Merge pull request #14679 from dashevchenko/extendedApiForTenantAdmin

Extended getTenantsByIds API for tenant admins

application/src/main/java/org/thingsboard/server/controller/TenantController.java

@@ -169,7 +169,7 @@ public class TenantController extends BaseController {
         return checkNotNull(tenantService.findTenantInfos(pageLink));
     }
 
-    @PreAuthorize("hasAnyAuthority('SYS_ADMIN')")
+    @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN')")
     @GetMapping(value = "/tenants", params = {"tenantIds"})
     public List<Tenant> getTenantsByIds(
             @Parameter(description = "A list of tenant ids, separated by comma ','", array = @ArraySchema(schema = @Schema(type = "string")))
@@ -179,7 +179,18 @@ public class TenantController extends BaseController {
         for (UUID tenantIdUUID : tenantUUIDs) {
             tenantIds.add(TenantId.fromUUID(tenantIdUUID));
         }
-        return tenantService.findTenantsByIds(tenantId, tenantIds);
+        List<Tenant> tenants = tenantService.findTenantsByIds(tenantId, tenantIds);
+        return filterTenantsByReadPermission(tenants);
+    }
+
+    private List<Tenant> filterTenantsByReadPermission(List<Tenant> tenants) {
+        return tenants.stream().filter(tenant -> {
+            try {
+                return accessControlService.hasPermission(getCurrentUser(), Resource.TENANT, Operation.READ, tenant.getId(), tenant);
+            } catch (ThingsboardException e) {
+                return false;
+            }
+        }).toList();
     }
 
 }

application/src/test/java/org/thingsboard/server/controller/TenantControllerTest.java

@@ -219,6 +219,15 @@ public class TenantControllerTest extends AbstractControllerTest {
             Assert.assertEquals(savedTenant, foundTenant);
         }
 
+        loginTenantAdmin();
+        Tenant[] foundTenantsByTenant = doGet("/api/tenants?tenantIds=" + idsParam, Tenant[].class);
+        assertThat(foundTenantsByTenant).isEmpty();
+
+        Tenant[] foundCurrentTenant = doGet("/api/tenants?tenantIds=" + tenantId, Tenant[].class);
+        assertThat(foundCurrentTenant).hasSize(1);
+        assertThat(foundCurrentTenant[0].getTenantId()).isEqualTo(tenantId);
+
+        loginSysAdmin();
         for (Tenant savedTenant : savedTenants) {
             deleteTenant(savedTenant.getId());
         }