fixed security test

application/src/main/java/org/thingsboard/server/controller/AlarmCommentController.java

@@ -38,6 +38,7 @@ import org.thingsboard.server.common.data.page.PageLink;
 import org.thingsboard.server.queue.util.TbCoreComponent;
 import org.thingsboard.server.service.entitiy.alarm.TbAlarmCommentService;
 import org.thingsboard.server.service.security.permission.Operation;
+import org.thingsboard.server.service.security.permission.Resource;
 
 import static org.thingsboard.server.controller.ControllerConstants.ALARM_ID_PARAM_DESCRIPTION;
 import static org.thingsboard.server.controller.ControllerConstants.ALARM_SORT_PROPERTY_ALLOWABLE_VALUES;
@@ -88,7 +89,7 @@ public class AlarmCommentController extends BaseController {
     public Boolean deleteAlarmComment(@ApiParam(value = ALARM_ID_PARAM_DESCRIPTION) @PathVariable(ALARM_ID) String strAlarmId, @ApiParam(value = ALARM_ID_PARAM_DESCRIPTION) @PathVariable(ALARM_COMMENT_ID) String strCommentId) throws ThingsboardException {
         checkParameter(ALARM_ID, strAlarmId);
         AlarmId alarmId = new AlarmId(toUUID(strAlarmId));
-        Alarm alarm = checkAlarmId(alarmId, Operation.WRITE);
+        Alarm alarm = checkAlarmId(alarmId, Operation.DELETE);
 
         AlarmCommentId alarmCommentId = new AlarmCommentId(toUUID(strCommentId));
         AlarmComment alarmComment = checkAlarmCommentId(alarmCommentId);
@@ -115,7 +116,9 @@ public class AlarmCommentController extends BaseController {
     ) throws Exception {
         checkParameter(ALARM_ID, strAlarmId);
         AlarmId alarmId = new AlarmId(toUUID(strAlarmId));
-        Alarm alarm = checkAlarmId(alarmId, Operation.WRITE);
+        Alarm alarm = alarmService.findAlarmByIdAsync(getCurrentUser().getTenantId(), alarmId).get();
+        checkNotNull(alarm, "Alarm with id [" + alarmId + "] is not found");
+        checkEntityId(alarm.getOriginator(), Operation.READ);
 
         PageLink pageLink = createPageLink(pageSize, page, null, sortProperty, sortOrder);
         return checkNotNull(alarmCommentService.findAlarmComments(alarm.getTenantId(), alarmId, pageLink));

application/src/test/java/org/thingsboard/server/controller/BaseAlarmCommentControllerTest.java

@@ -137,8 +137,8 @@ public abstract class BaseAlarmCommentControllerTest extends AbstractControllerT
         Assert.assertEquals("true", updatedAlarmComment.getComment().get("edited").asText());
         Assert.assertNotNull(updatedAlarmComment.getComment().get("editedOn"));
 
-        testNotifyEntityAllOneTime(updatedAlarmComment, updatedAlarmComment.getId(), updatedAlarmComment.getId(),
-                tenantId, customerId, customerUserId, CUSTOMER_USER_EMAIL, ActionType.UPDATED);
+        testLogEntityAction(updatedAlarmComment, updatedAlarmComment.getId(), tenantId, customerId, customerUserId, CUSTOMER_USER_EMAIL, ActionType.UPDATED, 1);
+        testPushMsgToRuleEngineTime(updatedAlarmComment.getId(), tenantId, updatedAlarmComment, 1);
     }
 
     @Test
@@ -157,8 +157,8 @@ public abstract class BaseAlarmCommentControllerTest extends AbstractControllerT
         Assert.assertEquals("true", updatedAlarmComment.getComment().get("edited").asText());
         Assert.assertNotNull(updatedAlarmComment.getComment().get("editedOn"));
 
-        testNotifyEntityAllOneTime(updatedAlarmComment, updatedAlarmComment.getId(), updatedAlarmComment.getId(),
-                tenantId, customerId, tenantAdminUserId, TENANT_ADMIN_EMAIL, ActionType.UPDATED);
+        testLogEntityAction(updatedAlarmComment, updatedAlarmComment.getId(), tenantId, customerId, tenantAdminUserId, TENANT_ADMIN_EMAIL, ActionType.UPDATED, 1);
+        testPushMsgToRuleEngineTime(updatedAlarmComment.getId(), tenantId, updatedAlarmComment, 1);
     }
 
     @Test
@@ -257,21 +257,6 @@ public abstract class BaseAlarmCommentControllerTest extends AbstractControllerT
         testNotifyEntityNever(alarm.getId(), alarm);
     }
 
-    @Test
-    public void testClearAlarmViaCustomer() throws Exception {
-        loginCustomerUser();
-        AlarmComment alarmComment = createAlarmComment(alarm.getId());
-
-        Mockito.reset(tbClusterService, auditLogService);
-
-        doPost("/api/alarm/" + alarm.getId() + "/clear").andExpect(status().isOk());
-
-        Alarm foundAlarm = doGet("/api/alarm/" + alarm.getId(), Alarm.class);
-        Assert.assertNotNull(foundAlarm);
-        Assert.assertEquals(AlarmStatus.CLEARED_UNACK, foundAlarm.getStatus());
-
-    }
-
     @Test
     public void testFindAlarmCommentsViaCustomerUser() throws Exception {
         loginCustomerUser();