Class AclQueryUtilsTest

java.lang.Object

ubic.gemma.core.util.test.BaseTest5

ubic.gemma.core.util.test.BaseIntegrationTest5

ubic.gemma.core.util.test.BaseSpringContextTest5

ubic.gemma.persistence.util.AclQueryUtilsTest

public class AclQueryUtilsTest
extends BaseSpringContextTest5

Field Summary

Fields inherited from class BaseSpringContextTest5

arrayDesignPersister, externalDatabaseService, log, persisterHelper, taxonService, testHelper

Constructor Summary

Constructors

Constructor	Description
AclQueryUtilsTest()

Method Summary

Modifier and Type	Method	Description
void	setUp()
void	tearDown()
void	testAddAclJoinParameters()
void	testAsAdmin()
void	testAsAnonymous()
void	testAsUser()
void	testFormAclJoinClauseAsAdmin()
void	testFormAclJoinClauseAsNonAdminIncludesAoiEntriesInnerJointure()
void	testFormNativeRestrictionClause()
void	testFormNativeRestrictionClauseAsAnonymous()
void	testIsPubliclyReadableExpressionIsBoundForAdmin()	The isPublic filter emits AclQueryUtils.formIsPubliclyReadableExpression(String), which declares :aclQueryUtils_aoiClassId for every caller — including an administrator, whose restriction clause is only the (1=1) placeholder.
void	testIsPubliclyReadableExpressionIsBoundForAnonymous()
void	testNative()
void	testNativeAsAnonymous()
void	testNativeAsUser()
void	testSecurableEntitiesNamesAreUnchanged()	Since ACL relies on the class name, and these class names are stored in the database, we must ensure that they are never changed.

Methods inherited from class BaseSpringContextTest5

addTestAnalyses, countRowsInTable, deleteFromTables, getJdbcTemplate, getNewTestPersistentCompleteExpressionExperiment, getTaxon, getTestNonPersistentBioSequence, getTestPersistentArrayDesign, getTestPersistentArrayDesign, getTestPersistentArrayDesign, getTestPersistentBasicExpressionExperiment, getTestPersistentBasicExpressionExperiment, getTestPersistentBibliographicReference, getTestPersistentBioAssay, getTestPersistentBioAssay, getTestPersistentBioMaterial, getTestPersistentBioMaterial, getTestPersistentBioSequence, getTestPersistentBioSequence, getTestPersistentBioSequence2GeneProducts, getTestPersistentBlatResult, getTestPersistentBlatResult, getTestPersistentCompleteExpressionExperiment, getTestPersistentCompleteExpressionExperimentWithSequences, getTestPersistentCompleteExpressionExperimentWithSequences, getTestPersistentContact, getTestPersistentDatabaseEntry, getTestPersistentDatabaseEntry, getTestPersistentDatabaseEntry, getTestPersistentDatabaseEntry, getTestPersistentDatabaseEntry, getTestPersistentExpressionExperiment, getTestPersistentExpressionExperiment, getTestPersistentGene, getTestPersistentGene, getTestPersistentGeneProduct, getTestPersistentQuantitationType, randomName, resetTestCollectionSize, runAsAdmin, runAsAgent, runAsAnonymous, runAsUser, runAsUser, setTestCollectionSize

Methods inherited from class BaseIntegrationTest5

setUpAuthentication, tearDownSecurityContext

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

AclQueryUtilsTest

public AclQueryUtilsTest()

Method Details

setUp

@BeforeEach
public void setUp()

tearDown

@AfterEach
public void tearDown()

testSecurableEntitiesNamesAreUnchanged

@Test
public void testSecurableEntitiesNamesAreUnchanged()

Since ACL relies on the class name, and these class names are stored in the database, we must ensure that they are never changed.

testFormAclJoinClauseAsAdmin

@Test
public void testFormAclJoinClauseAsAdmin()

testFormAclJoinClauseAsNonAdminIncludesAoiEntriesInnerJointure

@Test
public void testFormAclJoinClauseAsNonAdminIncludesAoiEntriesInnerJointure()

testAddAclJoinParameters

@Test
public void testAddAclJoinParameters()

testFormNativeRestrictionClause

@Test
public void testFormNativeRestrictionClause()

testFormNativeRestrictionClauseAsAnonymous

@Test
public void testFormNativeRestrictionClauseAsAnonymous()

testAsAdmin

@Test
public void testAsAdmin()

testAsUser

@Test
public void testAsUser()

testAsAnonymous

@Test
public void testAsAnonymous()

testIsPubliclyReadableExpressionIsBoundForAdmin

@Test
public void testIsPubliclyReadableExpressionIsBoundForAdmin()

The isPublic filter emits AclQueryUtils.formIsPubliclyReadableExpression(String), which declares :aclQueryUtils_aoiClassId for every caller — including an administrator, whose restriction clause is only the (1=1) placeholder. The binding therefore cannot sit behind the admin bypass in AclQueryUtils.addAclParameters(Query, Class).

Before the fix this threw No argument for named parameter ':aclQueryUtils_aoiClassId', which is what /datasets?filter=isPublic returned to every authenticated curator.

testIsPubliclyReadableExpressionIsBoundForAnonymous

@Test
public void testIsPubliclyReadableExpressionIsBoundForAnonymous()

testNative

@Test
public void testNative()

testNativeAsUser

@Test
public void testNativeAsUser()

testNativeAsAnonymous

@Test
public void testNativeAsAnonymous()