Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
<parent>
<groupId>org.jenkins-ci.plugins</groupId>
<artifactId>plugin</artifactId>
<version>5.18</version>
<version>5.22</version>
</parent>
<artifactId>matrix-auth</artifactId>
<version>${revision}${changelist}</version>
Expand Down Expand Up @@ -32,6 +32,7 @@
<jenkins.baseline>2.479</jenkins.baseline>
<jenkins.version>${jenkins.baseline}.3</jenkins.version>
<spotless.check.skip>false</spotless.check.skip>
<ban-junit4-imports.skip>true</ban-junit4-imports.skip>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤦

</properties>

<dependencyManagement>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@

package com.cloudbees.hudson.plugins.folder.properties;

import static org.junit.Assert.*;
import static org.junit.jupiter.api.Assertions.*;

import com.cloudbees.hudson.plugins.folder.Folder;
import hudson.model.FreeStyleProject;
Expand All @@ -44,136 +44,131 @@
import org.jenkinsci.plugins.matrixauth.PermissionEntry;
import org.jenkinsci.plugins.matrixauth.inheritance.InheritParentStrategy;
import org.jenkinsci.plugins.matrixauth.inheritance.NonInheritingStrategy;
import org.junit.Assert;
import org.junit.Rule;
import org.junit.Test;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.jvnet.hudson.test.JenkinsRule;
import org.jvnet.hudson.test.LoggerRule;
import org.jvnet.hudson.test.LogRecorder;
import org.jvnet.hudson.test.junit.jupiter.WithJenkins;

public class AuthorizationMatrixPropertyTest {
@WithJenkins
class AuthorizationMatrixPropertyTest {

@Rule
public JenkinsRule r = new JenkinsRule();
private final LogRecorder l = new LogRecorder();

@Rule
public LoggerRule l = new LoggerRule();
private JenkinsRule j;

@BeforeEach
void setUp(JenkinsRule rule) {
j = rule;
}

@Test
public void ensureCreatorHasPermissions() throws Exception {
void ensureCreatorHasPermissions() throws Exception {
HudsonPrivateSecurityRealm realm = new HudsonPrivateSecurityRealm(false, false, null);
realm.createAccount("alice", "alice");
realm.createAccount("bob", "bob");
r.jenkins.setSecurityRealm(realm);
j.jenkins.setSecurityRealm(realm);

ProjectMatrixAuthorizationStrategy authorizationStrategy = new ProjectMatrixAuthorizationStrategy();
authorizationStrategy.add(Item.CREATE, PermissionEntry.user("alice"));
authorizationStrategy.add(Jenkins.READ, PermissionEntry.user("alice"));
r.jenkins.setAuthorizationStrategy(authorizationStrategy);
j.jenkins.setAuthorizationStrategy(authorizationStrategy);

Folder job;
try (ACLContext ignored = ACL.as(User.get("alice", false, Collections.emptyMap()))) {
job = r.createProject(Folder.class);
job = j.createProject(Folder.class);
}

Assert.assertNotNull(job.getProperties().get(AuthorizationMatrixProperty.class));
Assert.assertTrue(job.getACL()
assertNotNull(job.getProperties().get(AuthorizationMatrixProperty.class));
assertTrue(job.getACL()
.hasPermission2(
Objects.requireNonNull(User.get("alice", false, Collections.emptyMap()))
.impersonate2(),
Item.READ));
Assert.assertFalse(job.getACL()
assertFalse(job.getACL()
.hasPermission2(
Objects.requireNonNull(User.get("bob", false, Collections.emptyMap()))
.impersonate2(),
Item.READ));
Assert.assertTrue(job.getACL()
assertTrue(job.getACL()
.hasPermission2(
Objects.requireNonNull(User.get("alice", false, Collections.emptyMap()))
.impersonate2(),
Item.CONFIGURE));
}

@Test
public void basics1() throws Exception {
void basics1() throws Exception {
HudsonPrivateSecurityRealm realm = new HudsonPrivateSecurityRealm(false, false, null);
realm.createAccount("alice", "alice");
realm.createAccount("bob", "bob");
r.jenkins.setSecurityRealm(realm);
j.jenkins.setSecurityRealm(realm);

ProjectMatrixAuthorizationStrategy as = new ProjectMatrixAuthorizationStrategy();
r.jenkins.setAuthorizationStrategy(as);
j.jenkins.setAuthorizationStrategy(as);
as.add(Hudson.READ, PermissionEntry.group("authenticated"));

Folder f = r.jenkins.createProject(Folder.class, "d");
Folder f = j.jenkins.createProject(Folder.class, "d");
AuthorizationMatrixProperty amp = new AuthorizationMatrixProperty();

assertTrue(amp.getInheritanceStrategy() instanceof InheritParentStrategy);
assertInstanceOf(InheritParentStrategy.class, amp.getInheritanceStrategy());

amp.add(Item.READ, PermissionEntry.user("alice"));
amp.add(Item.BUILD, PermissionEntry.user("alice"));
f.getProperties().add(amp);

final FreeStyleProject foo = f.createProject(FreeStyleProject.class, "foo");

JenkinsRule.WebClient wc = r.createWebClient().login("bob");
try {
wc.getPage(foo);
fail();
} catch (FailingHttpStatusCodeException e) {
assertEquals(404, e.getStatusCode());
}
FailingHttpStatusCodeException e = assertThrows(
FailingHttpStatusCodeException.class,
() -> j.createWebClient().login("bob").getPage(foo));
assertEquals(404, e.getStatusCode());

wc = r.createWebClient().login("alice");
JenkinsRule.WebClient wc = j.createWebClient().login("alice");
wc.getPage(foo); // this should succeed

// and build permission should be set, too
wc.executeOnServer(() -> {
foo.checkPermission(Item.BUILD);
try {
foo.checkPermission(Item.DELETE);
fail("access should be denied");
} catch (RuntimeException x) {
assertEquals(
hudson.security.Messages.AccessDeniedException2_MissingPermission("alice", "Job/Delete"),
x.getMessage());
}
RuntimeException x = assertThrows(
RuntimeException.class, () -> foo.checkPermission(Item.DELETE), "access should be denied");
assertEquals(
hudson.security.Messages.AccessDeniedException2_MissingPermission("alice", "Job/Delete"),
x.getMessage());
return null;
});
}

@Test
public void disabling_permission_inheritance_removes_global_permissions() throws Exception {
void disabling_permission_inheritance_removes_global_permissions() throws Exception {
HudsonPrivateSecurityRealm realm = new HudsonPrivateSecurityRealm(false, false, null);
realm.createAccount("alice", "alice");
realm.createAccount("bob", "bob");
r.jenkins.setSecurityRealm(realm);
j.jenkins.setSecurityRealm(realm);

ProjectMatrixAuthorizationStrategy as = new ProjectMatrixAuthorizationStrategy();
r.jenkins.setAuthorizationStrategy(as);
j.jenkins.setAuthorizationStrategy(as);
as.add(Hudson.READ, PermissionEntry.group("authenticated"));

Folder f = r.jenkins.createProject(Folder.class, "d");
Folder f = j.jenkins.createProject(Folder.class, "d");
AuthorizationMatrixProperty amp = new AuthorizationMatrixProperty();
amp.setInheritanceStrategy(new NonInheritingStrategy());
amp.add(Item.READ, PermissionEntry.user("alice"));
f.getProperties().add(amp);

final FreeStyleProject foo = f.createProject(FreeStyleProject.class, "foo");

JenkinsRule.WebClient wc = r.createWebClient().login("bob");
try {
wc.getPage(foo);
fail();
} catch (FailingHttpStatusCodeException e) {
assertEquals(404, e.getStatusCode());
}
FailingHttpStatusCodeException e = assertThrows(
FailingHttpStatusCodeException.class,
() -> j.createWebClient().login("bob").getPage(foo));
assertEquals(404, e.getStatusCode());

wc = r.createWebClient().login("alice");
JenkinsRule.WebClient wc = j.createWebClient().login("alice");
wc.getPage(foo); // this should succeed
}

@Test
public void inapplicablePermissionIsSkipped() {
void inapplicablePermissionIsSkipped() {
AuthorizationMatrixProperty property = new AuthorizationMatrixProperty();
l.record(AuthorizationContainer.class, Level.WARNING).capture(5);
property.add("hudson.model.Hudson.Administer:alice");
Expand All @@ -184,7 +179,7 @@ public void inapplicablePermissionIsSkipped() {
}

@Test
public void inapplicablePermissionIsSkipped2() {
void inapplicablePermissionIsSkipped2() {
AuthorizationMatrixProperty property = new AuthorizationMatrixProperty();
l.record(AuthorizationContainer.class, Level.WARNING).capture(5);
property.add("USER:hudson.model.Hudson.Administer:alice");
Expand Down
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
package com.cloudbees.hudson.plugins.folder.properties;

import static org.junit.Assert.assertEquals;
import static org.junit.Assert.fail;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.junit.jupiter.api.Assertions.fail;

import hudson.model.FreeStyleProject;
import hudson.model.Hudson;
Expand All @@ -10,15 +11,22 @@
import hudson.security.ProjectMatrixAuthorizationStrategy;
import jenkins.model.IdStrategy;
import org.htmlunit.FailingHttpStatusCodeException;
import org.junit.Rule;
import org.junit.Test;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.jvnet.hudson.test.JenkinsRule;
import org.jvnet.hudson.test.junit.jupiter.WithJenkins;

@WithJenkins
class IdStrategyTest {

public class IdStrategyTest {
private static final IdStrategy.CaseSensitive CASE_SENSITIVE = new IdStrategy.CaseSensitive();

@Rule
public JenkinsRule r = new JenkinsRule();
private JenkinsRule j;

@BeforeEach
void setUp(JenkinsRule rule) {
j = rule;
}

private static class CaseInsensitiveSecurityRealm extends HudsonPrivateSecurityRealm {
CaseInsensitiveSecurityRealm() {
Expand Down Expand Up @@ -53,20 +61,20 @@ public IdStrategy getGroupIdStrategy() {
}

@Test
public void insensitive() throws Exception {
void insensitive() throws Exception {
HudsonPrivateSecurityRealm realm = new CaseInsensitiveSecurityRealm();
realm.createAccount("alice", "alice");
r.jenkins.setSecurityRealm(realm);
j.jenkins.setSecurityRealm(realm);

ProjectMatrixAuthorizationStrategy as = new ProjectMatrixAuthorizationStrategy();
r.jenkins.setAuthorizationStrategy(as);
j.jenkins.setAuthorizationStrategy(as);
as.add(Hudson.READ, "authenticated");
as.add(Item.READ, "alicE");
as.add(Item.BUILD, "aLice");

final FreeStyleProject foo = r.createProject(FreeStyleProject.class, "foo");
final FreeStyleProject foo = j.createProject(FreeStyleProject.class, "foo");

JenkinsRule.WebClient wc = r.createWebClient().login("alice");
JenkinsRule.WebClient wc = j.createWebClient().login("alice");
wc.getPage(foo); // this should succeed

// and build permission should be set, too
Expand All @@ -83,15 +91,12 @@ public void insensitive() throws Exception {
return null;
});

try {
r.createWebClient().login("AliCe");
fail();
} catch (FailingHttpStatusCodeException e) {
assertEquals(401, e.getStatusCode());
}
FailingHttpStatusCodeException e = assertThrows(
FailingHttpStatusCodeException.class, () -> j.createWebClient().login("AliCe"));
assertEquals(401, e.getStatusCode());

// now logging with the username case incorrect should still authenticate as the password is a match
wc = r.createWebClient().login("AliCe", "alice");
wc = j.createWebClient().login("AliCe", "alice");
wc.getPage(foo); // this should succeed

// and build permission should be set, too
Expand All @@ -110,40 +115,34 @@ public void insensitive() throws Exception {
}

@Test
public void sensitive() throws Exception {
void sensitive() throws Exception {
HudsonPrivateSecurityRealm realm = new CaseSensitiveSecurityRealm();
realm.createAccount("alice", "alice");
r.jenkins.setSecurityRealm(realm);
j.jenkins.setSecurityRealm(realm);

ProjectMatrixAuthorizationStrategy as = new ProjectMatrixAuthorizationStrategy();
r.jenkins.setAuthorizationStrategy(as);
j.jenkins.setAuthorizationStrategy(as);
as.add(Hudson.READ, "authenticated");
as.add(Item.READ, "alice");
as.add(Item.BUILD, "alice");

final FreeStyleProject foo = r.createProject(FreeStyleProject.class, "foo");
JenkinsRule.WebClient wc = r.createWebClient().login("alice", "alice");
final FreeStyleProject foo = j.createProject(FreeStyleProject.class, "foo");
JenkinsRule.WebClient wc = j.createWebClient().login("alice", "alice");
wc.getPage(foo); // this should succeed

// and build permission should be set, too
wc.executeOnServer(() -> {
foo.checkPermission(Item.BUILD);
try {
foo.checkPermission(Item.DELETE);
fail("access should be denied");
} catch (RuntimeException x) {
assertEquals(
hudson.security.Messages.AccessDeniedException2_MissingPermission("alice", "Job/Delete"),
x.getMessage());
}
RuntimeException x = assertThrows(
RuntimeException.class, () -> foo.checkPermission(Item.DELETE), "access should be denied");
assertEquals(
hudson.security.Messages.AccessDeniedException2_MissingPermission("alice", "Job/Delete"),
x.getMessage());
return null;
});

try {
r.createWebClient().login("Alice", "alice");
fail();
} catch (FailingHttpStatusCodeException e) {
assertEquals(401, e.getStatusCode());
}
FailingHttpStatusCodeException e = assertThrows(
FailingHttpStatusCodeException.class, () -> j.createWebClient().login("Alice", "alice"));
assertEquals(401, e.getStatusCode());
}
}
Loading