From 282d5a51df1cf66512ac499a636b094e9e94d33f Mon Sep 17 00:00:00 2001 From: IamMujuziMoses Date: Thu, 4 Jul 2024 21:23:47 +0300 Subject: [PATCH] RESTWS-946: /session endpoint throws an error if user doesn't have Get Providers privilege --- .../openmrs2_0/SessionController2_0.java | 12 +++--- .../openmrs2_0/SessionController2_0Test.java | 37 ++++++++++++++----- .../sessionControllerTestDataset.xml | 8 ++++ 3 files changed, 43 insertions(+), 14 deletions(-) rename omod-1.9/src/main/java/org/openmrs/module/webservices/rest/web/v1_0/controller/openmrs1_9/SessionController1_9.java => omod-2.0/src/main/java/org/openmrs/module/webservices/rest/web/v1_0/controller/openmrs2_0/SessionController2_0.java (93%) rename omod-1.9/src/test/java/org/openmrs/module/webservices/rest/web/v1_0/controller/openmrs1_9/SessionController1_9Test.java => omod-2.0/src/test/java/org/openmrs/module/webservices/rest/web/v1_0/controller/openmrs2_0/SessionController2_0Test.java (86%) create mode 100644 omod-2.0/src/test/resources/sessionControllerTestDataset.xml diff --git a/omod-1.9/src/main/java/org/openmrs/module/webservices/rest/web/v1_0/controller/openmrs1_9/SessionController1_9.java b/omod-2.0/src/main/java/org/openmrs/module/webservices/rest/web/v1_0/controller/openmrs2_0/SessionController2_0.java similarity index 93% rename from omod-1.9/src/main/java/org/openmrs/module/webservices/rest/web/v1_0/controller/openmrs1_9/SessionController1_9.java rename to omod-2.0/src/main/java/org/openmrs/module/webservices/rest/web/v1_0/controller/openmrs2_0/SessionController2_0.java index e19e6d1fd..85c8bf1dd 100644 --- a/omod-1.9/src/main/java/org/openmrs/module/webservices/rest/web/v1_0/controller/openmrs1_9/SessionController1_9.java +++ b/omod-2.0/src/main/java/org/openmrs/module/webservices/rest/web/v1_0/controller/openmrs2_0/SessionController2_0.java @@ -7,7 +7,7 @@ * Copyright (C) OpenMRS Inc. OpenMRS is a registered trademark and the OpenMRS * graphic logo is a trademark of OpenMRS Inc. */ -package org.openmrs.module.webservices.rest.web.v1_0.controller.openmrs1_9; +package org.openmrs.module.webservices.rest.web.v1_0.controller.openmrs2_0; import org.apache.commons.lang3.LocaleUtils; import org.openmrs.Location; @@ -48,9 +48,9 @@ */ @Controller @RequestMapping(value = "/rest/" + RestConstants.VERSION_1 + "/session") -public class SessionController1_9 extends BaseRestController { +public class SessionController2_0 extends BaseRestController { - private static final Logger log = LoggerFactory.getLogger(SessionController1_9.class); + private static final Logger log = LoggerFactory.getLogger(SessionController2_0.class); public static final String USER_CUSTOM_REP = "(uuid,display,username,systemId,userProperties,person:(uuid,display),privileges:(uuid,display,name),roles:(uuid,display,name),links)"; @@ -138,13 +138,15 @@ private Provider getCurrentProvider() { if (currentUser != null) { Collection providers = new HashSet(); try { - Context.addProxyPrivilege(PrivilegeConstants.VIEW_PROVIDERS); + Context.addProxyPrivilege(PrivilegeConstants.GET_PROVIDERS); + Context.addProxyPrivilege("View Providers"); // support later versions of OpenMRS if (currentUser.getPerson() != null) { providers = Context.getProviderService().getProvidersByPerson(currentUser.getPerson(), false); } } finally { - Context.removeProxyPrivilege(PrivilegeConstants.VIEW_PROVIDERS); + Context.removeProxyPrivilege(PrivilegeConstants.GET_PROVIDERS); + Context.removeProxyPrivilege("View Providers"); // support later versions of OpenMRS } if (providers.size() > 1) { log.warn("Can't handle users with multiple provider accounts"); diff --git a/omod-1.9/src/test/java/org/openmrs/module/webservices/rest/web/v1_0/controller/openmrs1_9/SessionController1_9Test.java b/omod-2.0/src/test/java/org/openmrs/module/webservices/rest/web/v1_0/controller/openmrs2_0/SessionController2_0Test.java similarity index 86% rename from omod-1.9/src/test/java/org/openmrs/module/webservices/rest/web/v1_0/controller/openmrs1_9/SessionController1_9Test.java rename to omod-2.0/src/test/java/org/openmrs/module/webservices/rest/web/v1_0/controller/openmrs2_0/SessionController2_0Test.java index 5ff929b84..8b5bc3e92 100644 --- a/omod-1.9/src/test/java/org/openmrs/module/webservices/rest/web/v1_0/controller/openmrs1_9/SessionController1_9Test.java +++ b/omod-2.0/src/test/java/org/openmrs/module/webservices/rest/web/v1_0/controller/openmrs2_0/SessionController2_0Test.java @@ -7,7 +7,7 @@ * Copyright (C) OpenMRS Inc. OpenMRS is a registered trademark and the OpenMRS * graphic logo is a trademark of OpenMRS Inc. */ -package org.openmrs.module.webservices.rest.web.v1_0.controller.openmrs1_9; +package org.openmrs.module.webservices.rest.web.v1_0.controller.openmrs2_0; import org.apache.commons.beanutils.PropertyUtils; import org.codehaus.jackson.map.ObjectMapper; @@ -16,6 +16,7 @@ import org.junit.Test; import org.openmrs.GlobalProperty; import org.openmrs.Location; +import org.openmrs.User; import org.openmrs.api.APIException; import org.openmrs.api.context.Context; import org.openmrs.util.OpenmrsConstants; @@ -23,15 +24,14 @@ import org.springframework.mock.web.MockHttpServletRequest; import org.springframework.mock.web.MockHttpSession; import org.springframework.mock.web.MockServletContext; -import org.springframework.web.context.request.ServletWebRequest; -import org.springframework.web.context.request.WebRequest; import javax.servlet.http.HttpServletRequest; import java.util.HashMap; import java.util.List; import java.util.Locale; -public class SessionController1_9Test extends BaseModuleWebContextSensitiveTest { +@SuppressWarnings("unchecked") +public class SessionController2_0Test extends BaseModuleWebContextSensitiveTest { private static final String SESSION_ID = "test-session-id"; @@ -39,13 +39,13 @@ public class SessionController1_9Test extends BaseModuleWebContextSensitiveTest private static final String XANADU_UUID = "9356400c-a5a2-4532-8f2b-2361b3446eb8"; // Xanadu - private SessionController1_9 controller; + private SessionController2_0 controller; private HttpServletRequest hsr; @Before public void before() { - controller = Context.getRegisteredComponents(SessionController1_9.class).iterator().next(); // should only be 1 + controller = Context.getRegisteredComponents(SessionController2_0.class).iterator().next(); // should only be 1 MockHttpServletRequest mockHsr = new MockHttpServletRequest(); mockHsr.setSession(new MockHttpSession(new MockServletContext(), SESSION_ID)); hsr = mockHsr; @@ -56,7 +56,7 @@ public void before() { } /** - * @see SessionController1_9#delete(HttpServletRequest) + * @see SessionController2_0#delete(HttpServletRequest) * @verifies log the client out */ @Test @@ -68,7 +68,7 @@ public void delete_shouldLogTheClientOut() throws Exception { } /** - * @see SessionController1_9#get() + * @see SessionController2_0#get() * @verifies return the session id if the user is authenticated */ @Test @@ -105,7 +105,7 @@ public void get_shouldReturnLocationIfTheUserIsAuthenticated() throws Exception } /** - * @see SessionController1_9#get() + * @see SessionController2_0#get() * @verifies return the session with current provider if the user is authenticated */ @Test @@ -169,4 +169,23 @@ public void post_shouldFailWhenSettingNonexistantLocation() throws Exception { String content = "{\"sessionLocation\":\"fake-nonexistant-uuid\"}"; controller.post(hsr, new ObjectMapper().readValue(content, HashMap.class)); } + + /** + * @see SessionController2_0#get() + * @verifies return the session with current provider if the user doesn't have Get Providers privileges + */ + @Test + public void get_shouldReturnCurrentProviderIfTheUserDoesNotHaveGetProvidersPrivileges() throws Exception { + executeDataSet("sessionControllerTestDataset.xml"); + + // authenticate new user without privileges + Context.logout(); + Context.authenticate("test_user", "test"); + Assert.assertTrue(Context.isAuthenticated()); + + Object ret = controller.get(); + Object currentProvider = PropertyUtils.getProperty(ret, "currentProvider"); + Assert.assertNotNull(currentProvider); + Assert.assertTrue(currentProvider.toString().contains("Test Provider")); + } } diff --git a/omod-2.0/src/test/resources/sessionControllerTestDataset.xml b/omod-2.0/src/test/resources/sessionControllerTestDataset.xml new file mode 100644 index 000000000..bbe423784 --- /dev/null +++ b/omod-2.0/src/test/resources/sessionControllerTestDataset.xml @@ -0,0 +1,8 @@ + + + + + + + + \ No newline at end of file