added test update entity by different tenant to controllers tests

application/src/main/java/org/thingsboard/server/controller/AlarmController.java

@@ -85,7 +85,7 @@ public class AlarmController extends BaseController {
         try {
             alarm.setTenantId(getCurrentUser().getTenantId());
 
-           checkEntity(alarm.getId(), alarm);
+           checkEntity(alarm.getId(), alarm, Resource.ALARM);
 
             Alarm savedAlarm = checkNotNull(alarmService.createOrUpdateAlarm(alarm));
             logEntityAction(savedAlarm.getId(), savedAlarm,

application/src/main/java/org/thingsboard/server/controller/AssetController.java

@@ -76,7 +76,7 @@ public class AssetController extends BaseController {
         try {
             asset.setTenantId(getCurrentUser().getTenantId());
 
-           checkEntity(asset.getId(), asset);
+           checkEntity(asset.getId(), asset, Resource.ASSET);
 
             Asset savedAsset = checkNotNull(assetService.saveAsset(asset));
 

application/src/main/java/org/thingsboard/server/controller/BaseController.java

@@ -330,10 +330,10 @@ public abstract class BaseController {
         }
     }
 
-    protected <I extends EntityId, T extends HasTenantId> void checkEntity(I entityId, T entity) throws ThingsboardException {
+    protected <I extends EntityId, T extends HasTenantId> void checkEntity(I entityId, T entity, Resource resource) throws ThingsboardException {
         if (entityId == null) {
             accessControlService
-                    .checkPermission(getCurrentUser(), Resource.ALARM, Operation.CREATE, null, entity);
+                    .checkPermission(getCurrentUser(), resource, Operation.CREATE, null, entity);
         } else {
             checkEntityId(entityId, Operation.WRITE);
         }

application/src/main/java/org/thingsboard/server/controller/CustomerController.java

@@ -100,7 +100,7 @@ public class CustomerController extends BaseController {
         try {
             customer.setTenantId(getCurrentUser().getTenantId());
 
-            checkEntity(customer.getId(), customer);
+            checkEntity(customer.getId(), customer, Resource.CUSTOMER);
 
             Customer savedCustomer = checkNotNull(customerService.saveCustomer(customer));
 

application/src/main/java/org/thingsboard/server/controller/DeviceController.java

@@ -92,7 +92,7 @@ public class DeviceController extends BaseController {
         try {
             device.setTenantId(getCurrentUser().getTenantId());
 
-            checkEntity(device.getId(), device);
+            checkEntity(device.getId(), device, Resource.DEVICE);
 
             Device savedDevice = checkNotNull(deviceService.saveDeviceWithAccessToken(device, accessToken));
 

application/src/main/java/org/thingsboard/server/controller/EntityViewController.java

@@ -92,7 +92,7 @@ public class EntityViewController extends BaseController {
         try {
             entityView.setTenantId(getCurrentUser().getTenantId());
 
-            checkEntity(entityView.getId(), entityView);
+            checkEntity(entityView.getId(), entityView, Resource.ENTITY_VIEW);
 
             EntityView savedEntityView = checkNotNull(entityViewService.saveEntityView(entityView));
             List<ListenableFuture<List<Void>>> futures = new ArrayList<>();

application/src/main/java/org/thingsboard/server/controller/RuleChainController.java

@@ -126,7 +126,7 @@ public class RuleChainController extends BaseController {
             boolean created = ruleChain.getId() == null;
             ruleChain.setTenantId(getCurrentUser().getTenantId());
 
-            checkEntity(ruleChain.getId(), ruleChain);
+            checkEntity(ruleChain.getId(), ruleChain, Resource.RULE_CHAIN);
 
             RuleChain savedRuleChain = checkNotNull(ruleChainService.saveRuleChain(ruleChain));
 

application/src/main/java/org/thingsboard/server/controller/TenantController.java

@@ -72,7 +72,7 @@ public class TenantController extends BaseController {
         try {
             boolean newTenant = tenant.getId() == null;
 
-            checkEntity(tenant.getId(), tenant);
+            checkEntity(tenant.getId(), tenant, Resource.TENANT);
 
             tenant = checkNotNull(tenantService.saveTenant(tenant));
             if (newTenant) {

application/src/main/java/org/thingsboard/server/controller/UserController.java

@@ -138,7 +138,7 @@ public class UserController extends BaseController {
                 user.setTenantId(getCurrentUser().getTenantId());
             }
 
-            checkEntity(user.getId(), user);
+            checkEntity(user.getId(), user, Resource.USER);
 
             boolean sendEmail = user.getId() == null && sendActivationMail;
             User savedUser = checkNotNull(userService.saveUser(user));

application/src/main/java/org/thingsboard/server/controller/WidgetTypeController.java

@@ -66,7 +66,7 @@ public class WidgetTypeController extends BaseController {
                 widgetType.setTenantId(getCurrentUser().getTenantId());
             }
 
-            checkEntity(widgetType.getId(), widgetType);
+            checkEntity(widgetType.getId(), widgetType, Resource.WIDGET_TYPE);
 
             return checkNotNull(widgetTypeService.saveWidgetType(widgetType));
         } catch (Exception e) {

application/src/main/java/org/thingsboard/server/controller/WidgetsBundleController.java

@@ -61,15 +61,13 @@ public class WidgetsBundleController extends BaseController {
     @ResponseBody
     public WidgetsBundle saveWidgetsBundle(@RequestBody WidgetsBundle widgetsBundle) throws ThingsboardException {
         try {
-            checkEntity(widgetsBundle.getId(), widgetsBundle);
-
-            if (widgetsBundle.getId() == null) {
-                accessControlService
-                        .checkPermission(getCurrentUser(), Resource.WIDGETS_BUNDLE, Operation.CREATE, widgetsBundle.getId(), widgetsBundle);
+            if (getCurrentUser().getAuthority() == Authority.SYS_ADMIN) {
+                widgetsBundle.setTenantId(TenantId.SYS_TENANT_ID);
             } else {
-                checkWidgetsBundleId(widgetsBundle.getId(), Operation.WRITE);
+                widgetsBundle.setTenantId(getCurrentUser().getTenantId());
             }
 
+            checkEntity(widgetsBundle.getId(), widgetsBundle, Resource.WIDGETS_BUNDLE);
             return checkNotNull(widgetsBundleService.saveWidgetsBundle(widgetsBundle));
         } catch (Exception e) {
             throw handleException(e);

application/src/main/java/org/thingsboard/server/service/security/permission/Resource.java

@@ -46,4 +46,13 @@ public enum Resource {
     public Optional<EntityType> getEntityType() {
         return Optional.ofNullable(entityType);
     }
+
+    public static Resource of(EntityType entityType) {
+        for (Resource resource : Resource.values()) {
+            if (resource.getEntityType().get() == entityType) {
+                return resource;
+            }
+        }
+        throw new IllegalArgumentException("Unknown EntityType: " + entityType.name());
+    }
 }

application/src/test/java/org/thingsboard/server/controller/AbstractControllerTest.java

@@ -223,6 +223,27 @@ public abstract class AbstractControllerTest {
         login(CUSTOMER_USER_EMAIL, CUSTOMER_USER_PASSWORD);
     }
 
+    private Tenant savedDifferentTenant;
+    protected void loginDifferentTenant() throws Exception {
+        loginSysAdmin();
+        Tenant tenant = new Tenant();
+        tenant.setTitle("Different tenant");
+        savedDifferentTenant = doPost("/api/tenant", tenant, Tenant.class);
+        Assert.assertNotNull(savedDifferentTenant);
+        User differentTenantAdmin = new User();
+        differentTenantAdmin.setAuthority(Authority.TENANT_ADMIN);
+        differentTenantAdmin.setTenantId(savedDifferentTenant.getId());
+        differentTenantAdmin.setEmail("different_tenant@thingsboard.org");
+
+        createUserAndLogin(differentTenantAdmin, "testPassword");
+    }
+
+    protected void deleteDifferentTenant() throws Exception {
+        loginSysAdmin();
+        doDelete("/api/tenant/" + savedDifferentTenant.getId().getId().toString())
+                .andExpect(status().isOk());
+    }
+
     protected User createUserAndLogin(User user, String password) throws Exception {
         User savedUser = doPost("/api/user", user, User.class);
         logout();

application/src/test/java/org/thingsboard/server/controller/BaseAssetControllerTest.java

@@ -98,6 +98,18 @@ public abstract class BaseAssetControllerTest extends AbstractControllerTest {
         Assert.assertEquals(foundAsset.getName(), savedAsset.getName());
     }
 
+    @Test
+    public void testUpdateAssetFromDifferentTenant() throws Exception {
+        Asset asset = new Asset();
+        asset.setName("My asset");
+        asset.setType("default");
+        Asset savedAsset = doPost("/api/asset", asset, Asset.class);
+
+        loginDifferentTenant();
+        doPost("/api/asset", savedAsset, Asset.class, status().isForbidden());
+        deleteDifferentTenant();
+    }
+
     @Test
     public void testFindAssetById() throws Exception {
         Asset asset = new Asset();

application/src/test/java/org/thingsboard/server/controller/BaseCustomerControllerTest.java

@@ -23,6 +23,8 @@ import java.util.Collections;
 import java.util.List;
 
 import org.apache.commons.lang3.RandomStringUtils;
+import org.junit.After;
+import org.junit.Before;
 import org.thingsboard.server.common.data.Customer;
 import org.thingsboard.server.common.data.Tenant;
 import org.thingsboard.server.common.data.User;
@@ -38,25 +40,39 @@ import com.fasterxml.jackson.core.type.TypeReference;
 public abstract class BaseCustomerControllerTest extends AbstractControllerTest {
 
     private IdComparator<Customer> idComparator = new IdComparator<>();
-    
-    @Test
-    public void testSaveCustomer() throws Exception {
+
+    private Tenant savedTenant;
+    private User tenantAdmin;
+
+    @Before
+    public void beforeTest() throws Exception {
         loginSysAdmin();
 
         Tenant tenant = new Tenant();
         tenant.setTitle("My tenant");
-        Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class);
+        savedTenant = doPost("/api/tenant", tenant, Tenant.class);
         Assert.assertNotNull(savedTenant);
-        
-        User tenantAdmin = new User();
+
+        tenantAdmin = new User();
         tenantAdmin.setAuthority(Authority.TENANT_ADMIN);
         tenantAdmin.setTenantId(savedTenant.getId());
         tenantAdmin.setEmail("tenant2@thingsboard.org");
         tenantAdmin.setFirstName("Joe");
         tenantAdmin.setLastName("Downs");
-        
+
         tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1");
-        
+    }
+
+    @After
+    public void afterTest() throws Exception {
+        loginSysAdmin();
+
+        doDelete("/api/tenant/" + savedTenant.getId().getId().toString())
+                .andExpect(status().isOk());
+    }
+
+    @Test
+    public void testSaveCustomer() throws Exception {
         Customer customer = new Customer();
         customer.setTitle("My customer");
         Customer savedCustomer = doPost("/api/customer", customer, Customer.class);
@@ -66,266 +82,159 @@ public abstract class BaseCustomerControllerTest extends AbstractControllerTest
         Assert.assertEquals(customer.getTitle(), savedCustomer.getTitle());
         savedCustomer.setTitle("My new customer");
         doPost("/api/customer", savedCustomer, Customer.class);
-        
-        Customer foundCustomer = doGet("/api/customer/"+savedCustomer.getId().getId().toString(), Customer.class); 
+
+        Customer foundCustomer = doGet("/api/customer/"+savedCustomer.getId().getId().toString(), Customer.class);
         Assert.assertEquals(foundCustomer.getTitle(), savedCustomer.getTitle());
-        
+
         doDelete("/api/customer/"+savedCustomer.getId().getId().toString())
         .andExpect(status().isOk());
-        
-        loginSysAdmin();
-        
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
     }
-    
+
     @Test
-    public void testFindCustomerById() throws Exception {
-        
-        loginSysAdmin();
+    public void testUpdateCustomerFromDifferentTenant() throws Exception {
+        Customer customer = new Customer();
+        customer.setTitle("My customer");
+        Customer savedCustomer = doPost("/api/customer", customer, Customer.class);
+        doPost("/api/customer", savedCustomer, Customer.class);
 
-        Tenant tenant = new Tenant();
-        tenant.setTitle("My tenant");
-        Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class);
-        Assert.assertNotNull(savedTenant);
-        
-        User tenantAdmin = new User();
-        tenantAdmin.setAuthority(Authority.TENANT_ADMIN);
-        tenantAdmin.setTenantId(savedTenant.getId());
-        tenantAdmin.setEmail("tenant2@thingsboard.org");
-        tenantAdmin.setFirstName("Joe");
-        tenantAdmin.setLastName("Downs");
-        
-        tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1");
-        
+        loginDifferentTenant();
+        doPost("/api/customer", savedCustomer, Customer.class, status().isForbidden());
+        deleteDifferentTenant();
+
+        login(tenantAdmin.getName(), "testPassword1");
+        doDelete("/api/customer/" + savedCustomer.getId().getId().toString())
+                .andExpect(status().isOk());
+    }
+
+    @Test
+    public void testFindCustomerById() throws Exception {
         Customer customer = new Customer();
         customer.setTitle("My customer");
         Customer savedCustomer = doPost("/api/customer", customer, Customer.class);
-        
-        Customer foundCustomer = doGet("/api/customer/"+savedCustomer.getId().getId().toString(), Customer.class);
+
+        Customer foundCustomer = doGet("/api/customer/" + savedCustomer.getId().getId().toString(), Customer.class);
         Assert.assertNotNull(foundCustomer);
         Assert.assertEquals(savedCustomer, foundCustomer);
-        
-        doDelete("/api/customer/"+savedCustomer.getId().getId().toString())
-        .andExpect(status().isOk());
-        
-        loginSysAdmin();
-        
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
+
+        doDelete("/api/customer/" + savedCustomer.getId().getId().toString())
+                .andExpect(status().isOk());
     }
-    
+
     @Test
     public void testDeleteCustomer() throws Exception {
-        
-        loginSysAdmin();
-
-        Tenant tenant = new Tenant();
-        tenant.setTitle("My tenant");
-        Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class);
-        Assert.assertNotNull(savedTenant);
-        
-        User tenantAdmin = new User();
-        tenantAdmin.setAuthority(Authority.TENANT_ADMIN);
-        tenantAdmin.setTenantId(savedTenant.getId());
-        tenantAdmin.setEmail("tenant2@thingsboard.org");
-        tenantAdmin.setFirstName("Joe");
-        tenantAdmin.setLastName("Downs");
-        
-        tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1");
-        
         Customer customer = new Customer();
         customer.setTitle("My customer");
         Customer savedCustomer = doPost("/api/customer", customer, Customer.class);
-        
-        doDelete("/api/customer/"+savedCustomer.getId().getId().toString())
-        .andExpect(status().isOk());
 
-        doGet("/api/customer/"+savedCustomer.getId().getId().toString())
-        .andExpect(status().isNotFound());
-        
-        loginSysAdmin();
-        
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
+        doDelete("/api/customer/" + savedCustomer.getId().getId().toString())
+                .andExpect(status().isOk());
+
+        doGet("/api/customer/" + savedCustomer.getId().getId().toString())
+                .andExpect(status().isNotFound());
     }
-    
+
     @Test
     public void testSaveCustomerWithEmptyTitle() throws Exception {
-        
-        loginSysAdmin();
-
-        Tenant tenant = new Tenant();
-        tenant.setTitle("My tenant");
-        Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class);
-        Assert.assertNotNull(savedTenant);
-        
-        User tenantAdmin = new User();
-        tenantAdmin.setAuthority(Authority.TENANT_ADMIN);
-        tenantAdmin.setTenantId(savedTenant.getId());
-        tenantAdmin.setEmail("tenant2@thingsboard.org");
-        tenantAdmin.setFirstName("Joe");
-        tenantAdmin.setLastName("Downs");
-        
-        tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1");
-        
         Customer customer = new Customer();
         doPost("/api/customer", customer)
-        .andExpect(status().isBadRequest())
-        .andExpect(statusReason(containsString("Customer title should be specified")));
-        
-        loginSysAdmin();
-        
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
+                .andExpect(status().isBadRequest())
+                .andExpect(statusReason(containsString("Customer title should be specified")));
     }
-    
+
     @Test
     public void testSaveCustomerWithInvalidEmail() throws Exception {
-        
-        loginSysAdmin();
-
-        Tenant tenant = new Tenant();
-        tenant.setTitle("My tenant");
-        Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class);
-        Assert.assertNotNull(savedTenant);
-        
-        User tenantAdmin = new User();
-        tenantAdmin.setAuthority(Authority.TENANT_ADMIN);
-        tenantAdmin.setTenantId(savedTenant.getId());
-        tenantAdmin.setEmail("tenant2@thingsboard.org");
-        tenantAdmin.setFirstName("Joe");
-        tenantAdmin.setLastName("Downs");
-        
-        tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1");
-        
         Customer customer = new Customer();
         customer.setTitle("My customer");
         customer.setEmail("invalid@mail");
         doPost("/api/customer", customer)
-        .andExpect(status().isBadRequest())
-        .andExpect(statusReason(containsString("Invalid email address format 'invalid@mail'")));
-        
-        loginSysAdmin();
-        
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
+                .andExpect(status().isBadRequest())
+                .andExpect(statusReason(containsString("Invalid email address format 'invalid@mail'")));
+
+//        loginSysAdmin();
+//
+//        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
+//        .andExpect(status().isOk());
     }
-    
+
     @Test
     public void testFindCustomers() throws Exception {
-        loginSysAdmin();
-
-        Tenant tenant = new Tenant();
-        tenant.setTitle("My tenant");
-        Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class);
-        Assert.assertNotNull(savedTenant);
-        
         TenantId tenantId = savedTenant.getId();
-        
-        User tenantAdmin = new User();
-        tenantAdmin.setAuthority(Authority.TENANT_ADMIN);
-        tenantAdmin.setTenantId(tenantId);
-        tenantAdmin.setEmail("tenant2@thingsboard.org");
-        tenantAdmin.setFirstName("Joe");
-        tenantAdmin.setLastName("Downs");
-        
-        tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1");
-        
+
         List<Customer> customers = new ArrayList<>();
-        for (int i=0;i<135;i++) {
+        for (int i = 0; i < 135; i++) {
             Customer customer = new Customer();
             customer.setTenantId(tenantId);
-            customer.setTitle("Customer"+i);
+            customer.setTitle("Customer" + i);
             customers.add(doPost("/api/customer", customer, Customer.class));
         }
-        
+
         List<Customer> loadedCustomers = new ArrayList<>();
         TextPageLink pageLink = new TextPageLink(23);
         TextPageData<Customer> pageData = null;
         do {
-            pageData = doGetTypedWithPageLink("/api/customers?", new TypeReference<TextPageData<Customer>>(){}, pageLink);
+            pageData = doGetTypedWithPageLink("/api/customers?", new TypeReference<TextPageData<Customer>>() {
+            }, pageLink);
             loadedCustomers.addAll(pageData.getData());
             if (pageData.hasNext()) {
                 pageLink = pageData.getNextPageLink();
             }
         } while (pageData.hasNext());
-        
+
         Collections.sort(customers, idComparator);
         Collections.sort(loadedCustomers, idComparator);
-        
+
         Assert.assertEquals(customers, loadedCustomers);
-        
-        loginSysAdmin();
-        
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
     }
-    
+
     @Test
     public void testFindCustomersByTitle() throws Exception {
-        
-        loginSysAdmin();
-        
-        Tenant tenant = new Tenant();
-        tenant.setTitle("My tenant");
-        Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class);
-        Assert.assertNotNull(savedTenant);
-        
         TenantId tenantId = savedTenant.getId();
-        
-        User tenantAdmin = new User();
-        tenantAdmin.setAuthority(Authority.TENANT_ADMIN);
-        tenantAdmin.setTenantId(tenantId);
-        tenantAdmin.setEmail("tenant2@thingsboard.org");
-        tenantAdmin.setFirstName("Joe");
-        tenantAdmin.setLastName("Downs");
-        
-        tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1");
-        
+
         String title1 = "Customer title 1";
         List<Customer> customersTitle1 = new ArrayList<>();
-        for (int i=0;i<143;i++) {
+        for (int i = 0; i < 143; i++) {
             Customer customer = new Customer();
             customer.setTenantId(tenantId);
-            String suffix = RandomStringUtils.randomAlphanumeric((int)(5 + Math.random()*10));
-            String title = title1+suffix;
+            String suffix = RandomStringUtils.randomAlphanumeric((int) (5 + Math.random() * 10));
+            String title = title1 + suffix;
             title = i % 2 == 0 ? title.toLowerCase() : title.toUpperCase();
             customer.setTitle(title);
             customersTitle1.add(doPost("/api/customer", customer, Customer.class));
         }
         String title2 = "Customer title 2";
         List<Customer> customersTitle2 = new ArrayList<>();
-        for (int i=0;i<175;i++) {
+        for (int i = 0; i < 175; i++) {
             Customer customer = new Customer();
             customer.setTenantId(tenantId);
-            String suffix = RandomStringUtils.randomAlphanumeric((int)(5 + Math.random()*10));
-            String title = title2+suffix;
+            String suffix = RandomStringUtils.randomAlphanumeric((int) (5 + Math.random() * 10));
+            String title = title2 + suffix;
             title = i % 2 == 0 ? title.toLowerCase() : title.toUpperCase();
             customer.setTitle(title);
             customersTitle2.add(doPost("/api/customer", customer, Customer.class));
         }
-        
+
         List<Customer> loadedCustomersTitle1 = new ArrayList<>();
         TextPageLink pageLink = new TextPageLink(15, title1);
         TextPageData<Customer> pageData = null;
         do {
-            pageData = doGetTypedWithPageLink("/api/customers?", new TypeReference<TextPageData<Customer>>(){}, pageLink);
+            pageData = doGetTypedWithPageLink("/api/customers?", new TypeReference<TextPageData<Customer>>() {
+            }, pageLink);
             loadedCustomersTitle1.addAll(pageData.getData());
             if (pageData.hasNext()) {
                 pageLink = pageData.getNextPageLink();
             }
         } while (pageData.hasNext());
-        
+
         Collections.sort(customersTitle1, idComparator);
         Collections.sort(loadedCustomersTitle1, idComparator);
-        
+
         Assert.assertEquals(customersTitle1, loadedCustomersTitle1);
-        
+
         List<Customer> loadedCustomersTitle2 = new ArrayList<>();
         pageLink = new TextPageLink(4, title2);
         do {
-            pageData = doGetTypedWithPageLink("/api/customers?", new TypeReference<TextPageData<Customer>>(){}, pageLink);
+            pageData = doGetTypedWithPageLink("/api/customers?", new TypeReference<TextPageData<Customer>>() {
+            }, pageLink);
             loadedCustomersTitle2.addAll(pageData.getData());
             if (pageData.hasNext()) {
                 pageLink = pageData.getNextPageLink();
@@ -334,33 +243,30 @@ public abstract class BaseCustomerControllerTest extends AbstractControllerTest
 
         Collections.sort(customersTitle2, idComparator);
         Collections.sort(loadedCustomersTitle2, idComparator);
-        
+
         Assert.assertEquals(customersTitle2, loadedCustomersTitle2);
-        
+
         for (Customer customer : loadedCustomersTitle1) {
-            doDelete("/api/customer/"+customer.getId().getId().toString())
-            .andExpect(status().isOk());    
+            doDelete("/api/customer/" + customer.getId().getId().toString())
+                    .andExpect(status().isOk());
         }
-        
+
         pageLink = new TextPageLink(4, title1);
-        pageData = doGetTypedWithPageLink("/api/customers?", new TypeReference<TextPageData<Customer>>(){}, pageLink);
+        pageData = doGetTypedWithPageLink("/api/customers?", new TypeReference<TextPageData<Customer>>() {
+        }, pageLink);
         Assert.assertFalse(pageData.hasNext());
         Assert.assertEquals(0, pageData.getData().size());
-        
+
         for (Customer customer : loadedCustomersTitle2) {
-            doDelete("/api/customer/"+customer.getId().getId().toString())
-            .andExpect(status().isOk());    
+            doDelete("/api/customer/" + customer.getId().getId().toString())
+                    .andExpect(status().isOk());
         }
-        
+
         pageLink = new TextPageLink(4, title2);
-        pageData = doGetTypedWithPageLink("/api/customers?", new TypeReference<TextPageData<Customer>>(){}, pageLink);
+        pageData = doGetTypedWithPageLink("/api/customers?", new TypeReference<TextPageData<Customer>>() {
+        }, pageLink);
         Assert.assertFalse(pageData.hasNext());
         Assert.assertEquals(0, pageData.getData().size());
-        
-        loginSysAdmin();
-        
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
     }
-    
+
 }

application/src/test/java/org/thingsboard/server/controller/BaseDashboardControllerTest.java

@@ -16,10 +16,8 @@
 package org.thingsboard.server.controller;
 
 import static org.hamcrest.Matchers.containsString;
-import static org.thingsboard.server.dao.model.ModelConstants.NULL_UUID;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
 
-import java.sql.Time;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
@@ -33,7 +31,6 @@ import org.thingsboard.server.common.data.page.TextPageLink;
 import org.thingsboard.server.common.data.page.TimePageData;
 import org.thingsboard.server.common.data.page.TimePageLink;
 import org.thingsboard.server.common.data.security.Authority;
-import org.thingsboard.server.dao.model.ModelConstants;
 import org.junit.After;
 import org.junit.Assert;
 import org.junit.Before;
@@ -93,6 +90,17 @@ public abstract class BaseDashboardControllerTest extends AbstractControllerTest
         Dashboard foundDashboard = doGet("/api/dashboard/" + savedDashboard.getId().getId().toString(), Dashboard.class);
         Assert.assertEquals(foundDashboard.getTitle(), savedDashboard.getTitle());
     }
+
+    @Test
+    public void testUpdateDashboardFromDifferentTenant() throws Exception {
+        Dashboard dashboard = new Dashboard();
+        dashboard.setTitle("My dashboard");
+        Dashboard savedDashboard = doPost("/api/dashboard", dashboard, Dashboard.class);
+
+        loginDifferentTenant();
+        doPost("/api/dashboard", savedDashboard, Dashboard.class, status().isForbidden());
+        deleteDifferentTenant();
+    }
     
     @Test
     public void testFindDashboardById() throws Exception {

application/src/test/java/org/thingsboard/server/controller/BaseDeviceControllerTest.java

@@ -107,6 +107,17 @@ public abstract class BaseDeviceControllerTest extends AbstractControllerTest {
         Device foundDevice = doGet("/api/device/" + savedDevice.getId().getId().toString(), Device.class);
         Assert.assertEquals(foundDevice.getName(), savedDevice.getName());
     }
+
+    @Test
+    public void testUpdateDeviceFromDifferentTenant() throws Exception {
+        Device device = new Device();
+        device.setName("My device");
+        device.setType("default");
+        Device savedDevice = doPost("/api/device", device, Device.class);
+        loginDifferentTenant();
+        doPost("/api/device", savedDevice, Device.class, status().isForbidden());
+        deleteDifferentTenant();
+    }
     
     @Test
     public void testFindDeviceById() throws Exception {

application/src/test/java/org/thingsboard/server/controller/BaseEntityViewControllerTest.java

@@ -25,7 +25,6 @@ import org.eclipse.paho.client.mqttv3.MqttMessage;
 import org.junit.After;
 import org.junit.Assert;
 import org.junit.Before;
-import org.junit.Ignore;
 import org.junit.Test;
 import org.thingsboard.server.common.data.Customer;
 import org.thingsboard.server.common.data.Device;
@@ -132,6 +131,15 @@ public abstract class BaseEntityViewControllerTest extends AbstractControllerTes
         assertEquals(foundEntityView.getKeys(), telemetry);
     }
 
+
+    @Test
+    public void testUpdateEntityViewFromDifferentTenant() throws Exception {
+        EntityView savedView = getNewSavedEntityView("Test entity view");
+        loginDifferentTenant();
+        doPost("/api/entityView", savedView, EntityView.class, status().isForbidden());
+        deleteDifferentTenant();
+    }
+
     @Test
     public void testDeleteEntityView() throws Exception {
         EntityView view = getNewSavedEntityView("Test entity view");

application/src/test/java/org/thingsboard/server/controller/BaseUserControllerTest.java

@@ -38,21 +38,23 @@ import java.util.List;
 
 import static org.hamcrest.Matchers.containsString;
 import static org.hamcrest.Matchers.is;
-import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
 
 public abstract class BaseUserControllerTest extends AbstractControllerTest {
-    
+
     private IdComparator<User> idComparator = new IdComparator<>();
 
     @Test
     public void testSaveUser() throws Exception {
         loginSysAdmin();
-        
+
         Tenant tenant = new Tenant();
         tenant.setTitle("My tenant");
         Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class);
         Assert.assertNotNull(savedTenant);
-        
+
         String email = "tenant2@thingsboard.org";
         User user = new User();
         user.setAuthority(Authority.TENANT_ADMIN);
@@ -66,13 +68,13 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
         Assert.assertTrue(savedUser.getCreatedTime() > 0);
         Assert.assertEquals(user.getEmail(), savedUser.getEmail());
 
-        User foundUser = doGet("/api/user/"+savedUser.getId().getId().toString(), User.class); 
+        User foundUser = doGet("/api/user/" + savedUser.getId().getId().toString(), User.class);
         Assert.assertEquals(foundUser, savedUser);
-        
+
         logout();
         doGet("/api/noauth/activate?activateToken={activateToken}", TestMailService.currentActivateToken)
-        .andExpect(status().isSeeOther())
-        .andExpect(header().string(HttpHeaders.LOCATION, "/login/createPassword?activateToken=" + TestMailService.currentActivateToken));
+                .andExpect(status().isSeeOther())
+                .andExpect(header().string(HttpHeaders.LOCATION, "/login/createPassword?activateToken=" + TestMailService.currentActivateToken));
 
         JsonNode activateRequest = new ObjectMapper().createObjectNode()
                 .put("activateToken", TestMailService.currentActivateToken)
@@ -82,36 +84,61 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
         validateAndSetJwtToken(tokenInfo, email);
 
         doGet("/api/auth/user")
-        .andExpect(status().isOk())
-        .andExpect(jsonPath("$.authority",is(Authority.TENANT_ADMIN.name())))
-        .andExpect(jsonPath("$.email",is(email)));
-        
+                .andExpect(status().isOk())
+                .andExpect(jsonPath("$.authority", is(Authority.TENANT_ADMIN.name())))
+                .andExpect(jsonPath("$.email", is(email)));
+
         logout();
-        
+
         login(email, "testPassword");
-        
+
         doGet("/api/auth/user")
-        .andExpect(status().isOk())
-        .andExpect(jsonPath("$.authority",is(Authority.TENANT_ADMIN.name())))
-        .andExpect(jsonPath("$.email",is(email)));
-        
+                .andExpect(status().isOk())
+                .andExpect(jsonPath("$.authority", is(Authority.TENANT_ADMIN.name())))
+                .andExpect(jsonPath("$.email", is(email)));
+
         loginSysAdmin();
-        doDelete("/api/user/"+savedUser.getId().getId().toString())
-        .andExpect(status().isOk());
-        
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
+        doDelete("/api/user/" + savedUser.getId().getId().toString())
+                .andExpect(status().isOk());
+
+        doDelete("/api/tenant/" + savedTenant.getId().getId().toString())
+                .andExpect(status().isOk());
     }
-    
+
+    @Test
+    public void testUpdateUserFromDifferentTenant() throws Exception {
+        loginSysAdmin();
+        Tenant tenant = new Tenant();
+        tenant.setTitle("My tenant");
+        Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class);
+        Assert.assertNotNull(savedTenant);
+
+        User tenantAdmin = new User();
+        tenantAdmin.setAuthority(Authority.TENANT_ADMIN);
+        tenantAdmin.setTenantId(savedTenant.getId());
+        tenantAdmin.setEmail("tenant2@thingsboard.org");
+        tenantAdmin.setFirstName("Joe");
+        tenantAdmin.setLastName("Downs");
+        tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1");
+
+        loginDifferentTenant();
+        doPost("/api/user", tenantAdmin, User.class, status().isForbidden());
+        deleteDifferentTenant();
+
+        loginSysAdmin();
+        doDelete("/api/tenant/" + savedTenant.getId().getId().toString())
+                .andExpect(status().isOk());
+    }
+
     @Test
     public void testResetPassword() throws Exception {
         loginSysAdmin();
-        
+
         Tenant tenant = new Tenant();
         tenant.setTitle("My tenant");
         Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class);
         Assert.assertNotNull(savedTenant);
-        
+
         String email = "tenant2@thingsboard.org";
         User user = new User();
         user.setAuthority(Authority.TENANT_ADMIN);
@@ -119,7 +146,7 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
         user.setEmail(email);
         user.setFirstName("Joe");
         user.setLastName("Downs");
-        
+
         User savedUser = createUserAndLogin(user, "testPassword1");
         logout();
 
@@ -127,10 +154,10 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
                 .put("email", email);
 
         doPost("/api/noauth/resetPasswordByEmail", resetPasswordByEmailRequest)
-        .andExpect(status().isOk());
+                .andExpect(status().isOk());
         doGet("/api/noauth/resetPassword?resetToken={resetToken}", TestMailService.currentResetPasswordToken)
-        .andExpect(status().isSeeOther())
-        .andExpect(header().string(HttpHeaders.LOCATION, "/login/resetPassword?resetToken=" + TestMailService.currentResetPasswordToken));
+                .andExpect(status().isSeeOther())
+                .andExpect(header().string(HttpHeaders.LOCATION, "/login/resetPassword?resetToken=" + TestMailService.currentResetPasswordToken));
 
         JsonNode resetPasswordRequest = new ObjectMapper().createObjectNode()
                 .put("resetToken", TestMailService.currentResetPasswordToken)
@@ -140,35 +167,35 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
         validateAndSetJwtToken(tokenInfo, email);
 
         doGet("/api/auth/user")
-        .andExpect(status().isOk())
-        .andExpect(jsonPath("$.authority",is(Authority.TENANT_ADMIN.name())))
-        .andExpect(jsonPath("$.email",is(email)));
-        
+                .andExpect(status().isOk())
+                .andExpect(jsonPath("$.authority", is(Authority.TENANT_ADMIN.name())))
+                .andExpect(jsonPath("$.email", is(email)));
+
         logout();
-        
+
         login(email, "testPassword2");
         doGet("/api/auth/user")
-        .andExpect(status().isOk())
-        .andExpect(jsonPath("$.authority",is(Authority.TENANT_ADMIN.name())))
-        .andExpect(jsonPath("$.email",is(email)));
-        
+                .andExpect(status().isOk())
+                .andExpect(jsonPath("$.authority", is(Authority.TENANT_ADMIN.name())))
+                .andExpect(jsonPath("$.email", is(email)));
+
         loginSysAdmin();
-        doDelete("/api/user/"+savedUser.getId().getId().toString())
-        .andExpect(status().isOk());
-        
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
+        doDelete("/api/user/" + savedUser.getId().getId().toString())
+                .andExpect(status().isOk());
+
+        doDelete("/api/tenant/" + savedTenant.getId().getId().toString())
+                .andExpect(status().isOk());
     }
-    
+
     @Test
     public void testFindUserById() throws Exception {
         loginSysAdmin();
-        
+
         Tenant tenant = new Tenant();
         tenant.setTitle("My tenant");
         Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class);
         Assert.assertNotNull(savedTenant);
-        
+
         String email = "tenant2@thingsboard.org";
         User user = new User();
         user.setAuthority(Authority.TENANT_ADMIN);
@@ -176,25 +203,25 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
         user.setEmail(email);
         user.setFirstName("Joe");
         user.setLastName("Downs");
-        
+
         User savedUser = doPost("/api/user", user, User.class);
-        User foundUser = doGet("/api/user/"+savedUser.getId().getId().toString(), User.class); 
+        User foundUser = doGet("/api/user/" + savedUser.getId().getId().toString(), User.class);
         Assert.assertNotNull(foundUser);
         Assert.assertEquals(savedUser, foundUser);
-        
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
+
+        doDelete("/api/tenant/" + savedTenant.getId().getId().toString())
+                .andExpect(status().isOk());
     }
-    
+
     @Test
     public void testSaveUserWithSameEmail() throws Exception {
         loginSysAdmin();
-        
+
         Tenant tenant = new Tenant();
         tenant.setTitle("My tenant");
         Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class);
         Assert.assertNotNull(savedTenant);
-        
+
         String email = TENANT_ADMIN_EMAIL;
         User user = new User();
         user.setAuthority(Authority.TENANT_ADMIN);
@@ -202,24 +229,24 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
         user.setEmail(email);
         user.setFirstName("Joe");
         user.setLastName("Downs");
-        
+
         doPost("/api/user", user)
-        .andExpect(status().isBadRequest())
-        .andExpect(statusReason(containsString("User with email '" + email + "'  already present in database")));
-        
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
+                .andExpect(status().isBadRequest())
+                .andExpect(statusReason(containsString("User with email '" + email + "'  already present in database")));
+
+        doDelete("/api/tenant/" + savedTenant.getId().getId().toString())
+                .andExpect(status().isOk());
     }
-    
+
     @Test
     public void testSaveUserWithInvalidEmail() throws Exception {
         loginSysAdmin();
-        
+
         Tenant tenant = new Tenant();
         tenant.setTitle("My tenant");
         Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class);
         Assert.assertNotNull(savedTenant);
-        
+
         String email = "tenant_thingsboard.org";
         User user = new User();
         user.setAuthority(Authority.TENANT_ADMIN);
@@ -227,62 +254,62 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
         user.setEmail(email);
         user.setFirstName("Joe");
         user.setLastName("Downs");
-        
+
         doPost("/api/user", user)
-        .andExpect(status().isBadRequest())
-        .andExpect(statusReason(containsString("Invalid email address format '" + email + "'")));
-        
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
+                .andExpect(status().isBadRequest())
+                .andExpect(statusReason(containsString("Invalid email address format '" + email + "'")));
+
+        doDelete("/api/tenant/" + savedTenant.getId().getId().toString())
+                .andExpect(status().isOk());
     }
-    
+
     @Test
     public void testSaveUserWithEmptyEmail() throws Exception {
         loginSysAdmin();
-        
+
         Tenant tenant = new Tenant();
         tenant.setTitle("My tenant");
         Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class);
         Assert.assertNotNull(savedTenant);
-        
+
         User user = new User();
         user.setAuthority(Authority.TENANT_ADMIN);
         user.setTenantId(savedTenant.getId());
         user.setFirstName("Joe");
         user.setLastName("Downs");
-        
+
         doPost("/api/user", user)
-        .andExpect(status().isBadRequest())
-        .andExpect(statusReason(containsString("User email should be specified")));
-        
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
+                .andExpect(status().isBadRequest())
+                .andExpect(statusReason(containsString("User email should be specified")));
+
+        doDelete("/api/tenant/" + savedTenant.getId().getId().toString())
+                .andExpect(status().isOk());
     }
-    
+
     @Test
     public void testSaveUserWithoutTenant() throws Exception {
         loginSysAdmin();
-        
+
         User user = new User();
         user.setAuthority(Authority.TENANT_ADMIN);
         user.setEmail("tenant2@thingsboard.org");
         user.setFirstName("Joe");
         user.setLastName("Downs");
-        
+
         doPost("/api/user", user)
-        .andExpect(status().isBadRequest())
-        .andExpect(statusReason(containsString("Tenant administrator should be assigned to tenant")));
+                .andExpect(status().isBadRequest())
+                .andExpect(statusReason(containsString("Tenant administrator should be assigned to tenant")));
     }
-    
+
     @Test
     public void testDeleteUser() throws Exception {
         loginSysAdmin();
-        
+
         Tenant tenant = new Tenant();
         tenant.setTitle("My tenant");
         Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class);
         Assert.assertNotNull(savedTenant);
-        
+
         String email = "tenant2@thingsboard.org";
         User user = new User();
         user.setAuthority(Authority.TENANT_ADMIN);
@@ -290,176 +317,182 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
         user.setEmail(email);
         user.setFirstName("Joe");
         user.setLastName("Downs");
-        
+
         User savedUser = doPost("/api/user", user, User.class);
-        User foundUser = doGet("/api/user/"+savedUser.getId().getId().toString(), User.class); 
+        User foundUser = doGet("/api/user/" + savedUser.getId().getId().toString(), User.class);
         Assert.assertNotNull(foundUser);
-        
-        doDelete("/api/user/"+savedUser.getId().getId().toString())
-        .andExpect(status().isOk());
-        
-        doGet("/api/user/"+savedUser.getId().getId().toString())
-        .andExpect(status().isNotFound());
-        
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
+
+        doDelete("/api/user/" + savedUser.getId().getId().toString())
+                .andExpect(status().isOk());
+
+        doGet("/api/user/" + savedUser.getId().getId().toString())
+                .andExpect(status().isNotFound());
+
+        doDelete("/api/tenant/" + savedTenant.getId().getId().toString())
+                .andExpect(status().isOk());
     }
-    
+
     @Test
     public void testFindTenantAdmins() throws Exception {
         loginSysAdmin();
-        
+
         Tenant tenant = new Tenant();
         tenant.setTitle("My tenant");
         Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class);
         Assert.assertNotNull(savedTenant);
-        
+
         TenantId tenantId = savedTenant.getId();
-        
+
         List<User> tenantAdmins = new ArrayList<>();
-        for (int i=0;i<64;i++) {
+        for (int i = 0; i < 64; i++) {
             User user = new User();
             user.setAuthority(Authority.TENANT_ADMIN);
             user.setTenantId(tenantId);
             user.setEmail("testTenant" + i + "@thingsboard.org");
             tenantAdmins.add(doPost("/api/user", user, User.class));
         }
-        
+
         List<User> loadedTenantAdmins = new ArrayList<>();
         TextPageLink pageLink = new TextPageLink(33);
         TextPageData<User> pageData = null;
         do {
-            pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?", 
-                    new TypeReference<TextPageData<User>>(){}, pageLink);
+            pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?",
+                    new TypeReference<TextPageData<User>>() {
+                    }, pageLink);
             loadedTenantAdmins.addAll(pageData.getData());
             if (pageData.hasNext()) {
                 pageLink = pageData.getNextPageLink();
             }
         } while (pageData.hasNext());
-        
+
         Collections.sort(tenantAdmins, idComparator);
         Collections.sort(loadedTenantAdmins, idComparator);
-        
+
         Assert.assertEquals(tenantAdmins, loadedTenantAdmins);
-        
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
-        
+
+        doDelete("/api/tenant/" + savedTenant.getId().getId().toString())
+                .andExpect(status().isOk());
+
         pageLink = new TextPageLink(33);
-        pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?", 
-                new TypeReference<TextPageData<User>>(){}, pageLink);
+        pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?",
+                new TypeReference<TextPageData<User>>() {
+                }, pageLink);
         Assert.assertFalse(pageData.hasNext());
         Assert.assertTrue(pageData.getData().isEmpty());
     }
-    
+
     @Test
     public void testFindTenantAdminsByEmail() throws Exception {
-        
+
         loginSysAdmin();
-        
+
         Tenant tenant = new Tenant();
         tenant.setTitle("My tenant");
         Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class);
         Assert.assertNotNull(savedTenant);
-        
+
         TenantId tenantId = savedTenant.getId();
-        
-        String email1 = "testEmail1";      
+
+        String email1 = "testEmail1";
         List<User> tenantAdminsEmail1 = new ArrayList<>();
-        
-        for (int i=0;i<124;i++) {
+
+        for (int i = 0; i < 124; i++) {
             User user = new User();
             user.setAuthority(Authority.TENANT_ADMIN);
             user.setTenantId(tenantId);
-            String suffix = RandomStringUtils.randomAlphanumeric((int)(5 + Math.random()*10));
-            String email = email1+suffix+ "@thingsboard.org";
+            String suffix = RandomStringUtils.randomAlphanumeric((int) (5 + Math.random() * 10));
+            String email = email1 + suffix + "@thingsboard.org";
             email = i % 2 == 0 ? email.toLowerCase() : email.toUpperCase();
             user.setEmail(email);
             tenantAdminsEmail1.add(doPost("/api/user", user, User.class));
         }
-        
-        String email2 = "testEmail2";        
+
+        String email2 = "testEmail2";
         List<User> tenantAdminsEmail2 = new ArrayList<>();
-        
-        for (int i=0;i<112;i++) {
+
+        for (int i = 0; i < 112; i++) {
             User user = new User();
             user.setAuthority(Authority.TENANT_ADMIN);
             user.setTenantId(tenantId);
-            String suffix = RandomStringUtils.randomAlphanumeric((int)(5 + Math.random()*10));
-            String email = email2+suffix+ "@thingsboard.org";
+            String suffix = RandomStringUtils.randomAlphanumeric((int) (5 + Math.random() * 10));
+            String email = email2 + suffix + "@thingsboard.org";
             email = i % 2 == 0 ? email.toLowerCase() : email.toUpperCase();
             user.setEmail(email);
             tenantAdminsEmail2.add(doPost("/api/user", user, User.class));
         }
-        
+
         List<User> loadedTenantAdminsEmail1 = new ArrayList<>();
         TextPageLink pageLink = new TextPageLink(33, email1);
         TextPageData<User> pageData = null;
         do {
-            pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?", 
-                    new TypeReference<TextPageData<User>>(){}, pageLink);
+            pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?",
+                    new TypeReference<TextPageData<User>>() {
+                    }, pageLink);
             loadedTenantAdminsEmail1.addAll(pageData.getData());
             if (pageData.hasNext()) {
                 pageLink = pageData.getNextPageLink();
             }
         } while (pageData.hasNext());
-        
+
         Collections.sort(tenantAdminsEmail1, idComparator);
         Collections.sort(loadedTenantAdminsEmail1, idComparator);
-        
+
         Assert.assertEquals(tenantAdminsEmail1, loadedTenantAdminsEmail1);
-        
+
         List<User> loadedTenantAdminsEmail2 = new ArrayList<>();
         pageLink = new TextPageLink(16, email2);
         do {
-            pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?", 
-                    new TypeReference<TextPageData<User>>(){}, pageLink);
+            pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?",
+                    new TypeReference<TextPageData<User>>() {
+                    }, pageLink);
             loadedTenantAdminsEmail2.addAll(pageData.getData());
             if (pageData.hasNext()) {
                 pageLink = pageData.getNextPageLink();
             }
         } while (pageData.hasNext());
-        
+
         Collections.sort(tenantAdminsEmail2, idComparator);
         Collections.sort(loadedTenantAdminsEmail2, idComparator);
-        
+
         Assert.assertEquals(tenantAdminsEmail2, loadedTenantAdminsEmail2);
-        
+
         for (User user : loadedTenantAdminsEmail1) {
-            doDelete("/api/user/"+user.getId().getId().toString())
-                .andExpect(status().isOk());
+            doDelete("/api/user/" + user.getId().getId().toString())
+                    .andExpect(status().isOk());
         }
-        
+
         pageLink = new TextPageLink(4, email1);
-        pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?", 
-                new TypeReference<TextPageData<User>>(){}, pageLink);
+        pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?",
+                new TypeReference<TextPageData<User>>() {
+                }, pageLink);
         Assert.assertFalse(pageData.hasNext());
         Assert.assertEquals(0, pageData.getData().size());
-        
+
         for (User user : loadedTenantAdminsEmail2) {
-            doDelete("/api/user/"+user.getId().getId().toString())
-                .andExpect(status().isOk());
+            doDelete("/api/user/" + user.getId().getId().toString())
+                    .andExpect(status().isOk());
         }
-        
+
         pageLink = new TextPageLink(4, email2);
-        pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?", 
-                new TypeReference<TextPageData<User>>(){}, pageLink);
+        pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?",
+                new TypeReference<TextPageData<User>>() {
+                }, pageLink);
         Assert.assertFalse(pageData.hasNext());
         Assert.assertEquals(0, pageData.getData().size());
-        
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
+
+        doDelete("/api/tenant/" + savedTenant.getId().getId().toString())
+                .andExpect(status().isOk());
     }
-    
+
     @Test
     public void testFindCustomerUsers() throws Exception {
-        
+
         loginSysAdmin();
         Tenant tenant = new Tenant();
         tenant.setTitle("My tenant");
         Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class);
         Assert.assertNotNull(savedTenant);
-        
+
         TenantId tenantId = savedTenant.getId();
         User tenantAdmin = new User();
         tenantAdmin.setAuthority(Authority.TENANT_ADMIN);
@@ -467,59 +500,60 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
         tenantAdmin.setEmail("tenant2@thingsboard.org");
         tenantAdmin.setFirstName("Joe");
         tenantAdmin.setLastName("Downs");
-        
+
         tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1");
-        
+
         Customer customer = new Customer();
         customer.setTitle("My customer");
         Customer savedCustomer = doPost("/api/customer", customer, Customer.class);
 
         CustomerId customerId = savedCustomer.getId();
-        
+
         List<User> customerUsers = new ArrayList<>();
-        for (int i=0;i<56;i++) {
+        for (int i = 0; i < 56; i++) {
             User user = new User();
             user.setAuthority(Authority.CUSTOMER_USER);
             user.setCustomerId(customerId);
             user.setEmail("testCustomer" + i + "@thingsboard.org");
             customerUsers.add(doPost("/api/user", user, User.class));
         }
-        
+
         List<User> loadedCustomerUsers = new ArrayList<>();
         TextPageLink pageLink = new TextPageLink(33);
         TextPageData<User> pageData = null;
         do {
-            pageData = doGetTypedWithPageLink("/api/customer/" + customerId.getId().toString() + "/users?", 
-                    new TypeReference<TextPageData<User>>(){}, pageLink);
+            pageData = doGetTypedWithPageLink("/api/customer/" + customerId.getId().toString() + "/users?",
+                    new TypeReference<TextPageData<User>>() {
+                    }, pageLink);
             loadedCustomerUsers.addAll(pageData.getData());
             if (pageData.hasNext()) {
                 pageLink = pageData.getNextPageLink();
             }
         } while (pageData.hasNext());
-        
+
         Collections.sort(customerUsers, idComparator);
         Collections.sort(loadedCustomerUsers, idComparator);
-        
+
         Assert.assertEquals(customerUsers, loadedCustomerUsers);
-        
-        doDelete("/api/customer/"+customerId.getId().toString())
-        .andExpect(status().isOk());
-        
+
+        doDelete("/api/customer/" + customerId.getId().toString())
+                .andExpect(status().isOk());
+
         loginSysAdmin();
-        
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
+
+        doDelete("/api/tenant/" + savedTenant.getId().getId().toString())
+                .andExpect(status().isOk());
     }
-    
+
     @Test
     public void testFindCustomerUsersByEmail() throws Exception {
-        
+
         loginSysAdmin();
         Tenant tenant = new Tenant();
         tenant.setTitle("My tenant");
         Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class);
         Assert.assertNotNull(savedTenant);
-        
+
         TenantId tenantId = savedTenant.getId();
         User tenantAdmin = new User();
         tenantAdmin.setAuthority(Authority.TENANT_ADMIN);
@@ -527,105 +561,109 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest {
         tenantAdmin.setEmail("tenant2@thingsboard.org");
         tenantAdmin.setFirstName("Joe");
         tenantAdmin.setLastName("Downs");
-        
+
         tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1");
-        
+
         Customer customer = new Customer();
         customer.setTitle("My customer");
         Customer savedCustomer = doPost("/api/customer", customer, Customer.class);
 
         CustomerId customerId = savedCustomer.getId();
-        
-        String email1 = "testEmail1";        
+
+        String email1 = "testEmail1";
         List<User> customerUsersEmail1 = new ArrayList<>();
-        
-        for (int i=0;i<74;i++) {
+
+        for (int i = 0; i < 74; i++) {
             User user = new User();
             user.setAuthority(Authority.CUSTOMER_USER);
             user.setCustomerId(customerId);
-            String suffix = RandomStringUtils.randomAlphanumeric((int)(5 + Math.random()*10));
-            String email = email1+suffix+ "@thingsboard.org";
+            String suffix = RandomStringUtils.randomAlphanumeric((int) (5 + Math.random() * 10));
+            String email = email1 + suffix + "@thingsboard.org";
             email = i % 2 == 0 ? email.toLowerCase() : email.toUpperCase();
             user.setEmail(email);
             customerUsersEmail1.add(doPost("/api/user", user, User.class));
         }
-        
-        String email2 = "testEmail2";        
+
+        String email2 = "testEmail2";
         List<User> customerUsersEmail2 = new ArrayList<>();
-        
-        for (int i=0;i<92;i++) {
+
+        for (int i = 0; i < 92; i++) {
             User user = new User();
             user.setAuthority(Authority.CUSTOMER_USER);
             user.setCustomerId(customerId);
-            String suffix = RandomStringUtils.randomAlphanumeric((int)(5 + Math.random()*10));
-            String email = email2+suffix+ "@thingsboard.org";
+            String suffix = RandomStringUtils.randomAlphanumeric((int) (5 + Math.random() * 10));
+            String email = email2 + suffix + "@thingsboard.org";
             email = i % 2 == 0 ? email.toLowerCase() : email.toUpperCase();
             user.setEmail(email);
             customerUsersEmail2.add(doPost("/api/user", user, User.class));
         }
-        
+
         List<User> loadedCustomerUsersEmail1 = new ArrayList<>();
         TextPageLink pageLink = new TextPageLink(33, email1);
         TextPageData<User> pageData = null;
         do {
-            pageData = doGetTypedWithPageLink("/api/customer/" + customerId.getId().toString() + "/users?", 
-                    new TypeReference<TextPageData<User>>(){}, pageLink);
+            pageData = doGetTypedWithPageLink("/api/customer/" + customerId.getId().toString() + "/users?",
+                    new TypeReference<TextPageData<User>>() {
+                    }, pageLink);
             loadedCustomerUsersEmail1.addAll(pageData.getData());
             if (pageData.hasNext()) {
                 pageLink = pageData.getNextPageLink();
             }
         } while (pageData.hasNext());
-        
+
         Collections.sort(customerUsersEmail1, idComparator);
         Collections.sort(loadedCustomerUsersEmail1, idComparator);
-        
+
         Assert.assertEquals(customerUsersEmail1, loadedCustomerUsersEmail1);
-        
+
         List<User> loadedCustomerUsersEmail2 = new ArrayList<>();
         pageLink = new TextPageLink(16, email2);
         do {
-            pageData = doGetTypedWithPageLink("/api/customer/" + customerId.getId().toString() + "/users?", 
-                    new TypeReference<TextPageData<User>>(){}, pageLink);
+            pageData = doGetTypedWithPageLink("/api/customer/" + customerId.getId().toString() + "/users?",
+                    new TypeReference<TextPageData<User>>() {
+                    }, pageLink);
             loadedCustomerUsersEmail2.addAll(pageData.getData());
             if (pageData.hasNext()) {
                 pageLink = pageData.getNextPageLink();
             }
         } while (pageData.hasNext());
-        
+
         Collections.sort(customerUsersEmail2, idComparator);
         Collections.sort(loadedCustomerUsersEmail2, idComparator);
-        
+
         Assert.assertEquals(customerUsersEmail2, loadedCustomerUsersEmail2);
-        
+
         for (User user : loadedCustomerUsersEmail1) {
-            doDelete("/api/user/"+user.getId().getId().toString())
-            .andExpect(status().isOk());
+            doDelete("/api/user/" + user.getId().getId().toString())
+                    .andExpect(status().isOk());
         }
-        
+
         pageLink = new TextPageLink(4, email1);
-        pageData = doGetTypedWithPageLink("/api/customer/" + customerId.getId().toString() + "/users?", 
-                new TypeReference<TextPageData<User>>(){}, pageLink);
+        pageData = doGetTypedWithPageLink("/api/customer/" + customerId.getId().toString() + "/users?",
+                new TypeReference<TextPageData<User>>() {
+                }, pageLink);
         Assert.assertFalse(pageData.hasNext());
         Assert.assertEquals(0, pageData.getData().size());
-        
+
         for (User user : loadedCustomerUsersEmail2) {
-            doDelete("/api/user/"+user.getId().getId().toString())
-            .andExpect(status().isOk());
+            doDelete("/api/user/" + user.getId().getId().toString())
+                    .andExpect(status().isOk());
         }
-        
+
         pageLink = new TextPageLink(4, email2);
-        pageData = doGetTypedWithPageLink("/api/customer/" + customerId.getId().toString() + "/users?", 
-                new TypeReference<TextPageData<User>>(){}, pageLink);
+        pageData = doGetTypedWithPageLink("/api/customer/" + customerId.getId().toString() + "/users?",
+                new TypeReference<TextPageData<User>>() {
+                }, pageLink);
         Assert.assertFalse(pageData.hasNext());
         Assert.assertEquals(0, pageData.getData().size());
-        
-        doDelete("/api/customer/"+customerId.getId().toString())
-        .andExpect(status().isOk());
-        
+
+        doDelete("/api/customer/" + customerId.getId().toString())
+                .andExpect(status().isOk());
+
         loginSysAdmin();
-        
-        doDelete("/api/tenant/"+savedTenant.getId().getId().toString())
-        .andExpect(status().isOk());
+
+        doDelete("/api/tenant/" + savedTenant.getId().getId().toString())
+                .andExpect(status().isOk());
     }
-    
+
 }

application/src/test/java/org/thingsboard/server/controller/BaseWidgetTypeControllerTest.java

@@ -64,7 +64,6 @@ public abstract class BaseWidgetTypeControllerTest extends AbstractControllerTes
         WidgetsBundle widgetsBundle = new WidgetsBundle();
         widgetsBundle.setTitle("My widgets bundle");
         savedWidgetsBundle = doPost("/api/widgetsBundle", widgetsBundle, WidgetsBundle.class);
-
     }
 
     @After
@@ -100,6 +99,19 @@ public abstract class BaseWidgetTypeControllerTest extends AbstractControllerTes
         Assert.assertEquals(foundWidgetType.getName(), savedWidgetType.getName());
     }
 
+    @Test
+    public void testUpdateWidgetTypeFromDifferentTenant() throws Exception {
+        WidgetType widgetType = new WidgetType();
+        widgetType.setBundleAlias(savedWidgetsBundle.getAlias());
+        widgetType.setName("Widget Type");
+        widgetType.setDescriptor(new ObjectMapper().readValue("{ \"someKey\": \"someValue\" }", JsonNode.class));
+        WidgetType savedWidgetType = doPost("/api/widgetType", widgetType, WidgetType.class);
+
+        loginDifferentTenant();
+        doPost("/api/widgetType", savedWidgetType, WidgetType.class, status().isForbidden());
+        deleteDifferentTenant();
+    }
+
     @Test
     public void testFindWidgetTypeById() throws Exception {
         WidgetType widgetType = new WidgetType();

application/src/test/java/org/thingsboard/server/controller/BaseWidgetsBundleControllerTest.java

@@ -88,6 +88,17 @@ public abstract class BaseWidgetsBundleControllerTest extends AbstractController
         Assert.assertEquals(foundWidgetsBundle.getTitle(), savedWidgetsBundle.getTitle());
     }
 
+    @Test
+    public void testUpdateWidgetsBundleFromDifferentTenant() throws Exception {
+        WidgetsBundle widgetsBundle = new WidgetsBundle();
+        widgetsBundle.setTitle("My widgets bundle");
+        WidgetsBundle savedWidgetsBundle = doPost("/api/widgetsBundle", widgetsBundle, WidgetsBundle.class);
+
+        loginDifferentTenant();
+        doPost("/api/widgetsBundle", savedWidgetsBundle, WidgetsBundle.class, status().isForbidden());
+        deleteDifferentTenant();
+    }
+
     @Test
     public void testFindWidgetsBundleById() throws Exception {
         WidgetsBundle widgetsBundle = new WidgetsBundle();