Skip to content
Snippets Groups Projects
Commit c5796588 authored by Xiangliang Meng's avatar Xiangliang Meng
Browse files

Squashed commit of the following

commit 3b661d0e 
Author: David Meng <xlmeng@amazon.com> 
Date: Tue Aug 23 2022 11:24:37 GMT-0400 (Eastern Daylight Time) 

    Refactor AuthorizationFilter::hasAnyPermission to avoid always returning true
parent c2b35f15
No related branches found
No related tags found
Loading
......@@ -63,25 +63,23 @@ public class AuthorizationFilter {
if (Arrays.asList(requiredRoles).contains(Config.CRON) && requestInfoExt.isCronRequest()) {
dpsHeaders.put(DpsHeaders.USER_EMAIL, Config.CRON);
requestInfoExt.setHeaders(dpsHeaders);
return true;
} else if (Arrays.asList(requiredRoles).contains(Config.PUBSUB)) {
String jwt = dpsHeaders.getAuthorization().substring(BEARER_PREFIX.length());
if (!this.validator.isValidPublisherServiceAccount(jwt)) {
if (!this.authorizeWithEntitlements(requiredRoles)) {
throw new AppException(401, "Invalid User Identity", "this user is not authorized for this operation");
}
this.authorizeWithEntitlements(requiredRoles);
} else {
return false;
}
return true;
} else {
return authorizeWithEntitlements(requiredRoles);
authorizeWithEntitlements(requiredRoles);
}
return true;
}
private boolean authorizeWithEntitlements(String... requiredRoles) {
AuthorizationResponse authorizationResponse = authService.authorizeAny(requestInfoExt.getHeaders(), requiredRoles);
private void authorizeWithEntitlements(String... requiredRoles) {
DpsHeaders dpsHeaders = requestInfoExt.getHeaders();
AuthorizationResponse authorizationResponse = authService.authorizeAny(dpsHeaders, requiredRoles);
dpsHeaders.put(DpsHeaders.USER_EMAIL, authorizationResponse.getUser());
requestInfoExt.setHeaders(dpsHeaders);
return true;
}
}
......@@ -112,7 +112,7 @@ public class AuthorizationFilterTest {
this.sut.hasAnyPermission(ROLE3);
}
@Test
@Test(expected = Test.None.class)
public void should_authenticateRequest_when_isFromPubsubAndUserIdentityIsCorrect() {
when(headers.getAuthorization()).thenReturn(TEST_PUBSUB_JWT);
when(this.validator.isValidServiceAccount(any(), any())).thenReturn(true);
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment