diff --git a/application/src/main/java/org/thingsboard/server/controller/AlarmController.java b/application/src/main/java/org/thingsboard/server/controller/AlarmController.java index b685d8a8f5..7553448c09 100644 --- a/application/src/main/java/org/thingsboard/server/controller/AlarmController.java +++ b/application/src/main/java/org/thingsboard/server/controller/AlarmController.java @@ -85,7 +85,7 @@ public class AlarmController extends BaseController { try { alarm.setTenantId(getCurrentUser().getTenantId()); - checkEntity(alarm.getId(), alarm); + checkEntity(alarm.getId(), alarm, Resource.ALARM); Alarm savedAlarm = checkNotNull(alarmService.createOrUpdateAlarm(alarm)); logEntityAction(savedAlarm.getId(), savedAlarm, diff --git a/application/src/main/java/org/thingsboard/server/controller/AssetController.java b/application/src/main/java/org/thingsboard/server/controller/AssetController.java index 94915c4641..731eefc838 100644 --- a/application/src/main/java/org/thingsboard/server/controller/AssetController.java +++ b/application/src/main/java/org/thingsboard/server/controller/AssetController.java @@ -76,7 +76,7 @@ public class AssetController extends BaseController { try { asset.setTenantId(getCurrentUser().getTenantId()); - checkEntity(asset.getId(), asset); + checkEntity(asset.getId(), asset, Resource.ASSET); Asset savedAsset = checkNotNull(assetService.saveAsset(asset)); diff --git a/application/src/main/java/org/thingsboard/server/controller/BaseController.java b/application/src/main/java/org/thingsboard/server/controller/BaseController.java index ef81a0bcca..f0e93f5662 100644 --- a/application/src/main/java/org/thingsboard/server/controller/BaseController.java +++ b/application/src/main/java/org/thingsboard/server/controller/BaseController.java @@ -330,10 +330,10 @@ public abstract class BaseController { } } - protected void checkEntity(I entityId, T entity) throws ThingsboardException { + protected void checkEntity(I entityId, T entity, Resource resource) throws ThingsboardException { if (entityId == null) { accessControlService - .checkPermission(getCurrentUser(), Resource.ALARM, Operation.CREATE, null, entity); + .checkPermission(getCurrentUser(), resource, Operation.CREATE, null, entity); } else { checkEntityId(entityId, Operation.WRITE); } diff --git a/application/src/main/java/org/thingsboard/server/controller/CustomerController.java b/application/src/main/java/org/thingsboard/server/controller/CustomerController.java index e04b263210..75dee42ff8 100644 --- a/application/src/main/java/org/thingsboard/server/controller/CustomerController.java +++ b/application/src/main/java/org/thingsboard/server/controller/CustomerController.java @@ -100,7 +100,7 @@ public class CustomerController extends BaseController { try { customer.setTenantId(getCurrentUser().getTenantId()); - checkEntity(customer.getId(), customer); + checkEntity(customer.getId(), customer, Resource.CUSTOMER); Customer savedCustomer = checkNotNull(customerService.saveCustomer(customer)); diff --git a/application/src/main/java/org/thingsboard/server/controller/DeviceController.java b/application/src/main/java/org/thingsboard/server/controller/DeviceController.java index 30c43a7eba..f6f327d7d9 100644 --- a/application/src/main/java/org/thingsboard/server/controller/DeviceController.java +++ b/application/src/main/java/org/thingsboard/server/controller/DeviceController.java @@ -92,7 +92,7 @@ public class DeviceController extends BaseController { try { device.setTenantId(getCurrentUser().getTenantId()); - checkEntity(device.getId(), device); + checkEntity(device.getId(), device, Resource.DEVICE); Device savedDevice = checkNotNull(deviceService.saveDeviceWithAccessToken(device, accessToken)); diff --git a/application/src/main/java/org/thingsboard/server/controller/EntityViewController.java b/application/src/main/java/org/thingsboard/server/controller/EntityViewController.java index 8e7cbb00f5..47023c24a6 100644 --- a/application/src/main/java/org/thingsboard/server/controller/EntityViewController.java +++ b/application/src/main/java/org/thingsboard/server/controller/EntityViewController.java @@ -92,7 +92,7 @@ public class EntityViewController extends BaseController { try { entityView.setTenantId(getCurrentUser().getTenantId()); - checkEntity(entityView.getId(), entityView); + checkEntity(entityView.getId(), entityView, Resource.ENTITY_VIEW); EntityView savedEntityView = checkNotNull(entityViewService.saveEntityView(entityView)); List>> futures = new ArrayList<>(); diff --git a/application/src/main/java/org/thingsboard/server/controller/RuleChainController.java b/application/src/main/java/org/thingsboard/server/controller/RuleChainController.java index 37f037f46f..73b89b034f 100644 --- a/application/src/main/java/org/thingsboard/server/controller/RuleChainController.java +++ b/application/src/main/java/org/thingsboard/server/controller/RuleChainController.java @@ -126,7 +126,7 @@ public class RuleChainController extends BaseController { boolean created = ruleChain.getId() == null; ruleChain.setTenantId(getCurrentUser().getTenantId()); - checkEntity(ruleChain.getId(), ruleChain); + checkEntity(ruleChain.getId(), ruleChain, Resource.RULE_CHAIN); RuleChain savedRuleChain = checkNotNull(ruleChainService.saveRuleChain(ruleChain)); diff --git a/application/src/main/java/org/thingsboard/server/controller/TenantController.java b/application/src/main/java/org/thingsboard/server/controller/TenantController.java index fcd1d541fd..ca87e08c96 100644 --- a/application/src/main/java/org/thingsboard/server/controller/TenantController.java +++ b/application/src/main/java/org/thingsboard/server/controller/TenantController.java @@ -72,7 +72,7 @@ public class TenantController extends BaseController { try { boolean newTenant = tenant.getId() == null; - checkEntity(tenant.getId(), tenant); + checkEntity(tenant.getId(), tenant, Resource.TENANT); tenant = checkNotNull(tenantService.saveTenant(tenant)); if (newTenant) { diff --git a/application/src/main/java/org/thingsboard/server/controller/UserController.java b/application/src/main/java/org/thingsboard/server/controller/UserController.java index f978829c4a..b3d66adc53 100644 --- a/application/src/main/java/org/thingsboard/server/controller/UserController.java +++ b/application/src/main/java/org/thingsboard/server/controller/UserController.java @@ -138,7 +138,7 @@ public class UserController extends BaseController { user.setTenantId(getCurrentUser().getTenantId()); } - checkEntity(user.getId(), user); + checkEntity(user.getId(), user, Resource.USER); boolean sendEmail = user.getId() == null && sendActivationMail; User savedUser = checkNotNull(userService.saveUser(user)); diff --git a/application/src/main/java/org/thingsboard/server/controller/WidgetTypeController.java b/application/src/main/java/org/thingsboard/server/controller/WidgetTypeController.java index 7b88b6ff0b..ffff90536f 100644 --- a/application/src/main/java/org/thingsboard/server/controller/WidgetTypeController.java +++ b/application/src/main/java/org/thingsboard/server/controller/WidgetTypeController.java @@ -66,7 +66,7 @@ public class WidgetTypeController extends BaseController { widgetType.setTenantId(getCurrentUser().getTenantId()); } - checkEntity(widgetType.getId(), widgetType); + checkEntity(widgetType.getId(), widgetType, Resource.WIDGET_TYPE); return checkNotNull(widgetTypeService.saveWidgetType(widgetType)); } catch (Exception e) { diff --git a/application/src/main/java/org/thingsboard/server/controller/WidgetsBundleController.java b/application/src/main/java/org/thingsboard/server/controller/WidgetsBundleController.java index 231a8ca1d7..1b6b371297 100644 --- a/application/src/main/java/org/thingsboard/server/controller/WidgetsBundleController.java +++ b/application/src/main/java/org/thingsboard/server/controller/WidgetsBundleController.java @@ -61,15 +61,13 @@ public class WidgetsBundleController extends BaseController { @ResponseBody public WidgetsBundle saveWidgetsBundle(@RequestBody WidgetsBundle widgetsBundle) throws ThingsboardException { try { - checkEntity(widgetsBundle.getId(), widgetsBundle); - - if (widgetsBundle.getId() == null) { - accessControlService - .checkPermission(getCurrentUser(), Resource.WIDGETS_BUNDLE, Operation.CREATE, widgetsBundle.getId(), widgetsBundle); + if (getCurrentUser().getAuthority() == Authority.SYS_ADMIN) { + widgetsBundle.setTenantId(TenantId.SYS_TENANT_ID); } else { - checkWidgetsBundleId(widgetsBundle.getId(), Operation.WRITE); + widgetsBundle.setTenantId(getCurrentUser().getTenantId()); } + checkEntity(widgetsBundle.getId(), widgetsBundle, Resource.WIDGETS_BUNDLE); return checkNotNull(widgetsBundleService.saveWidgetsBundle(widgetsBundle)); } catch (Exception e) { throw handleException(e); diff --git a/application/src/main/java/org/thingsboard/server/service/security/permission/Resource.java b/application/src/main/java/org/thingsboard/server/service/security/permission/Resource.java index ce657931c6..a66b822fca 100644 --- a/application/src/main/java/org/thingsboard/server/service/security/permission/Resource.java +++ b/application/src/main/java/org/thingsboard/server/service/security/permission/Resource.java @@ -46,4 +46,13 @@ public enum Resource { public Optional getEntityType() { return Optional.ofNullable(entityType); } + + public static Resource of(EntityType entityType) { + for (Resource resource : Resource.values()) { + if (resource.getEntityType().get() == entityType) { + return resource; + } + } + throw new IllegalArgumentException("Unknown EntityType: " + entityType.name()); + } } diff --git a/application/src/test/java/org/thingsboard/server/controller/AbstractControllerTest.java b/application/src/test/java/org/thingsboard/server/controller/AbstractControllerTest.java index 26f375c464..eaaf81ef6b 100644 --- a/application/src/test/java/org/thingsboard/server/controller/AbstractControllerTest.java +++ b/application/src/test/java/org/thingsboard/server/controller/AbstractControllerTest.java @@ -223,6 +223,27 @@ public abstract class AbstractControllerTest { login(CUSTOMER_USER_EMAIL, CUSTOMER_USER_PASSWORD); } + private Tenant savedDifferentTenant; + protected void loginDifferentTenant() throws Exception { + loginSysAdmin(); + Tenant tenant = new Tenant(); + tenant.setTitle("Different tenant"); + savedDifferentTenant = doPost("/api/tenant", tenant, Tenant.class); + Assert.assertNotNull(savedDifferentTenant); + User differentTenantAdmin = new User(); + differentTenantAdmin.setAuthority(Authority.TENANT_ADMIN); + differentTenantAdmin.setTenantId(savedDifferentTenant.getId()); + differentTenantAdmin.setEmail("different_tenant@thingsboard.org"); + + createUserAndLogin(differentTenantAdmin, "testPassword"); + } + + protected void deleteDifferentTenant() throws Exception { + loginSysAdmin(); + doDelete("/api/tenant/" + savedDifferentTenant.getId().getId().toString()) + .andExpect(status().isOk()); + } + protected User createUserAndLogin(User user, String password) throws Exception { User savedUser = doPost("/api/user", user, User.class); logout(); diff --git a/application/src/test/java/org/thingsboard/server/controller/BaseAssetControllerTest.java b/application/src/test/java/org/thingsboard/server/controller/BaseAssetControllerTest.java index 0422a85416..24dbcca2db 100644 --- a/application/src/test/java/org/thingsboard/server/controller/BaseAssetControllerTest.java +++ b/application/src/test/java/org/thingsboard/server/controller/BaseAssetControllerTest.java @@ -98,6 +98,18 @@ public abstract class BaseAssetControllerTest extends AbstractControllerTest { Assert.assertEquals(foundAsset.getName(), savedAsset.getName()); } + @Test + public void testUpdateAssetFromDifferentTenant() throws Exception { + Asset asset = new Asset(); + asset.setName("My asset"); + asset.setType("default"); + Asset savedAsset = doPost("/api/asset", asset, Asset.class); + + loginDifferentTenant(); + doPost("/api/asset", savedAsset, Asset.class, status().isForbidden()); + deleteDifferentTenant(); + } + @Test public void testFindAssetById() throws Exception { Asset asset = new Asset(); diff --git a/application/src/test/java/org/thingsboard/server/controller/BaseCustomerControllerTest.java b/application/src/test/java/org/thingsboard/server/controller/BaseCustomerControllerTest.java index f5ea544560..558600c73e 100644 --- a/application/src/test/java/org/thingsboard/server/controller/BaseCustomerControllerTest.java +++ b/application/src/test/java/org/thingsboard/server/controller/BaseCustomerControllerTest.java @@ -23,6 +23,8 @@ import java.util.Collections; import java.util.List; import org.apache.commons.lang3.RandomStringUtils; +import org.junit.After; +import org.junit.Before; import org.thingsboard.server.common.data.Customer; import org.thingsboard.server.common.data.Tenant; import org.thingsboard.server.common.data.User; @@ -38,25 +40,39 @@ import com.fasterxml.jackson.core.type.TypeReference; public abstract class BaseCustomerControllerTest extends AbstractControllerTest { private IdComparator idComparator = new IdComparator<>(); - - @Test - public void testSaveCustomer() throws Exception { + + private Tenant savedTenant; + private User tenantAdmin; + + @Before + public void beforeTest() throws Exception { loginSysAdmin(); Tenant tenant = new Tenant(); tenant.setTitle("My tenant"); - Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); + savedTenant = doPost("/api/tenant", tenant, Tenant.class); Assert.assertNotNull(savedTenant); - - User tenantAdmin = new User(); + + tenantAdmin = new User(); tenantAdmin.setAuthority(Authority.TENANT_ADMIN); tenantAdmin.setTenantId(savedTenant.getId()); tenantAdmin.setEmail("tenant2@thingsboard.org"); tenantAdmin.setFirstName("Joe"); tenantAdmin.setLastName("Downs"); - + tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1"); - + } + + @After + public void afterTest() throws Exception { + loginSysAdmin(); + + doDelete("/api/tenant/" + savedTenant.getId().getId().toString()) + .andExpect(status().isOk()); + } + + @Test + public void testSaveCustomer() throws Exception { Customer customer = new Customer(); customer.setTitle("My customer"); Customer savedCustomer = doPost("/api/customer", customer, Customer.class); @@ -66,266 +82,159 @@ public abstract class BaseCustomerControllerTest extends AbstractControllerTest Assert.assertEquals(customer.getTitle(), savedCustomer.getTitle()); savedCustomer.setTitle("My new customer"); doPost("/api/customer", savedCustomer, Customer.class); - - Customer foundCustomer = doGet("/api/customer/"+savedCustomer.getId().getId().toString(), Customer.class); + + Customer foundCustomer = doGet("/api/customer/"+savedCustomer.getId().getId().toString(), Customer.class); Assert.assertEquals(foundCustomer.getTitle(), savedCustomer.getTitle()); - + doDelete("/api/customer/"+savedCustomer.getId().getId().toString()) .andExpect(status().isOk()); - - loginSysAdmin(); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); } - + @Test - public void testFindCustomerById() throws Exception { - - loginSysAdmin(); + public void testUpdateCustomerFromDifferentTenant() throws Exception { + Customer customer = new Customer(); + customer.setTitle("My customer"); + Customer savedCustomer = doPost("/api/customer", customer, Customer.class); + doPost("/api/customer", savedCustomer, Customer.class); - Tenant tenant = new Tenant(); - tenant.setTitle("My tenant"); - Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); - Assert.assertNotNull(savedTenant); - - User tenantAdmin = new User(); - tenantAdmin.setAuthority(Authority.TENANT_ADMIN); - tenantAdmin.setTenantId(savedTenant.getId()); - tenantAdmin.setEmail("tenant2@thingsboard.org"); - tenantAdmin.setFirstName("Joe"); - tenantAdmin.setLastName("Downs"); - - tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1"); - + loginDifferentTenant(); + doPost("/api/customer", savedCustomer, Customer.class, status().isForbidden()); + deleteDifferentTenant(); + + login(tenantAdmin.getName(), "testPassword1"); + doDelete("/api/customer/" + savedCustomer.getId().getId().toString()) + .andExpect(status().isOk()); + } + + @Test + public void testFindCustomerById() throws Exception { Customer customer = new Customer(); customer.setTitle("My customer"); Customer savedCustomer = doPost("/api/customer", customer, Customer.class); - - Customer foundCustomer = doGet("/api/customer/"+savedCustomer.getId().getId().toString(), Customer.class); + + Customer foundCustomer = doGet("/api/customer/" + savedCustomer.getId().getId().toString(), Customer.class); Assert.assertNotNull(foundCustomer); Assert.assertEquals(savedCustomer, foundCustomer); - - doDelete("/api/customer/"+savedCustomer.getId().getId().toString()) - .andExpect(status().isOk()); - - loginSysAdmin(); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); + + doDelete("/api/customer/" + savedCustomer.getId().getId().toString()) + .andExpect(status().isOk()); } - + @Test public void testDeleteCustomer() throws Exception { - - loginSysAdmin(); - - Tenant tenant = new Tenant(); - tenant.setTitle("My tenant"); - Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); - Assert.assertNotNull(savedTenant); - - User tenantAdmin = new User(); - tenantAdmin.setAuthority(Authority.TENANT_ADMIN); - tenantAdmin.setTenantId(savedTenant.getId()); - tenantAdmin.setEmail("tenant2@thingsboard.org"); - tenantAdmin.setFirstName("Joe"); - tenantAdmin.setLastName("Downs"); - - tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1"); - Customer customer = new Customer(); customer.setTitle("My customer"); Customer savedCustomer = doPost("/api/customer", customer, Customer.class); - - doDelete("/api/customer/"+savedCustomer.getId().getId().toString()) - .andExpect(status().isOk()); - doGet("/api/customer/"+savedCustomer.getId().getId().toString()) - .andExpect(status().isNotFound()); - - loginSysAdmin(); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); + doDelete("/api/customer/" + savedCustomer.getId().getId().toString()) + .andExpect(status().isOk()); + + doGet("/api/customer/" + savedCustomer.getId().getId().toString()) + .andExpect(status().isNotFound()); } - + @Test public void testSaveCustomerWithEmptyTitle() throws Exception { - - loginSysAdmin(); - - Tenant tenant = new Tenant(); - tenant.setTitle("My tenant"); - Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); - Assert.assertNotNull(savedTenant); - - User tenantAdmin = new User(); - tenantAdmin.setAuthority(Authority.TENANT_ADMIN); - tenantAdmin.setTenantId(savedTenant.getId()); - tenantAdmin.setEmail("tenant2@thingsboard.org"); - tenantAdmin.setFirstName("Joe"); - tenantAdmin.setLastName("Downs"); - - tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1"); - Customer customer = new Customer(); doPost("/api/customer", customer) - .andExpect(status().isBadRequest()) - .andExpect(statusReason(containsString("Customer title should be specified"))); - - loginSysAdmin(); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); + .andExpect(status().isBadRequest()) + .andExpect(statusReason(containsString("Customer title should be specified"))); } - + @Test public void testSaveCustomerWithInvalidEmail() throws Exception { - - loginSysAdmin(); - - Tenant tenant = new Tenant(); - tenant.setTitle("My tenant"); - Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); - Assert.assertNotNull(savedTenant); - - User tenantAdmin = new User(); - tenantAdmin.setAuthority(Authority.TENANT_ADMIN); - tenantAdmin.setTenantId(savedTenant.getId()); - tenantAdmin.setEmail("tenant2@thingsboard.org"); - tenantAdmin.setFirstName("Joe"); - tenantAdmin.setLastName("Downs"); - - tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1"); - Customer customer = new Customer(); customer.setTitle("My customer"); customer.setEmail("invalid@mail"); doPost("/api/customer", customer) - .andExpect(status().isBadRequest()) - .andExpect(statusReason(containsString("Invalid email address format 'invalid@mail'"))); - - loginSysAdmin(); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); + .andExpect(status().isBadRequest()) + .andExpect(statusReason(containsString("Invalid email address format 'invalid@mail'"))); + +// loginSysAdmin(); +// +// doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) +// .andExpect(status().isOk()); } - + @Test public void testFindCustomers() throws Exception { - loginSysAdmin(); - - Tenant tenant = new Tenant(); - tenant.setTitle("My tenant"); - Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); - Assert.assertNotNull(savedTenant); - TenantId tenantId = savedTenant.getId(); - - User tenantAdmin = new User(); - tenantAdmin.setAuthority(Authority.TENANT_ADMIN); - tenantAdmin.setTenantId(tenantId); - tenantAdmin.setEmail("tenant2@thingsboard.org"); - tenantAdmin.setFirstName("Joe"); - tenantAdmin.setLastName("Downs"); - - tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1"); - + List customers = new ArrayList<>(); - for (int i=0;i<135;i++) { + for (int i = 0; i < 135; i++) { Customer customer = new Customer(); customer.setTenantId(tenantId); - customer.setTitle("Customer"+i); + customer.setTitle("Customer" + i); customers.add(doPost("/api/customer", customer, Customer.class)); } - + List loadedCustomers = new ArrayList<>(); TextPageLink pageLink = new TextPageLink(23); TextPageData pageData = null; do { - pageData = doGetTypedWithPageLink("/api/customers?", new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/customers?", new TypeReference>() { + }, pageLink); loadedCustomers.addAll(pageData.getData()); if (pageData.hasNext()) { pageLink = pageData.getNextPageLink(); } } while (pageData.hasNext()); - + Collections.sort(customers, idComparator); Collections.sort(loadedCustomers, idComparator); - + Assert.assertEquals(customers, loadedCustomers); - - loginSysAdmin(); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); } - + @Test public void testFindCustomersByTitle() throws Exception { - - loginSysAdmin(); - - Tenant tenant = new Tenant(); - tenant.setTitle("My tenant"); - Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); - Assert.assertNotNull(savedTenant); - TenantId tenantId = savedTenant.getId(); - - User tenantAdmin = new User(); - tenantAdmin.setAuthority(Authority.TENANT_ADMIN); - tenantAdmin.setTenantId(tenantId); - tenantAdmin.setEmail("tenant2@thingsboard.org"); - tenantAdmin.setFirstName("Joe"); - tenantAdmin.setLastName("Downs"); - - tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1"); - + String title1 = "Customer title 1"; List customersTitle1 = new ArrayList<>(); - for (int i=0;i<143;i++) { + for (int i = 0; i < 143; i++) { Customer customer = new Customer(); customer.setTenantId(tenantId); - String suffix = RandomStringUtils.randomAlphanumeric((int)(5 + Math.random()*10)); - String title = title1+suffix; + String suffix = RandomStringUtils.randomAlphanumeric((int) (5 + Math.random() * 10)); + String title = title1 + suffix; title = i % 2 == 0 ? title.toLowerCase() : title.toUpperCase(); customer.setTitle(title); customersTitle1.add(doPost("/api/customer", customer, Customer.class)); } String title2 = "Customer title 2"; List customersTitle2 = new ArrayList<>(); - for (int i=0;i<175;i++) { + for (int i = 0; i < 175; i++) { Customer customer = new Customer(); customer.setTenantId(tenantId); - String suffix = RandomStringUtils.randomAlphanumeric((int)(5 + Math.random()*10)); - String title = title2+suffix; + String suffix = RandomStringUtils.randomAlphanumeric((int) (5 + Math.random() * 10)); + String title = title2 + suffix; title = i % 2 == 0 ? title.toLowerCase() : title.toUpperCase(); customer.setTitle(title); customersTitle2.add(doPost("/api/customer", customer, Customer.class)); } - + List loadedCustomersTitle1 = new ArrayList<>(); TextPageLink pageLink = new TextPageLink(15, title1); TextPageData pageData = null; do { - pageData = doGetTypedWithPageLink("/api/customers?", new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/customers?", new TypeReference>() { + }, pageLink); loadedCustomersTitle1.addAll(pageData.getData()); if (pageData.hasNext()) { pageLink = pageData.getNextPageLink(); } } while (pageData.hasNext()); - + Collections.sort(customersTitle1, idComparator); Collections.sort(loadedCustomersTitle1, idComparator); - + Assert.assertEquals(customersTitle1, loadedCustomersTitle1); - + List loadedCustomersTitle2 = new ArrayList<>(); pageLink = new TextPageLink(4, title2); do { - pageData = doGetTypedWithPageLink("/api/customers?", new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/customers?", new TypeReference>() { + }, pageLink); loadedCustomersTitle2.addAll(pageData.getData()); if (pageData.hasNext()) { pageLink = pageData.getNextPageLink(); @@ -334,33 +243,30 @@ public abstract class BaseCustomerControllerTest extends AbstractControllerTest Collections.sort(customersTitle2, idComparator); Collections.sort(loadedCustomersTitle2, idComparator); - + Assert.assertEquals(customersTitle2, loadedCustomersTitle2); - + for (Customer customer : loadedCustomersTitle1) { - doDelete("/api/customer/"+customer.getId().getId().toString()) - .andExpect(status().isOk()); + doDelete("/api/customer/" + customer.getId().getId().toString()) + .andExpect(status().isOk()); } - + pageLink = new TextPageLink(4, title1); - pageData = doGetTypedWithPageLink("/api/customers?", new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/customers?", new TypeReference>() { + }, pageLink); Assert.assertFalse(pageData.hasNext()); Assert.assertEquals(0, pageData.getData().size()); - + for (Customer customer : loadedCustomersTitle2) { - doDelete("/api/customer/"+customer.getId().getId().toString()) - .andExpect(status().isOk()); + doDelete("/api/customer/" + customer.getId().getId().toString()) + .andExpect(status().isOk()); } - + pageLink = new TextPageLink(4, title2); - pageData = doGetTypedWithPageLink("/api/customers?", new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/customers?", new TypeReference>() { + }, pageLink); Assert.assertFalse(pageData.hasNext()); Assert.assertEquals(0, pageData.getData().size()); - - loginSysAdmin(); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); } - + } diff --git a/application/src/test/java/org/thingsboard/server/controller/BaseDashboardControllerTest.java b/application/src/test/java/org/thingsboard/server/controller/BaseDashboardControllerTest.java index 0ae939550a..e8fbfe4aa1 100644 --- a/application/src/test/java/org/thingsboard/server/controller/BaseDashboardControllerTest.java +++ b/application/src/test/java/org/thingsboard/server/controller/BaseDashboardControllerTest.java @@ -16,10 +16,8 @@ package org.thingsboard.server.controller; import static org.hamcrest.Matchers.containsString; -import static org.thingsboard.server.dao.model.ModelConstants.NULL_UUID; import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status; -import java.sql.Time; import java.util.ArrayList; import java.util.Collections; import java.util.List; @@ -33,7 +31,6 @@ import org.thingsboard.server.common.data.page.TextPageLink; import org.thingsboard.server.common.data.page.TimePageData; import org.thingsboard.server.common.data.page.TimePageLink; import org.thingsboard.server.common.data.security.Authority; -import org.thingsboard.server.dao.model.ModelConstants; import org.junit.After; import org.junit.Assert; import org.junit.Before; @@ -93,6 +90,17 @@ public abstract class BaseDashboardControllerTest extends AbstractControllerTest Dashboard foundDashboard = doGet("/api/dashboard/" + savedDashboard.getId().getId().toString(), Dashboard.class); Assert.assertEquals(foundDashboard.getTitle(), savedDashboard.getTitle()); } + + @Test + public void testUpdateDashboardFromDifferentTenant() throws Exception { + Dashboard dashboard = new Dashboard(); + dashboard.setTitle("My dashboard"); + Dashboard savedDashboard = doPost("/api/dashboard", dashboard, Dashboard.class); + + loginDifferentTenant(); + doPost("/api/dashboard", savedDashboard, Dashboard.class, status().isForbidden()); + deleteDifferentTenant(); + } @Test public void testFindDashboardById() throws Exception { diff --git a/application/src/test/java/org/thingsboard/server/controller/BaseDeviceControllerTest.java b/application/src/test/java/org/thingsboard/server/controller/BaseDeviceControllerTest.java index 2f347f1f89..aa11c4ab40 100644 --- a/application/src/test/java/org/thingsboard/server/controller/BaseDeviceControllerTest.java +++ b/application/src/test/java/org/thingsboard/server/controller/BaseDeviceControllerTest.java @@ -107,6 +107,17 @@ public abstract class BaseDeviceControllerTest extends AbstractControllerTest { Device foundDevice = doGet("/api/device/" + savedDevice.getId().getId().toString(), Device.class); Assert.assertEquals(foundDevice.getName(), savedDevice.getName()); } + + @Test + public void testUpdateDeviceFromDifferentTenant() throws Exception { + Device device = new Device(); + device.setName("My device"); + device.setType("default"); + Device savedDevice = doPost("/api/device", device, Device.class); + loginDifferentTenant(); + doPost("/api/device", savedDevice, Device.class, status().isForbidden()); + deleteDifferentTenant(); + } @Test public void testFindDeviceById() throws Exception { diff --git a/application/src/test/java/org/thingsboard/server/controller/BaseEntityViewControllerTest.java b/application/src/test/java/org/thingsboard/server/controller/BaseEntityViewControllerTest.java index 420446e04d..bec1b55a79 100644 --- a/application/src/test/java/org/thingsboard/server/controller/BaseEntityViewControllerTest.java +++ b/application/src/test/java/org/thingsboard/server/controller/BaseEntityViewControllerTest.java @@ -25,7 +25,6 @@ import org.eclipse.paho.client.mqttv3.MqttMessage; import org.junit.After; import org.junit.Assert; import org.junit.Before; -import org.junit.Ignore; import org.junit.Test; import org.thingsboard.server.common.data.Customer; import org.thingsboard.server.common.data.Device; @@ -132,6 +131,15 @@ public abstract class BaseEntityViewControllerTest extends AbstractControllerTes assertEquals(foundEntityView.getKeys(), telemetry); } + + @Test + public void testUpdateEntityViewFromDifferentTenant() throws Exception { + EntityView savedView = getNewSavedEntityView("Test entity view"); + loginDifferentTenant(); + doPost("/api/entityView", savedView, EntityView.class, status().isForbidden()); + deleteDifferentTenant(); + } + @Test public void testDeleteEntityView() throws Exception { EntityView view = getNewSavedEntityView("Test entity view"); diff --git a/application/src/test/java/org/thingsboard/server/controller/BaseUserControllerTest.java b/application/src/test/java/org/thingsboard/server/controller/BaseUserControllerTest.java index 2a2032e4c7..e290ac9f24 100644 --- a/application/src/test/java/org/thingsboard/server/controller/BaseUserControllerTest.java +++ b/application/src/test/java/org/thingsboard/server/controller/BaseUserControllerTest.java @@ -38,21 +38,23 @@ import java.util.List; import static org.hamcrest.Matchers.containsString; import static org.hamcrest.Matchers.is; -import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status; public abstract class BaseUserControllerTest extends AbstractControllerTest { - + private IdComparator idComparator = new IdComparator<>(); @Test public void testSaveUser() throws Exception { loginSysAdmin(); - + Tenant tenant = new Tenant(); tenant.setTitle("My tenant"); Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); Assert.assertNotNull(savedTenant); - + String email = "tenant2@thingsboard.org"; User user = new User(); user.setAuthority(Authority.TENANT_ADMIN); @@ -66,13 +68,13 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest { Assert.assertTrue(savedUser.getCreatedTime() > 0); Assert.assertEquals(user.getEmail(), savedUser.getEmail()); - User foundUser = doGet("/api/user/"+savedUser.getId().getId().toString(), User.class); + User foundUser = doGet("/api/user/" + savedUser.getId().getId().toString(), User.class); Assert.assertEquals(foundUser, savedUser); - + logout(); doGet("/api/noauth/activate?activateToken={activateToken}", TestMailService.currentActivateToken) - .andExpect(status().isSeeOther()) - .andExpect(header().string(HttpHeaders.LOCATION, "/login/createPassword?activateToken=" + TestMailService.currentActivateToken)); + .andExpect(status().isSeeOther()) + .andExpect(header().string(HttpHeaders.LOCATION, "/login/createPassword?activateToken=" + TestMailService.currentActivateToken)); JsonNode activateRequest = new ObjectMapper().createObjectNode() .put("activateToken", TestMailService.currentActivateToken) @@ -82,36 +84,61 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest { validateAndSetJwtToken(tokenInfo, email); doGet("/api/auth/user") - .andExpect(status().isOk()) - .andExpect(jsonPath("$.authority",is(Authority.TENANT_ADMIN.name()))) - .andExpect(jsonPath("$.email",is(email))); - + .andExpect(status().isOk()) + .andExpect(jsonPath("$.authority", is(Authority.TENANT_ADMIN.name()))) + .andExpect(jsonPath("$.email", is(email))); + logout(); - + login(email, "testPassword"); - + doGet("/api/auth/user") - .andExpect(status().isOk()) - .andExpect(jsonPath("$.authority",is(Authority.TENANT_ADMIN.name()))) - .andExpect(jsonPath("$.email",is(email))); - + .andExpect(status().isOk()) + .andExpect(jsonPath("$.authority", is(Authority.TENANT_ADMIN.name()))) + .andExpect(jsonPath("$.email", is(email))); + loginSysAdmin(); - doDelete("/api/user/"+savedUser.getId().getId().toString()) - .andExpect(status().isOk()); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); + doDelete("/api/user/" + savedUser.getId().getId().toString()) + .andExpect(status().isOk()); + + doDelete("/api/tenant/" + savedTenant.getId().getId().toString()) + .andExpect(status().isOk()); } - + + @Test + public void testUpdateUserFromDifferentTenant() throws Exception { + loginSysAdmin(); + Tenant tenant = new Tenant(); + tenant.setTitle("My tenant"); + Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); + Assert.assertNotNull(savedTenant); + + User tenantAdmin = new User(); + tenantAdmin.setAuthority(Authority.TENANT_ADMIN); + tenantAdmin.setTenantId(savedTenant.getId()); + tenantAdmin.setEmail("tenant2@thingsboard.org"); + tenantAdmin.setFirstName("Joe"); + tenantAdmin.setLastName("Downs"); + tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1"); + + loginDifferentTenant(); + doPost("/api/user", tenantAdmin, User.class, status().isForbidden()); + deleteDifferentTenant(); + + loginSysAdmin(); + doDelete("/api/tenant/" + savedTenant.getId().getId().toString()) + .andExpect(status().isOk()); + } + @Test public void testResetPassword() throws Exception { loginSysAdmin(); - + Tenant tenant = new Tenant(); tenant.setTitle("My tenant"); Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); Assert.assertNotNull(savedTenant); - + String email = "tenant2@thingsboard.org"; User user = new User(); user.setAuthority(Authority.TENANT_ADMIN); @@ -119,7 +146,7 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest { user.setEmail(email); user.setFirstName("Joe"); user.setLastName("Downs"); - + User savedUser = createUserAndLogin(user, "testPassword1"); logout(); @@ -127,10 +154,10 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest { .put("email", email); doPost("/api/noauth/resetPasswordByEmail", resetPasswordByEmailRequest) - .andExpect(status().isOk()); + .andExpect(status().isOk()); doGet("/api/noauth/resetPassword?resetToken={resetToken}", TestMailService.currentResetPasswordToken) - .andExpect(status().isSeeOther()) - .andExpect(header().string(HttpHeaders.LOCATION, "/login/resetPassword?resetToken=" + TestMailService.currentResetPasswordToken)); + .andExpect(status().isSeeOther()) + .andExpect(header().string(HttpHeaders.LOCATION, "/login/resetPassword?resetToken=" + TestMailService.currentResetPasswordToken)); JsonNode resetPasswordRequest = new ObjectMapper().createObjectNode() .put("resetToken", TestMailService.currentResetPasswordToken) @@ -140,35 +167,35 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest { validateAndSetJwtToken(tokenInfo, email); doGet("/api/auth/user") - .andExpect(status().isOk()) - .andExpect(jsonPath("$.authority",is(Authority.TENANT_ADMIN.name()))) - .andExpect(jsonPath("$.email",is(email))); - + .andExpect(status().isOk()) + .andExpect(jsonPath("$.authority", is(Authority.TENANT_ADMIN.name()))) + .andExpect(jsonPath("$.email", is(email))); + logout(); - + login(email, "testPassword2"); doGet("/api/auth/user") - .andExpect(status().isOk()) - .andExpect(jsonPath("$.authority",is(Authority.TENANT_ADMIN.name()))) - .andExpect(jsonPath("$.email",is(email))); - + .andExpect(status().isOk()) + .andExpect(jsonPath("$.authority", is(Authority.TENANT_ADMIN.name()))) + .andExpect(jsonPath("$.email", is(email))); + loginSysAdmin(); - doDelete("/api/user/"+savedUser.getId().getId().toString()) - .andExpect(status().isOk()); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); + doDelete("/api/user/" + savedUser.getId().getId().toString()) + .andExpect(status().isOk()); + + doDelete("/api/tenant/" + savedTenant.getId().getId().toString()) + .andExpect(status().isOk()); } - + @Test public void testFindUserById() throws Exception { loginSysAdmin(); - + Tenant tenant = new Tenant(); tenant.setTitle("My tenant"); Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); Assert.assertNotNull(savedTenant); - + String email = "tenant2@thingsboard.org"; User user = new User(); user.setAuthority(Authority.TENANT_ADMIN); @@ -176,25 +203,25 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest { user.setEmail(email); user.setFirstName("Joe"); user.setLastName("Downs"); - + User savedUser = doPost("/api/user", user, User.class); - User foundUser = doGet("/api/user/"+savedUser.getId().getId().toString(), User.class); + User foundUser = doGet("/api/user/" + savedUser.getId().getId().toString(), User.class); Assert.assertNotNull(foundUser); Assert.assertEquals(savedUser, foundUser); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); + + doDelete("/api/tenant/" + savedTenant.getId().getId().toString()) + .andExpect(status().isOk()); } - + @Test public void testSaveUserWithSameEmail() throws Exception { loginSysAdmin(); - + Tenant tenant = new Tenant(); tenant.setTitle("My tenant"); Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); Assert.assertNotNull(savedTenant); - + String email = TENANT_ADMIN_EMAIL; User user = new User(); user.setAuthority(Authority.TENANT_ADMIN); @@ -202,24 +229,24 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest { user.setEmail(email); user.setFirstName("Joe"); user.setLastName("Downs"); - + doPost("/api/user", user) - .andExpect(status().isBadRequest()) - .andExpect(statusReason(containsString("User with email '" + email + "' already present in database"))); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); + .andExpect(status().isBadRequest()) + .andExpect(statusReason(containsString("User with email '" + email + "' already present in database"))); + + doDelete("/api/tenant/" + savedTenant.getId().getId().toString()) + .andExpect(status().isOk()); } - + @Test public void testSaveUserWithInvalidEmail() throws Exception { loginSysAdmin(); - + Tenant tenant = new Tenant(); tenant.setTitle("My tenant"); Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); Assert.assertNotNull(savedTenant); - + String email = "tenant_thingsboard.org"; User user = new User(); user.setAuthority(Authority.TENANT_ADMIN); @@ -227,62 +254,62 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest { user.setEmail(email); user.setFirstName("Joe"); user.setLastName("Downs"); - + doPost("/api/user", user) - .andExpect(status().isBadRequest()) - .andExpect(statusReason(containsString("Invalid email address format '" + email + "'"))); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); + .andExpect(status().isBadRequest()) + .andExpect(statusReason(containsString("Invalid email address format '" + email + "'"))); + + doDelete("/api/tenant/" + savedTenant.getId().getId().toString()) + .andExpect(status().isOk()); } - + @Test public void testSaveUserWithEmptyEmail() throws Exception { loginSysAdmin(); - + Tenant tenant = new Tenant(); tenant.setTitle("My tenant"); Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); Assert.assertNotNull(savedTenant); - + User user = new User(); user.setAuthority(Authority.TENANT_ADMIN); user.setTenantId(savedTenant.getId()); user.setFirstName("Joe"); user.setLastName("Downs"); - + doPost("/api/user", user) - .andExpect(status().isBadRequest()) - .andExpect(statusReason(containsString("User email should be specified"))); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); + .andExpect(status().isBadRequest()) + .andExpect(statusReason(containsString("User email should be specified"))); + + doDelete("/api/tenant/" + savedTenant.getId().getId().toString()) + .andExpect(status().isOk()); } - + @Test public void testSaveUserWithoutTenant() throws Exception { loginSysAdmin(); - + User user = new User(); user.setAuthority(Authority.TENANT_ADMIN); user.setEmail("tenant2@thingsboard.org"); user.setFirstName("Joe"); user.setLastName("Downs"); - + doPost("/api/user", user) - .andExpect(status().isBadRequest()) - .andExpect(statusReason(containsString("Tenant administrator should be assigned to tenant"))); + .andExpect(status().isBadRequest()) + .andExpect(statusReason(containsString("Tenant administrator should be assigned to tenant"))); } - + @Test public void testDeleteUser() throws Exception { loginSysAdmin(); - + Tenant tenant = new Tenant(); tenant.setTitle("My tenant"); Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); Assert.assertNotNull(savedTenant); - + String email = "tenant2@thingsboard.org"; User user = new User(); user.setAuthority(Authority.TENANT_ADMIN); @@ -290,176 +317,182 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest { user.setEmail(email); user.setFirstName("Joe"); user.setLastName("Downs"); - + User savedUser = doPost("/api/user", user, User.class); - User foundUser = doGet("/api/user/"+savedUser.getId().getId().toString(), User.class); + User foundUser = doGet("/api/user/" + savedUser.getId().getId().toString(), User.class); Assert.assertNotNull(foundUser); - - doDelete("/api/user/"+savedUser.getId().getId().toString()) - .andExpect(status().isOk()); - - doGet("/api/user/"+savedUser.getId().getId().toString()) - .andExpect(status().isNotFound()); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); + + doDelete("/api/user/" + savedUser.getId().getId().toString()) + .andExpect(status().isOk()); + + doGet("/api/user/" + savedUser.getId().getId().toString()) + .andExpect(status().isNotFound()); + + doDelete("/api/tenant/" + savedTenant.getId().getId().toString()) + .andExpect(status().isOk()); } - + @Test public void testFindTenantAdmins() throws Exception { loginSysAdmin(); - + Tenant tenant = new Tenant(); tenant.setTitle("My tenant"); Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); Assert.assertNotNull(savedTenant); - + TenantId tenantId = savedTenant.getId(); - + List tenantAdmins = new ArrayList<>(); - for (int i=0;i<64;i++) { + for (int i = 0; i < 64; i++) { User user = new User(); user.setAuthority(Authority.TENANT_ADMIN); user.setTenantId(tenantId); user.setEmail("testTenant" + i + "@thingsboard.org"); tenantAdmins.add(doPost("/api/user", user, User.class)); } - + List loadedTenantAdmins = new ArrayList<>(); TextPageLink pageLink = new TextPageLink(33); TextPageData pageData = null; do { - pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?", - new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?", + new TypeReference>() { + }, pageLink); loadedTenantAdmins.addAll(pageData.getData()); if (pageData.hasNext()) { pageLink = pageData.getNextPageLink(); } } while (pageData.hasNext()); - + Collections.sort(tenantAdmins, idComparator); Collections.sort(loadedTenantAdmins, idComparator); - + Assert.assertEquals(tenantAdmins, loadedTenantAdmins); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); - + + doDelete("/api/tenant/" + savedTenant.getId().getId().toString()) + .andExpect(status().isOk()); + pageLink = new TextPageLink(33); - pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?", - new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?", + new TypeReference>() { + }, pageLink); Assert.assertFalse(pageData.hasNext()); Assert.assertTrue(pageData.getData().isEmpty()); } - + @Test public void testFindTenantAdminsByEmail() throws Exception { - + loginSysAdmin(); - + Tenant tenant = new Tenant(); tenant.setTitle("My tenant"); Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); Assert.assertNotNull(savedTenant); - + TenantId tenantId = savedTenant.getId(); - - String email1 = "testEmail1"; + + String email1 = "testEmail1"; List tenantAdminsEmail1 = new ArrayList<>(); - - for (int i=0;i<124;i++) { + + for (int i = 0; i < 124; i++) { User user = new User(); user.setAuthority(Authority.TENANT_ADMIN); user.setTenantId(tenantId); - String suffix = RandomStringUtils.randomAlphanumeric((int)(5 + Math.random()*10)); - String email = email1+suffix+ "@thingsboard.org"; + String suffix = RandomStringUtils.randomAlphanumeric((int) (5 + Math.random() * 10)); + String email = email1 + suffix + "@thingsboard.org"; email = i % 2 == 0 ? email.toLowerCase() : email.toUpperCase(); user.setEmail(email); tenantAdminsEmail1.add(doPost("/api/user", user, User.class)); } - - String email2 = "testEmail2"; + + String email2 = "testEmail2"; List tenantAdminsEmail2 = new ArrayList<>(); - - for (int i=0;i<112;i++) { + + for (int i = 0; i < 112; i++) { User user = new User(); user.setAuthority(Authority.TENANT_ADMIN); user.setTenantId(tenantId); - String suffix = RandomStringUtils.randomAlphanumeric((int)(5 + Math.random()*10)); - String email = email2+suffix+ "@thingsboard.org"; + String suffix = RandomStringUtils.randomAlphanumeric((int) (5 + Math.random() * 10)); + String email = email2 + suffix + "@thingsboard.org"; email = i % 2 == 0 ? email.toLowerCase() : email.toUpperCase(); user.setEmail(email); tenantAdminsEmail2.add(doPost("/api/user", user, User.class)); } - + List loadedTenantAdminsEmail1 = new ArrayList<>(); TextPageLink pageLink = new TextPageLink(33, email1); TextPageData pageData = null; do { - pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?", - new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?", + new TypeReference>() { + }, pageLink); loadedTenantAdminsEmail1.addAll(pageData.getData()); if (pageData.hasNext()) { pageLink = pageData.getNextPageLink(); } } while (pageData.hasNext()); - + Collections.sort(tenantAdminsEmail1, idComparator); Collections.sort(loadedTenantAdminsEmail1, idComparator); - + Assert.assertEquals(tenantAdminsEmail1, loadedTenantAdminsEmail1); - + List loadedTenantAdminsEmail2 = new ArrayList<>(); pageLink = new TextPageLink(16, email2); do { - pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?", - new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?", + new TypeReference>() { + }, pageLink); loadedTenantAdminsEmail2.addAll(pageData.getData()); if (pageData.hasNext()) { pageLink = pageData.getNextPageLink(); } } while (pageData.hasNext()); - + Collections.sort(tenantAdminsEmail2, idComparator); Collections.sort(loadedTenantAdminsEmail2, idComparator); - + Assert.assertEquals(tenantAdminsEmail2, loadedTenantAdminsEmail2); - + for (User user : loadedTenantAdminsEmail1) { - doDelete("/api/user/"+user.getId().getId().toString()) - .andExpect(status().isOk()); + doDelete("/api/user/" + user.getId().getId().toString()) + .andExpect(status().isOk()); } - + pageLink = new TextPageLink(4, email1); - pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?", - new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?", + new TypeReference>() { + }, pageLink); Assert.assertFalse(pageData.hasNext()); Assert.assertEquals(0, pageData.getData().size()); - + for (User user : loadedTenantAdminsEmail2) { - doDelete("/api/user/"+user.getId().getId().toString()) - .andExpect(status().isOk()); + doDelete("/api/user/" + user.getId().getId().toString()) + .andExpect(status().isOk()); } - + pageLink = new TextPageLink(4, email2); - pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?", - new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?", + new TypeReference>() { + }, pageLink); Assert.assertFalse(pageData.hasNext()); Assert.assertEquals(0, pageData.getData().size()); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); + + doDelete("/api/tenant/" + savedTenant.getId().getId().toString()) + .andExpect(status().isOk()); } - + @Test public void testFindCustomerUsers() throws Exception { - + loginSysAdmin(); Tenant tenant = new Tenant(); tenant.setTitle("My tenant"); Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); Assert.assertNotNull(savedTenant); - + TenantId tenantId = savedTenant.getId(); User tenantAdmin = new User(); tenantAdmin.setAuthority(Authority.TENANT_ADMIN); @@ -467,59 +500,60 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest { tenantAdmin.setEmail("tenant2@thingsboard.org"); tenantAdmin.setFirstName("Joe"); tenantAdmin.setLastName("Downs"); - + tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1"); - + Customer customer = new Customer(); customer.setTitle("My customer"); Customer savedCustomer = doPost("/api/customer", customer, Customer.class); CustomerId customerId = savedCustomer.getId(); - + List customerUsers = new ArrayList<>(); - for (int i=0;i<56;i++) { + for (int i = 0; i < 56; i++) { User user = new User(); user.setAuthority(Authority.CUSTOMER_USER); user.setCustomerId(customerId); user.setEmail("testCustomer" + i + "@thingsboard.org"); customerUsers.add(doPost("/api/user", user, User.class)); } - + List loadedCustomerUsers = new ArrayList<>(); TextPageLink pageLink = new TextPageLink(33); TextPageData pageData = null; do { - pageData = doGetTypedWithPageLink("/api/customer/" + customerId.getId().toString() + "/users?", - new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/customer/" + customerId.getId().toString() + "/users?", + new TypeReference>() { + }, pageLink); loadedCustomerUsers.addAll(pageData.getData()); if (pageData.hasNext()) { pageLink = pageData.getNextPageLink(); } } while (pageData.hasNext()); - + Collections.sort(customerUsers, idComparator); Collections.sort(loadedCustomerUsers, idComparator); - + Assert.assertEquals(customerUsers, loadedCustomerUsers); - - doDelete("/api/customer/"+customerId.getId().toString()) - .andExpect(status().isOk()); - + + doDelete("/api/customer/" + customerId.getId().toString()) + .andExpect(status().isOk()); + loginSysAdmin(); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); + + doDelete("/api/tenant/" + savedTenant.getId().getId().toString()) + .andExpect(status().isOk()); } - + @Test public void testFindCustomerUsersByEmail() throws Exception { - + loginSysAdmin(); Tenant tenant = new Tenant(); tenant.setTitle("My tenant"); Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); Assert.assertNotNull(savedTenant); - + TenantId tenantId = savedTenant.getId(); User tenantAdmin = new User(); tenantAdmin.setAuthority(Authority.TENANT_ADMIN); @@ -527,105 +561,109 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest { tenantAdmin.setEmail("tenant2@thingsboard.org"); tenantAdmin.setFirstName("Joe"); tenantAdmin.setLastName("Downs"); - + tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1"); - + Customer customer = new Customer(); customer.setTitle("My customer"); Customer savedCustomer = doPost("/api/customer", customer, Customer.class); CustomerId customerId = savedCustomer.getId(); - - String email1 = "testEmail1"; + + String email1 = "testEmail1"; List customerUsersEmail1 = new ArrayList<>(); - - for (int i=0;i<74;i++) { + + for (int i = 0; i < 74; i++) { User user = new User(); user.setAuthority(Authority.CUSTOMER_USER); user.setCustomerId(customerId); - String suffix = RandomStringUtils.randomAlphanumeric((int)(5 + Math.random()*10)); - String email = email1+suffix+ "@thingsboard.org"; + String suffix = RandomStringUtils.randomAlphanumeric((int) (5 + Math.random() * 10)); + String email = email1 + suffix + "@thingsboard.org"; email = i % 2 == 0 ? email.toLowerCase() : email.toUpperCase(); user.setEmail(email); customerUsersEmail1.add(doPost("/api/user", user, User.class)); } - - String email2 = "testEmail2"; + + String email2 = "testEmail2"; List customerUsersEmail2 = new ArrayList<>(); - - for (int i=0;i<92;i++) { + + for (int i = 0; i < 92; i++) { User user = new User(); user.setAuthority(Authority.CUSTOMER_USER); user.setCustomerId(customerId); - String suffix = RandomStringUtils.randomAlphanumeric((int)(5 + Math.random()*10)); - String email = email2+suffix+ "@thingsboard.org"; + String suffix = RandomStringUtils.randomAlphanumeric((int) (5 + Math.random() * 10)); + String email = email2 + suffix + "@thingsboard.org"; email = i % 2 == 0 ? email.toLowerCase() : email.toUpperCase(); user.setEmail(email); customerUsersEmail2.add(doPost("/api/user", user, User.class)); } - + List loadedCustomerUsersEmail1 = new ArrayList<>(); TextPageLink pageLink = new TextPageLink(33, email1); TextPageData pageData = null; do { - pageData = doGetTypedWithPageLink("/api/customer/" + customerId.getId().toString() + "/users?", - new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/customer/" + customerId.getId().toString() + "/users?", + new TypeReference>() { + }, pageLink); loadedCustomerUsersEmail1.addAll(pageData.getData()); if (pageData.hasNext()) { pageLink = pageData.getNextPageLink(); } } while (pageData.hasNext()); - + Collections.sort(customerUsersEmail1, idComparator); Collections.sort(loadedCustomerUsersEmail1, idComparator); - + Assert.assertEquals(customerUsersEmail1, loadedCustomerUsersEmail1); - + List loadedCustomerUsersEmail2 = new ArrayList<>(); pageLink = new TextPageLink(16, email2); do { - pageData = doGetTypedWithPageLink("/api/customer/" + customerId.getId().toString() + "/users?", - new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/customer/" + customerId.getId().toString() + "/users?", + new TypeReference>() { + }, pageLink); loadedCustomerUsersEmail2.addAll(pageData.getData()); if (pageData.hasNext()) { pageLink = pageData.getNextPageLink(); } } while (pageData.hasNext()); - + Collections.sort(customerUsersEmail2, idComparator); Collections.sort(loadedCustomerUsersEmail2, idComparator); - + Assert.assertEquals(customerUsersEmail2, loadedCustomerUsersEmail2); - + for (User user : loadedCustomerUsersEmail1) { - doDelete("/api/user/"+user.getId().getId().toString()) - .andExpect(status().isOk()); + doDelete("/api/user/" + user.getId().getId().toString()) + .andExpect(status().isOk()); } - + pageLink = new TextPageLink(4, email1); - pageData = doGetTypedWithPageLink("/api/customer/" + customerId.getId().toString() + "/users?", - new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/customer/" + customerId.getId().toString() + "/users?", + new TypeReference>() { + }, pageLink); Assert.assertFalse(pageData.hasNext()); Assert.assertEquals(0, pageData.getData().size()); - + for (User user : loadedCustomerUsersEmail2) { - doDelete("/api/user/"+user.getId().getId().toString()) - .andExpect(status().isOk()); + doDelete("/api/user/" + user.getId().getId().toString()) + .andExpect(status().isOk()); } - + pageLink = new TextPageLink(4, email2); - pageData = doGetTypedWithPageLink("/api/customer/" + customerId.getId().toString() + "/users?", - new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/customer/" + customerId.getId().toString() + "/users?", + new TypeReference>() { + }, pageLink); Assert.assertFalse(pageData.hasNext()); Assert.assertEquals(0, pageData.getData().size()); - - doDelete("/api/customer/"+customerId.getId().toString()) - .andExpect(status().isOk()); - + + doDelete("/api/customer/" + customerId.getId().toString()) + .andExpect(status().isOk()); + loginSysAdmin(); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); + + doDelete("/api/tenant/" + savedTenant.getId().getId().toString()) + .andExpect(status().isOk()); } - + } diff --git a/application/src/test/java/org/thingsboard/server/controller/BaseWidgetTypeControllerTest.java b/application/src/test/java/org/thingsboard/server/controller/BaseWidgetTypeControllerTest.java index 85dc0572cc..ce2404041c 100644 --- a/application/src/test/java/org/thingsboard/server/controller/BaseWidgetTypeControllerTest.java +++ b/application/src/test/java/org/thingsboard/server/controller/BaseWidgetTypeControllerTest.java @@ -64,7 +64,6 @@ public abstract class BaseWidgetTypeControllerTest extends AbstractControllerTes WidgetsBundle widgetsBundle = new WidgetsBundle(); widgetsBundle.setTitle("My widgets bundle"); savedWidgetsBundle = doPost("/api/widgetsBundle", widgetsBundle, WidgetsBundle.class); - } @After @@ -100,6 +99,19 @@ public abstract class BaseWidgetTypeControllerTest extends AbstractControllerTes Assert.assertEquals(foundWidgetType.getName(), savedWidgetType.getName()); } + @Test + public void testUpdateWidgetTypeFromDifferentTenant() throws Exception { + WidgetType widgetType = new WidgetType(); + widgetType.setBundleAlias(savedWidgetsBundle.getAlias()); + widgetType.setName("Widget Type"); + widgetType.setDescriptor(new ObjectMapper().readValue("{ \"someKey\": \"someValue\" }", JsonNode.class)); + WidgetType savedWidgetType = doPost("/api/widgetType", widgetType, WidgetType.class); + + loginDifferentTenant(); + doPost("/api/widgetType", savedWidgetType, WidgetType.class, status().isForbidden()); + deleteDifferentTenant(); + } + @Test public void testFindWidgetTypeById() throws Exception { WidgetType widgetType = new WidgetType(); diff --git a/application/src/test/java/org/thingsboard/server/controller/BaseWidgetsBundleControllerTest.java b/application/src/test/java/org/thingsboard/server/controller/BaseWidgetsBundleControllerTest.java index c274ea92eb..ae23f6633b 100644 --- a/application/src/test/java/org/thingsboard/server/controller/BaseWidgetsBundleControllerTest.java +++ b/application/src/test/java/org/thingsboard/server/controller/BaseWidgetsBundleControllerTest.java @@ -88,6 +88,17 @@ public abstract class BaseWidgetsBundleControllerTest extends AbstractController Assert.assertEquals(foundWidgetsBundle.getTitle(), savedWidgetsBundle.getTitle()); } + @Test + public void testUpdateWidgetsBundleFromDifferentTenant() throws Exception { + WidgetsBundle widgetsBundle = new WidgetsBundle(); + widgetsBundle.setTitle("My widgets bundle"); + WidgetsBundle savedWidgetsBundle = doPost("/api/widgetsBundle", widgetsBundle, WidgetsBundle.class); + + loginDifferentTenant(); + doPost("/api/widgetsBundle", savedWidgetsBundle, WidgetsBundle.class, status().isForbidden()); + deleteDifferentTenant(); + } + @Test public void testFindWidgetsBundleById() throws Exception { WidgetsBundle widgetsBundle = new WidgetsBundle();