Merge with develop/2.5.1

application/src/main/java/org/thingsboard/server/controller/AlarmController.java

@@ -28,7 +28,6 @@ import org.springframework.web.bind.annotation.ResponseStatus;
 import org.springframework.web.bind.annotation.RestController;
 import org.thingsboard.server.common.data.EntityType;
 import org.thingsboard.server.common.data.alarm.Alarm;
-import org.thingsboard.server.common.data.id.AlarmId;
 import org.thingsboard.server.common.data.alarm.AlarmInfo;
 import org.thingsboard.server.common.data.alarm.AlarmQuery;
 import org.thingsboard.server.common.data.alarm.AlarmSearchStatus;
@@ -37,6 +36,7 @@ import org.thingsboard.server.common.data.alarm.AlarmStatus;
 import org.thingsboard.server.common.data.audit.ActionType;
 import org.thingsboard.server.common.data.exception.ThingsboardErrorCode;
 import org.thingsboard.server.common.data.exception.ThingsboardException;
+import org.thingsboard.server.common.data.id.AlarmId;
 import org.thingsboard.server.common.data.id.EntityId;
 import org.thingsboard.server.common.data.id.EntityIdFactory;
 import org.thingsboard.server.common.data.page.PageData;
@@ -86,8 +86,9 @@ public class AlarmController extends BaseController {
     public Alarm saveAlarm(@RequestBody Alarm alarm) throws ThingsboardException {
         try {
             alarm.setTenantId(getCurrentUser().getTenantId());
-            Operation operation = alarm.getId() == null ? Operation.CREATE : Operation.WRITE;
+
-            accessControlService.checkPermission(getCurrentUser(), Resource.ALARM, operation, alarm.getId(), alarm);
+           checkEntity(alarm.getId(), alarm, Resource.ALARM);
+
             Alarm savedAlarm = checkNotNull(alarmService.createOrUpdateAlarm(alarm));
             logEntityAction(savedAlarm.getId(), savedAlarm,
                     getCurrentUser().getCustomerId(),

application/src/main/java/org/thingsboard/server/controller/AssetController.java

@@ -91,18 +91,15 @@ public class AssetController extends BaseController {
         try {
             asset.setTenantId(getCurrentUser().getTenantId());
 
-            Operation operation = asset.getId() == null ? Operation.CREATE : Operation.WRITE;
+           checkEntity(asset.getId(), asset, Resource.ASSET);
 
-            accessControlService.checkPermission(getCurrentUser(), Resource.ASSET, operation,
+            Asset savedAsset = checkNotNull(assetService.saveAsset(asset));
-                    asset.getId(), asset);
-
-            Asset savedAsset  = checkNotNull(assetService.saveAsset(asset));
 
             logEntityAction(savedAsset.getId(), savedAsset,
                     savedAsset.getCustomerId(),
                     asset.getId() == null ? ActionType.ADDED : ActionType.UPDATED, null);
 
-            return  savedAsset;
+            return savedAsset;
         } catch (Exception e) {
             logEntityAction(emptyId(EntityType.ASSET), asset,
                     null, asset.getId() == null ? ActionType.ADDED : ActionType.UPDATED, e);
@@ -153,7 +150,7 @@ public class AssetController extends BaseController {
                     savedAsset.getCustomerId(),
                     ActionType.ASSIGNED_TO_CUSTOMER, null, strAssetId, strCustomerId, customer.getName());
 
-            return  savedAsset;
+            return savedAsset;
         } catch (Exception e) {
 
             logEntityAction(emptyId(EntityType.ASSET), null,

application/src/main/java/org/thingsboard/server/controller/BaseController.java

@@ -26,7 +26,6 @@ import org.springframework.beans.factory.annotation.Value;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.web.bind.annotation.ExceptionHandler;
-import org.thingsboard.server.actors.service.ActorService;
 import org.thingsboard.server.common.data.*;
 import org.thingsboard.server.common.data.Customer;
 import org.thingsboard.server.common.data.Dashboard;
@@ -107,7 +106,6 @@ import org.thingsboard.server.service.state.DeviceStateService;
 import org.thingsboard.server.service.telemetry.TelemetrySubscriptionService;
 
 import javax.mail.MessagingException;
-import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.util.List;
 import java.util.Optional;
@@ -340,11 +338,23 @@ public abstract class BaseController {
         }
     }
 
+    protected <I extends EntityId, T extends HasTenantId> void checkEntity(I entityId, T entity, Resource resource) throws ThingsboardException {
+        if (entityId == null) {
+            accessControlService
+                    .checkPermission(getCurrentUser(), resource, Operation.CREATE, null, entity);
+        } else {
+            checkEntityId(entityId, Operation.WRITE);
+        }
+    }
+
     protected void checkEntityId(EntityId entityId, Operation operation) throws ThingsboardException {
         try {
             checkNotNull(entityId);
             validateId(entityId.getId(), "Incorrect entityId " + entityId);
             switch (entityId.getEntityType()) {
+                case ALARM:
+                    checkAlarmId(new AlarmId(entityId.getId()), operation);
+                    return;
                 case DEVICE:
                     checkDeviceId(new DeviceId(entityId.getId()), operation);
                     return;
@@ -372,6 +382,12 @@ public abstract class BaseController {
                 case ENTITY_VIEW:
                     checkEntityViewId(new EntityViewId(entityId.getId()), operation);
                     return;
+                case WIDGETS_BUNDLE:
+                    checkWidgetsBundleId(new WidgetsBundleId(entityId.getId()), operation);
+                    return;
+                case WIDGET_TYPE:
+                    checkWidgetTypeId(new WidgetTypeId(entityId.getId()), operation);
+                    return;
                 default:
                     throw new IllegalArgumentException("Unsupported entity type: " + entityId.getEntityType());
             }

application/src/main/java/org/thingsboard/server/controller/CustomerController.java

@@ -100,8 +100,7 @@ public class CustomerController extends BaseController {
         try {
             customer.setTenantId(getCurrentUser().getTenantId());
 
-            Operation operation = customer.getId() == null ? Operation.CREATE : Operation.WRITE;
+            checkEntity(customer.getId(), customer, Resource.CUSTOMER);
-            accessControlService.checkPermission(getCurrentUser(), Resource.CUSTOMER, operation, customer.getId(), customer);
 
             Customer savedCustomer = checkNotNull(customerService.saveCustomer(customer));
 

application/src/main/java/org/thingsboard/server/controller/DashboardController.java

@@ -104,10 +104,12 @@ public class DashboardController extends BaseController {
         try {
             dashboard.setTenantId(getCurrentUser().getTenantId());
 
-            Operation operation = dashboard.getId() == null ? Operation.CREATE : Operation.WRITE;
+            if (dashboard.getId() == null) {
-
+                accessControlService
-            accessControlService.checkPermission(getCurrentUser(), Resource.DASHBOARD, operation,
+                        .checkPermission(getCurrentUser(), Resource.DASHBOARD, Operation.CREATE, dashboard.getId(), dashboard);
-                    dashboard.getId(), dashboard);
+            } else {
+                checkDashboardId(dashboard.getId(), Operation.WRITE);
+            }
 
             Dashboard savedDashboard = checkNotNull(dashboardService.saveDashboard(dashboard));
 
@@ -153,7 +155,7 @@ public class DashboardController extends BaseController {
     @RequestMapping(value = "/customer/{customerId}/dashboard/{dashboardId}", method = RequestMethod.POST)
     @ResponseBody
     public Dashboard assignDashboardToCustomer(@PathVariable("customerId") String strCustomerId,
-                                         @PathVariable(DASHBOARD_ID) String strDashboardId) throws ThingsboardException {
+                                               @PathVariable(DASHBOARD_ID) String strDashboardId) throws ThingsboardException {
         checkParameter("customerId", strCustomerId);
         checkParameter(DASHBOARD_ID, strDashboardId);
         try {

application/src/main/java/org/thingsboard/server/controller/DeviceController.java

@@ -106,10 +106,7 @@ public class DeviceController extends BaseController {
         try {
             device.setTenantId(getCurrentUser().getTenantId());
 
-            Operation operation = device.getId() == null ? Operation.CREATE : Operation.WRITE;
+            checkEntity(device.getId(), device, Resource.DEVICE);
-
-            accessControlService.checkPermission(getCurrentUser(), Resource.DEVICE, operation,
-                    device.getId(), device);
 
             Device savedDevice = checkNotNull(deviceService.saveDeviceWithAccessToken(device, accessToken));
 

application/src/main/java/org/thingsboard/server/controller/EntityViewController.java

@@ -101,10 +101,7 @@ public class EntityViewController extends BaseController {
         try {
             entityView.setTenantId(getCurrentUser().getTenantId());
 
-            Operation operation = entityView.getId() == null ? Operation.CREATE : Operation.WRITE;
+            checkEntity(entityView.getId(), entityView, Resource.ENTITY_VIEW);
-
-            accessControlService.checkPermission(getCurrentUser(), Resource.ENTITY_VIEW, operation,
-                    entityView.getId(), entityView);
 
             EntityView savedEntityView = checkNotNull(entityViewService.saveEntityView(entityView));
             List<ListenableFuture<List<Void>>> futures = new ArrayList<>();

application/src/main/java/org/thingsboard/server/controller/RuleChainController.java

@@ -125,10 +125,7 @@ public class RuleChainController extends BaseController {
             boolean created = ruleChain.getId() == null;
             ruleChain.setTenantId(getCurrentUser().getTenantId());
 
-            Operation operation = created ? Operation.CREATE : Operation.WRITE;
+            checkEntity(ruleChain.getId(), ruleChain, Resource.RULE_CHAIN);
-
-            accessControlService.checkPermission(getCurrentUser(), Resource.RULE_CHAIN, operation,
-                    ruleChain.getId(), ruleChain);
 
             RuleChain savedRuleChain = checkNotNull(ruleChainService.saveRuleChain(ruleChain));
 

application/src/main/java/org/thingsboard/server/controller/TenantController.java

@@ -72,10 +72,8 @@ public class TenantController extends BaseController {
         try {
             boolean newTenant = tenant.getId() == null;
 
-            Operation operation = newTenant ? Operation.CREATE : Operation.WRITE;
+            checkEntity(tenant.getId(), tenant, Resource.TENANT);
 
-            accessControlService.checkPermission(getCurrentUser(), Resource.TENANT, operation,
-                    tenant.getId(), tenant);
             tenant = checkNotNull(tenantService.saveTenant(tenant));
             if (newTenant) {
                 installScripts.createDefaultRuleChains(tenant.getId());

application/src/main/java/org/thingsboard/server/controller/UserController.java

@@ -132,17 +132,14 @@ public class UserController extends BaseController {
     @ResponseBody
     public User saveUser(@RequestBody User user,
                          @RequestParam(required = false, defaultValue = "true") boolean sendActivationMail,
-            HttpServletRequest request) throws ThingsboardException {
+                         HttpServletRequest request) throws ThingsboardException {
         try {
 
             if (Authority.TENANT_ADMIN.equals(getCurrentUser().getAuthority())) {
                 user.setTenantId(getCurrentUser().getTenantId());
             }
 
-            Operation operation = user.getId() == null ? Operation.CREATE : Operation.WRITE;
+            checkEntity(user.getId(), user, Resource.USER);
-
-            accessControlService.checkPermission(getCurrentUser(), Resource.USER, operation,
-                    user.getId(), user);
 
             boolean sendEmail = user.getId() == null && sendActivationMail;
             User savedUser = checkNotNull(userService.saveUser(user));

application/src/main/java/org/thingsboard/server/controller/WidgetTypeController.java

@@ -66,10 +66,7 @@ public class WidgetTypeController extends BaseController {
                 widgetType.setTenantId(getCurrentUser().getTenantId());
             }
 
-            Operation operation = widgetType.getId() == null ? Operation.CREATE : Operation.WRITE;
+            checkEntity(widgetType.getId(), widgetType, Resource.WIDGET_TYPE);
-
-            accessControlService.checkPermission(getCurrentUser(), Resource.WIDGET_TYPE, operation,
-                    widgetType.getId(), widgetType);
 
             return checkNotNull(widgetTypeService.saveWidgetType(widgetType));
         } catch (Exception e) {
@@ -92,7 +89,7 @@ public class WidgetTypeController extends BaseController {
     }
 
     @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN')")
-    @RequestMapping(value = "/widgetTypes", params = { "isSystem", "bundleAlias"}, method = RequestMethod.GET)
+    @RequestMapping(value = "/widgetTypes", params = {"isSystem", "bundleAlias"}, method = RequestMethod.GET)
     @ResponseBody
     public List<WidgetType> getBundleWidgetTypes(
             @RequestParam boolean isSystem,
@@ -111,7 +108,7 @@ public class WidgetTypeController extends BaseController {
     }
 
     @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')")
-    @RequestMapping(value = "/widgetType", params = { "isSystem", "bundleAlias", "alias" }, method = RequestMethod.GET)
+    @RequestMapping(value = "/widgetType", params = {"isSystem", "bundleAlias", "alias"}, method = RequestMethod.GET)
     @ResponseBody
     public WidgetType getWidgetType(
             @RequestParam boolean isSystem,

application/src/main/java/org/thingsboard/server/controller/WidgetsBundleController.java

@@ -67,11 +67,7 @@ public class WidgetsBundleController extends BaseController {
                 widgetsBundle.setTenantId(getCurrentUser().getTenantId());
             }
 
-            Operation operation = widgetsBundle.getId() == null ? Operation.CREATE : Operation.WRITE;
+            checkEntity(widgetsBundle.getId(), widgetsBundle, Resource.WIDGETS_BUNDLE);
-
-            accessControlService.checkPermission(getCurrentUser(), Resource.WIDGETS_BUNDLE, operation,
-                    widgetsBundle.getId(), widgetsBundle);
-
             return checkNotNull(widgetsBundleService.saveWidgetsBundle(widgetsBundle));
         } catch (Exception e) {
             throw handleException(e);

application/src/main/java/org/thingsboard/server/service/security/permission/Resource.java

@@ -46,4 +46,13 @@ public enum Resource {
     public Optional<EntityType> getEntityType() {
         return Optional.ofNullable(entityType);
     }
+
+    public static Resource of(EntityType entityType) {
+        for (Resource resource : Resource.values()) {
+            if (resource.getEntityType().get() == entityType) {
+                return resource;
+            }
+        }
+        throw new IllegalArgumentException("Unknown EntityType: " + entityType.name());
+    }
 }

application/src/test/java/org/thingsboard/server/controller/AbstractControllerTest.java

@@ -33,7 +33,6 @@ import org.junit.rules.TestRule;
 import org.junit.rules.TestWatcher;
 import org.junit.runner.Description;
 import org.junit.runner.RunWith;
-import org.mockito.Mockito;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.context.SpringBootContextLoader;
 import org.springframework.boot.test.context.SpringBootTest;
@@ -49,7 +48,6 @@ import org.springframework.mock.http.MockHttpOutputMessage;
 import org.springframework.test.annotation.DirtiesContext;
 import org.springframework.test.context.ActiveProfiles;
 import org.springframework.test.context.ContextConfiguration;
-import org.springframework.test.context.TestPropertySource;
 import org.springframework.test.context.junit4.SpringRunner;
 import org.springframework.test.context.web.WebAppConfiguration;
 import org.springframework.test.web.servlet.MockMvc;
@@ -76,7 +74,6 @@ import org.thingsboard.server.service.security.auth.jwt.RefreshTokenRequest;
 import org.thingsboard.server.service.security.auth.rest.LoginRequest;
 
 import java.io.IOException;
-import java.nio.charset.Charset;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Comparator;
@@ -224,6 +221,27 @@ public abstract class AbstractControllerTest {
         login(CUSTOMER_USER_EMAIL, CUSTOMER_USER_PASSWORD);
     }
 
+    private Tenant savedDifferentTenant;
+    protected void loginDifferentTenant() throws Exception {
+        loginSysAdmin();
+        Tenant tenant = new Tenant();
+        tenant.setTitle("Different tenant");
+        savedDifferentTenant = doPost("/api/tenant", tenant, Tenant.class);
+        Assert.assertNotNull(savedDifferentTenant);
+        User differentTenantAdmin = new User();
+        differentTenantAdmin.setAuthority(Authority.TENANT_ADMIN);
+        differentTenantAdmin.setTenantId(savedDifferentTenant.getId());
+        differentTenantAdmin.setEmail("different_tenant@thingsboard.org");
+
+        createUserAndLogin(differentTenantAdmin, "testPassword");
+    }
+
+    protected void deleteDifferentTenant() throws Exception {
+        loginSysAdmin();
+        doDelete("/api/tenant/" + savedDifferentTenant.getId().getId().toString())
+                .andExpect(status().isOk());
+    }
+
     protected User createUserAndLogin(User user, String password) throws Exception {
         User savedUser = doPost("/api/user", user, User.class);
         logout();

application/src/test/java/org/thingsboard/server/controller/BaseAssetControllerTest.java

@@ -98,6 +98,18 @@ public abstract class BaseAssetControllerTest extends AbstractControllerTest {
         Assert.assertEquals(foundAsset.getName(), savedAsset.getName());
     }
 
+    @Test
+    public void testUpdateAssetFromDifferentTenant() throws Exception {
+        Asset asset = new Asset();
+        asset.setName("My asset");
+        asset.setType("default");
+        Asset savedAsset = doPost("/api/asset", asset, Asset.class);
+
+        loginDifferentTenant();
+        doPost("/api/asset", savedAsset, Asset.class, status().isForbidden());
+        deleteDifferentTenant();
+    }
+
     @Test
     public void testFindAssetById() throws Exception {
         Asset asset = new Asset();

application/src/test/java/org/thingsboard/server/controller/BaseCustomerControllerTest.java

@@ -23,6 +23,8 @@ import java.util.Collections;
 import java.util.List;
 
 import org.apache.commons.lang3.RandomStringUtils;
+import org.junit.After;
+import org.junit.Before;
 import org.thingsboard.server.common.data.Customer;
 import org.thingsboard.server.common.data.Tenant;
 import org.thingsboard.server.common.data.User;
@@ -39,16 +41,19 @@ public abstract class BaseCustomerControllerTest extends AbstractControllerTest
 
     private IdComparator<Customer> idComparator = new IdComparator<>();
 
-    @Test
+    private Tenant savedTenant;
-    public void testSaveCustomer() throws Exception {
+    private User tenantAdmin;
+
+    @Before
+    public void beforeTest() throws Exception {
         loginSysAdmin();
 
         Tenant tenant = new Tenant();
         tenant.setTitle("My tenant");
-        Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class);
+        savedTenant = doPost("/api/tenant", tenant, Tenant.class);
         Assert.assertNotNull(savedTenant);
 
-        User tenantAdmin = new User();
+        tenantAdmin = new User();
         tenantAdmin.setAuthority(Authority.TENANT_ADMIN);
         tenantAdmin.setTenantId(savedTenant.getId());
         tenantAdmin.setEmail("tenant2@thingsboard.org");
@@ -56,7 +61,18 @@ public abstract class BaseCustomerControllerTest extends AbstractControllerTest
         tenantAdmin.setLastName("Downs");
 
         tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1");
+    }
 
+    @After
+    public void afterTest() throws Exception {
+        loginSysAdmin();
+
+        doDelete("/api/tenant/" + savedTenant.getId().getId().toString())
+                .andExpect(status().isOk());
+    }
+
+    @Test
+    public void testSaveCustomer() throws Exception {
         Customer customer = new Customer();
         customer.setTitle("My customer");
         Customer savedCustomer = doPost("/api/customer", customer, Customer.class);
@@ -72,171 +88,83 @@ public abstract class BaseCustomerControllerTest extends AbstractControllerTest
 
         doDelete("/api/customer/"+savedCustomer.getId().getId().toString())
         .andExpect(status().isOk());
-        
-        loginSysAdmin();
-        
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
     }
 
     @Test
-    public void testFindCustomerById() throws Exception {
+    public void testUpdateCustomerFromDifferentTenant() throws Exception {
-        
+        Customer customer = new Customer();
-        loginSysAdmin();
+        customer.setTitle("My customer");
+        Customer savedCustomer = doPost("/api/customer", customer, Customer.class);
+        doPost("/api/customer", savedCustomer, Customer.class);
 
-        Tenant tenant = new Tenant();
+        loginDifferentTenant();
-        tenant.setTitle("My tenant");
+        doPost("/api/customer", savedCustomer, Customer.class, status().isForbidden());
-        Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class);
+        deleteDifferentTenant();
-        Assert.assertNotNull(savedTenant);
 
-        User tenantAdmin = new User();
+        login(tenantAdmin.getName(), "testPassword1");
-        tenantAdmin.setAuthority(Authority.TENANT_ADMIN);
+        doDelete("/api/customer/" + savedCustomer.getId().getId().toString())
-        tenantAdmin.setTenantId(savedTenant.getId());
+                .andExpect(status().isOk());
-        tenantAdmin.setEmail("tenant2@thingsboard.org");
+    }
-        tenantAdmin.setFirstName("Joe");
-        tenantAdmin.setLastName("Downs");
-        
-        tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1");
 
+    @Test
+    public void testFindCustomerById() throws Exception {
         Customer customer = new Customer();
         customer.setTitle("My customer");
         Customer savedCustomer = doPost("/api/customer", customer, Customer.class);
 
-        Customer foundCustomer = doGet("/api/customer/"+savedCustomer.getId().getId().toString(), Customer.class);
+        Customer foundCustomer = doGet("/api/customer/" + savedCustomer.getId().getId().toString(), Customer.class);
         Assert.assertNotNull(foundCustomer);
         Assert.assertEquals(savedCustomer, foundCustomer);
 
-        doDelete("/api/customer/"+savedCustomer.getId().getId().toString())
+        doDelete("/api/customer/" + savedCustomer.getId().getId().toString())
-        .andExpect(status().isOk());
+                .andExpect(status().isOk());
-        
-        loginSysAdmin();
-        
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
     }
 
     @Test
     public void testDeleteCustomer() throws Exception {
-        
-        loginSysAdmin();
-
-        Tenant tenant = new Tenant();
-        tenant.setTitle("My tenant");
-        Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class);
-        Assert.assertNotNull(savedTenant);
-        
-        User tenantAdmin = new User();
-        tenantAdmin.setAuthority(Authority.TENANT_ADMIN);
-        tenantAdmin.setTenantId(savedTenant.getId());
-        tenantAdmin.setEmail("tenant2@thingsboard.org");
-        tenantAdmin.setFirstName("Joe");
-        tenantAdmin.setLastName("Downs");
-        
-        tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1");
-        
         Customer customer = new Customer();
         customer.setTitle("My customer");
         Customer savedCustomer = doPost("/api/customer", customer, Customer.class);
 
-        doDelete("/api/customer/"+savedCustomer.getId().getId().toString())
+        doDelete("/api/customer/" + savedCustomer.getId().getId().toString())
-        .andExpect(status().isOk());
+                .andExpect(status().isOk());
-
-        doGet("/api/customer/"+savedCustomer.getId().getId().toString())
-        .andExpect(status().isNotFound());
 
-        loginSysAdmin();
+        doGet("/api/customer/" + savedCustomer.getId().getId().toString())
-        
+                .andExpect(status().isNotFound());
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
     }
 
     @Test
     public void testSaveCustomerWithEmptyTitle() throws Exception {
-        
-        loginSysAdmin();
-
-        Tenant tenant = new Tenant();
-        tenant.setTitle("My tenant");
-        Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class);
-        Assert.assertNotNull(savedTenant);
-        
-        User tenantAdmin = new User();
-        tenantAdmin.setAuthority(Authority.TENANT_ADMIN);
-        tenantAdmin.setTenantId(savedTenant.getId());
-        tenantAdmin.setEmail("tenant2@thingsboard.org");
-        tenantAdmin.setFirstName("Joe");
-        tenantAdmin.setLastName("Downs");
-        
-        tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1");
-        
         Customer customer = new Customer();
         doPost("/api/customer", customer)
-        .andExpect(status().isBadRequest())
+                .andExpect(status().isBadRequest())
-        .andExpect(statusReason(containsString("Customer title should be specified")));
+                .andExpect(statusReason(containsString("Customer title should be specified")));
-        
-        loginSysAdmin();
-        
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
     }
 
     @Test
     public void testSaveCustomerWithInvalidEmail() throws Exception {
-        
-        loginSysAdmin();
-
-        Tenant tenant = new Tenant();
-        tenant.setTitle("My tenant");
-        Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class);
-        Assert.assertNotNull(savedTenant);
-        
-        User tenantAdmin = new User();
-        tenantAdmin.setAuthority(Authority.TENANT_ADMIN);
-        tenantAdmin.setTenantId(savedTenant.getId());
-        tenantAdmin.setEmail("tenant2@thingsboard.org");
-        tenantAdmin.setFirstName("Joe");
-        tenantAdmin.setLastName("Downs");
-        
-        tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1");
-        
         Customer customer = new Customer();
         customer.setTitle("My customer");
         customer.setEmail("invalid@mail");
         doPost("/api/customer", customer)
-        .andExpect(status().isBadRequest())
+                .andExpect(status().isBadRequest())
-        .andExpect(statusReason(containsString("Invalid email address format 'invalid@mail'")));
+                .andExpect(statusReason(containsString("Invalid email address format 'invalid@mail'")));
-        
-        loginSysAdmin();
 
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
+//        loginSysAdmin();
-        .andExpect(status().isOk());
+//
+//        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
+//        .andExpect(status().isOk());
     }
 
     @Test
     public void testFindCustomers() throws Exception {
-        loginSysAdmin();
-
-        Tenant tenant = new Tenant();
-        tenant.setTitle("My tenant");
-        Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class);
-        Assert.assertNotNull(savedTenant);
-        
         TenantId tenantId = savedTenant.getId();
 
-        User tenantAdmin = new User();
-        tenantAdmin.setAuthority(Authority.TENANT_ADMIN);
-        tenantAdmin.setTenantId(tenantId);
-        tenantAdmin.setEmail("tenant2@thingsboard.org");
-        tenantAdmin.setFirstName("Joe");
-        tenantAdmin.setLastName("Downs");
-        
-        tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1");
-        
         List<Customer> customers = new ArrayList<>();
-        for (int i=0;i<135;i++) {
+        for (int i = 0; i < 135; i++) {
             Customer customer = new Customer();
             customer.setTenantId(tenantId);
-            customer.setTitle("Customer"+i);
+            customer.setTitle("Customer" + i);
             customers.add(doPost("/api/customer", customer, Customer.class));
         }
 
@@ -255,52 +183,30 @@ public abstract class BaseCustomerControllerTest extends AbstractControllerTest
         Collections.sort(loadedCustomers, idComparator);
 
         Assert.assertEquals(customers, loadedCustomers);
-        
-        loginSysAdmin();
-        
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
     }
 
     @Test
     public void testFindCustomersByTitle() throws Exception {
-        
-        loginSysAdmin();
-        
-        Tenant tenant = new Tenant();
-        tenant.setTitle("My tenant");
-        Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class);
-        Assert.assertNotNull(savedTenant);
-        
         TenantId tenantId = savedTenant.getId();
 
-        User tenantAdmin = new User();
-        tenantAdmin.setAuthority(Authority.TENANT_ADMIN);
-        tenantAdmin.setTenantId(tenantId);
-        tenantAdmin.setEmail("tenant2@thingsboard.org");
-        tenantAdmin.setFirstName("Joe");
-        tenantAdmin.setLastName("Downs");
-        
-        tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1");
-        
         String title1 = "Customer title 1";
         List<Customer> customersTitle1 = new ArrayList<>();
-        for (int i=0;i<143;i++) {
+        for (int i = 0; i < 143; i++) {
             Customer customer = new Customer();
             customer.setTenantId(tenantId);
-            String suffix = RandomStringUtils.randomAlphanumeric((int)(5 + Math.random()*10));
+            String suffix = RandomStringUtils.randomAlphanumeric((int) (5 + Math.random() * 10));
-            String title = title1+suffix;
+            String title = title1 + suffix;
             title = i % 2 == 0 ? title.toLowerCase() : title.toUpperCase();
             customer.setTitle(title);
             customersTitle1.add(doPost("/api/customer", customer, Customer.class));
         }
         String title2 = "Customer title 2";
         List<Customer> customersTitle2 = new ArrayList<>();
-        for (int i=0;i<175;i++) {
+        for (int i = 0; i < 175; i++) {
             Customer customer = new Customer();
             customer.setTenantId(tenantId);
-            String suffix = RandomStringUtils.randomAlphanumeric((int)(5 + Math.random()*10));
+            String suffix = RandomStringUtils.randomAlphanumeric((int) (5 + Math.random() * 10));
-            String title = title2+suffix;
+            String title = title2 + suffix;
             title = i % 2 == 0 ? title.toLowerCase() : title.toUpperCase();
             customer.setTitle(title);
             customersTitle2.add(doPost("/api/customer", customer, Customer.class));
@@ -338,8 +244,8 @@ public abstract class BaseCustomerControllerTest extends AbstractControllerTest
         Assert.assertEquals(customersTitle2, loadedCustomersTitle2);
 
         for (Customer customer : loadedCustomersTitle1) {
-            doDelete("/api/customer/"+customer.getId().getId().toString())
+            doDelete("/api/customer/" + customer.getId().getId().toString())
-            .andExpect(status().isOk());    
+                    .andExpect(status().isOk());
         }
 
         pageLink = new PageLink(4, 0, title1);
@@ -348,19 +254,14 @@ public abstract class BaseCustomerControllerTest extends AbstractControllerTest
         Assert.assertEquals(0, pageData.getData().size());
 
         for (Customer customer : loadedCustomersTitle2) {
-            doDelete("/api/customer/"+customer.getId().getId().toString())
+            doDelete("/api/customer/" + customer.getId().getId().toString())
-            .andExpect(status().isOk());    
+                    .andExpect(status().isOk());
         }
 
         pageLink = new PageLink(4, 0, title2);
         pageData = doGetTypedWithPageLink("/api/customers?", new TypeReference<PageData<Customer>>(){}, pageLink);
         Assert.assertFalse(pageData.hasNext());
         Assert.assertEquals(0, pageData.getData().size());
-        
-        loginSysAdmin();
-        
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
     }
 
 }

application/src/test/java/org/thingsboard/server/controller/BaseDashboardControllerTest.java

@@ -16,10 +16,8 @@
 package org.thingsboard.server.controller;
 
 import static org.hamcrest.Matchers.containsString;
-import static org.thingsboard.server.dao.model.ModelConstants.NULL_UUID;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
 
-import java.sql.Time;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
@@ -32,7 +30,6 @@ import org.thingsboard.server.common.data.page.PageData;
 import org.thingsboard.server.common.data.page.PageLink;
 import org.thingsboard.server.common.data.page.TimePageLink;
 import org.thingsboard.server.common.data.security.Authority;
-import org.thingsboard.server.dao.model.ModelConstants;
 import org.junit.After;
 import org.junit.Assert;
 import org.junit.Before;
@@ -93,6 +90,17 @@ public abstract class BaseDashboardControllerTest extends AbstractControllerTest
         Assert.assertEquals(foundDashboard.getTitle(), savedDashboard.getTitle());
     }
 
+    @Test
+    public void testUpdateDashboardFromDifferentTenant() throws Exception {
+        Dashboard dashboard = new Dashboard();
+        dashboard.setTitle("My dashboard");
+        Dashboard savedDashboard = doPost("/api/dashboard", dashboard, Dashboard.class);
+
+        loginDifferentTenant();
+        doPost("/api/dashboard", savedDashboard, Dashboard.class, status().isForbidden());
+        deleteDifferentTenant();
+    }
+    
     @Test
     public void testFindDashboardById() throws Exception {
         Dashboard dashboard = new Dashboard();

application/src/test/java/org/thingsboard/server/controller/BaseDeviceControllerTest.java

@@ -108,6 +108,17 @@ public abstract class BaseDeviceControllerTest extends AbstractControllerTest {
         Assert.assertEquals(foundDevice.getName(), savedDevice.getName());
     }
 
+    @Test
+    public void testUpdateDeviceFromDifferentTenant() throws Exception {
+        Device device = new Device();
+        device.setName("My device");
+        device.setType("default");
+        Device savedDevice = doPost("/api/device", device, Device.class);
+        loginDifferentTenant();
+        doPost("/api/device", savedDevice, Device.class, status().isForbidden());
+        deleteDifferentTenant();
+    }
+    
     @Test
     public void testFindDeviceById() throws Exception {
         Device device = new Device();

application/src/test/java/org/thingsboard/server/controller/BaseEntityViewControllerTest.java

@@ -25,7 +25,6 @@ import org.eclipse.paho.client.mqttv3.MqttMessage;
 import org.junit.After;
 import org.junit.Assert;
 import org.junit.Before;
-import org.junit.Ignore;
 import org.junit.Test;
 import org.thingsboard.server.common.data.*;
 import org.thingsboard.server.common.data.id.CustomerId;
@@ -128,6 +127,15 @@ public abstract class BaseEntityViewControllerTest extends AbstractControllerTes
         assertEquals(foundEntityView.getKeys(), telemetry);
     }
 
+
+    @Test
+    public void testUpdateEntityViewFromDifferentTenant() throws Exception {
+        EntityView savedView = getNewSavedEntityView("Test entity view");
+        loginDifferentTenant();
+        doPost("/api/entityView", savedView, EntityView.class, status().isForbidden());
+        deleteDifferentTenant();
+    }
+
     @Test
     public void testDeleteEntityView() throws Exception {
         EntityView view = getNewSavedEntityView("Test entity view");

application/src/test/java/org/thingsboard/server/controller/BaseUserControllerTest.java

@@ -38,7 +38,9 @@ import java.util.List;
 
 import static org.hamcrest.Matchers.containsString;
 import static org.hamcrest.Matchers.is;
-import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
 
 public abstract class BaseUserControllerTest extends AbstractControllerTest {
 
@@ -66,13 +68,13 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
         Assert.assertTrue(savedUser.getCreatedTime() > 0);
         Assert.assertEquals(user.getEmail(), savedUser.getEmail());
 
-        User foundUser = doGet("/api/user/"+savedUser.getId().getId().toString(), User.class); 
+        User foundUser = doGet("/api/user/" + savedUser.getId().getId().toString(), User.class);
         Assert.assertEquals(foundUser, savedUser);
 
         logout();
         doGet("/api/noauth/activate?activateToken={activateToken}", TestMailService.currentActivateToken)
-        .andExpect(status().isSeeOther())
+                .andExpect(status().isSeeOther())
-        .andExpect(header().string(HttpHeaders.LOCATION, "/login/createPassword?activateToken=" + TestMailService.currentActivateToken));
+                .andExpect(header().string(HttpHeaders.LOCATION, "/login/createPassword?activateToken=" + TestMailService.currentActivateToken));
 
         JsonNode activateRequest = new ObjectMapper().createObjectNode()
                 .put("activateToken", TestMailService.currentActivateToken)
@@ -82,25 +84,50 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
         validateAndSetJwtToken(tokenInfo, email);
 
         doGet("/api/auth/user")
-        .andExpect(status().isOk())
+                .andExpect(status().isOk())
-        .andExpect(jsonPath("$.authority",is(Authority.TENANT_ADMIN.name())))
+                .andExpect(jsonPath("$.authority", is(Authority.TENANT_ADMIN.name())))
-        .andExpect(jsonPath("$.email",is(email)));
+                .andExpect(jsonPath("$.email", is(email)));
 
         logout();
 
         login(email, "testPassword");
 
         doGet("/api/auth/user")
-        .andExpect(status().isOk())
+                .andExpect(status().isOk())
-        .andExpect(jsonPath("$.authority",is(Authority.TENANT_ADMIN.name())))
+                .andExpect(jsonPath("$.authority", is(Authority.TENANT_ADMIN.name())))
-        .andExpect(jsonPath("$.email",is(email)));
+                .andExpect(jsonPath("$.email", is(email)));
 
         loginSysAdmin();
-        doDelete("/api/user/"+savedUser.getId().getId().toString())
+        doDelete("/api/user/" + savedUser.getId().getId().toString())
-        .andExpect(status().isOk());
+                .andExpect(status().isOk());
 
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
+        doDelete("/api/tenant/" + savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
+                .andExpect(status().isOk());
+    }
+
+    @Test
+    public void testUpdateUserFromDifferentTenant() throws Exception {
+        loginSysAdmin();
+        Tenant tenant = new Tenant();
+        tenant.setTitle("My tenant");
+        Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class);
+        Assert.assertNotNull(savedTenant);
+
+        User tenantAdmin = new User();
+        tenantAdmin.setAuthority(Authority.TENANT_ADMIN);
+        tenantAdmin.setTenantId(savedTenant.getId());
+        tenantAdmin.setEmail("tenant2@thingsboard.org");
+        tenantAdmin.setFirstName("Joe");
+        tenantAdmin.setLastName("Downs");
+        tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1");
+
+        loginDifferentTenant();
+        doPost("/api/user", tenantAdmin, User.class, status().isForbidden());
+        deleteDifferentTenant();
+
+        loginSysAdmin();
+        doDelete("/api/tenant/" + savedTenant.getId().getId().toString())
+                .andExpect(status().isOk());
     }
 
     @Test
@@ -127,10 +154,10 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
                 .put("email", email);
 
         doPost("/api/noauth/resetPasswordByEmail", resetPasswordByEmailRequest)
-        .andExpect(status().isOk());
+                .andExpect(status().isOk());
         doGet("/api/noauth/resetPassword?resetToken={resetToken}", TestMailService.currentResetPasswordToken)
-        .andExpect(status().isSeeOther())
+                .andExpect(status().isSeeOther())
-        .andExpect(header().string(HttpHeaders.LOCATION, "/login/resetPassword?resetToken=" + TestMailService.currentResetPasswordToken));
+                .andExpect(header().string(HttpHeaders.LOCATION, "/login/resetPassword?resetToken=" + TestMailService.currentResetPasswordToken));
 
         JsonNode resetPasswordRequest = new ObjectMapper().createObjectNode()
                 .put("resetToken", TestMailService.currentResetPasswordToken)
@@ -140,24 +167,24 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
         validateAndSetJwtToken(tokenInfo, email);
 
         doGet("/api/auth/user")
-        .andExpect(status().isOk())
+                .andExpect(status().isOk())
-        .andExpect(jsonPath("$.authority",is(Authority.TENANT_ADMIN.name())))
+                .andExpect(jsonPath("$.authority", is(Authority.TENANT_ADMIN.name())))
-        .andExpect(jsonPath("$.email",is(email)));
+                .andExpect(jsonPath("$.email", is(email)));
 
         logout();
 
         login(email, "testPassword2");
         doGet("/api/auth/user")
-        .andExpect(status().isOk())
+                .andExpect(status().isOk())
-        .andExpect(jsonPath("$.authority",is(Authority.TENANT_ADMIN.name())))
+                .andExpect(jsonPath("$.authority", is(Authority.TENANT_ADMIN.name())))
-        .andExpect(jsonPath("$.email",is(email)));
+                .andExpect(jsonPath("$.email", is(email)));
 
         loginSysAdmin();
-        doDelete("/api/user/"+savedUser.getId().getId().toString())
+        doDelete("/api/user/" + savedUser.getId().getId().toString())
-        .andExpect(status().isOk());
+                .andExpect(status().isOk());
 
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
+        doDelete("/api/tenant/" + savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
+                .andExpect(status().isOk());
     }
 
     @Test
@@ -178,12 +205,12 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
         user.setLastName("Downs");
 
         User savedUser = doPost("/api/user", user, User.class);
-        User foundUser = doGet("/api/user/"+savedUser.getId().getId().toString(), User.class); 
+        User foundUser = doGet("/api/user/" + savedUser.getId().getId().toString(), User.class);
         Assert.assertNotNull(foundUser);
         Assert.assertEquals(savedUser, foundUser);
 
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
+        doDelete("/api/tenant/" + savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
+                .andExpect(status().isOk());
     }
 
     @Test
@@ -204,11 +231,11 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
         user.setLastName("Downs");
 
         doPost("/api/user", user)
-        .andExpect(status().isBadRequest())
+                .andExpect(status().isBadRequest())
-        .andExpect(statusReason(containsString("User with email '" + email + "'  already present in database")));
+                .andExpect(statusReason(containsString("User with email '" + email + "'  already present in database")));
 
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
+        doDelete("/api/tenant/" + savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
+                .andExpect(status().isOk());
     }
 
     @Test
@@ -229,11 +256,11 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
         user.setLastName("Downs");
 
         doPost("/api/user", user)
-        .andExpect(status().isBadRequest())
+                .andExpect(status().isBadRequest())
-        .andExpect(statusReason(containsString("Invalid email address format '" + email + "'")));
+                .andExpect(statusReason(containsString("Invalid email address format '" + email + "'")));
 
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
+        doDelete("/api/tenant/" + savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
+                .andExpect(status().isOk());
     }
 
     @Test
@@ -252,11 +279,11 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
         user.setLastName("Downs");
 
         doPost("/api/user", user)
-        .andExpect(status().isBadRequest())
+                .andExpect(status().isBadRequest())
-        .andExpect(statusReason(containsString("User email should be specified")));
+                .andExpect(statusReason(containsString("User email should be specified")));
 
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
+        doDelete("/api/tenant/" + savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
+                .andExpect(status().isOk());
     }
 
     @Test
@@ -270,8 +297,8 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
         user.setLastName("Downs");
 
         doPost("/api/user", user)
-        .andExpect(status().isBadRequest())
+                .andExpect(status().isBadRequest())
-        .andExpect(statusReason(containsString("Tenant administrator should be assigned to tenant")));
+                .andExpect(statusReason(containsString("Tenant administrator should be assigned to tenant")));
     }
 
     @Test
@@ -292,17 +319,17 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
         user.setLastName("Downs");
 
         User savedUser = doPost("/api/user", user, User.class);
-        User foundUser = doGet("/api/user/"+savedUser.getId().getId().toString(), User.class); 
+        User foundUser = doGet("/api/user/" + savedUser.getId().getId().toString(), User.class);
         Assert.assertNotNull(foundUser);
 
-        doDelete("/api/user/"+savedUser.getId().getId().toString())
+        doDelete("/api/user/" + savedUser.getId().getId().toString())
-        .andExpect(status().isOk());
+                .andExpect(status().isOk());
 
-        doGet("/api/user/"+savedUser.getId().getId().toString())
+        doGet("/api/user/" + savedUser.getId().getId().toString())
-        .andExpect(status().isNotFound());
+                .andExpect(status().isNotFound());
 
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
+        doDelete("/api/tenant/" + savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
+                .andExpect(status().isOk());
     }
 
     @Test
@@ -317,7 +344,7 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
         TenantId tenantId = savedTenant.getId();
 
         List<User> tenantAdmins = new ArrayList<>();
-        for (int i=0;i<64;i++) {
+        for (int i = 0; i < 64; i++) {
             User user = new User();
             user.setAuthority(Authority.TENANT_ADMIN);
             user.setTenantId(tenantId);
@@ -367,12 +394,12 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
         String email1 = "testEmail1";
         List<User> tenantAdminsEmail1 = new ArrayList<>();
 
-        for (int i=0;i<124;i++) {
+        for (int i = 0; i < 124; i++) {
             User user = new User();
             user.setAuthority(Authority.TENANT_ADMIN);
             user.setTenantId(tenantId);
-            String suffix = RandomStringUtils.randomAlphanumeric((int)(5 + Math.random()*10));
+            String suffix = RandomStringUtils.randomAlphanumeric((int) (5 + Math.random() * 10));
-            String email = email1+suffix+ "@thingsboard.org";
+            String email = email1 + suffix + "@thingsboard.org";
             email = i % 2 == 0 ? email.toLowerCase() : email.toUpperCase();
             user.setEmail(email);
             tenantAdminsEmail1.add(doPost("/api/user", user, User.class));
@@ -381,12 +408,12 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
         String email2 = "testEmail2";
         List<User> tenantAdminsEmail2 = new ArrayList<>();
 
-        for (int i=0;i<112;i++) {
+        for (int i = 0; i < 112; i++) {
             User user = new User();
             user.setAuthority(Authority.TENANT_ADMIN);
             user.setTenantId(tenantId);
-            String suffix = RandomStringUtils.randomAlphanumeric((int)(5 + Math.random()*10));
+            String suffix = RandomStringUtils.randomAlphanumeric((int) (5 + Math.random() * 10));
-            String email = email2+suffix+ "@thingsboard.org";
+            String email = email2 + suffix + "@thingsboard.org";
             email = i % 2 == 0 ? email.toLowerCase() : email.toUpperCase();
             user.setEmail(email);
             tenantAdminsEmail2.add(doPost("/api/user", user, User.class));
@@ -426,8 +453,8 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
         Assert.assertEquals(tenantAdminsEmail2, loadedTenantAdminsEmail2);
 
         for (User user : loadedTenantAdminsEmail1) {
-            doDelete("/api/user/"+user.getId().getId().toString())
+            doDelete("/api/user/" + user.getId().getId().toString())
-                .andExpect(status().isOk());
+                    .andExpect(status().isOk());
         }
 
         pageLink = new PageLink(4, 0, email1);
@@ -437,8 +464,8 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
         Assert.assertEquals(0, pageData.getData().size());
 
         for (User user : loadedTenantAdminsEmail2) {
-            doDelete("/api/user/"+user.getId().getId().toString())
+            doDelete("/api/user/" + user.getId().getId().toString())
-                .andExpect(status().isOk());
+                    .andExpect(status().isOk());
         }
 
         pageLink = new PageLink(4, 0, email2);
@@ -447,8 +474,8 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
         Assert.assertFalse(pageData.hasNext());
         Assert.assertEquals(0, pageData.getData().size());
 
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
+        doDelete("/api/tenant/" + savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
+                .andExpect(status().isOk());
     }
 
     @Test
@@ -477,7 +504,7 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
         CustomerId customerId = savedCustomer.getId();
 
         List<User> customerUsers = new ArrayList<>();
-        for (int i=0;i<56;i++) {
+        for (int i = 0; i < 56; i++) {
             User user = new User();
             user.setAuthority(Authority.CUSTOMER_USER);
             user.setCustomerId(customerId);
@@ -502,13 +529,13 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
 
         Assert.assertEquals(customerUsers, loadedCustomerUsers);
 
-        doDelete("/api/customer/"+customerId.getId().toString())
+        doDelete("/api/customer/" + customerId.getId().toString())
-        .andExpect(status().isOk());
+                .andExpect(status().isOk());
 
         loginSysAdmin();
 
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
+        doDelete("/api/tenant/" + savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
+                .andExpect(status().isOk());
     }
 
     @Test
@@ -539,12 +566,12 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
         String email1 = "testEmail1";
         List<User> customerUsersEmail1 = new ArrayList<>();
 
-        for (int i=0;i<74;i++) {
+        for (int i = 0; i < 74; i++) {
             User user = new User();
             user.setAuthority(Authority.CUSTOMER_USER);
             user.setCustomerId(customerId);
-            String suffix = RandomStringUtils.randomAlphanumeric((int)(5 + Math.random()*10));
+            String suffix = RandomStringUtils.randomAlphanumeric((int) (5 + Math.random() * 10));
-            String email = email1+suffix+ "@thingsboard.org";
+            String email = email1 + suffix + "@thingsboard.org";
             email = i % 2 == 0 ? email.toLowerCase() : email.toUpperCase();
             user.setEmail(email);
             customerUsersEmail1.add(doPost("/api/user", user, User.class));
@@ -553,12 +580,12 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
         String email2 = "testEmail2";
         List<User> customerUsersEmail2 = new ArrayList<>();
 
-        for (int i=0;i<92;i++) {
+        for (int i = 0; i < 92; i++) {
             User user = new User();
             user.setAuthority(Authority.CUSTOMER_USER);
             user.setCustomerId(customerId);
-            String suffix = RandomStringUtils.randomAlphanumeric((int)(5 + Math.random()*10));
+            String suffix = RandomStringUtils.randomAlphanumeric((int) (5 + Math.random() * 10));
-            String email = email2+suffix+ "@thingsboard.org";
+            String email = email2 + suffix + "@thingsboard.org";
             email = i % 2 == 0 ? email.toLowerCase() : email.toUpperCase();
             user.setEmail(email);
             customerUsersEmail2.add(doPost("/api/user", user, User.class));
@@ -598,8 +625,8 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
         Assert.assertEquals(customerUsersEmail2, loadedCustomerUsersEmail2);
 
         for (User user : loadedCustomerUsersEmail1) {
-            doDelete("/api/user/"+user.getId().getId().toString())
+            doDelete("/api/user/" + user.getId().getId().toString())
-            .andExpect(status().isOk());
+                    .andExpect(status().isOk());
         }
 
         pageLink = new PageLink(4, 0, email1);
@@ -609,8 +636,8 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
         Assert.assertEquals(0, pageData.getData().size());
 
         for (User user : loadedCustomerUsersEmail2) {
-            doDelete("/api/user/"+user.getId().getId().toString())
+            doDelete("/api/user/" + user.getId().getId().toString())
-            .andExpect(status().isOk());
+                    .andExpect(status().isOk());
         }
 
         pageLink = new PageLink(4, 0, email2);
@@ -619,13 +646,13 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
         Assert.assertFalse(pageData.hasNext());
         Assert.assertEquals(0, pageData.getData().size());
 
-        doDelete("/api/customer/"+customerId.getId().toString())
+        doDelete("/api/customer/" + customerId.getId().toString())
-        .andExpect(status().isOk());
+                .andExpect(status().isOk());
 
         loginSysAdmin();
 
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
+        doDelete("/api/tenant/" + savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
+                .andExpect(status().isOk());
     }
 
 }

application/src/test/java/org/thingsboard/server/controller/BaseWidgetTypeControllerTest.java

@@ -64,7 +64,6 @@ public abstract class BaseWidgetTypeControllerTest extends AbstractControllerTes
         WidgetsBundle widgetsBundle = new WidgetsBundle();
         widgetsBundle.setTitle("My widgets bundle");
         savedWidgetsBundle = doPost("/api/widgetsBundle", widgetsBundle, WidgetsBundle.class);
-
     }
 
     @After
@@ -100,6 +99,19 @@ public abstract class BaseWidgetTypeControllerTest extends AbstractControllerTes
         Assert.assertEquals(foundWidgetType.getName(), savedWidgetType.getName());
     }
 
+    @Test
+    public void testUpdateWidgetTypeFromDifferentTenant() throws Exception {
+        WidgetType widgetType = new WidgetType();
+        widgetType.setBundleAlias(savedWidgetsBundle.getAlias());
+        widgetType.setName("Widget Type");
+        widgetType.setDescriptor(new ObjectMapper().readValue("{ \"someKey\": \"someValue\" }", JsonNode.class));
+        WidgetType savedWidgetType = doPost("/api/widgetType", widgetType, WidgetType.class);
+
+        loginDifferentTenant();
+        doPost("/api/widgetType", savedWidgetType, WidgetType.class, status().isForbidden());
+        deleteDifferentTenant();
+    }
+
     @Test
     public void testFindWidgetTypeById() throws Exception {
         WidgetType widgetType = new WidgetType();

application/src/test/java/org/thingsboard/server/controller/BaseWidgetsBundleControllerTest.java

@@ -88,6 +88,17 @@ public abstract class BaseWidgetsBundleControllerTest extends AbstractController
         Assert.assertEquals(foundWidgetsBundle.getTitle(), savedWidgetsBundle.getTitle());
     }
 
+    @Test
+    public void testUpdateWidgetsBundleFromDifferentTenant() throws Exception {
+        WidgetsBundle widgetsBundle = new WidgetsBundle();
+        widgetsBundle.setTitle("My widgets bundle");
+        WidgetsBundle savedWidgetsBundle = doPost("/api/widgetsBundle", widgetsBundle, WidgetsBundle.class);
+
+        loginDifferentTenant();
+        doPost("/api/widgetsBundle", savedWidgetsBundle, WidgetsBundle.class, status().isForbidden());
+        deleteDifferentTenant();
+    }
+
     @Test
     public void testFindWidgetsBundleById() throws Exception {
         WidgetsBundle widgetsBundle = new WidgetsBundle();