test/com/interrupt/bookkeeping/cc/kkell/aauth/TestAAuthentication.java

   1 package com.interrupt.bookkeeping.cc.kkell.aauth;
   2
   3 import java.io.File;
   4 import java.io.UnsupportedEncodingException;
   5 import java.util.Collections;
   6 import java.util.List;
   7 import java.security.MessageDigest;
   8 import java.security.NoSuchAlgorithmException;
   9
  10 import org.apache.log4j.Logger;
  11 import org.jgroups.util.Command;
  12 import org.xmldb.api.DatabaseManager;
  13 import org.xmldb.api.base.Collection;
  14 import org.xmldb.api.base.Database;
  15 import org.xmldb.api.base.XMLDBException;
  16 import org.xmldb.api.modules.CollectionManagementService;
  17
  18 import com.interrupt.bob.base.Bob;
  19 import com.interrupt.bob.base.IBob;
  20 import com.interrupt.bob.base.IVisitor;
  21 import com.interrupt.bookkeeping.AbstractBookkeepingTestCase;
  22 import com.interrupt.bookkeeping.Bookkeeping;
  23 import com.interrupt.bookkeeping.TestGeneral;
  24 import com.interrupt.bookkeeping.cc.bkell.aauth.Aauthentication;
  25 import com.interrupt.bookkeeping.cc.bkell.aauth.GAllowedActions;
  26 import com.interrupt.bookkeeping.cc.bkell.aauth.IAllowedActions;
  27 import com.interrupt.bookkeeping.cc.bkell.command.CreateCommand;
  28 import com.interrupt.bookkeeping.cc.bkell.command.FindVisitor;
  29 import com.interrupt.bookkeeping.cc.bkell.command.GCommand;
  30 import com.interrupt.bookkeeping.exception.AuthorisationException;
  31 import com.interrupt.bookkeeping.exception.SystemException;
  32 import com.interrupt.bookkeeping.system.BookkeepingSystemProperties;
  33 import com.interrupt.bookkeeping.users.GGroup;
  34 import com.interrupt.bookkeeping.users.GGroups;
  35 import com.interrupt.bookkeeping.users.Group;
  36 import com.interrupt.bookkeeping.users.IGroup;
  37 import com.interrupt.bookkeeping.users.IUser;
  38 import com.interrupt.bookkeeping.users.IUserSession;
  39 import com.interrupt.bookkeeping.users.IUsers;
  40 import com.interrupt.bookkeeping.users.User;
  41 import com.interrupt.bookkeeping.users.Users;
  42 import com.interrupt.spittoon.Spittoon;
  43 import com.interrupt.util.TestIdGenerator;
  44 import com.interrupt.util.Util;
  45
  46 import junit.framework.Test;
  47 import junit.framework.TestCase;
  48 import junit.framework.TestSuite;
  49
  50 public class TestAAuthentication extends TestCase {
  51
  52
  53         Logger logger = Logger.getLogger(TestAAuthentication.class);
  54         private Spittoon spittoon = null;
  55         private Bob bob = new Bob();
  56         private IBob loadedAuthorise = null;
  57         private BookkeepingSystemProperties bsproperties = null;
  58         public TestAAuthentication() throws XMLDBException {
  59
  60                 //super();
  61                 this(null);
  62         }
  63         public TestAAuthentication(String name) throws XMLDBException {
  64
  65                 super(name);
  66
  67                 System.getProperties().setProperty(com.interrupt.bob.util.Util.DEF, BookkeepingSystemProperties.instance().getProperty("bob.def"));
  68                 System.getProperties().setProperty(com.interrupt.bob.util.Util.BASE, ".");
  69                 System.getProperties().setProperty(com.interrupt.bob.util.Util.END, ".xml");
  70
  71                 bsproperties = BookkeepingSystemProperties.instance();
  72
  73
  74                 //loadedAuthorise = bob.load(new File("xml/bookkeeping.authorise.xml"), BookkeepingSystemProperties.instance().getProperty("bob.def"));
  75                 loadedAuthorise = bob.load(TestAAuthentication.class.getResourceAsStream("/bookkeeping.authorise.xml"), BookkeepingSystemProperties.instance().getProperty("bob.def"));
  76
  77     }
  78
  79         public void setUp() {
  80
  81                 // xml database will be running locally as part of the unit test suite
  82                 spittoon = new Spittoon();
  83                 spittoon.initialise();
  84                 spittoon.setupRoot();
  85
  86                 /**
  87                  * for some reason the Configure class isn't working
  88                  */
  89                 String axml = Util.loadTextFile("setup.aauthentication.xml");
  90                 String gxml = Util.loadTextFile("setup.groups.xml");
  91
  92                 String axpath = "/system[ @id='main.system' ]";
  93                 logger.debug("Aauthentication XPath["+ axpath +"]");
  94                 String aurl = spittoon.getAauthDbUrl();
  95                 spittoon.createR(aurl, axpath, axml);
  96
  97                 String gxpath = "/system[ @id='main.system' ]";
  98                 logger.debug("Groups XPath["+ gxpath +"]");
  99                 String gurl = spittoon.getGroupsDbUrl();
 100                 spittoon.createR(gurl, gxpath, gxml);
 101
 102
 103         }
 104         public void tearDown() {
 105
 106                 //spittoon.tearDownRoot();
 107         }
 108
 109         public static Test suite() throws XMLDBException {
 110
 111                 TestSuite suite = new TestSuite();
 112
 113                 //** basic authentication functionality
 114                 /*suite.addTest( new TestAAuthentication("testDefaultRootUser") );
 115                 suite.addTest( new TestAAuthentication("testDefaultAllowedActions") );
 116
 117                 suite.addTest( new TestAAuthentication("testAuthenticated") );
 118                 suite.addTest( new TestAAuthentication("testNotAuthenticated") );
 119                 suite.addTest( new TestAAuthentication("testAuthorised") );
 120                 suite.addTest( new TestAAuthentication("testNotAuthorised") );
 121                 suite.addTest( new TestAAuthentication("testAuthorisedButNotAuthenticated") );
 122
 123                 suite.addTest( new TestAAuthentication("testLoadFromDB") );
 124
 125                 suite.addTest( new TestAAuthentication("testAddGroup") );
 126                 suite.addTest( new TestAAuthentication("testAddGroupSetAssociatedBookkeeping") );
 127                 suite.addTest( new TestAAuthentication("testRemoveGroup") );
 128
 129
 130                 suite.addTest( new TestAAuthentication("testAddUserDefaultGroup") );
 131                 suite.addTest( new TestAAuthentication("testRemoveUserDefaultGroup") );
 132
 133                 //** a secondary user tries to join a group
 134                 suite.addTest( new TestAAuthentication("testAddUserToGroup") );
 135                 suite.addTest( new TestAAuthentication("testRemoveUserFromGroup") );
 136                 */
 137
 138                 /*
 139                 //** the default group owner accepts another into their group
 140                 suite.addTest( new TestAAuthentication("testDefaultUserAcceptUserIntoGroup") );
 141                 suite.addTest( new TestAAuthentication("testDefaultUserRejectUserIntoGroup") );
 142
 143                 //** Deals with the actual thread that maintains the sessions
 144                 suite.addTest( new TestAAuthentication("testSessionAuthenticate") );
 145                 suite.addTest( new TestAAuthentication("testSessionTimeout") );
 146                 */
 147
 148                 suite.addTest( new TestAAuthentication("testAddUserDefaultGroup") );
 149                 /*suite.addTest( new TestAAuthentication("testGeneratePasswordHash") );
 150                 suite.addTest( new TestAAuthentication("testAathenticateGeneratePasswordHash") );
 151                 suite.addTest( new TestAAuthentication("testGoodLogin") );
 152                 suite.addTest( new TestAAuthentication("testSessionTimeout") );
 153                 suite.addTest( new TestAAuthentication("testBadLogin") );
 154                 */
 155                 return suite;
 156         }
 157
 158
 159         /********************
 160          *
 161          ********************/
 162         public void testGeneratePasswordHash() throws NoSuchAlgorithmException, UnsupportedEncodingException {
 163
 164                 String password = "sdfib0876-df";
 165                 String passwordComparator = "sdfib0876-df";
 166
 167                 MessageDigest digest = MessageDigest.getInstance("SHA-1");
 168
 169                 digest.reset();
 170                 byte[] input = digest.digest(password.getBytes("UTF-8"));
 171
 172                 digest.reset();
 173                 byte[] inputComparator = digest.digest(passwordComparator.getBytes("UTF-8"));
 174
 175                 String hashString = new String(input);
 176                 String hashStringComparator = new String(inputComparator);
 177
 178                 logger.debug("testGeneratePasswordHash:: hash1["+hashString+"] > hash2["+hashStringComparator+"]");
 179                 assertEquals("The password hashes are generating different values > exp["+hashString+"] / actual["+
 180                                 hashStringComparator+"]", hashString, hashStringComparator);
 181
 182         }
 183         public void testAathenticateGeneratePasswordHash() {
 184
 185                 String password = "sdfib0876-df";
 186                 Aauthentication aauth = new Aauthentication();
 187                 String hash1 = aauth.hashPassword(password);
 188                 String hash2 = aauth.hashPassword(password);
 189                 String hashDiff = aauth.hashPassword("zinger");
 190
 191                 logger.debug("testAathenticateGeneratePasswordHash > hash1["+hash1+"] > hash2["+hash2+"] > hashDiff["+hashDiff+"]");
 192                 assertEquals("Aauthentication is generating DIFFERENT password hashes > exp["+hash1+"] / actual["+
 193                                 hash2+"]", hash1, hash2);
 194
 195                 assertTrue("Aauthentication is generating SAME password hashes > exp["+hash1+"] / actual["+
 196                                 hashDiff+"]", !hash1.equals(hashDiff));
 197         }
 198         public void testGoodLogin() throws XMLDBException, InterruptedException {
 199
 200
 201                 Aauthentication aauthentication = (Aauthentication)spittoon.
 202                         retrieve(spittoon.getAauthDbUrl(),
 203                                         "/system[ @id='main.system' ]/aauthentication[ @id='main.authentication' ]", true);
 204
 205                 logger.debug("loaded Aauthentication ["+ aauthentication +"]");
 206
 207                 IUser user = new User();
 208                 user.setId("root");
 209                 user.setUsername("root");
 210                 user.setPassword("password");
 211                 user.setLogintimeout("2500");
 212
 213                 String authResult = null;
 214                 SystemException ee = null;
 215                 try {
 216                         IUserSession usession = aauthentication.authenticate("webkell", user);
 217                         authResult = usession.getId();
 218                 }
 219                 catch(SystemException e) {
 220                         e.printStackTrace();
 221                         ee = e;
 222                 }
 223
 224                 assertNull("There was a SystemException while authenticating", ee);
 225                 assertNotNull("This should give us a POSITIVE login result", authResult);
 226
 227         }
 228         public void testSessionTimeout() throws XMLDBException, InterruptedException {
 229
 230
 231                 Aauthentication aauthentication = (Aauthentication)spittoon.
 232                         retrieve(spittoon.getAauthDbUrl(),
 233                                         "/system[ @id='main.system' ]/aauthentication[ @id='main.authentication' ]", true);
 234
 235                 logger.debug("loaded Aauthentication ["+ aauthentication +"]");
 236
 237                 IUser user = new User();
 238                 user.setId("root");
 239                 user.setUsername("root");
 240                 user.setPassword("password");
 241                 user.setLogintimeout("2500");
 242
 243                 String authResult = null;
 244                 try {
 245
 246                         IUserSession usession = aauthentication.authenticate("webkell", user);
 247                         authResult = usession.getId();
 248                 }
 249                 catch(SystemException e) {
 250                         e.printStackTrace();
 251                 }
 252
 253
 254                 boolean auth1 = aauthentication.authenticated(user);
 255                 assertTrue("We should still be authenticated if less than 2.5 seconds", auth1);
 256
 257                 /**
 258                  * crude way of waiting for more than 5 seconds for the session to invalidate
 259                  * this object probably won't control the thread monitor, so I need to control time somehow
 260                  */
 261                 for (int i = 0; i < 4000; i++) {
 262                         logger.debug("Waiting for session end...["+i+"]");
 263                 }
 264
 265
 266                 boolean auth2 = aauthentication.authenticated(user);
 267                 assertFalse("We should NOT be authenticated after 2.5 seconds", auth2);
 268
 269         }
 270         public void testBadLogin() throws XMLDBException {
 271
 272                 Aauthentication aauthentication = (Aauthentication)spittoon.
 273                         retrieve(spittoon.getAauthDbUrl(),
 274                                         "/system[ @id='main.system' ]/aauthentication[ @id='main.authentication' ]", true);
 275
 276                 IUser user = new User();
 277                 user.setId("root");
 278                 user.setUsername("root");
 279                 user.setPassword("wrong.password");
 280
 281                 IUserSession usession = aauthentication.authenticate("webkell", user);
 282                 String authResult = usession.getId();
 283                 assertNull("This should give us a NEGATIVE login result",authResult);
 284
 285                 aauthentication.teardown();
 286
 287         }
 288
 289         /********************
 290          *
 291          ********************/
 292
 293
 294         /**
 295          * ensure there is a default 'root' user in the system
 296          */
 297         public void testDefaultRootUser() throws XMLDBException {
 298
 299                 Aauthentication aauthentication = Aauthentication.instance();
 300                 aauthentication.setup();
 301
 302                 String collectionString = bsproperties.getProperty("db.url") + "system/aauthentication/users/";
 303                 logger.debug("TestAauthentication.testDefaultRootUser: collectionString:: " + collectionString);
 304
 305                 User rootUser = null; //(User)spittoon.getDocument(collectionString, "user", "root");
 306
 307                 assertNotNull("rootUser is null", rootUser);
 308                 assertEquals("rootUser id is WRONG", rootUser.getId(), "root");
 309
 310                 //** TEARDOWN
 311                 //spittoon.removeCollection("xmldb:exist://localhost:8090/exist/xmlrpc/db/bookkeeping/system/users/");
 312                 aauthentication.teardown();
 313
 314         }
 315
 316         public void testDefaultAllowedActions() throws XMLDBException {
 317
 318                 //** SETUP
 319                 // put a default '/aauthentication/users/user/allowedActions' in the xml database
 320                 Aauthentication aauthentication = Aauthentication.instance();
 321                 aauthentication.setup();
 322
 323                 String collectionString = bsproperties.getProperty("db.url") + "system/aauthentication/users/";
 324
 325                 IUsers rootUsers = null;        //(IUsers)spittoon.getDocument(collectionString, "users", "aauth.users");
 326                 IAllowedActions rootAllowedActions = (IAllowedActions)rootUsers.find("allowedActions", "root.allowedActions");
 327
 328                 assertNotNull("allowedActions is null", rootAllowedActions);
 329                 assertEquals("allowedActions id is WRONG", rootAllowedActions.getId(), "root.allowedActions");
 330
 331                 //** TEARDOWN
 332                 aauthentication.teardown();
 333
 334         }
 335
 336         /**
 337          * 1. login
 338          * 2. tests that after a good login, that the user's session is maintained
 339          */
 340         public void testAuthenticated() throws XMLDBException {
 341
 342                 Aauthentication aauthentication = Aauthentication.instance();
 343                 aauthentication.setup();
 344                 aauthentication.initialise();
 345
 346                 IUser user = new User();
 347                 user.setId("root");
 348                 user.setUsername("root");
 349                 user.setPassword("password");
 350                 user.setLogintimeout("60000");
 351
 352                 aauthentication.authenticate("webkell", user);
 353                 boolean authResult = aauthentication.authenticated(user);
 354                 assertTrue("We SHOULD be authenticated after logging in", authResult);
 355
 356                 aauthentication.teardown();
 357
 358         }
 359
 360         /**
 361          * 1. login
 362          * 2. test logged in
 363          * 3. log a person out and then test if they are authenticated
 364          */
 365         public void testNotAuthenticated() throws XMLDBException {
 366
 367                 Aauthentication aauthentication = Aauthentication.instance();
 368                 aauthentication.setup();
 369                 aauthentication.initialise();
 370
 371                 IUser user = new User();
 372                 user.setId("root");
 373                 user.setUsername("root");
 374                 user.setPassword("password");
 375                 user.setLogintimeout("60000");
 376
 377                 aauthentication.authenticate("webkell", user);
 378                 boolean authResult = aauthentication.authenticated(user);
 379                 assertTrue("Part 1. We SHOULD be authenticated after logging in", authResult);
 380
 381                 aauthentication.logout(user);
 382                 boolean authResult2 = aauthentication.authenticated(user);
 383                 assertFalse("Part 2. We SHOULD NOT be authenticated at this point", authResult2);
 384
 385                 aauthentication.teardown();
 386
 387         }
 388
 389
 390         /**
 391          * 1. login
 392          * 2. make the user perform an action for which they are authorised
 393          */
 394         public void testAuthorised() {
 395
 396                 Aauthentication aauthentication = Aauthentication.instance();
 397                 aauthentication.setup();
 398                 aauthentication.initialise();
 399
 400                 IUser user = new User();
 401                 user.setId("root");
 402                 user.setUsername("root");
 403                 user.setPassword("password");
 404                 user.setLogintimeout("60000");
 405
 406                 aauthentication.authenticate("webkell", user);
 407                 boolean authResult = aauthentication.authenticated(user);
 408                 assertTrue("Part 1. We SHOULD be authenticated after logging in", authResult);
 409
 410                 CreateCommand ccommand = new CreateCommand();
 411                 boolean authorised = aauthentication.authorised(user, ccommand);
 412                 assertTrue("we SHOULD be authorised at this point", authorised);
 413
 414         }
 415
 416
 417         /**
 418          * 1. login
 419          * 2. make the user perform an action for which they are NOT authorised
 420          */
 421         public void testNotAuthorised() {
 422
 423                 Aauthentication aauthentication = Aauthentication.instance();
 424                 aauthentication.setup();
 425                 aauthentication.initialise();
 426
 427                 IUser user = new User();
 428                 user.setId("root");
 429                 user.setUsername("root");
 430                 user.setPassword("password");
 431                 user.setLogintimeout("60000");
 432
 433                 aauthentication.authenticate("webkell", user);
 434                 boolean authResult = aauthentication.authenticated(user);
 435                 assertTrue("Part 1. We SHOULD be authenticated after logging in", authResult);
 436
 437                 class StubCommand extends GCommand {
 438                         public StubCommand() {
 439                                 this.setName("stub");
 440                         }
 441                 }
 442
 443                 StubCommand scommand = new StubCommand();
 444                 boolean authorised = aauthentication.authorised(user, scommand);
 445                 assertFalse("we SHOULD NOT be authorised", authorised);
 446
 447         }
 448
 449
 450         /**
 451          * 1. login
 452          * 2. test logged in
 453          * 3. logout
 454          * 4. make a user perform and action for which they are authorised
 455          */
 456         public void testAuthorisedButNotAuthenticated() {
 457
 458                 Aauthentication aauthentication = Aauthentication.instance();
 459                 aauthentication.setup();
 460                 aauthentication.initialise();
 461
 462                 IUser user = new User();
 463                 user.setId("root");
 464                 user.setUsername("root");
 465                 user.setPassword("password");
 466                 user.setLogintimeout("60000");
 467
 468                 aauthentication.authenticate("webkell", user);
 469                 boolean authResult = aauthentication.authenticated(user);
 470                 assertTrue("Part 1. We SHOULD be authenticated after logging in", authResult);
 471
 472                 aauthentication.logout(user);
 473                 boolean afterLogout = aauthentication.authenticated(user);
 474                 assertFalse("Part 2. We SHOULD NOT be authenticated here", afterLogout );
 475
 476                 CreateCommand ccommand = new CreateCommand();
 477                 boolean authorised = aauthentication.authorised(user, ccommand);
 478                 assertFalse("we SHOULD be authorised at this point", authorised);
 479
 480         }
 481
 482
 483         public void testLoadFromDB() {
 484
 485                 //Spittoon.instance().installDelete();
 486                 //Spittoon.instance().installCreate();
 487
 488                 Aauthentication aauth = Aauthentication.instance();
 489                 aauth.initialise();
 490
 491                 GGroups agroups = (GGroups)aauth.find("groups", "aauth.groups");
 492                 Users ausers = (Users)aauth.find("users", "aauth.users");
 493
 494                 assertNotNull("'aauth.groups' SHOULD have been loaded from the DB", agroups);
 495                 assertNotNull("'aauth.users' SHOULD have been loaded from the DB", ausers);
 496
 497         }
 498
 499         public void testAddGroup() {
 500
 501                 Aauthentication aauth = Aauthentication.instance();
 502                 Group groupStartingPoint =
 503                         (Group)bob.load(
 504                                 TestAAuthentication.class.getResourceAsStream("/add.usergroup.xml"), BookkeepingSystemProperties.instance().getProperty("bob.def"));
 505
 506
 507                 // 1. ensure there is an owner reference
 508                 Group groupTrial1 = groupStartingPoint;
 509                 groupTrial1.setOwner(null);
 510                 AuthorisationException e1 = null;
 511                 try { aauth.addGroup(groupTrial1); }
 512                 catch(AuthorisationException e) { e1 = e; }
 513                 assertNotNull("an AuthorisationException SHOULD be thrown when there's no 'owner' reference to a user in the group", e1);
 514
 515
 516                 // 2. ensure there is not another group with the same name
 517                 Group duplicateGroup = new Group();
 518                 duplicateGroup.setId("testuser.group");
 519                 duplicateGroup.setName("testuser.group");
 520                 duplicateGroup.setOwner("root");
 521                 aauth.addGroup(duplicateGroup);
 522
 523                 Group groupTrial2 = groupStartingPoint;
 524                 AuthorisationException e2 = null;
 525                 try { aauth.addGroup(groupTrial2); }
 526                 catch(AuthorisationException e) { e2 = e; }
 527                 assertNotNull("an AuthorisationException SHOULD be thrown when there's a duplicate group", e2);
 528
 529
 530                 // 3. ensure that owner reference user in the group actually exists as a regular user
 531                 Group groupTrial3 = groupStartingPoint;
 532                 groupTrial3.setOwner("nonexistant.user");
 533                 AuthorisationException e3 = null;
 534                 try { aauth.addGroup(groupTrial3); }
 535                 catch(AuthorisationException e) { e3 = e; }
 536                 assertNotNull("an AuthorisationException SHOULD be thrown when the owner is set to  non-existant user", e3);
 537
 538         }
 539
 540         public void testAddGroupSetAssociatedBookkeeping() {
 541
 542                 // 1. ** add a 'group' entry in the 'groups' directory with an empty 'bookkeeping'
 543                 //Spittoon.instance().installInitialise();
 544                 //Spittoon.instance().installDelete();
 545                 //Spittoon.instance().installCreate();
 546
 547
 548                 // 2. load the group to add
 549                 Group groupStartingPoint =
 550                         (Group)bob.load(
 551                                 TestAAuthentication.class.getResourceAsStream("/add.usergroup.xml"),
 552                                         BookkeepingSystemProperties.instance().getProperty("bob.def"));
 553
 554                 com.interrupt.bookkeeping.System system = new com.interrupt.bookkeeping.System();
 555                 system.initialise();
 556
 557
 558                 this.setupTestUser();
 559
 560                 // 3. make the call to add the group
 561                 system.addGroupSetAssociatedBookkeeping(groupStartingPoint);
 562
 563                 Group newGroup = (Group)system.getGroups().find("group", groupStartingPoint.getId());
 564                 assertNotNull("There SHOULD be a new group 'testuser.group'", newGroup);
 565                 assertNotNull("There new group SHOULD have an id of 'testuser.group'", "testuser.group");
 566
 567                 Bookkeeping bookkeeping = (Bookkeeping)newGroup.findBookkeepingById("main.bookkeeping");
 568                 assertNotNull("There SHOULD be the default set of books 'main.bookkeeping'", bookkeeping);
 569
 570
 571                 //** Spittoon should take a random Bob object and persist it.
 572                 // The said object should instruct Spittoon how to persist
 573                 //Spittoon.instance().update(system);
 574
 575                 String dburl = BookkeepingSystemProperties.instance().getProperty("db.url");
 576                 Group aauthGroup = null; //(Group)Spittoon.instance().getDocument(dburl + "system/aauthentication/groups", "group", groupStartingPoint.getId());
 577                 Group mainGroup = null; //(Group)Spittoon.instance().getDocument(dburl + "system/groups", "group", groupStartingPoint.getId());
 578                 assertNotNull("new group in aauthentication collection is NULL", aauthGroup);
 579                 //assertNotNull("new group in groups collection is NULL", mainGroup);
 580                 /**/
 581
 582         }
 583
 584         public void testRemoveGroup() {
 585
 586                 // initialise Spittoon and System
 587                 //Spittoon.instance().installInitialise();
 588                 //Spittoon.instance().installDelete();
 589                 //Spittoon.instance().installCreate();
 590                 com.interrupt.bookkeeping.System system = new com.interrupt.bookkeeping.System();
 591                 system.initialise();
 592
 593
 594                 // load and add the test group
 595                 this.setupTestUser();
 596                 Group groupStartingPoint =
 597                         (Group)bob.load(
 598                                 TestAAuthentication.class.getResourceAsStream("/add.usergroup.xml"),
 599                                         BookkeepingSystemProperties.instance().getProperty("bob.def"));
 600                 system.addGroupSetAssociatedBookkeeping(groupStartingPoint);
 601
 602
 603                 User testUser1 = (User)Bob.loadS(
 604                         "<user xmlns='com/interrupt/bookkeeping/users' id='testuser1' username='testuser1' password='password' />",
 605                                 BookkeepingSystemProperties.instance().getProperty("bob.def"));
 606                 User testUser2 = (User)Bob.loadS(
 607                         "<user xmlns='com/interrupt/bookkeeping/users' id='testuser2' username='testuser2' password='password' />",
 608                                 BookkeepingSystemProperties.instance().getProperty("bob.def"));
 609                 String testGroupId = "testuser.group";
 610
 611
 612                 // add user(s) to the system
 613                 AddUserToGroupVisitor auvisitor = new AddUserToGroupVisitor();
 614                 auvisitor.groupid = testGroupId;
 615                 auvisitor.userToAdd = testUser1;
 616                 system.getAauthentication().accept(auvisitor);
 617
 618                 auvisitor.done = false;
 619                 auvisitor.userToAdd = testUser2;
 620                 system.getAauthentication().accept(auvisitor);
 621
 622
 623                 // 1. ensure there are no more users besides the default user before deleting
 624                 // 2. move group / bookkeeping data to a removed folder for future reference
 625                 AuthorisationException ee = null;
 626                 try {
 627                         system.getAauthentication().removeGroup(testGroupId);
 628                 }
 629                 catch(AuthorisationException e) {
 630                         ee = e;
 631                 }
 632                 assertNotNull("more than 1 default user in group - There SHOULD have been an 'AuthorisationException'", ee);
 633
 634
 635                 // remove the extra test user
 636                 RemoveUserFromGroupVisitor ruvisitor = new RemoveUserFromGroupVisitor();
 637                 ruvisitor.groupid = testGroupId;
 638                 ruvisitor.userToRemove = testUser2;
 639                 system.getAauthentication().accept(ruvisitor);
 640
 641                 // now removing groups should work
 642                 AuthorisationException e2 = null;
 643                 try {
 644                         system.getAauthentication().removeGroup(testGroupId);
 645                 }
 646                 catch(AuthorisationException e) {
 647                         e2 = e;
 648                 }
 649                 assertNull("1 default user in group - There should be NO 'AuthorisationException'", e2);
 650
 651         }
 652
 653
 654         /**
 655          * These methods will pretty much take the abouve methods and wrap adding a user around them.
 656          * The group id, name and owner should correspond with the user's
 657          */
 658         public void testAddUserDefaultGroup() {
 659
 660                 com.interrupt.bookkeeping.System system = new com.interrupt.bookkeeping.System();
 661                 system.setSpittoon(spittoon);
 662                 system.initialise();
 663
 664                 User userStartingPoint =
 665                         (User)bob.load(
 666                                 TestAAuthentication.class.getResourceAsStream("/add.user.xml"),
 667                                         BookkeepingSystemProperties.instance().getProperty("bob.def"));
 668
 669
 670                 //** 1. ensure that there's not duplicate user id
 671                 User userTry1 = userStartingPoint;
 672                 userTry1.setId("root");
 673                 AuthorisationException ee = null;
 674                 try {
 675                         system.getAauthentication().addUser(userTry1);
 676                 }
 677                 catch(AuthorisationException e) {
 678                         ee = e;
 679                 }
 680                 assertNotNull("There SHOULD be an exception if there's a duplicate User 'id' or 'name'", ee);
 681
 682
 683                 //** 2. test that the user was added to the XML DB
 684                 userStartingPoint.setId("testuser");
 685                 AuthorisationException e2 = null;
 686                 try {
 687
 688                         system.getAauthentication().addUser(userStartingPoint);
 689                 }
 690                 catch(AuthorisationException e) {
 691                         e.printStackTrace();
 692                         e2 = e;
 693                 }
 694
 695                 String adburl = spittoon.getAauthDbUrl();
 696                 String axpath = "/system[ @id='main.system' ]/aauthentication[ @id='main.authentication' ]/users[ @id='aauth.users' ]/user[ @id='testuser' ]";
 697                 User aauthUser = (User)spittoon.retrieve(adburl, axpath, false);
 698
 699                 String message = null;
 700                 if(e2 != null)
 701                         message = e2.getMessage();
 702                 assertNull("There should NOT be any exception when adding a unique user / message["+ message +"]", e2);
 703                 assertNotNull("The test user was NOT added to the database", aauthUser);
 704
 705
 706                 //** 3. test that there's a default group associated with new user
 707                 String gxpath = "/system[ @id='main.system' ]/aauthentication[ @id='main.authentication' ]/groups[ @id='aauth.groups' ]/group[ @id='testuser.group' ]";
 708                 Group aauthGroup = (Group)spittoon.retrieve(adburl, gxpath, false);
 709
 710                 assertNotNull("There SHOULD be an associated group with this new user", aauthGroup);
 711                 assertEquals("The group id SHOULD be 'testuser.group'", "testuser.group", aauthGroup.getId());
 712
 713                 // 4 test that there's a default associated group with with associated bookkeeping
 714                 Group aauthGroupBK = null;
 715                         //(Group)Spittoon.instance().getDocument(dburl + "system/groups",
 716                                 //"group", userStartingPoint.getId() + ".group");
 717                 assertNotNull("There SHOULD be an associated group/bookkeeping with this new user", aauthGroup);
 718                 assertEquals("The group/bookkeeping id SHOULD be 'testuser.group'", "testuser.group", aauthGroup.getId());
 719
 720         }
 721
 722
 723         /**
 724          * should be a fairly easy job of i) removing the group (with its checks and balances),
 725          * then ii) removing the owning user.
 726          */
 727         public void testRemoveUserDefaultGroup() {
 728
 729                 //Spittoon.instance().installInitialise();
 730                 //Spittoon.instance().installDelete();
 731                 //Spittoon.instance().installCreate();
 732
 733                 com.interrupt.bookkeeping.System system = new com.interrupt.bookkeeping.System();
 734                 system.initialise();
 735
 736                 User userStartingPoint =
 737                         (User)bob.load(
 738                                 TestAAuthentication.class.getResourceAsStream("/add.user.xml"),
 739                                         BookkeepingSystemProperties.instance().getProperty("bob.def"));
 740                 system.getAauthentication().addUser(userStartingPoint);
 741                 //Spittoon.instance().update(system);
 742
 743
 744                 system.getAauthentication().removeUser(userStartingPoint.getId());
 745                 //Spittoon.instance().update(system);
 746
 747
 748                 String dburl = BookkeepingSystemProperties.instance().getProperty("db.url");
 749                 String testGroupName = userStartingPoint.getId() + ".group";
 750
 751                 User testUser = null;
 752                         //(User)Spittoon.instance().getDocument(dburl + "system/aauthentication/users",
 753                                 //"user", userStartingPoint.getId());
 754                 Group testGroup = null;
 755                         //(Group)Spittoon.instance().getDocument(dburl + "system/aauthentication/groups",
 756                                 //"group", testGroupName);
 757                 Group testGroupBK = null;
 758                         //(Group)Spittoon.instance().getDocument(dburl + "system/groups",
 759                                 //"group", testGroupName);
 760
 761                 assertNull("There should be NO user 'testuser' in system/aauthentication/users/", testUser);
 762                 assertNull("There should be NO group 'testuser.group' in system/aauthentication/groups/", testGroup);
 763                 assertNull("There should be NO group 'testuser.group' in system/groups/", testGroupBK);
 764
 765         }
 766
 767
 768         public void testAddUserToGroup() {
 769
 770                 //Spittoon.instance().installInitialise();
 771                 //Spittoon.instance().installDelete();
 772                 //Spittoon.instance().installCreate();
 773
 774                 com.interrupt.bookkeeping.System system = new com.interrupt.bookkeeping.System();
 775                 system.initialise();
 776
 777
 778                 // 1. add a second user
 779                 User userStartingPoint =
 780                         (User)bob.load(
 781                                 TestAAuthentication.class.getResourceAsStream("/add.user.xml"),
 782                                         BookkeepingSystemProperties.instance().getProperty("bob.def"));
 783                 system.addUser(userStartingPoint);
 784                 //Spittoon.instance().update(system);
 785
 786
 787                 // 2. add an alternative group
 788                 Group groupStartingPoint =
 789                         (Group)bob.load(
 790                                 TestAAuthentication.class.getResourceAsStream("/add.group.xml"), BookkeepingSystemProperties.instance().getProperty("bob.def"));
 791                 system.addGroup(groupStartingPoint);
 792
 793
 794                 // 3. add the user to the group
 795                 system.getAauthentication().addUserToGroup(groupStartingPoint.getId(), userStartingPoint);
 796                 //Spittoon.instance().update(system);
 797
 798
 799                 //** assert user is in group, in DB
 800                 String dburl = BookkeepingSystemProperties.instance().getProperty("db.url");
 801                 User resultUser = null;
 802                         //(User)Spittoon.instance().getDocument(dburl + "system/aauthentication/groups",
 803                                 //"user", userStartingPoint.getId());
 804                 assertNotNull("The user SHOULD exist in the group", resultUser);
 805                 assertEquals("The user id SHOULD be 'testuser'", userStartingPoint.getId(), resultUser.getId());
 806
 807
 808                 //** assert user is in group, in memory
 809                 Group memGroup = (Group)system.getAauthentication().getGroups().findGroupById(groupStartingPoint.getId());
 810                 User memUser = (User)memGroup.findUserById(userStartingPoint.getId());
 811                 assertNotNull("The user (in memory) SHOULD exist in the group", memUser);
 812                 assertEquals("The user id (in memory) SHOULD be 'testuser'", userStartingPoint.getId(), memUser.getId());
 813
 814         }
 815         public void testRemoveUserFromGroup() {
 816
 817                 //Spittoon.instance().installInitialise();
 818                 //Spittoon.instance().installDelete();
 819                 //Spittoon.instance().installCreate();
 820
 821                 com.interrupt.bookkeeping.System system = new com.interrupt.bookkeeping.System();
 822                 system.initialise();
 823
 824                 // 1. add a second user
 825                 User userStartingPoint =
 826                         (User)bob.load(
 827                                 TestAAuthentication.class.getResourceAsStream("/add.user.xml"),
 828                                         BookkeepingSystemProperties.instance().getProperty("bob.def"));
 829                 system.addUser(userStartingPoint);
 830                 //Spittoon.instance().update(system);
 831
 832                 // 2. add an alternative group
 833                 Group groupStartingPoint =
 834                         (Group)bob.load(
 835                                 TestAAuthentication.class.getResourceAsStream("/add.group.xml"), BookkeepingSystemProperties.instance().getProperty("bob.def"));
 836                 system.addGroup(groupStartingPoint);
 837                 //Spittoon.instance().update(system);
 838
 839
 840
 841                 // TESTs
 842                 //** passing in a non-existant groupid
 843                 AuthorisationException e1 = null;
 844                 try {
 845                         system.getAauthentication().removeUserFromGroup("non.existent.group", userStartingPoint.getId());
 846                 }
 847                 catch(AuthorisationException e) {
 848                         e1 = e;
 849                 }
 850                 assertNotNull("There SHOULD be an error here as there is no 'non.existent.group'", e1);
 851
 852
 853                 //** passing in a non-existant userid
 854                 AuthorisationException e2 = null;
 855                 try {
 856                         system.getAauthentication().removeUserFromGroup(groupStartingPoint.getId(), "non.existent.user");
 857                 }
 858                 catch(AuthorisationException e) {
 859                         e2 = e;
 860                 }
 861                 assertNotNull("There SHOULD be an error here as there is no 'non.existent.user'", e2);
 862
 863
 864                 //** trying to remove a user not in the group, should throw an exception
 865                 AuthorisationException e3 = null;
 866                 try {
 867                         system.getAauthentication().removeUserFromGroup(groupStartingPoint.getId(), userStartingPoint.getId());
 868                 }
 869                 catch(AuthorisationException e) {
 870                         e3 = e;
 871                 }
 872                 assertNotNull("There SHOULD be an error here as the 'testuser' isn't yet in the 'alternative.group'", e3);
 873
 874
 875                 // 3. add the user to the group
 876                 system.getAauthentication().addUserToGroup(groupStartingPoint.getId(), userStartingPoint);
 877                 //Spittoon.instance().update(system);
 878
 879
 880                 system.getAauthentication().removeUserFromGroup(groupStartingPoint.getId(), userStartingPoint.getId());
 881                 User finalUser = (User)system.getAauthentication().getGroups().findGroupById(groupStartingPoint.getId()).findUserById(userStartingPoint.getId());
 882                 assertNull("The removed user should NOT be in the group", finalUser);
 883
 884         }
 885
 886
 887         /**
 888          * a utility method to add a test user to the system
 889          */
 890         public void setupTestUser() {
 891
 892                 User testUser = (User)Bob.loadS(
 893                         "<user xmlns='com/interrupt/bookkeeping/users' id='testuser' username='testuser' password='password' />",
 894                                 BookkeepingSystemProperties.instance().getProperty("bob.def"));
 895
 896                 // 3. i. get aauth users from DB, ii. add test user and iii. persist to DB
 897                 String dburl = BookkeepingSystemProperties.instance().getProperty("db.url");
 898                 Users aauthUsers = null; //(Users)Spittoon.instance().getDocument(dburl + "system/aauthentication/users/", "users", "aauth.users");
 899                 aauthUsers.addUser(testUser);
 900                 //Spittoon.instance().updateDocument(
 901                         //dburl + "system/aauthentication/users/",
 902                                 //aauthUsers.getTagName(), aauthUsers.getId(), aauthUsers);
 903
 904         }
 905
 906         /**
 907          * utility classes to add and remove user(s) to/from a group
 908          * they are meant to work at depth
 909          */
 910         class AddUserToGroupVisitor implements IVisitor {
 911                 public String groupid = "";
 912                 public User userToAdd = null;
 913                 public boolean done = false;
 914                 public void visit(IBob bob) {
 915
 916                         if(!done) {
 917                                 if(     bob.getTagName().equals("group") &&
 918                                         bob.getAttributes().getValue("id").equals(groupid)) {
 919                                         ((Group)bob).addUser(userToAdd);
 920                                         done = true;
 921                                 }
 922                         }
 923                 }
 924         }
 925         class RemoveUserFromGroupVisitor implements IVisitor {
 926                 public String groupid = "";
 927                 public User userToRemove = null;
 928                 public boolean done = false;
 929                 public void visit(IBob bob) {
 930
 931                         if(!done) {
 932                                 if(     bob.getTagName().equals("group") &&
 933                                         bob.getAttributes().getValue("id").equals(groupid)) {
 934                                         ((Group)bob).removeUserById(userToRemove.getId());
 935                                         done = true;
 936                                 }
 937                         }
 938                 }
 939         }
 940
 941 }
 942
 943