQuery()
      .resourceId(processInstanceId)
      .singleResult();
  enableAuthorization();
  assertNotNull(authorization);

  // when
  runtimeService.deleteProcessInstance(processInstanceId, null);

  // then
  disableAuthorization();
  authorization = authorizationService
      .createAuthorizationQuery()
      .resourceId(processInstanceId)
      .singleResult();
  enableAuthorization();

  assertNull(authorization);
}
 

import org.camunda.bpm.engine.authorization.Authorization; //导入依赖的package包/类
public void testClearAuthorizationOnDeleteDeployment() {
  // given
  createGrantAuthorization(DEPLOYMENT, ANY, userId, CREATE);
  Deployment deployment = repositoryService
    .createDeployment()
    .addClasspathResource(FIRST_RESOURCE)
    .deploy();

  String deploymentId = deployment.getId();

  AuthorizationQuery query = authorizationService
    .createAuthorizationQuery()
    .userIdIn(userId)
    .resourceId(deploymentId);

  Authorization authorization = query.singleResult();
  assertNotNull(authorization);

  // when
  repositoryService.deleteDeployment(deploymentId);

  authorization = query.singleResult();
  assertNull(authorization);

  deleteDeployment(deploymentId);
}
 

import org.camunda.bpm.engine.authorization.Authorization; //导入依赖的package包/类
protected User createUser(String userId) {
  User user = identityService.newUser(userId);
  identityService.saveUser(user);

  // give user all permission to manipulate authorizations
  Authorization authorization = createGrantAuthorization(AUTHORIZATION, ANY);
  authorization.setUserId(userId);
  authorization.addPermission(ALL);
  saveAuthorization(authorization);

  // give user all permission to manipulate users
  authorization = createGrantAuthorization(USER, ANY);
  authorization.setUserId(userId);
  authorization.addPermission(Permissions.ALL);
  saveAuthorization(authorization);

  return user;
}
 

import org.camunda.bpm.engine.authorization.Authorization; //导入依赖的package包/类
public void testCreateUser() {
  // initially there are no authorizations for jonny2:
  assertEquals(0, authorizationService.createAuthorizationQuery().userIdIn("jonny2").count());

  // create new user
  identityService.saveUser(identityService.newUser("jonny2"));

  // now there is an authorization for jonny2 which grants him ALL permissions on himself
  Authorization authorization = authorizationService.createAuthorizationQuery().userIdIn("jonny2").singleResult();
  assertNotNull(authorization);
  assertEquals(AUTH_TYPE_GRANT, authorization.getAuthorizationType());
  assertEquals(USER.resourceType(), authorization.getResourceType());
  assertEquals("jonny2", authorization.getResourceId());
  assertTrue(authorization.isPermissionGranted(ALL));

  // delete the user
  identityService.deleteUser("jonny2");

  // the authorization is deleted as well:
  assertEquals(0, authorizationService.createAuthorizationQuery().userIdIn("jonny2").count());
}
 

import org.camunda.bpm.engine.authorization.Authorization; //导入依赖的package包/类
public void testTaskQueryWithOneGroupAuthorization() {
  createGroupGrantAuthorization(Resources.TASK, Authorization.ANY, testGroupIds.get(0));

  processEngineConfiguration.getCommandExecutorTxRequired().execute(new Command<Void>() {
    public Void execute(CommandContext commandContext) {
      AuthorizationManager authorizationManager = spyOnSession(commandContext, AuthorizationManager.class);

      TaskQueryImpl taskQuery = (TaskQueryImpl) spy(processEngine.getTaskService().createTaskQuery());
      AuthorizationCheck authCheck = spy(new AuthorizationCheck());
      when(taskQuery.getAuthCheck()).thenReturn(authCheck);

      taskQuery.list();

      verify(authorizationManager, atLeastOnce()).filterAuthenticatedGroupIds(eq(testGroupIds));
      verify(authCheck).setAuthGroupIds(eq(testGroupIds.subList(0, 1)));

      return null;
    }
  });
}
 

import org.camunda.bpm.engine.authorization.Authorization; //导入依赖的package包/类
public void testTaskQueryWithGroupAuthorization() {
  for (String testGroupId : testGroupIds) {
    createGroupGrantAuthorization(Resources.TASK, Authorization.ANY, testGroupId);
  }

  processEngineConfiguration.getCommandExecutorTxRequired().execute(new Command<Void>() {
    public Void execute(CommandContext commandContext) {
      AuthorizationManager authorizationManager = spyOnSession(commandContext, AuthorizationManager.class);

      TaskQueryImpl taskQuery = (TaskQueryImpl) spy(processEngine.getTaskService().createTaskQuery());
      AuthorizationCheck authCheck = spy(new AuthorizationCheck());
      when(taskQuery.getAuthCheck()).thenReturn(authCheck);

      taskQuery.list();

      verify(authorizationManager, atLeastOnce()).filterAuthenticatedGroupIds(eq(testGroupIds));
      verify(authCheck, atLeastOnce()).setAuthGroupIds((List<String>) argThat(containsInAnyOrder(testGroupIds.toArray())));

      return null;
    }
  });
}
 

import org.camunda.bpm.engine.authorization.Authorization; //导入依赖的package包/类
public void testCheckAuthorizationWithGroupAuthorizations() {
  for (String testGroupId : testGroupIds) {
    createGroupGrantAuthorization(Resources.TASK, Authorization.ANY, testGroupId);
  }

  processEngineConfiguration.getCommandExecutorTxRequired().execute(new Command<Void>() {
    public Void execute(CommandContext commandContext) {
      AuthorizationManager authorizationManager = spyOnSession(commandContext, AuthorizationManager.class);
      DbEntityManager dbEntityManager = spyOnSession(commandContext, DbEntityManager.class);

      authorizationService.isUserAuthorized(testUserId, testGroupIds, Permissions.READ, Resources.TASK);

      verify(authorizationManager, atLeastOnce()).filterAuthenticatedGroupIds(eq(testGroupIds));

      ArgumentCaptor<AuthorizationCheck> authorizationCheckArgument = ArgumentCaptor.forClass(AuthorizationCheck.class);
      verify(dbEntityManager).selectBoolean(eq("isUserAuthorizedForResource"), authorizationCheckArgument.capture());

      AuthorizationCheck authorizationCheck = authorizationCheckArgument.getValue();
      assertThat(authorizationCheck.getAuthGroupIds(), containsInAnyOrder(testGroupIds.toArray()));

      return null;
    }
  });
}
 

import org.camunda.bpm.engine.authorization.Authorization; //导入依赖的package包/类
@Test
public void testDeleteAuthorization() {

  Authorization authorization = MockProvider.createMockGlobalAuthorization();

  AuthorizationQuery authorizationQuery = mock(AuthorizationQuery.class);
  when(authorizationServiceMock.createAuthorizationQuery()).thenReturn(authorizationQuery);
  when(authorizationQuery.authorizationId(MockProvider.EXAMPLE_AUTHORIZATION_ID)).thenReturn(authorizationQuery);
  when(authorizationQuery.singleResult()).thenReturn(authorization);

  given()
      .pathParam("id", MockProvider.EXAMPLE_AUTHORIZATION_ID)
  .then().expect()
      .statusCode(Status.NO_CONTENT.getStatusCode())
  .when()
      .delete(AUTH_RESOURCE_PATH);

  verify(authorizationQuery).authorizationId(MockProvider.EXAMPLE_AUTHORIZATION_ID);
  verify(authorizationServiceMock).deleteAuthorization(MockProvider.EXAMPLE_AUTHORIZATION_ID);

}
 

import org.camunda.bpm.engine.authorization.Authorization; //导入依赖的package包/类
@Test
public void testGetAuthorizationById() {

  Authorization authorization = MockProvider.createMockGlobalAuthorization();

  AuthorizationQuery authorizationQuery = mock(AuthorizationQuery.class);
  when(authorizationServiceMock.createAuthorizationQuery()).thenReturn(authorizationQuery);
  when(authorizationQuery.authorizationId(MockProvider.EXAMPLE_AUTHORIZATION_ID)).thenReturn(authorizationQuery);
  when(authorizationQuery.singleResult()).thenReturn(authorization);

  given()
      .pathParam("id", MockProvider.EXAMPLE_AUTHORIZATION_ID)
  .then().expect()
      .statusCode(Status.OK.getStatusCode()).contentType(ContentType.JSON)
      .body("id", equalTo(authorization.getId()))
      .body("type", equalTo(authorization.getAuthorizationType()))
      .body("permissions[0]", equalTo(Permissions.READ.getName()))
      .body("permissions[1]", equalTo(Permissions.UPDATE.getName()))
      .body("userId", equalTo(authorization.getUserId()))
      .body("groupId", equalTo(authorization.getGroupId()))
      .body("resourceType", equalTo(authorization.getResourceType()))
      .body("resourceId", equalTo(authorization.getResourceId()))
  .when()
      .get(AUTH_RESOURCE_PATH);

}
 

import org.camunda.bpm.engine.authorization.Authorization; //导入依赖的package包/类
public void testCreateGroup() {
  // initially there are no authorizations for group "sales":
  assertEquals(0, authorizationService.createAuthorizationQuery().groupIdIn("sales").count());

  // create new group
  identityService.saveGroup(identityService.newGroup("sales"));

  // now there is an authorization for sales which grants all members READ permissions
  Authorization authorization = authorizationService.createAuthorizationQuery().groupIdIn("sales").singleResult();
  assertNotNull(authorization);
  assertEquals(AUTH_TYPE_GRANT, authorization.getAuthorizationType());
  assertEquals(GROUP.resourceType(), authorization.getResourceType());
  assertEquals("sales", authorization.getResourceId());
  assertTrue(authorization.isPermissionGranted(READ));

  // delete the group
  identityService.deleteGroup("sales");

  // the authorization is deleted as well:
  assertEquals(0, authorizationService.createAuthorizationQuery().groupIdIn("sales").count());
}
 

import org.camunda.bpm.engine.authorization.Authorization; //导入依赖的package包/类
public Authorization instantiate(AuthorizationService authorizationService, Map<String, String> replacements) {
  Authorization authorization = authorizationService.createNewAuthorization(type);

  // TODO: group id is missing
  authorization.setResource(resource);

  if (replacements.containsKey(resourceId)) {
    authorization.setResourceId(replacements.get(resourceId));
  }
  else {
    authorization.setResourceId(resourceId);
  }
  authorization.setUserId(userId);
  authorization.setPermissions(permissions);

  return authorization;
}
 

import org.camunda.bpm.engine.authorization.Authorization; //导入依赖的package包/类
@Test
public void shouldFetchTaskCountWithAuthorization() {
  // given
  User user = identityService.newUser(userId);
  identityService.saveUser(user);

  Authorization authorization = authorizationService.createNewAuthorization(AUTH_TYPE_GRANT);
  authorization.addPermission(READ);
  authorization.setResource(TASK);
  authorization.setResourceId(ANY);
  authorization.setUserId(userId);
  authorizationService.saveAuthorization(authorization);

  processEngineConfiguration.setAuthorizationEnabled(true);
  authenticate();

  // when
  List<TaskCountByCandidateGroupResult> results = taskService.createTaskReport().taskCountByCandidateGroup();
  processEngineConfiguration.setAuthorizationEnabled(false);
  authorizationService.deleteAuthorization(authorization.getId());
  identityService.deleteUser(userId);

  assertEquals(0, results.size());
}
 

import org.camunda.bpm.engine.authorization.Authorization; //导入依赖的package包/类
public void testAuthorizationQueryAuthorizations() {

    // we are jonny2
    String authUserId = "jonny2";
    identityService.setAuthenticatedUserId(authUserId);

    // create new auth wich revokes read access on auth
    Authorization basePerms = authorizationService.createNewAuthorization(AUTH_TYPE_GLOBAL);
    basePerms.setResource(AUTHORIZATION);
    basePerms.setResourceId(ANY);
    authorizationService.saveAuthorization(basePerms);

    // I can see it
    assertEquals(1, authorizationService.createAuthorizationQuery().count());

    // now enable checks
    processEngineConfiguration.setAuthorizationEnabled(true);

    // I can't see it
    assertEquals(0, authorizationService.createAuthorizationQuery().count());

  }
 

import org.camunda.bpm.engine.authorization.Authorization; //导入依赖的package包/类
public void testCreateAuthorizationWithUserId() {

    TestResource resource1 = new TestResource("resource1",100);

    // initially, no authorization exists:
    assertEquals(0, authorizationService.createAuthorizationQuery().count());

    // simple create / delete with userId
    Authorization authorization = authorizationService.createNewAuthorization(AUTH_TYPE_GRANT);
    authorization.setUserId("aUserId");
    authorization.setResource(resource1);

    // save the authorization
    authorizationService.saveAuthorization(authorization);
    // authorization exists
    assertEquals(1, authorizationService.createAuthorizationQuery().count());
    // delete the authorization
    authorizationService.deleteAuthorization(authorization.getId());
    // it's gone
    assertEquals(0, authorizationService.createAuthorizationQuery().count());

  }