diff --git a/application/src/main/java/org/thingsboard/server/controller/AlarmController.java b/application/src/main/java/org/thingsboard/server/controller/AlarmController.java index 2132675f97..7553448c09 100644 --- a/application/src/main/java/org/thingsboard/server/controller/AlarmController.java +++ b/application/src/main/java/org/thingsboard/server/controller/AlarmController.java @@ -28,7 +28,6 @@ import org.springframework.web.bind.annotation.ResponseStatus; import org.springframework.web.bind.annotation.RestController; import org.thingsboard.server.common.data.EntityType; import org.thingsboard.server.common.data.alarm.Alarm; -import org.thingsboard.server.common.data.id.AlarmId; import org.thingsboard.server.common.data.alarm.AlarmInfo; import org.thingsboard.server.common.data.alarm.AlarmQuery; import org.thingsboard.server.common.data.alarm.AlarmSearchStatus; @@ -37,6 +36,7 @@ import org.thingsboard.server.common.data.alarm.AlarmStatus; import org.thingsboard.server.common.data.audit.ActionType; import org.thingsboard.server.common.data.exception.ThingsboardErrorCode; import org.thingsboard.server.common.data.exception.ThingsboardException; +import org.thingsboard.server.common.data.id.AlarmId; import org.thingsboard.server.common.data.id.EntityId; import org.thingsboard.server.common.data.id.EntityIdFactory; import org.thingsboard.server.common.data.page.TimePageData; @@ -84,8 +84,9 @@ public class AlarmController extends BaseController { public Alarm saveAlarm(@RequestBody Alarm alarm) throws ThingsboardException { try { alarm.setTenantId(getCurrentUser().getTenantId()); - Operation operation = alarm.getId() == null ? Operation.CREATE : Operation.WRITE; - accessControlService.checkPermission(getCurrentUser(), Resource.ALARM, operation, alarm.getId(), alarm); + + checkEntity(alarm.getId(), alarm, Resource.ALARM); + Alarm savedAlarm = checkNotNull(alarmService.createOrUpdateAlarm(alarm)); logEntityAction(savedAlarm.getId(), savedAlarm, getCurrentUser().getCustomerId(), diff --git a/application/src/main/java/org/thingsboard/server/controller/AssetController.java b/application/src/main/java/org/thingsboard/server/controller/AssetController.java index 03c5462446..731eefc838 100644 --- a/application/src/main/java/org/thingsboard/server/controller/AssetController.java +++ b/application/src/main/java/org/thingsboard/server/controller/AssetController.java @@ -76,18 +76,15 @@ public class AssetController extends BaseController { try { asset.setTenantId(getCurrentUser().getTenantId()); - Operation operation = asset.getId() == null ? Operation.CREATE : Operation.WRITE; + checkEntity(asset.getId(), asset, Resource.ASSET); - accessControlService.checkPermission(getCurrentUser(), Resource.ASSET, operation, - asset.getId(), asset); - - Asset savedAsset = checkNotNull(assetService.saveAsset(asset)); + Asset savedAsset = checkNotNull(assetService.saveAsset(asset)); logEntityAction(savedAsset.getId(), savedAsset, savedAsset.getCustomerId(), asset.getId() == null ? ActionType.ADDED : ActionType.UPDATED, null); - return savedAsset; + return savedAsset; } catch (Exception e) { logEntityAction(emptyId(EntityType.ASSET), asset, null, asset.getId() == null ? ActionType.ADDED : ActionType.UPDATED, e); @@ -138,7 +135,7 @@ public class AssetController extends BaseController { savedAsset.getCustomerId(), ActionType.ASSIGNED_TO_CUSTOMER, null, strAssetId, strCustomerId, customer.getName()); - return savedAsset; + return savedAsset; } catch (Exception e) { logEntityAction(emptyId(EntityType.ASSET), null, @@ -218,7 +215,7 @@ public class AssetController extends BaseController { try { TenantId tenantId = getCurrentUser().getTenantId(); TextPageLink pageLink = createPageLink(limit, textSearch, idOffset, textOffset); - if (type != null && type.trim().length()>0) { + if (type != null && type.trim().length() > 0) { return checkNotNull(assetService.findAssetsByTenantIdAndType(tenantId, type, pageLink)); } else { return checkNotNull(assetService.findAssetsByTenantId(tenantId, pageLink)); @@ -257,7 +254,7 @@ public class AssetController extends BaseController { CustomerId customerId = new CustomerId(toUUID(strCustomerId)); checkCustomerId(customerId, Operation.READ); TextPageLink pageLink = createPageLink(limit, textSearch, idOffset, textOffset); - if (type != null && type.trim().length()>0) { + if (type != null && type.trim().length() > 0) { return checkNotNull(assetService.findAssetsByTenantIdAndCustomerIdAndType(tenantId, customerId, type, pageLink)); } else { return checkNotNull(assetService.findAssetsByTenantIdAndCustomerId(tenantId, customerId, pageLink)); diff --git a/application/src/main/java/org/thingsboard/server/controller/BaseController.java b/application/src/main/java/org/thingsboard/server/controller/BaseController.java index a8d6098c4a..f0e93f5662 100644 --- a/application/src/main/java/org/thingsboard/server/controller/BaseController.java +++ b/application/src/main/java/org/thingsboard/server/controller/BaseController.java @@ -26,6 +26,7 @@ import org.springframework.beans.factory.annotation.Value; import org.springframework.security.core.Authentication; import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.web.bind.annotation.ExceptionHandler; +import org.thingsboard.server.common.data.BaseData; import org.thingsboard.server.common.data.Customer; import org.thingsboard.server.common.data.Dashboard; import org.thingsboard.server.common.data.DashboardInfo; @@ -103,7 +104,6 @@ import org.thingsboard.server.service.state.DeviceStateService; import org.thingsboard.server.service.telemetry.TelemetrySubscriptionService; import javax.mail.MessagingException; -import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.util.List; import java.util.Optional; @@ -330,11 +330,23 @@ public abstract class BaseController { } } + protected void checkEntity(I entityId, T entity, Resource resource) throws ThingsboardException { + if (entityId == null) { + accessControlService + .checkPermission(getCurrentUser(), resource, Operation.CREATE, null, entity); + } else { + checkEntityId(entityId, Operation.WRITE); + } + } + protected void checkEntityId(EntityId entityId, Operation operation) throws ThingsboardException { try { checkNotNull(entityId); validateId(entityId.getId(), "Incorrect entityId " + entityId); switch (entityId.getEntityType()) { + case ALARM: + checkAlarmId(new AlarmId(entityId.getId()), operation); + return; case DEVICE: checkDeviceId(new DeviceId(entityId.getId()), operation); return; @@ -362,6 +374,12 @@ public abstract class BaseController { case ENTITY_VIEW: checkEntityViewId(new EntityViewId(entityId.getId()), operation); return; + case WIDGETS_BUNDLE: + checkWidgetsBundleId(new WidgetsBundleId(entityId.getId()), operation); + return; + case WIDGET_TYPE: + checkWidgetTypeId(new WidgetTypeId(entityId.getId()), operation); + return; default: throw new IllegalArgumentException("Unsupported entity type: " + entityId.getEntityType()); } diff --git a/application/src/main/java/org/thingsboard/server/controller/CustomerController.java b/application/src/main/java/org/thingsboard/server/controller/CustomerController.java index 18fcfc2ab5..75dee42ff8 100644 --- a/application/src/main/java/org/thingsboard/server/controller/CustomerController.java +++ b/application/src/main/java/org/thingsboard/server/controller/CustomerController.java @@ -100,8 +100,7 @@ public class CustomerController extends BaseController { try { customer.setTenantId(getCurrentUser().getTenantId()); - Operation operation = customer.getId() == null ? Operation.CREATE : Operation.WRITE; - accessControlService.checkPermission(getCurrentUser(), Resource.CUSTOMER, operation, customer.getId(), customer); + checkEntity(customer.getId(), customer, Resource.CUSTOMER); Customer savedCustomer = checkNotNull(customerService.saveCustomer(customer)); diff --git a/application/src/main/java/org/thingsboard/server/controller/DashboardController.java b/application/src/main/java/org/thingsboard/server/controller/DashboardController.java index 68f18c9081..ee6e6b03cd 100644 --- a/application/src/main/java/org/thingsboard/server/controller/DashboardController.java +++ b/application/src/main/java/org/thingsboard/server/controller/DashboardController.java @@ -100,15 +100,17 @@ public class DashboardController extends BaseController { @PreAuthorize("hasAuthority('TENANT_ADMIN')") @RequestMapping(value = "/dashboard", method = RequestMethod.POST) - @ResponseBody + @ResponseBody public Dashboard saveDashboard(@RequestBody Dashboard dashboard) throws ThingsboardException { try { dashboard.setTenantId(getCurrentUser().getTenantId()); - Operation operation = dashboard.getId() == null ? Operation.CREATE : Operation.WRITE; - - accessControlService.checkPermission(getCurrentUser(), Resource.DASHBOARD, operation, - dashboard.getId(), dashboard); + if (dashboard.getId() == null) { + accessControlService + .checkPermission(getCurrentUser(), Resource.DASHBOARD, Operation.CREATE, dashboard.getId(), dashboard); + } else { + checkDashboardId(dashboard.getId(), Operation.WRITE); + } Dashboard savedDashboard = checkNotNull(dashboardService.saveDashboard(dashboard)); @@ -152,9 +154,9 @@ public class DashboardController extends BaseController { @PreAuthorize("hasAuthority('TENANT_ADMIN')") @RequestMapping(value = "/customer/{customerId}/dashboard/{dashboardId}", method = RequestMethod.POST) - @ResponseBody + @ResponseBody public Dashboard assignDashboardToCustomer(@PathVariable("customerId") String strCustomerId, - @PathVariable(DASHBOARD_ID) String strDashboardId) throws ThingsboardException { + @PathVariable(DASHBOARD_ID) String strDashboardId) throws ThingsboardException { checkParameter("customerId", strCustomerId); checkParameter(DASHBOARD_ID, strDashboardId); try { @@ -163,7 +165,7 @@ public class DashboardController extends BaseController { DashboardId dashboardId = new DashboardId(toUUID(strDashboardId)); checkDashboardId(dashboardId, Operation.ASSIGN_TO_CUSTOMER); - + Dashboard savedDashboard = checkNotNull(dashboardService.assignDashboardToCustomer(getCurrentUser().getTenantId(), dashboardId, customerId)); logEntityAction(dashboardId, savedDashboard, @@ -184,7 +186,7 @@ public class DashboardController extends BaseController { @PreAuthorize("hasAuthority('TENANT_ADMIN')") @RequestMapping(value = "/customer/{customerId}/dashboard/{dashboardId}", method = RequestMethod.DELETE) - @ResponseBody + @ResponseBody public Dashboard unassignDashboardFromCustomer(@PathVariable("customerId") String strCustomerId, @PathVariable(DASHBOARD_ID) String strDashboardId) throws ThingsboardException { checkParameter("customerId", strCustomerId); @@ -418,7 +420,7 @@ public class DashboardController extends BaseController { } @PreAuthorize("hasAuthority('SYS_ADMIN')") - @RequestMapping(value = "/tenant/{tenantId}/dashboards", params = { "limit" }, method = RequestMethod.GET) + @RequestMapping(value = "/tenant/{tenantId}/dashboards", params = {"limit"}, method = RequestMethod.GET) @ResponseBody public TextPageData getTenantDashboards( @PathVariable("tenantId") String strTenantId, @@ -437,7 +439,7 @@ public class DashboardController extends BaseController { } @PreAuthorize("hasAuthority('TENANT_ADMIN')") - @RequestMapping(value = "/tenant/dashboards", params = { "limit" }, method = RequestMethod.GET) + @RequestMapping(value = "/tenant/dashboards", params = {"limit"}, method = RequestMethod.GET) @ResponseBody public TextPageData getTenantDashboards( @RequestParam int limit, @@ -454,7 +456,7 @@ public class DashboardController extends BaseController { } @PreAuthorize("hasAnyAuthority('TENANT_ADMIN', 'CUSTOMER_USER')") - @RequestMapping(value = "/customer/{customerId}/dashboards", params = { "limit" }, method = RequestMethod.GET) + @RequestMapping(value = "/customer/{customerId}/dashboards", params = {"limit"}, method = RequestMethod.GET) @ResponseBody public TimePageData getCustomerDashboards( @PathVariable("customerId") String strCustomerId, diff --git a/application/src/main/java/org/thingsboard/server/controller/DeviceController.java b/application/src/main/java/org/thingsboard/server/controller/DeviceController.java index ca61ecc8e9..f6f327d7d9 100644 --- a/application/src/main/java/org/thingsboard/server/controller/DeviceController.java +++ b/application/src/main/java/org/thingsboard/server/controller/DeviceController.java @@ -92,10 +92,7 @@ public class DeviceController extends BaseController { try { device.setTenantId(getCurrentUser().getTenantId()); - Operation operation = device.getId() == null ? Operation.CREATE : Operation.WRITE; - - accessControlService.checkPermission(getCurrentUser(), Resource.DEVICE, operation, - device.getId(), device); + checkEntity(device.getId(), device, Resource.DEVICE); Device savedDevice = checkNotNull(deviceService.saveDeviceWithAccessToken(device, accessToken)); diff --git a/application/src/main/java/org/thingsboard/server/controller/EntityViewController.java b/application/src/main/java/org/thingsboard/server/controller/EntityViewController.java index 05c57d35fa..47023c24a6 100644 --- a/application/src/main/java/org/thingsboard/server/controller/EntityViewController.java +++ b/application/src/main/java/org/thingsboard/server/controller/EntityViewController.java @@ -92,10 +92,7 @@ public class EntityViewController extends BaseController { try { entityView.setTenantId(getCurrentUser().getTenantId()); - Operation operation = entityView.getId() == null ? Operation.CREATE : Operation.WRITE; - - accessControlService.checkPermission(getCurrentUser(), Resource.ENTITY_VIEW, operation, - entityView.getId(), entityView); + checkEntity(entityView.getId(), entityView, Resource.ENTITY_VIEW); EntityView savedEntityView = checkNotNull(entityViewService.saveEntityView(entityView)); List>> futures = new ArrayList<>(); diff --git a/application/src/main/java/org/thingsboard/server/controller/RuleChainController.java b/application/src/main/java/org/thingsboard/server/controller/RuleChainController.java index 0bc518e48c..73b89b034f 100644 --- a/application/src/main/java/org/thingsboard/server/controller/RuleChainController.java +++ b/application/src/main/java/org/thingsboard/server/controller/RuleChainController.java @@ -126,10 +126,7 @@ public class RuleChainController extends BaseController { boolean created = ruleChain.getId() == null; ruleChain.setTenantId(getCurrentUser().getTenantId()); - Operation operation = created ? Operation.CREATE : Operation.WRITE; - - accessControlService.checkPermission(getCurrentUser(), Resource.RULE_CHAIN, operation, - ruleChain.getId(), ruleChain); + checkEntity(ruleChain.getId(), ruleChain, Resource.RULE_CHAIN); RuleChain savedRuleChain = checkNotNull(ruleChainService.saveRuleChain(ruleChain)); diff --git a/application/src/main/java/org/thingsboard/server/controller/TenantController.java b/application/src/main/java/org/thingsboard/server/controller/TenantController.java index 9def943e88..ca87e08c96 100644 --- a/application/src/main/java/org/thingsboard/server/controller/TenantController.java +++ b/application/src/main/java/org/thingsboard/server/controller/TenantController.java @@ -72,10 +72,8 @@ public class TenantController extends BaseController { try { boolean newTenant = tenant.getId() == null; - Operation operation = newTenant ? Operation.CREATE : Operation.WRITE; + checkEntity(tenant.getId(), tenant, Resource.TENANT); - accessControlService.checkPermission(getCurrentUser(), Resource.TENANT, operation, - tenant.getId(), tenant); tenant = checkNotNull(tenantService.saveTenant(tenant)); if (newTenant) { installScripts.createDefaultRuleChains(tenant.getId()); diff --git a/application/src/main/java/org/thingsboard/server/controller/UserController.java b/application/src/main/java/org/thingsboard/server/controller/UserController.java index bf64ad7d6f..b3d66adc53 100644 --- a/application/src/main/java/org/thingsboard/server/controller/UserController.java +++ b/application/src/main/java/org/thingsboard/server/controller/UserController.java @@ -132,17 +132,13 @@ public class UserController extends BaseController { @ResponseBody public User saveUser(@RequestBody User user, @RequestParam(required = false, defaultValue = "true") boolean sendActivationMail, - HttpServletRequest request) throws ThingsboardException { + HttpServletRequest request) throws ThingsboardException { try { - if (getCurrentUser().getAuthority() == Authority.TENANT_ADMIN) { user.setTenantId(getCurrentUser().getTenantId()); } - Operation operation = user.getId() == null ? Operation.CREATE : Operation.WRITE; - - accessControlService.checkPermission(getCurrentUser(), Resource.USER, operation, - user.getId(), user); + checkEntity(user.getId(), user, Resource.USER); boolean sendEmail = user.getId() == null && sendActivationMail; User savedUser = checkNotNull(userService.saveUser(user)); @@ -250,7 +246,7 @@ public class UserController extends BaseController { } @PreAuthorize("hasAuthority('SYS_ADMIN')") - @RequestMapping(value = "/tenant/{tenantId}/users", params = { "limit" }, method = RequestMethod.GET) + @RequestMapping(value = "/tenant/{tenantId}/users", params = {"limit"}, method = RequestMethod.GET) @ResponseBody public TextPageData getTenantAdmins( @PathVariable("tenantId") String strTenantId, @@ -269,7 +265,7 @@ public class UserController extends BaseController { } @PreAuthorize("hasAuthority('TENANT_ADMIN')") - @RequestMapping(value = "/customer/{customerId}/users", params = { "limit" }, method = RequestMethod.GET) + @RequestMapping(value = "/customer/{customerId}/users", params = {"limit"}, method = RequestMethod.GET) @ResponseBody public TextPageData getCustomerUsers( @PathVariable("customerId") String strCustomerId, diff --git a/application/src/main/java/org/thingsboard/server/controller/WidgetTypeController.java b/application/src/main/java/org/thingsboard/server/controller/WidgetTypeController.java index debe49b018..ffff90536f 100644 --- a/application/src/main/java/org/thingsboard/server/controller/WidgetTypeController.java +++ b/application/src/main/java/org/thingsboard/server/controller/WidgetTypeController.java @@ -66,10 +66,7 @@ public class WidgetTypeController extends BaseController { widgetType.setTenantId(getCurrentUser().getTenantId()); } - Operation operation = widgetType.getId() == null ? Operation.CREATE : Operation.WRITE; - - accessControlService.checkPermission(getCurrentUser(), Resource.WIDGET_TYPE, operation, - widgetType.getId(), widgetType); + checkEntity(widgetType.getId(), widgetType, Resource.WIDGET_TYPE); return checkNotNull(widgetTypeService.saveWidgetType(widgetType)); } catch (Exception e) { @@ -92,7 +89,7 @@ public class WidgetTypeController extends BaseController { } @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN')") - @RequestMapping(value = "/widgetTypes", params = { "isSystem", "bundleAlias"}, method = RequestMethod.GET) + @RequestMapping(value = "/widgetTypes", params = {"isSystem", "bundleAlias"}, method = RequestMethod.GET) @ResponseBody public List getBundleWidgetTypes( @RequestParam boolean isSystem, @@ -111,7 +108,7 @@ public class WidgetTypeController extends BaseController { } @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')") - @RequestMapping(value = "/widgetType", params = { "isSystem", "bundleAlias", "alias" }, method = RequestMethod.GET) + @RequestMapping(value = "/widgetType", params = {"isSystem", "bundleAlias", "alias"}, method = RequestMethod.GET) @ResponseBody public WidgetType getWidgetType( @RequestParam boolean isSystem, diff --git a/application/src/main/java/org/thingsboard/server/controller/WidgetsBundleController.java b/application/src/main/java/org/thingsboard/server/controller/WidgetsBundleController.java index 3d5cd22400..1b6b371297 100644 --- a/application/src/main/java/org/thingsboard/server/controller/WidgetsBundleController.java +++ b/application/src/main/java/org/thingsboard/server/controller/WidgetsBundleController.java @@ -67,11 +67,7 @@ public class WidgetsBundleController extends BaseController { widgetsBundle.setTenantId(getCurrentUser().getTenantId()); } - Operation operation = widgetsBundle.getId() == null ? Operation.CREATE : Operation.WRITE; - - accessControlService.checkPermission(getCurrentUser(), Resource.WIDGETS_BUNDLE, operation, - widgetsBundle.getId(), widgetsBundle); - + checkEntity(widgetsBundle.getId(), widgetsBundle, Resource.WIDGETS_BUNDLE); return checkNotNull(widgetsBundleService.saveWidgetsBundle(widgetsBundle)); } catch (Exception e) { throw handleException(e); @@ -93,7 +89,7 @@ public class WidgetsBundleController extends BaseController { } @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN', 'CUSTOMER_USER')") - @RequestMapping(value = "/widgetsBundles", params = { "limit" }, method = RequestMethod.GET) + @RequestMapping(value = "/widgetsBundles", params = {"limit"}, method = RequestMethod.GET) @ResponseBody public TextPageData getWidgetsBundles( @RequestParam int limit, diff --git a/application/src/main/java/org/thingsboard/server/service/security/permission/Resource.java b/application/src/main/java/org/thingsboard/server/service/security/permission/Resource.java index ce657931c6..a66b822fca 100644 --- a/application/src/main/java/org/thingsboard/server/service/security/permission/Resource.java +++ b/application/src/main/java/org/thingsboard/server/service/security/permission/Resource.java @@ -46,4 +46,13 @@ public enum Resource { public Optional getEntityType() { return Optional.ofNullable(entityType); } + + public static Resource of(EntityType entityType) { + for (Resource resource : Resource.values()) { + if (resource.getEntityType().get() == entityType) { + return resource; + } + } + throw new IllegalArgumentException("Unknown EntityType: " + entityType.name()); + } } diff --git a/application/src/test/java/org/thingsboard/server/controller/AbstractControllerTest.java b/application/src/test/java/org/thingsboard/server/controller/AbstractControllerTest.java index 26f375c464..5462bb12bd 100644 --- a/application/src/test/java/org/thingsboard/server/controller/AbstractControllerTest.java +++ b/application/src/test/java/org/thingsboard/server/controller/AbstractControllerTest.java @@ -33,7 +33,6 @@ import org.junit.rules.TestRule; import org.junit.rules.TestWatcher; import org.junit.runner.Description; import org.junit.runner.RunWith; -import org.mockito.Mockito; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.boot.test.context.SpringBootContextLoader; import org.springframework.boot.test.context.SpringBootTest; @@ -49,7 +48,6 @@ import org.springframework.mock.http.MockHttpOutputMessage; import org.springframework.test.annotation.DirtiesContext; import org.springframework.test.context.ActiveProfiles; import org.springframework.test.context.ContextConfiguration; -import org.springframework.test.context.TestPropertySource; import org.springframework.test.context.junit4.SpringRunner; import org.springframework.test.context.web.WebAppConfiguration; import org.springframework.test.web.servlet.MockMvc; @@ -75,7 +73,6 @@ import org.thingsboard.server.service.security.auth.jwt.RefreshTokenRequest; import org.thingsboard.server.service.security.auth.rest.LoginRequest; import java.io.IOException; -import java.nio.charset.Charset; import java.util.ArrayList; import java.util.Arrays; import java.util.Comparator; @@ -223,6 +220,27 @@ public abstract class AbstractControllerTest { login(CUSTOMER_USER_EMAIL, CUSTOMER_USER_PASSWORD); } + private Tenant savedDifferentTenant; + protected void loginDifferentTenant() throws Exception { + loginSysAdmin(); + Tenant tenant = new Tenant(); + tenant.setTitle("Different tenant"); + savedDifferentTenant = doPost("/api/tenant", tenant, Tenant.class); + Assert.assertNotNull(savedDifferentTenant); + User differentTenantAdmin = new User(); + differentTenantAdmin.setAuthority(Authority.TENANT_ADMIN); + differentTenantAdmin.setTenantId(savedDifferentTenant.getId()); + differentTenantAdmin.setEmail("different_tenant@thingsboard.org"); + + createUserAndLogin(differentTenantAdmin, "testPassword"); + } + + protected void deleteDifferentTenant() throws Exception { + loginSysAdmin(); + doDelete("/api/tenant/" + savedDifferentTenant.getId().getId().toString()) + .andExpect(status().isOk()); + } + protected User createUserAndLogin(User user, String password) throws Exception { User savedUser = doPost("/api/user", user, User.class); logout(); diff --git a/application/src/test/java/org/thingsboard/server/controller/BaseAssetControllerTest.java b/application/src/test/java/org/thingsboard/server/controller/BaseAssetControllerTest.java index 0422a85416..24dbcca2db 100644 --- a/application/src/test/java/org/thingsboard/server/controller/BaseAssetControllerTest.java +++ b/application/src/test/java/org/thingsboard/server/controller/BaseAssetControllerTest.java @@ -98,6 +98,18 @@ public abstract class BaseAssetControllerTest extends AbstractControllerTest { Assert.assertEquals(foundAsset.getName(), savedAsset.getName()); } + @Test + public void testUpdateAssetFromDifferentTenant() throws Exception { + Asset asset = new Asset(); + asset.setName("My asset"); + asset.setType("default"); + Asset savedAsset = doPost("/api/asset", asset, Asset.class); + + loginDifferentTenant(); + doPost("/api/asset", savedAsset, Asset.class, status().isForbidden()); + deleteDifferentTenant(); + } + @Test public void testFindAssetById() throws Exception { Asset asset = new Asset(); diff --git a/application/src/test/java/org/thingsboard/server/controller/BaseCustomerControllerTest.java b/application/src/test/java/org/thingsboard/server/controller/BaseCustomerControllerTest.java index f5ea544560..558600c73e 100644 --- a/application/src/test/java/org/thingsboard/server/controller/BaseCustomerControllerTest.java +++ b/application/src/test/java/org/thingsboard/server/controller/BaseCustomerControllerTest.java @@ -23,6 +23,8 @@ import java.util.Collections; import java.util.List; import org.apache.commons.lang3.RandomStringUtils; +import org.junit.After; +import org.junit.Before; import org.thingsboard.server.common.data.Customer; import org.thingsboard.server.common.data.Tenant; import org.thingsboard.server.common.data.User; @@ -38,25 +40,39 @@ import com.fasterxml.jackson.core.type.TypeReference; public abstract class BaseCustomerControllerTest extends AbstractControllerTest { private IdComparator idComparator = new IdComparator<>(); - - @Test - public void testSaveCustomer() throws Exception { + + private Tenant savedTenant; + private User tenantAdmin; + + @Before + public void beforeTest() throws Exception { loginSysAdmin(); Tenant tenant = new Tenant(); tenant.setTitle("My tenant"); - Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); + savedTenant = doPost("/api/tenant", tenant, Tenant.class); Assert.assertNotNull(savedTenant); - - User tenantAdmin = new User(); + + tenantAdmin = new User(); tenantAdmin.setAuthority(Authority.TENANT_ADMIN); tenantAdmin.setTenantId(savedTenant.getId()); tenantAdmin.setEmail("tenant2@thingsboard.org"); tenantAdmin.setFirstName("Joe"); tenantAdmin.setLastName("Downs"); - + tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1"); - + } + + @After + public void afterTest() throws Exception { + loginSysAdmin(); + + doDelete("/api/tenant/" + savedTenant.getId().getId().toString()) + .andExpect(status().isOk()); + } + + @Test + public void testSaveCustomer() throws Exception { Customer customer = new Customer(); customer.setTitle("My customer"); Customer savedCustomer = doPost("/api/customer", customer, Customer.class); @@ -66,266 +82,159 @@ public abstract class BaseCustomerControllerTest extends AbstractControllerTest Assert.assertEquals(customer.getTitle(), savedCustomer.getTitle()); savedCustomer.setTitle("My new customer"); doPost("/api/customer", savedCustomer, Customer.class); - - Customer foundCustomer = doGet("/api/customer/"+savedCustomer.getId().getId().toString(), Customer.class); + + Customer foundCustomer = doGet("/api/customer/"+savedCustomer.getId().getId().toString(), Customer.class); Assert.assertEquals(foundCustomer.getTitle(), savedCustomer.getTitle()); - + doDelete("/api/customer/"+savedCustomer.getId().getId().toString()) .andExpect(status().isOk()); - - loginSysAdmin(); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); } - + @Test - public void testFindCustomerById() throws Exception { - - loginSysAdmin(); + public void testUpdateCustomerFromDifferentTenant() throws Exception { + Customer customer = new Customer(); + customer.setTitle("My customer"); + Customer savedCustomer = doPost("/api/customer", customer, Customer.class); + doPost("/api/customer", savedCustomer, Customer.class); - Tenant tenant = new Tenant(); - tenant.setTitle("My tenant"); - Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); - Assert.assertNotNull(savedTenant); - - User tenantAdmin = new User(); - tenantAdmin.setAuthority(Authority.TENANT_ADMIN); - tenantAdmin.setTenantId(savedTenant.getId()); - tenantAdmin.setEmail("tenant2@thingsboard.org"); - tenantAdmin.setFirstName("Joe"); - tenantAdmin.setLastName("Downs"); - - tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1"); - + loginDifferentTenant(); + doPost("/api/customer", savedCustomer, Customer.class, status().isForbidden()); + deleteDifferentTenant(); + + login(tenantAdmin.getName(), "testPassword1"); + doDelete("/api/customer/" + savedCustomer.getId().getId().toString()) + .andExpect(status().isOk()); + } + + @Test + public void testFindCustomerById() throws Exception { Customer customer = new Customer(); customer.setTitle("My customer"); Customer savedCustomer = doPost("/api/customer", customer, Customer.class); - - Customer foundCustomer = doGet("/api/customer/"+savedCustomer.getId().getId().toString(), Customer.class); + + Customer foundCustomer = doGet("/api/customer/" + savedCustomer.getId().getId().toString(), Customer.class); Assert.assertNotNull(foundCustomer); Assert.assertEquals(savedCustomer, foundCustomer); - - doDelete("/api/customer/"+savedCustomer.getId().getId().toString()) - .andExpect(status().isOk()); - - loginSysAdmin(); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); + + doDelete("/api/customer/" + savedCustomer.getId().getId().toString()) + .andExpect(status().isOk()); } - + @Test public void testDeleteCustomer() throws Exception { - - loginSysAdmin(); - - Tenant tenant = new Tenant(); - tenant.setTitle("My tenant"); - Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); - Assert.assertNotNull(savedTenant); - - User tenantAdmin = new User(); - tenantAdmin.setAuthority(Authority.TENANT_ADMIN); - tenantAdmin.setTenantId(savedTenant.getId()); - tenantAdmin.setEmail("tenant2@thingsboard.org"); - tenantAdmin.setFirstName("Joe"); - tenantAdmin.setLastName("Downs"); - - tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1"); - Customer customer = new Customer(); customer.setTitle("My customer"); Customer savedCustomer = doPost("/api/customer", customer, Customer.class); - - doDelete("/api/customer/"+savedCustomer.getId().getId().toString()) - .andExpect(status().isOk()); - doGet("/api/customer/"+savedCustomer.getId().getId().toString()) - .andExpect(status().isNotFound()); - - loginSysAdmin(); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); + doDelete("/api/customer/" + savedCustomer.getId().getId().toString()) + .andExpect(status().isOk()); + + doGet("/api/customer/" + savedCustomer.getId().getId().toString()) + .andExpect(status().isNotFound()); } - + @Test public void testSaveCustomerWithEmptyTitle() throws Exception { - - loginSysAdmin(); - - Tenant tenant = new Tenant(); - tenant.setTitle("My tenant"); - Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); - Assert.assertNotNull(savedTenant); - - User tenantAdmin = new User(); - tenantAdmin.setAuthority(Authority.TENANT_ADMIN); - tenantAdmin.setTenantId(savedTenant.getId()); - tenantAdmin.setEmail("tenant2@thingsboard.org"); - tenantAdmin.setFirstName("Joe"); - tenantAdmin.setLastName("Downs"); - - tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1"); - Customer customer = new Customer(); doPost("/api/customer", customer) - .andExpect(status().isBadRequest()) - .andExpect(statusReason(containsString("Customer title should be specified"))); - - loginSysAdmin(); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); + .andExpect(status().isBadRequest()) + .andExpect(statusReason(containsString("Customer title should be specified"))); } - + @Test public void testSaveCustomerWithInvalidEmail() throws Exception { - - loginSysAdmin(); - - Tenant tenant = new Tenant(); - tenant.setTitle("My tenant"); - Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); - Assert.assertNotNull(savedTenant); - - User tenantAdmin = new User(); - tenantAdmin.setAuthority(Authority.TENANT_ADMIN); - tenantAdmin.setTenantId(savedTenant.getId()); - tenantAdmin.setEmail("tenant2@thingsboard.org"); - tenantAdmin.setFirstName("Joe"); - tenantAdmin.setLastName("Downs"); - - tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1"); - Customer customer = new Customer(); customer.setTitle("My customer"); customer.setEmail("invalid@mail"); doPost("/api/customer", customer) - .andExpect(status().isBadRequest()) - .andExpect(statusReason(containsString("Invalid email address format 'invalid@mail'"))); - - loginSysAdmin(); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); + .andExpect(status().isBadRequest()) + .andExpect(statusReason(containsString("Invalid email address format 'invalid@mail'"))); + +// loginSysAdmin(); +// +// doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) +// .andExpect(status().isOk()); } - + @Test public void testFindCustomers() throws Exception { - loginSysAdmin(); - - Tenant tenant = new Tenant(); - tenant.setTitle("My tenant"); - Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); - Assert.assertNotNull(savedTenant); - TenantId tenantId = savedTenant.getId(); - - User tenantAdmin = new User(); - tenantAdmin.setAuthority(Authority.TENANT_ADMIN); - tenantAdmin.setTenantId(tenantId); - tenantAdmin.setEmail("tenant2@thingsboard.org"); - tenantAdmin.setFirstName("Joe"); - tenantAdmin.setLastName("Downs"); - - tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1"); - + List customers = new ArrayList<>(); - for (int i=0;i<135;i++) { + for (int i = 0; i < 135; i++) { Customer customer = new Customer(); customer.setTenantId(tenantId); - customer.setTitle("Customer"+i); + customer.setTitle("Customer" + i); customers.add(doPost("/api/customer", customer, Customer.class)); } - + List loadedCustomers = new ArrayList<>(); TextPageLink pageLink = new TextPageLink(23); TextPageData pageData = null; do { - pageData = doGetTypedWithPageLink("/api/customers?", new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/customers?", new TypeReference>() { + }, pageLink); loadedCustomers.addAll(pageData.getData()); if (pageData.hasNext()) { pageLink = pageData.getNextPageLink(); } } while (pageData.hasNext()); - + Collections.sort(customers, idComparator); Collections.sort(loadedCustomers, idComparator); - + Assert.assertEquals(customers, loadedCustomers); - - loginSysAdmin(); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); } - + @Test public void testFindCustomersByTitle() throws Exception { - - loginSysAdmin(); - - Tenant tenant = new Tenant(); - tenant.setTitle("My tenant"); - Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); - Assert.assertNotNull(savedTenant); - TenantId tenantId = savedTenant.getId(); - - User tenantAdmin = new User(); - tenantAdmin.setAuthority(Authority.TENANT_ADMIN); - tenantAdmin.setTenantId(tenantId); - tenantAdmin.setEmail("tenant2@thingsboard.org"); - tenantAdmin.setFirstName("Joe"); - tenantAdmin.setLastName("Downs"); - - tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1"); - + String title1 = "Customer title 1"; List customersTitle1 = new ArrayList<>(); - for (int i=0;i<143;i++) { + for (int i = 0; i < 143; i++) { Customer customer = new Customer(); customer.setTenantId(tenantId); - String suffix = RandomStringUtils.randomAlphanumeric((int)(5 + Math.random()*10)); - String title = title1+suffix; + String suffix = RandomStringUtils.randomAlphanumeric((int) (5 + Math.random() * 10)); + String title = title1 + suffix; title = i % 2 == 0 ? title.toLowerCase() : title.toUpperCase(); customer.setTitle(title); customersTitle1.add(doPost("/api/customer", customer, Customer.class)); } String title2 = "Customer title 2"; List customersTitle2 = new ArrayList<>(); - for (int i=0;i<175;i++) { + for (int i = 0; i < 175; i++) { Customer customer = new Customer(); customer.setTenantId(tenantId); - String suffix = RandomStringUtils.randomAlphanumeric((int)(5 + Math.random()*10)); - String title = title2+suffix; + String suffix = RandomStringUtils.randomAlphanumeric((int) (5 + Math.random() * 10)); + String title = title2 + suffix; title = i % 2 == 0 ? title.toLowerCase() : title.toUpperCase(); customer.setTitle(title); customersTitle2.add(doPost("/api/customer", customer, Customer.class)); } - + List loadedCustomersTitle1 = new ArrayList<>(); TextPageLink pageLink = new TextPageLink(15, title1); TextPageData pageData = null; do { - pageData = doGetTypedWithPageLink("/api/customers?", new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/customers?", new TypeReference>() { + }, pageLink); loadedCustomersTitle1.addAll(pageData.getData()); if (pageData.hasNext()) { pageLink = pageData.getNextPageLink(); } } while (pageData.hasNext()); - + Collections.sort(customersTitle1, idComparator); Collections.sort(loadedCustomersTitle1, idComparator); - + Assert.assertEquals(customersTitle1, loadedCustomersTitle1); - + List loadedCustomersTitle2 = new ArrayList<>(); pageLink = new TextPageLink(4, title2); do { - pageData = doGetTypedWithPageLink("/api/customers?", new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/customers?", new TypeReference>() { + }, pageLink); loadedCustomersTitle2.addAll(pageData.getData()); if (pageData.hasNext()) { pageLink = pageData.getNextPageLink(); @@ -334,33 +243,30 @@ public abstract class BaseCustomerControllerTest extends AbstractControllerTest Collections.sort(customersTitle2, idComparator); Collections.sort(loadedCustomersTitle2, idComparator); - + Assert.assertEquals(customersTitle2, loadedCustomersTitle2); - + for (Customer customer : loadedCustomersTitle1) { - doDelete("/api/customer/"+customer.getId().getId().toString()) - .andExpect(status().isOk()); + doDelete("/api/customer/" + customer.getId().getId().toString()) + .andExpect(status().isOk()); } - + pageLink = new TextPageLink(4, title1); - pageData = doGetTypedWithPageLink("/api/customers?", new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/customers?", new TypeReference>() { + }, pageLink); Assert.assertFalse(pageData.hasNext()); Assert.assertEquals(0, pageData.getData().size()); - + for (Customer customer : loadedCustomersTitle2) { - doDelete("/api/customer/"+customer.getId().getId().toString()) - .andExpect(status().isOk()); + doDelete("/api/customer/" + customer.getId().getId().toString()) + .andExpect(status().isOk()); } - + pageLink = new TextPageLink(4, title2); - pageData = doGetTypedWithPageLink("/api/customers?", new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/customers?", new TypeReference>() { + }, pageLink); Assert.assertFalse(pageData.hasNext()); Assert.assertEquals(0, pageData.getData().size()); - - loginSysAdmin(); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); } - + } diff --git a/application/src/test/java/org/thingsboard/server/controller/BaseDashboardControllerTest.java b/application/src/test/java/org/thingsboard/server/controller/BaseDashboardControllerTest.java index 0ae939550a..e8fbfe4aa1 100644 --- a/application/src/test/java/org/thingsboard/server/controller/BaseDashboardControllerTest.java +++ b/application/src/test/java/org/thingsboard/server/controller/BaseDashboardControllerTest.java @@ -16,10 +16,8 @@ package org.thingsboard.server.controller; import static org.hamcrest.Matchers.containsString; -import static org.thingsboard.server.dao.model.ModelConstants.NULL_UUID; import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status; -import java.sql.Time; import java.util.ArrayList; import java.util.Collections; import java.util.List; @@ -33,7 +31,6 @@ import org.thingsboard.server.common.data.page.TextPageLink; import org.thingsboard.server.common.data.page.TimePageData; import org.thingsboard.server.common.data.page.TimePageLink; import org.thingsboard.server.common.data.security.Authority; -import org.thingsboard.server.dao.model.ModelConstants; import org.junit.After; import org.junit.Assert; import org.junit.Before; @@ -93,6 +90,17 @@ public abstract class BaseDashboardControllerTest extends AbstractControllerTest Dashboard foundDashboard = doGet("/api/dashboard/" + savedDashboard.getId().getId().toString(), Dashboard.class); Assert.assertEquals(foundDashboard.getTitle(), savedDashboard.getTitle()); } + + @Test + public void testUpdateDashboardFromDifferentTenant() throws Exception { + Dashboard dashboard = new Dashboard(); + dashboard.setTitle("My dashboard"); + Dashboard savedDashboard = doPost("/api/dashboard", dashboard, Dashboard.class); + + loginDifferentTenant(); + doPost("/api/dashboard", savedDashboard, Dashboard.class, status().isForbidden()); + deleteDifferentTenant(); + } @Test public void testFindDashboardById() throws Exception { diff --git a/application/src/test/java/org/thingsboard/server/controller/BaseDeviceControllerTest.java b/application/src/test/java/org/thingsboard/server/controller/BaseDeviceControllerTest.java index 2f347f1f89..aa11c4ab40 100644 --- a/application/src/test/java/org/thingsboard/server/controller/BaseDeviceControllerTest.java +++ b/application/src/test/java/org/thingsboard/server/controller/BaseDeviceControllerTest.java @@ -107,6 +107,17 @@ public abstract class BaseDeviceControllerTest extends AbstractControllerTest { Device foundDevice = doGet("/api/device/" + savedDevice.getId().getId().toString(), Device.class); Assert.assertEquals(foundDevice.getName(), savedDevice.getName()); } + + @Test + public void testUpdateDeviceFromDifferentTenant() throws Exception { + Device device = new Device(); + device.setName("My device"); + device.setType("default"); + Device savedDevice = doPost("/api/device", device, Device.class); + loginDifferentTenant(); + doPost("/api/device", savedDevice, Device.class, status().isForbidden()); + deleteDifferentTenant(); + } @Test public void testFindDeviceById() throws Exception { diff --git a/application/src/test/java/org/thingsboard/server/controller/BaseEntityViewControllerTest.java b/application/src/test/java/org/thingsboard/server/controller/BaseEntityViewControllerTest.java index 420446e04d..bec1b55a79 100644 --- a/application/src/test/java/org/thingsboard/server/controller/BaseEntityViewControllerTest.java +++ b/application/src/test/java/org/thingsboard/server/controller/BaseEntityViewControllerTest.java @@ -25,7 +25,6 @@ import org.eclipse.paho.client.mqttv3.MqttMessage; import org.junit.After; import org.junit.Assert; import org.junit.Before; -import org.junit.Ignore; import org.junit.Test; import org.thingsboard.server.common.data.Customer; import org.thingsboard.server.common.data.Device; @@ -132,6 +131,15 @@ public abstract class BaseEntityViewControllerTest extends AbstractControllerTes assertEquals(foundEntityView.getKeys(), telemetry); } + + @Test + public void testUpdateEntityViewFromDifferentTenant() throws Exception { + EntityView savedView = getNewSavedEntityView("Test entity view"); + loginDifferentTenant(); + doPost("/api/entityView", savedView, EntityView.class, status().isForbidden()); + deleteDifferentTenant(); + } + @Test public void testDeleteEntityView() throws Exception { EntityView view = getNewSavedEntityView("Test entity view"); diff --git a/application/src/test/java/org/thingsboard/server/controller/BaseUserControllerTest.java b/application/src/test/java/org/thingsboard/server/controller/BaseUserControllerTest.java index 2a2032e4c7..e290ac9f24 100644 --- a/application/src/test/java/org/thingsboard/server/controller/BaseUserControllerTest.java +++ b/application/src/test/java/org/thingsboard/server/controller/BaseUserControllerTest.java @@ -38,21 +38,23 @@ import java.util.List; import static org.hamcrest.Matchers.containsString; import static org.hamcrest.Matchers.is; -import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status; public abstract class BaseUserControllerTest extends AbstractControllerTest { - + private IdComparator idComparator = new IdComparator<>(); @Test public void testSaveUser() throws Exception { loginSysAdmin(); - + Tenant tenant = new Tenant(); tenant.setTitle("My tenant"); Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); Assert.assertNotNull(savedTenant); - + String email = "tenant2@thingsboard.org"; User user = new User(); user.setAuthority(Authority.TENANT_ADMIN); @@ -66,13 +68,13 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest { Assert.assertTrue(savedUser.getCreatedTime() > 0); Assert.assertEquals(user.getEmail(), savedUser.getEmail()); - User foundUser = doGet("/api/user/"+savedUser.getId().getId().toString(), User.class); + User foundUser = doGet("/api/user/" + savedUser.getId().getId().toString(), User.class); Assert.assertEquals(foundUser, savedUser); - + logout(); doGet("/api/noauth/activate?activateToken={activateToken}", TestMailService.currentActivateToken) - .andExpect(status().isSeeOther()) - .andExpect(header().string(HttpHeaders.LOCATION, "/login/createPassword?activateToken=" + TestMailService.currentActivateToken)); + .andExpect(status().isSeeOther()) + .andExpect(header().string(HttpHeaders.LOCATION, "/login/createPassword?activateToken=" + TestMailService.currentActivateToken)); JsonNode activateRequest = new ObjectMapper().createObjectNode() .put("activateToken", TestMailService.currentActivateToken) @@ -82,36 +84,61 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest { validateAndSetJwtToken(tokenInfo, email); doGet("/api/auth/user") - .andExpect(status().isOk()) - .andExpect(jsonPath("$.authority",is(Authority.TENANT_ADMIN.name()))) - .andExpect(jsonPath("$.email",is(email))); - + .andExpect(status().isOk()) + .andExpect(jsonPath("$.authority", is(Authority.TENANT_ADMIN.name()))) + .andExpect(jsonPath("$.email", is(email))); + logout(); - + login(email, "testPassword"); - + doGet("/api/auth/user") - .andExpect(status().isOk()) - .andExpect(jsonPath("$.authority",is(Authority.TENANT_ADMIN.name()))) - .andExpect(jsonPath("$.email",is(email))); - + .andExpect(status().isOk()) + .andExpect(jsonPath("$.authority", is(Authority.TENANT_ADMIN.name()))) + .andExpect(jsonPath("$.email", is(email))); + loginSysAdmin(); - doDelete("/api/user/"+savedUser.getId().getId().toString()) - .andExpect(status().isOk()); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); + doDelete("/api/user/" + savedUser.getId().getId().toString()) + .andExpect(status().isOk()); + + doDelete("/api/tenant/" + savedTenant.getId().getId().toString()) + .andExpect(status().isOk()); } - + + @Test + public void testUpdateUserFromDifferentTenant() throws Exception { + loginSysAdmin(); + Tenant tenant = new Tenant(); + tenant.setTitle("My tenant"); + Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); + Assert.assertNotNull(savedTenant); + + User tenantAdmin = new User(); + tenantAdmin.setAuthority(Authority.TENANT_ADMIN); + tenantAdmin.setTenantId(savedTenant.getId()); + tenantAdmin.setEmail("tenant2@thingsboard.org"); + tenantAdmin.setFirstName("Joe"); + tenantAdmin.setLastName("Downs"); + tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1"); + + loginDifferentTenant(); + doPost("/api/user", tenantAdmin, User.class, status().isForbidden()); + deleteDifferentTenant(); + + loginSysAdmin(); + doDelete("/api/tenant/" + savedTenant.getId().getId().toString()) + .andExpect(status().isOk()); + } + @Test public void testResetPassword() throws Exception { loginSysAdmin(); - + Tenant tenant = new Tenant(); tenant.setTitle("My tenant"); Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); Assert.assertNotNull(savedTenant); - + String email = "tenant2@thingsboard.org"; User user = new User(); user.setAuthority(Authority.TENANT_ADMIN); @@ -119,7 +146,7 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest { user.setEmail(email); user.setFirstName("Joe"); user.setLastName("Downs"); - + User savedUser = createUserAndLogin(user, "testPassword1"); logout(); @@ -127,10 +154,10 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest { .put("email", email); doPost("/api/noauth/resetPasswordByEmail", resetPasswordByEmailRequest) - .andExpect(status().isOk()); + .andExpect(status().isOk()); doGet("/api/noauth/resetPassword?resetToken={resetToken}", TestMailService.currentResetPasswordToken) - .andExpect(status().isSeeOther()) - .andExpect(header().string(HttpHeaders.LOCATION, "/login/resetPassword?resetToken=" + TestMailService.currentResetPasswordToken)); + .andExpect(status().isSeeOther()) + .andExpect(header().string(HttpHeaders.LOCATION, "/login/resetPassword?resetToken=" + TestMailService.currentResetPasswordToken)); JsonNode resetPasswordRequest = new ObjectMapper().createObjectNode() .put("resetToken", TestMailService.currentResetPasswordToken) @@ -140,35 +167,35 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest { validateAndSetJwtToken(tokenInfo, email); doGet("/api/auth/user") - .andExpect(status().isOk()) - .andExpect(jsonPath("$.authority",is(Authority.TENANT_ADMIN.name()))) - .andExpect(jsonPath("$.email",is(email))); - + .andExpect(status().isOk()) + .andExpect(jsonPath("$.authority", is(Authority.TENANT_ADMIN.name()))) + .andExpect(jsonPath("$.email", is(email))); + logout(); - + login(email, "testPassword2"); doGet("/api/auth/user") - .andExpect(status().isOk()) - .andExpect(jsonPath("$.authority",is(Authority.TENANT_ADMIN.name()))) - .andExpect(jsonPath("$.email",is(email))); - + .andExpect(status().isOk()) + .andExpect(jsonPath("$.authority", is(Authority.TENANT_ADMIN.name()))) + .andExpect(jsonPath("$.email", is(email))); + loginSysAdmin(); - doDelete("/api/user/"+savedUser.getId().getId().toString()) - .andExpect(status().isOk()); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); + doDelete("/api/user/" + savedUser.getId().getId().toString()) + .andExpect(status().isOk()); + + doDelete("/api/tenant/" + savedTenant.getId().getId().toString()) + .andExpect(status().isOk()); } - + @Test public void testFindUserById() throws Exception { loginSysAdmin(); - + Tenant tenant = new Tenant(); tenant.setTitle("My tenant"); Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); Assert.assertNotNull(savedTenant); - + String email = "tenant2@thingsboard.org"; User user = new User(); user.setAuthority(Authority.TENANT_ADMIN); @@ -176,25 +203,25 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest { user.setEmail(email); user.setFirstName("Joe"); user.setLastName("Downs"); - + User savedUser = doPost("/api/user", user, User.class); - User foundUser = doGet("/api/user/"+savedUser.getId().getId().toString(), User.class); + User foundUser = doGet("/api/user/" + savedUser.getId().getId().toString(), User.class); Assert.assertNotNull(foundUser); Assert.assertEquals(savedUser, foundUser); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); + + doDelete("/api/tenant/" + savedTenant.getId().getId().toString()) + .andExpect(status().isOk()); } - + @Test public void testSaveUserWithSameEmail() throws Exception { loginSysAdmin(); - + Tenant tenant = new Tenant(); tenant.setTitle("My tenant"); Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); Assert.assertNotNull(savedTenant); - + String email = TENANT_ADMIN_EMAIL; User user = new User(); user.setAuthority(Authority.TENANT_ADMIN); @@ -202,24 +229,24 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest { user.setEmail(email); user.setFirstName("Joe"); user.setLastName("Downs"); - + doPost("/api/user", user) - .andExpect(status().isBadRequest()) - .andExpect(statusReason(containsString("User with email '" + email + "' already present in database"))); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); + .andExpect(status().isBadRequest()) + .andExpect(statusReason(containsString("User with email '" + email + "' already present in database"))); + + doDelete("/api/tenant/" + savedTenant.getId().getId().toString()) + .andExpect(status().isOk()); } - + @Test public void testSaveUserWithInvalidEmail() throws Exception { loginSysAdmin(); - + Tenant tenant = new Tenant(); tenant.setTitle("My tenant"); Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); Assert.assertNotNull(savedTenant); - + String email = "tenant_thingsboard.org"; User user = new User(); user.setAuthority(Authority.TENANT_ADMIN); @@ -227,62 +254,62 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest { user.setEmail(email); user.setFirstName("Joe"); user.setLastName("Downs"); - + doPost("/api/user", user) - .andExpect(status().isBadRequest()) - .andExpect(statusReason(containsString("Invalid email address format '" + email + "'"))); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); + .andExpect(status().isBadRequest()) + .andExpect(statusReason(containsString("Invalid email address format '" + email + "'"))); + + doDelete("/api/tenant/" + savedTenant.getId().getId().toString()) + .andExpect(status().isOk()); } - + @Test public void testSaveUserWithEmptyEmail() throws Exception { loginSysAdmin(); - + Tenant tenant = new Tenant(); tenant.setTitle("My tenant"); Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); Assert.assertNotNull(savedTenant); - + User user = new User(); user.setAuthority(Authority.TENANT_ADMIN); user.setTenantId(savedTenant.getId()); user.setFirstName("Joe"); user.setLastName("Downs"); - + doPost("/api/user", user) - .andExpect(status().isBadRequest()) - .andExpect(statusReason(containsString("User email should be specified"))); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); + .andExpect(status().isBadRequest()) + .andExpect(statusReason(containsString("User email should be specified"))); + + doDelete("/api/tenant/" + savedTenant.getId().getId().toString()) + .andExpect(status().isOk()); } - + @Test public void testSaveUserWithoutTenant() throws Exception { loginSysAdmin(); - + User user = new User(); user.setAuthority(Authority.TENANT_ADMIN); user.setEmail("tenant2@thingsboard.org"); user.setFirstName("Joe"); user.setLastName("Downs"); - + doPost("/api/user", user) - .andExpect(status().isBadRequest()) - .andExpect(statusReason(containsString("Tenant administrator should be assigned to tenant"))); + .andExpect(status().isBadRequest()) + .andExpect(statusReason(containsString("Tenant administrator should be assigned to tenant"))); } - + @Test public void testDeleteUser() throws Exception { loginSysAdmin(); - + Tenant tenant = new Tenant(); tenant.setTitle("My tenant"); Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); Assert.assertNotNull(savedTenant); - + String email = "tenant2@thingsboard.org"; User user = new User(); user.setAuthority(Authority.TENANT_ADMIN); @@ -290,176 +317,182 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest { user.setEmail(email); user.setFirstName("Joe"); user.setLastName("Downs"); - + User savedUser = doPost("/api/user", user, User.class); - User foundUser = doGet("/api/user/"+savedUser.getId().getId().toString(), User.class); + User foundUser = doGet("/api/user/" + savedUser.getId().getId().toString(), User.class); Assert.assertNotNull(foundUser); - - doDelete("/api/user/"+savedUser.getId().getId().toString()) - .andExpect(status().isOk()); - - doGet("/api/user/"+savedUser.getId().getId().toString()) - .andExpect(status().isNotFound()); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); + + doDelete("/api/user/" + savedUser.getId().getId().toString()) + .andExpect(status().isOk()); + + doGet("/api/user/" + savedUser.getId().getId().toString()) + .andExpect(status().isNotFound()); + + doDelete("/api/tenant/" + savedTenant.getId().getId().toString()) + .andExpect(status().isOk()); } - + @Test public void testFindTenantAdmins() throws Exception { loginSysAdmin(); - + Tenant tenant = new Tenant(); tenant.setTitle("My tenant"); Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); Assert.assertNotNull(savedTenant); - + TenantId tenantId = savedTenant.getId(); - + List tenantAdmins = new ArrayList<>(); - for (int i=0;i<64;i++) { + for (int i = 0; i < 64; i++) { User user = new User(); user.setAuthority(Authority.TENANT_ADMIN); user.setTenantId(tenantId); user.setEmail("testTenant" + i + "@thingsboard.org"); tenantAdmins.add(doPost("/api/user", user, User.class)); } - + List loadedTenantAdmins = new ArrayList<>(); TextPageLink pageLink = new TextPageLink(33); TextPageData pageData = null; do { - pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?", - new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?", + new TypeReference>() { + }, pageLink); loadedTenantAdmins.addAll(pageData.getData()); if (pageData.hasNext()) { pageLink = pageData.getNextPageLink(); } } while (pageData.hasNext()); - + Collections.sort(tenantAdmins, idComparator); Collections.sort(loadedTenantAdmins, idComparator); - + Assert.assertEquals(tenantAdmins, loadedTenantAdmins); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); - + + doDelete("/api/tenant/" + savedTenant.getId().getId().toString()) + .andExpect(status().isOk()); + pageLink = new TextPageLink(33); - pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?", - new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?", + new TypeReference>() { + }, pageLink); Assert.assertFalse(pageData.hasNext()); Assert.assertTrue(pageData.getData().isEmpty()); } - + @Test public void testFindTenantAdminsByEmail() throws Exception { - + loginSysAdmin(); - + Tenant tenant = new Tenant(); tenant.setTitle("My tenant"); Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); Assert.assertNotNull(savedTenant); - + TenantId tenantId = savedTenant.getId(); - - String email1 = "testEmail1"; + + String email1 = "testEmail1"; List tenantAdminsEmail1 = new ArrayList<>(); - - for (int i=0;i<124;i++) { + + for (int i = 0; i < 124; i++) { User user = new User(); user.setAuthority(Authority.TENANT_ADMIN); user.setTenantId(tenantId); - String suffix = RandomStringUtils.randomAlphanumeric((int)(5 + Math.random()*10)); - String email = email1+suffix+ "@thingsboard.org"; + String suffix = RandomStringUtils.randomAlphanumeric((int) (5 + Math.random() * 10)); + String email = email1 + suffix + "@thingsboard.org"; email = i % 2 == 0 ? email.toLowerCase() : email.toUpperCase(); user.setEmail(email); tenantAdminsEmail1.add(doPost("/api/user", user, User.class)); } - - String email2 = "testEmail2"; + + String email2 = "testEmail2"; List tenantAdminsEmail2 = new ArrayList<>(); - - for (int i=0;i<112;i++) { + + for (int i = 0; i < 112; i++) { User user = new User(); user.setAuthority(Authority.TENANT_ADMIN); user.setTenantId(tenantId); - String suffix = RandomStringUtils.randomAlphanumeric((int)(5 + Math.random()*10)); - String email = email2+suffix+ "@thingsboard.org"; + String suffix = RandomStringUtils.randomAlphanumeric((int) (5 + Math.random() * 10)); + String email = email2 + suffix + "@thingsboard.org"; email = i % 2 == 0 ? email.toLowerCase() : email.toUpperCase(); user.setEmail(email); tenantAdminsEmail2.add(doPost("/api/user", user, User.class)); } - + List loadedTenantAdminsEmail1 = new ArrayList<>(); TextPageLink pageLink = new TextPageLink(33, email1); TextPageData pageData = null; do { - pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?", - new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?", + new TypeReference>() { + }, pageLink); loadedTenantAdminsEmail1.addAll(pageData.getData()); if (pageData.hasNext()) { pageLink = pageData.getNextPageLink(); } } while (pageData.hasNext()); - + Collections.sort(tenantAdminsEmail1, idComparator); Collections.sort(loadedTenantAdminsEmail1, idComparator); - + Assert.assertEquals(tenantAdminsEmail1, loadedTenantAdminsEmail1); - + List loadedTenantAdminsEmail2 = new ArrayList<>(); pageLink = new TextPageLink(16, email2); do { - pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?", - new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?", + new TypeReference>() { + }, pageLink); loadedTenantAdminsEmail2.addAll(pageData.getData()); if (pageData.hasNext()) { pageLink = pageData.getNextPageLink(); } } while (pageData.hasNext()); - + Collections.sort(tenantAdminsEmail2, idComparator); Collections.sort(loadedTenantAdminsEmail2, idComparator); - + Assert.assertEquals(tenantAdminsEmail2, loadedTenantAdminsEmail2); - + for (User user : loadedTenantAdminsEmail1) { - doDelete("/api/user/"+user.getId().getId().toString()) - .andExpect(status().isOk()); + doDelete("/api/user/" + user.getId().getId().toString()) + .andExpect(status().isOk()); } - + pageLink = new TextPageLink(4, email1); - pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?", - new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?", + new TypeReference>() { + }, pageLink); Assert.assertFalse(pageData.hasNext()); Assert.assertEquals(0, pageData.getData().size()); - + for (User user : loadedTenantAdminsEmail2) { - doDelete("/api/user/"+user.getId().getId().toString()) - .andExpect(status().isOk()); + doDelete("/api/user/" + user.getId().getId().toString()) + .andExpect(status().isOk()); } - + pageLink = new TextPageLink(4, email2); - pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?", - new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/tenant/" + tenantId.getId().toString() + "/users?", + new TypeReference>() { + }, pageLink); Assert.assertFalse(pageData.hasNext()); Assert.assertEquals(0, pageData.getData().size()); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); + + doDelete("/api/tenant/" + savedTenant.getId().getId().toString()) + .andExpect(status().isOk()); } - + @Test public void testFindCustomerUsers() throws Exception { - + loginSysAdmin(); Tenant tenant = new Tenant(); tenant.setTitle("My tenant"); Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); Assert.assertNotNull(savedTenant); - + TenantId tenantId = savedTenant.getId(); User tenantAdmin = new User(); tenantAdmin.setAuthority(Authority.TENANT_ADMIN); @@ -467,59 +500,60 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest { tenantAdmin.setEmail("tenant2@thingsboard.org"); tenantAdmin.setFirstName("Joe"); tenantAdmin.setLastName("Downs"); - + tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1"); - + Customer customer = new Customer(); customer.setTitle("My customer"); Customer savedCustomer = doPost("/api/customer", customer, Customer.class); CustomerId customerId = savedCustomer.getId(); - + List customerUsers = new ArrayList<>(); - for (int i=0;i<56;i++) { + for (int i = 0; i < 56; i++) { User user = new User(); user.setAuthority(Authority.CUSTOMER_USER); user.setCustomerId(customerId); user.setEmail("testCustomer" + i + "@thingsboard.org"); customerUsers.add(doPost("/api/user", user, User.class)); } - + List loadedCustomerUsers = new ArrayList<>(); TextPageLink pageLink = new TextPageLink(33); TextPageData pageData = null; do { - pageData = doGetTypedWithPageLink("/api/customer/" + customerId.getId().toString() + "/users?", - new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/customer/" + customerId.getId().toString() + "/users?", + new TypeReference>() { + }, pageLink); loadedCustomerUsers.addAll(pageData.getData()); if (pageData.hasNext()) { pageLink = pageData.getNextPageLink(); } } while (pageData.hasNext()); - + Collections.sort(customerUsers, idComparator); Collections.sort(loadedCustomerUsers, idComparator); - + Assert.assertEquals(customerUsers, loadedCustomerUsers); - - doDelete("/api/customer/"+customerId.getId().toString()) - .andExpect(status().isOk()); - + + doDelete("/api/customer/" + customerId.getId().toString()) + .andExpect(status().isOk()); + loginSysAdmin(); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); + + doDelete("/api/tenant/" + savedTenant.getId().getId().toString()) + .andExpect(status().isOk()); } - + @Test public void testFindCustomerUsersByEmail() throws Exception { - + loginSysAdmin(); Tenant tenant = new Tenant(); tenant.setTitle("My tenant"); Tenant savedTenant = doPost("/api/tenant", tenant, Tenant.class); Assert.assertNotNull(savedTenant); - + TenantId tenantId = savedTenant.getId(); User tenantAdmin = new User(); tenantAdmin.setAuthority(Authority.TENANT_ADMIN); @@ -527,105 +561,109 @@ public abstract class BaseUserControllerTest extends AbstractControllerTest { tenantAdmin.setEmail("tenant2@thingsboard.org"); tenantAdmin.setFirstName("Joe"); tenantAdmin.setLastName("Downs"); - + tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1"); - + Customer customer = new Customer(); customer.setTitle("My customer"); Customer savedCustomer = doPost("/api/customer", customer, Customer.class); CustomerId customerId = savedCustomer.getId(); - - String email1 = "testEmail1"; + + String email1 = "testEmail1"; List customerUsersEmail1 = new ArrayList<>(); - - for (int i=0;i<74;i++) { + + for (int i = 0; i < 74; i++) { User user = new User(); user.setAuthority(Authority.CUSTOMER_USER); user.setCustomerId(customerId); - String suffix = RandomStringUtils.randomAlphanumeric((int)(5 + Math.random()*10)); - String email = email1+suffix+ "@thingsboard.org"; + String suffix = RandomStringUtils.randomAlphanumeric((int) (5 + Math.random() * 10)); + String email = email1 + suffix + "@thingsboard.org"; email = i % 2 == 0 ? email.toLowerCase() : email.toUpperCase(); user.setEmail(email); customerUsersEmail1.add(doPost("/api/user", user, User.class)); } - - String email2 = "testEmail2"; + + String email2 = "testEmail2"; List customerUsersEmail2 = new ArrayList<>(); - - for (int i=0;i<92;i++) { + + for (int i = 0; i < 92; i++) { User user = new User(); user.setAuthority(Authority.CUSTOMER_USER); user.setCustomerId(customerId); - String suffix = RandomStringUtils.randomAlphanumeric((int)(5 + Math.random()*10)); - String email = email2+suffix+ "@thingsboard.org"; + String suffix = RandomStringUtils.randomAlphanumeric((int) (5 + Math.random() * 10)); + String email = email2 + suffix + "@thingsboard.org"; email = i % 2 == 0 ? email.toLowerCase() : email.toUpperCase(); user.setEmail(email); customerUsersEmail2.add(doPost("/api/user", user, User.class)); } - + List loadedCustomerUsersEmail1 = new ArrayList<>(); TextPageLink pageLink = new TextPageLink(33, email1); TextPageData pageData = null; do { - pageData = doGetTypedWithPageLink("/api/customer/" + customerId.getId().toString() + "/users?", - new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/customer/" + customerId.getId().toString() + "/users?", + new TypeReference>() { + }, pageLink); loadedCustomerUsersEmail1.addAll(pageData.getData()); if (pageData.hasNext()) { pageLink = pageData.getNextPageLink(); } } while (pageData.hasNext()); - + Collections.sort(customerUsersEmail1, idComparator); Collections.sort(loadedCustomerUsersEmail1, idComparator); - + Assert.assertEquals(customerUsersEmail1, loadedCustomerUsersEmail1); - + List loadedCustomerUsersEmail2 = new ArrayList<>(); pageLink = new TextPageLink(16, email2); do { - pageData = doGetTypedWithPageLink("/api/customer/" + customerId.getId().toString() + "/users?", - new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/customer/" + customerId.getId().toString() + "/users?", + new TypeReference>() { + }, pageLink); loadedCustomerUsersEmail2.addAll(pageData.getData()); if (pageData.hasNext()) { pageLink = pageData.getNextPageLink(); } } while (pageData.hasNext()); - + Collections.sort(customerUsersEmail2, idComparator); Collections.sort(loadedCustomerUsersEmail2, idComparator); - + Assert.assertEquals(customerUsersEmail2, loadedCustomerUsersEmail2); - + for (User user : loadedCustomerUsersEmail1) { - doDelete("/api/user/"+user.getId().getId().toString()) - .andExpect(status().isOk()); + doDelete("/api/user/" + user.getId().getId().toString()) + .andExpect(status().isOk()); } - + pageLink = new TextPageLink(4, email1); - pageData = doGetTypedWithPageLink("/api/customer/" + customerId.getId().toString() + "/users?", - new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/customer/" + customerId.getId().toString() + "/users?", + new TypeReference>() { + }, pageLink); Assert.assertFalse(pageData.hasNext()); Assert.assertEquals(0, pageData.getData().size()); - + for (User user : loadedCustomerUsersEmail2) { - doDelete("/api/user/"+user.getId().getId().toString()) - .andExpect(status().isOk()); + doDelete("/api/user/" + user.getId().getId().toString()) + .andExpect(status().isOk()); } - + pageLink = new TextPageLink(4, email2); - pageData = doGetTypedWithPageLink("/api/customer/" + customerId.getId().toString() + "/users?", - new TypeReference>(){}, pageLink); + pageData = doGetTypedWithPageLink("/api/customer/" + customerId.getId().toString() + "/users?", + new TypeReference>() { + }, pageLink); Assert.assertFalse(pageData.hasNext()); Assert.assertEquals(0, pageData.getData().size()); - - doDelete("/api/customer/"+customerId.getId().toString()) - .andExpect(status().isOk()); - + + doDelete("/api/customer/" + customerId.getId().toString()) + .andExpect(status().isOk()); + loginSysAdmin(); - - doDelete("/api/tenant/"+savedTenant.getId().getId().toString()) - .andExpect(status().isOk()); + + doDelete("/api/tenant/" + savedTenant.getId().getId().toString()) + .andExpect(status().isOk()); } - + } diff --git a/application/src/test/java/org/thingsboard/server/controller/BaseWidgetTypeControllerTest.java b/application/src/test/java/org/thingsboard/server/controller/BaseWidgetTypeControllerTest.java index 85dc0572cc..ce2404041c 100644 --- a/application/src/test/java/org/thingsboard/server/controller/BaseWidgetTypeControllerTest.java +++ b/application/src/test/java/org/thingsboard/server/controller/BaseWidgetTypeControllerTest.java @@ -64,7 +64,6 @@ public abstract class BaseWidgetTypeControllerTest extends AbstractControllerTes WidgetsBundle widgetsBundle = new WidgetsBundle(); widgetsBundle.setTitle("My widgets bundle"); savedWidgetsBundle = doPost("/api/widgetsBundle", widgetsBundle, WidgetsBundle.class); - } @After @@ -100,6 +99,19 @@ public abstract class BaseWidgetTypeControllerTest extends AbstractControllerTes Assert.assertEquals(foundWidgetType.getName(), savedWidgetType.getName()); } + @Test + public void testUpdateWidgetTypeFromDifferentTenant() throws Exception { + WidgetType widgetType = new WidgetType(); + widgetType.setBundleAlias(savedWidgetsBundle.getAlias()); + widgetType.setName("Widget Type"); + widgetType.setDescriptor(new ObjectMapper().readValue("{ \"someKey\": \"someValue\" }", JsonNode.class)); + WidgetType savedWidgetType = doPost("/api/widgetType", widgetType, WidgetType.class); + + loginDifferentTenant(); + doPost("/api/widgetType", savedWidgetType, WidgetType.class, status().isForbidden()); + deleteDifferentTenant(); + } + @Test public void testFindWidgetTypeById() throws Exception { WidgetType widgetType = new WidgetType(); diff --git a/application/src/test/java/org/thingsboard/server/controller/BaseWidgetsBundleControllerTest.java b/application/src/test/java/org/thingsboard/server/controller/BaseWidgetsBundleControllerTest.java index c274ea92eb..ae23f6633b 100644 --- a/application/src/test/java/org/thingsboard/server/controller/BaseWidgetsBundleControllerTest.java +++ b/application/src/test/java/org/thingsboard/server/controller/BaseWidgetsBundleControllerTest.java @@ -88,6 +88,17 @@ public abstract class BaseWidgetsBundleControllerTest extends AbstractController Assert.assertEquals(foundWidgetsBundle.getTitle(), savedWidgetsBundle.getTitle()); } + @Test + public void testUpdateWidgetsBundleFromDifferentTenant() throws Exception { + WidgetsBundle widgetsBundle = new WidgetsBundle(); + widgetsBundle.setTitle("My widgets bundle"); + WidgetsBundle savedWidgetsBundle = doPost("/api/widgetsBundle", widgetsBundle, WidgetsBundle.class); + + loginDifferentTenant(); + doPost("/api/widgetsBundle", savedWidgetsBundle, WidgetsBundle.class, status().isForbidden()); + deleteDifferentTenant(); + } + @Test public void testFindWidgetsBundleById() throws Exception { WidgetsBundle widgetsBundle = new WidgetsBundle();