From 2adf6660514a0d3a11aa20e17310045eec0e6548 Mon Sep 17 00:00:00 2001 From: dashevchenko Date: Tue, 4 Jun 2024 12:26:38 +0300 Subject: [PATCH] fixed entity data query permission part for DASHBOARD entity --- .../controller/EntityQueryControllerTest.java | 68 ++++++++++++++++++- .../query/DefaultEntityQueryRepository.java | 2 + 2 files changed, 68 insertions(+), 2 deletions(-) diff --git a/application/src/test/java/org/thingsboard/server/controller/EntityQueryControllerTest.java b/application/src/test/java/org/thingsboard/server/controller/EntityQueryControllerTest.java index 388f725665..50c82260eb 100644 --- a/application/src/test/java/org/thingsboard/server/controller/EntityQueryControllerTest.java +++ b/application/src/test/java/org/thingsboard/server/controller/EntityQueryControllerTest.java @@ -22,9 +22,12 @@ import org.junit.After; import org.junit.Assert; import org.junit.Before; import org.junit.Test; +import org.mockito.Mockito; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.test.web.servlet.ResultActions; import org.thingsboard.common.util.JacksonUtil; +import org.thingsboard.server.common.data.Customer; +import org.thingsboard.server.common.data.Dashboard; import org.thingsboard.server.common.data.DataConstants; import org.thingsboard.server.common.data.Device; import org.thingsboard.server.common.data.EntityType; @@ -33,6 +36,7 @@ import org.thingsboard.server.common.data.Tenant; import org.thingsboard.server.common.data.User; import org.thingsboard.server.common.data.alarm.Alarm; import org.thingsboard.server.common.data.alarm.AlarmSeverity; +import org.thingsboard.server.common.data.audit.ActionType; import org.thingsboard.server.common.data.id.DeviceId; import org.thingsboard.server.common.data.id.EntityId; import org.thingsboard.server.common.data.page.PageData; @@ -76,6 +80,11 @@ import static org.springframework.test.web.servlet.result.MockMvcResultMatchers. @DaoSqlTest public class EntityQueryControllerTest extends AbstractControllerTest { + private static final String CUSTOMER_USER_EMAIL = "entityQueryCustomer@thingsboard.org"; + private static final String TENANT_PASSWORD = "testPassword1"; + private static final String CUSTOMER_USER_PASSWORD = "customer"; + private static final String TENANT_EMAIL = "entityQueryTenant@thingsboard.org"; + private Tenant savedTenant; private User tenantAdmin; @@ -94,11 +103,11 @@ public class EntityQueryControllerTest extends AbstractControllerTest { tenantAdmin = new User(); tenantAdmin.setAuthority(Authority.TENANT_ADMIN); tenantAdmin.setTenantId(savedTenant.getId()); - tenantAdmin.setEmail("tenant2@thingsboard.org"); + tenantAdmin.setEmail(TENANT_EMAIL); tenantAdmin.setFirstName("Joe"); tenantAdmin.setLastName("Downs"); - tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1"); + tenantAdmin = createUserAndLogin(tenantAdmin, TENANT_PASSWORD); } @After @@ -807,6 +816,61 @@ public class EntityQueryControllerTest extends AbstractControllerTest { checkEntitiesByQuery(customerEntitiesQuery, 0, null, null); } + @Test + public void testFindCustomerDashboards() throws Exception { + Dashboard dashboard = new Dashboard(); + dashboard.setTitle("My dashboard"); + Dashboard savedDashboard = doPost("/api/dashboard", dashboard, Dashboard.class); + + Customer customer = new Customer(); + customer.setTitle("My customer"); + Customer savedCustomer = doPost("/api/customer", customer, Customer.class); + + //assign dashboard + doPost("/api/customer/" + savedCustomer.getId().getId().toString() + + "/dashboard/" + savedDashboard.getId().getId().toString(), Dashboard.class); + + // check entity data query by customer + User customerUser = new User(); + customerUser.setAuthority(Authority.CUSTOMER_USER); + customerUser.setTenantId(savedTenant.getId()); + customerUser.setCustomerId(savedCustomer.getId()); + customerUser.setEmail(CUSTOMER_USER_EMAIL); + + createUserAndLogin(customerUser, CUSTOMER_USER_PASSWORD); + + EntityTypeFilter filter = new EntityTypeFilter(); + filter.setEntityType(EntityType.DASHBOARD); + + EntityDataSortOrder sortOrder = new EntityDataSortOrder( + new EntityKey(EntityKeyType.ENTITY_FIELD, "createdTime"), EntityDataSortOrder.Direction.ASC); + EntityDataPageLink pageLink = new EntityDataPageLink(10, 0, null, sortOrder); + List entityFields = Collections.singletonList(new EntityKey(EntityKeyType.ENTITY_FIELD, "name")); + + EntityDataQuery query = new EntityDataQuery(filter, pageLink, entityFields, null, null); + + PageData data = + doPostWithTypedResponse("/api/entitiesQuery/find", query, new TypeReference>() { + }); + + Assert.assertEquals(1, data.getTotalElements()); + Assert.assertEquals(1, data.getTotalPages()); + Assert.assertEquals(1, data.getData().size()); + + // unnassign dashboard + login(TENANT_EMAIL, TENANT_PASSWORD); + doDelete("/api/customer/" + savedCustomer.getId().getId().toString() + "/dashboard/" + savedDashboard.getId().getId().toString(), Dashboard.class); + + login(CUSTOMER_USER_EMAIL, CUSTOMER_USER_PASSWORD); + PageData dataAfterUnassign = + doPostWithTypedResponse("/api/entitiesQuery/find", query, new TypeReference>() { + }); + + Assert.assertEquals(0, dataAfterUnassign.getTotalElements()); + Assert.assertEquals(0, dataAfterUnassign.getTotalPages()); + Assert.assertEquals(0, dataAfterUnassign.getData().size()); + } + private void checkEntitiesByQuery(EntityDataQuery query, int expectedNumOfDevices, String expectedOwnerName, String expectedOwnerType) throws Exception { Awaitility.await() .alias("data by query") diff --git a/dao/src/main/java/org/thingsboard/server/dao/sql/query/DefaultEntityQueryRepository.java b/dao/src/main/java/org/thingsboard/server/dao/sql/query/DefaultEntityQueryRepository.java index fef55380e4..dd1b4278d7 100644 --- a/dao/src/main/java/org/thingsboard/server/dao/sql/query/DefaultEntityQueryRepository.java +++ b/dao/src/main/java/org/thingsboard/server/dao/sql/query/DefaultEntityQueryRepository.java @@ -583,6 +583,8 @@ public class DefaultEntityQueryRepository implements EntityQueryRepository { return "e.tenant_id=:permissions_tenant_id and e.id=:permissions_customer_id"; } else if (ctx.getEntityType() == EntityType.API_USAGE_STATE) { return "e.tenant_id=:permissions_tenant_id and e.entity_id=:permissions_customer_id"; + } else if (ctx.getEntityType() == EntityType.DASHBOARD) { + return "e.tenant_id=:permissions_tenant_id and e.assigned_customers like concat('%', :permissions_customer_id, '%')"; } else { return "e.tenant_id=:permissions_tenant_id and e.customer_id=:permissions_customer_id"; }