diff --git a/qqq-backend-core/src/main/java/com/kingsrook/qqq/backend/core/model/session/QSession.java b/qqq-backend-core/src/main/java/com/kingsrook/qqq/backend/core/model/session/QSession.java index 56414e1a..ac2e313a 100644 --- a/qqq-backend-core/src/main/java/com/kingsrook/qqq/backend/core/model/session/QSession.java +++ b/qqq-backend-core/src/main/java/com/kingsrook/qqq/backend/core/model/session/QSession.java @@ -48,6 +48,7 @@ public class QSession implements Serializable private String uuid; private Set permissions; + private Map> securityKeyValues; private Map backendVariants; @@ -337,15 +338,10 @@ public class QSession implements Serializable /******************************************************************************* - ** Fluent setter for securityKeyValues - add a list of values for 1 key + ** Fluent setter for securityKeyValues - add 1 value for 1 key. *******************************************************************************/ - public QSession withSecurityKeyValues(String keyName, List values) + public QSession withSecurityKeyValue(String keyName, Serializable value) { - if(values == null) - { - return (this); - } - if(securityKeyValues == null) { securityKeyValues = new HashMap<>(); @@ -355,12 +351,15 @@ public class QSession implements Serializable try { - securityKeyValues.get(keyName).addAll(values); + securityKeyValues.get(keyName).add(value); } catch(UnsupportedOperationException uoe) { + ///////////////////// + // grr, List.of... // + ///////////////////// securityKeyValues.put(keyName, new ArrayList<>(securityKeyValues.get(keyName))); - securityKeyValues.get(keyName).addAll(values); + securityKeyValues.get(keyName).add(value); } return (this); @@ -368,16 +367,6 @@ public class QSession implements Serializable - /******************************************************************************* - ** Fluent setter for securityKeyValues - add 1 value for 1 key. - *******************************************************************************/ - public QSession withSecurityKeyValue(String keyName, Serializable value) - { - return (withSecurityKeyValues(keyName, List.of(value))); - } - - - /******************************************************************************* ** Clear the map of security key values in the session. *******************************************************************************/ diff --git a/qqq-backend-core/src/test/java/com/kingsrook/qqq/backend/core/actions/tables/InsertActionTest.java b/qqq-backend-core/src/test/java/com/kingsrook/qqq/backend/core/actions/tables/InsertActionTest.java index 8ac80a30..e17d6ed0 100644 --- a/qqq-backend-core/src/test/java/com/kingsrook/qqq/backend/core/actions/tables/InsertActionTest.java +++ b/qqq-backend-core/src/test/java/com/kingsrook/qqq/backend/core/actions/tables/InsertActionTest.java @@ -328,7 +328,7 @@ class InsertActionTest extends BaseTest // insert an order and lineItem with storeId=2 - then, reset our session to only have storeId=1 in it - and try to insert an order-line referencing that order. // ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// QContext.getQSession().withSecurityKeyValues(new HashMap<>()); - QContext.getQSession().withSecurityKeyValues(TestUtils.SECURITY_KEY_TYPE_STORE, List.of(2)); + QContext.getQSession().withSecurityKeyValue(TestUtils.SECURITY_KEY_TYPE_STORE, 2); InsertInput insertOrderInput = new InsertInput(); insertOrderInput.setTableName(TestUtils.TABLE_NAME_ORDER); insertOrderInput.setRecords(List.of(new QRecord().withValue("id", 42).withValue("storeId", 2))); @@ -342,7 +342,7 @@ class InsertActionTest extends BaseTest assertEquals(4200, insertLineItemOutput.getRecords().get(0).getValueInteger("id")); QContext.getQSession().withSecurityKeyValues(new HashMap<>()); - QContext.getQSession().withSecurityKeyValues(TestUtils.SECURITY_KEY_TYPE_STORE, List.of(1)); + QContext.getQSession().withSecurityKeyValue(TestUtils.SECURITY_KEY_TYPE_STORE, 1); InsertInput insertLineItemExtrinsicInput = new InsertInput(); insertLineItemExtrinsicInput.setTableName(TestUtils.TABLE_NAME_LINE_ITEM_EXTRINSIC); insertLineItemExtrinsicInput.setRecords(List.of(new QRecord().withValue("lineItemId", 4200).withValue("key", "kidsCanCallYou").withValue("value", "HoJu"))); @@ -352,7 +352,7 @@ class InsertActionTest extends BaseTest { QContext.getQSession().withSecurityKeyValues(new HashMap<>()); - QContext.getQSession().withSecurityKeyValues(TestUtils.SECURITY_KEY_TYPE_STORE, List.of(1)); + QContext.getQSession().withSecurityKeyValue(TestUtils.SECURITY_KEY_TYPE_STORE, 1); InsertInput insertOrderInput = new InsertInput(); insertOrderInput.setTableName(TestUtils.TABLE_NAME_ORDER); insertOrderInput.setRecords(List.of(new QRecord().withValue("id", 47).withValue("storeId", 1))); @@ -450,7 +450,7 @@ class InsertActionTest extends BaseTest // insert an order with storeId=2 - then, reset our session to only have storeId=1 in it - and try to insert an order-line referencing that order. // ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// QContext.getQSession().withSecurityKeyValues(new HashMap<>()); - QContext.getQSession().withSecurityKeyValues(TestUtils.SECURITY_KEY_TYPE_STORE, List.of(2)); + QContext.getQSession().withSecurityKeyValue(TestUtils.SECURITY_KEY_TYPE_STORE, 2); InsertInput insertOrderInput = new InsertInput(); insertOrderInput.setTableName(TestUtils.TABLE_NAME_ORDER); insertOrderInput.setRecords(List.of(new QRecord().withValue("id", 42).withValue("storeId", 2))); @@ -458,7 +458,7 @@ class InsertActionTest extends BaseTest assertEquals(42, insertOrderOutput.getRecords().get(0).getValueInteger("id")); QContext.getQSession().withSecurityKeyValues(new HashMap<>()); - QContext.getQSession().withSecurityKeyValues(TestUtils.SECURITY_KEY_TYPE_STORE, List.of(1)); + QContext.getQSession().withSecurityKeyValue(TestUtils.SECURITY_KEY_TYPE_STORE, 1); InsertInput insertLineItemInput = new InsertInput(); insertLineItemInput.setTableName(TestUtils.TABLE_NAME_LINE_ITEM); insertLineItemInput.setRecords(List.of(new QRecord().withValue("orderId", 42).withValue("sku", "BASIC1").withValue("quantity", 1))); @@ -468,7 +468,7 @@ class InsertActionTest extends BaseTest { QContext.getQSession().withSecurityKeyValues(new HashMap<>()); - QContext.getQSession().withSecurityKeyValues(TestUtils.SECURITY_KEY_TYPE_STORE, List.of(1)); + QContext.getQSession().withSecurityKeyValue(TestUtils.SECURITY_KEY_TYPE_STORE, 1); InsertInput insertOrderInput = new InsertInput(); insertOrderInput.setTableName(TestUtils.TABLE_NAME_ORDER); insertOrderInput.setRecords(List.of(new QRecord().withValue("id", 47).withValue("storeId", 1))); diff --git a/qqq-backend-core/src/test/java/com/kingsrook/qqq/backend/core/model/session/QSessionTest.java b/qqq-backend-core/src/test/java/com/kingsrook/qqq/backend/core/model/session/QSessionTest.java index da1d0ba0..cd676342 100644 --- a/qqq-backend-core/src/test/java/com/kingsrook/qqq/backend/core/model/session/QSessionTest.java +++ b/qqq-backend-core/src/test/java/com/kingsrook/qqq/backend/core/model/session/QSessionTest.java @@ -52,7 +52,8 @@ class QSessionTest extends BaseTest assertEquals(List.of(1701), session.getSecurityKeyValues("warehouseId")); assertEquals(List.of(), session.getSecurityKeyValues("tenantId")); - session.withSecurityKeyValues("clientId", List.of(256, 512)); + session.withSecurityKeyValue("clientId", 256); + session.withSecurityKeyValue("clientId", 512); for(int i : List.of(42, 47, 256, 512)) { assertTrue(session.hasSecurityKeyValue("clientId", i), "Should contain: " + i); diff --git a/qqq-backend-module-mongodb/src/test/java/com/kingsrook/qqq/backend/module/mongodb/actions/MongoDBQueryActionTest.java b/qqq-backend-module-mongodb/src/test/java/com/kingsrook/qqq/backend/module/mongodb/actions/MongoDBQueryActionTest.java index 6afe96ce..f9bc56db 100644 --- a/qqq-backend-module-mongodb/src/test/java/com/kingsrook/qqq/backend/module/mongodb/actions/MongoDBQueryActionTest.java +++ b/qqq-backend-module-mongodb/src/test/java/com/kingsrook/qqq/backend/module/mongodb/actions/MongoDBQueryActionTest.java @@ -875,13 +875,13 @@ class MongoDBQueryActionTest extends BaseTest QContext.setQSession(new QSession()); assertThat(new QueryAction().execute(queryInput).getRecords()).isEmpty(); - QContext.setQSession(new QSession().withSecurityKeyValues(TestUtils.TABLE_NAME_STORE, null)); + QContext.setQSession(new QSession().withSecurityKeyValue(TestUtils.TABLE_NAME_STORE, null)); assertThat(new QueryAction().execute(queryInput).getRecords()).isEmpty(); - QContext.setQSession(new QSession().withSecurityKeyValues(TestUtils.TABLE_NAME_STORE, Collections.emptyList())); + QContext.setQSession(new QSession().withSecurityKeyValues(Map.of(TestUtils.TABLE_NAME_STORE, Collections.emptyList()))); assertThat(new QueryAction().execute(queryInput).getRecords()).isEmpty(); - QContext.setQSession(new QSession().withSecurityKeyValues(TestUtils.TABLE_NAME_STORE, List.of(1, 3))); + QContext.setQSession(new QSession().withSecurityKeyValue(TestUtils.TABLE_NAME_STORE, 1).withSecurityKeyValue(TestUtils.TABLE_NAME_STORE, 3)); assertThat(new QueryAction().execute(queryInput).getRecords()) .hasSize(2) .anyMatch(r -> r.getValueInteger("key").equals(1)) @@ -919,13 +919,13 @@ class MongoDBQueryActionTest extends BaseTest QContext.setQSession(new QSession()); assertThat(new QueryAction().execute(queryInput).getRecords()).isEmpty(); - QContext.setQSession(new QSession().withSecurityKeyValues(TestUtils.TABLE_NAME_STORE, null)); + QContext.setQSession(new QSession().withSecurityKeyValue(TestUtils.TABLE_NAME_STORE, null)); assertThat(new QueryAction().execute(queryInput).getRecords()).isEmpty(); - QContext.setQSession(new QSession().withSecurityKeyValues(TestUtils.TABLE_NAME_STORE, Collections.emptyList())); + QContext.setQSession(new QSession().withSecurityKeyValues(Map.of(TestUtils.TABLE_NAME_STORE, Collections.emptyList()))); assertThat(new QueryAction().execute(queryInput).getRecords()).isEmpty(); - QContext.setQSession(new QSession().withSecurityKeyValues(TestUtils.TABLE_NAME_STORE, List.of(1, 3))); + QContext.setQSession(new QSession().withSecurityKeyValue(TestUtils.TABLE_NAME_STORE, 1).withSecurityKeyValue(TestUtils.TABLE_NAME_STORE, 3)); assertThat(new QueryAction().execute(queryInput).getRecords()) .hasSize(6) .allMatch(r -> r.getValueInteger("storeKey").equals(1) || r.getValueInteger("storeKey").equals(3)); @@ -961,7 +961,7 @@ class MongoDBQueryActionTest extends BaseTest assertThat(new QueryAction().execute(queryInput).getRecords()).isEmpty(); queryInput.setFilter(new QQueryFilter(new QFilterCriteria("storeKey", QCriteriaOperator.IN, List.of(1, 2)))); - QContext.setQSession(new QSession().withSecurityKeyValues(TestUtils.TABLE_NAME_STORE, List.of(1, 3))); + QContext.setQSession(new QSession().withSecurityKeyValue(TestUtils.TABLE_NAME_STORE, 1).withSecurityKeyValue(TestUtils.TABLE_NAME_STORE, 3)); assertThat(new QueryAction().execute(queryInput).getRecords()) .hasSize(3) .allMatch(r -> r.getValueInteger("storeKey").equals(1)); diff --git a/qqq-backend-module-rdbms/src/test/java/com/kingsrook/qqq/backend/module/rdbms/actions/RDBMSCountActionTest.java b/qqq-backend-module-rdbms/src/test/java/com/kingsrook/qqq/backend/module/rdbms/actions/RDBMSCountActionTest.java index bc50da8a..29247bc7 100644 --- a/qqq-backend-module-rdbms/src/test/java/com/kingsrook/qqq/backend/module/rdbms/actions/RDBMSCountActionTest.java +++ b/qqq-backend-module-rdbms/src/test/java/com/kingsrook/qqq/backend/module/rdbms/actions/RDBMSCountActionTest.java @@ -196,7 +196,7 @@ public class RDBMSCountActionTest extends RDBMSActionTest QContext.setQSession(new QSession().withSecurityKeyValue(TestUtils.SECURITY_KEY_STORE_ALL_ACCESS, true)); assertThat(new CountAction().execute(countInput).getCount()).isEqualTo(8); - QContext.setQSession(new QSession().withSecurityKeyValues(TestUtils.TABLE_NAME_STORE, List.of(2, 3))); + QContext.setQSession(new QSession().withSecurityKeyValue(TestUtils.TABLE_NAME_STORE, 2).withSecurityKeyValue(TestUtils.TABLE_NAME_STORE, 3)); assertThat(new CountAction().execute(countInput).getCount()).isEqualTo(5); } diff --git a/qqq-backend-module-rdbms/src/test/java/com/kingsrook/qqq/backend/module/rdbms/actions/RDBMSQueryActionTest.java b/qqq-backend-module-rdbms/src/test/java/com/kingsrook/qqq/backend/module/rdbms/actions/RDBMSQueryActionTest.java index 99e7d067..223fa5f4 100644 --- a/qqq-backend-module-rdbms/src/test/java/com/kingsrook/qqq/backend/module/rdbms/actions/RDBMSQueryActionTest.java +++ b/qqq-backend-module-rdbms/src/test/java/com/kingsrook/qqq/backend/module/rdbms/actions/RDBMSQueryActionTest.java @@ -635,7 +635,7 @@ public class RDBMSQueryActionTest extends RDBMSActionTest insertInput.setTableName(TestUtils.TABLE_NAME_PERSON); InsertAction insertAction = new InsertAction(); - QBackendTransaction transaction = QBackendTransaction.openFor(insertInput); + QBackendTransaction transaction = QBackendTransaction.openFor(insertInput); insertInput.setTransaction(transaction); insertInput.setRecords(List.of( @@ -1325,13 +1325,13 @@ public class RDBMSQueryActionTest extends RDBMSActionTest QContext.setQSession(new QSession()); assertThat(new QueryAction().execute(queryInput).getRecords()).isEmpty(); - QContext.setQSession(new QSession().withSecurityKeyValues(TestUtils.TABLE_NAME_STORE, null)); + QContext.setQSession(new QSession().withSecurityKeyValue(TestUtils.TABLE_NAME_STORE, null)); assertThat(new QueryAction().execute(queryInput).getRecords()).isEmpty(); - QContext.setQSession(new QSession().withSecurityKeyValues(TestUtils.TABLE_NAME_STORE, Collections.emptyList())); + QContext.setQSession(new QSession().withSecurityKeyValues(Map.of(TestUtils.TABLE_NAME_STORE, Collections.emptyList()))); assertThat(new QueryAction().execute(queryInput).getRecords()).isEmpty(); - QContext.setQSession(new QSession().withSecurityKeyValues(TestUtils.TABLE_NAME_STORE, List.of(1, 3))); + QContext.setQSession(new QSession().withSecurityKeyValue(TestUtils.TABLE_NAME_STORE, 1).withSecurityKeyValue(TestUtils.TABLE_NAME_STORE, 3)); assertThat(new QueryAction().execute(queryInput).getRecords()) .hasSize(2) .anyMatch(r -> r.getValueInteger("id").equals(1)) @@ -1369,13 +1369,13 @@ public class RDBMSQueryActionTest extends RDBMSActionTest QContext.setQSession(new QSession()); assertThat(new QueryAction().execute(queryInput).getRecords()).isEmpty(); - QContext.setQSession(new QSession().withSecurityKeyValues(TestUtils.TABLE_NAME_STORE, null)); + QContext.setQSession(new QSession().withSecurityKeyValue(TestUtils.TABLE_NAME_STORE, null)); assertThat(new QueryAction().execute(queryInput).getRecords()).isEmpty(); - QContext.setQSession(new QSession().withSecurityKeyValues(TestUtils.TABLE_NAME_STORE, Collections.emptyList())); + QContext.setQSession(new QSession().withSecurityKeyValues(Map.of(TestUtils.TABLE_NAME_STORE, Collections.emptyList()))); assertThat(new QueryAction().execute(queryInput).getRecords()).isEmpty(); - QContext.setQSession(new QSession().withSecurityKeyValues(TestUtils.TABLE_NAME_STORE, List.of(1, 3))); + QContext.setQSession(new QSession().withSecurityKeyValue(TestUtils.TABLE_NAME_STORE, 1).withSecurityKeyValue(TestUtils.TABLE_NAME_STORE, 3)); assertThat(new QueryAction().execute(queryInput).getRecords()) .hasSize(6) .allMatch(r -> r.getValueInteger("storeId").equals(1) || r.getValueInteger("storeId").equals(3)); @@ -1411,7 +1411,7 @@ public class RDBMSQueryActionTest extends RDBMSActionTest assertThat(new QueryAction().execute(queryInput).getRecords()).isEmpty(); queryInput.setFilter(new QQueryFilter(new QFilterCriteria("storeId", QCriteriaOperator.IN, List.of(1, 2)))); - QContext.setQSession(new QSession().withSecurityKeyValues(TestUtils.TABLE_NAME_STORE, List.of(1, 3))); + QContext.setQSession(new QSession().withSecurityKeyValue(TestUtils.TABLE_NAME_STORE, 1).withSecurityKeyValue(TestUtils.TABLE_NAME_STORE, 3)); assertThat(new QueryAction().execute(queryInput).getRecords()) .hasSize(3) .allMatch(r -> r.getValueInteger("storeId").equals(1)); @@ -1556,10 +1556,17 @@ public class RDBMSQueryActionTest extends RDBMSActionTest /////////////////////////////////////////////////////////////////////////////////////////////////////////////////// // user with list of all ids shouldn't see the nulls (given that default null-behavior on this key type is DENY) // /////////////////////////////////////////////////////////////////////////////////////////////////////////////////// - QContext.setQSession(new QSession().withSecurityKeyValues(TestUtils.TABLE_NAME_STORE, List.of(1, 2, 3, 4, 5))); - assertThat(new QueryAction().execute(queryInput).getRecords()) - .hasSize(8) - .noneMatch(hasNullStoreId); + { + QSession qSession = new QSession(); + for(Integer i : List.of(1, 2, 3, 4, 5)) + { + qSession.withSecurityKeyValue(TestUtils.TABLE_NAME_STORE, i); + } + QContext.setQSession(qSession); + assertThat(new QueryAction().execute(queryInput).getRecords()) + .hasSize(8) + .noneMatch(hasNullStoreId); + } ////////////////////////////////////////////////////////////////////////// // specifically set the null behavior to deny - repeat the last 2 tests // @@ -1569,10 +1576,17 @@ public class RDBMSQueryActionTest extends RDBMSActionTest QContext.setQSession(new QSession()); assertThat(new QueryAction().execute(queryInput).getRecords()).isEmpty(); - QContext.setQSession(new QSession().withSecurityKeyValues(TestUtils.TABLE_NAME_STORE, List.of(1, 2, 3, 4, 5))); - assertThat(new QueryAction().execute(queryInput).getRecords()) - .hasSize(8) - .noneMatch(hasNullStoreId); + { + QSession qSession = new QSession(); + for(Integer i : List.of(1, 2, 3, 4, 5)) + { + qSession.withSecurityKeyValue(TestUtils.TABLE_NAME_STORE, i); + } + QContext.setQSession(qSession); + assertThat(new QueryAction().execute(queryInput).getRecords()) + .hasSize(8) + .noneMatch(hasNullStoreId); + } /////////////////////////////////// // change null behavior to ALLOW // @@ -1598,10 +1612,17 @@ public class RDBMSQueryActionTest extends RDBMSActionTest //////////////////////////////////////////////////// // user with list of all ids should see the nulls // //////////////////////////////////////////////////// - QContext.setQSession(new QSession().withSecurityKeyValues(TestUtils.TABLE_NAME_STORE, List.of(1, 2, 3, 4, 5))); - assertThat(new QueryAction().execute(queryInput).getRecords()) - .hasSize(10) - .anyMatch(hasNullStoreId); + { + QSession qSession = new QSession(); + for(Integer i : List.of(1, 2, 3, 4, 5)) + { + qSession.withSecurityKeyValue(TestUtils.TABLE_NAME_STORE, i); + } + QContext.setQSession(qSession); + assertThat(new QueryAction().execute(queryInput).getRecords()) + .hasSize(10) + .anyMatch(hasNullStoreId); + } } @@ -1644,7 +1665,7 @@ public class RDBMSQueryActionTest extends RDBMSActionTest assertThat(new QueryAction().execute(queryInput).getRecords()).isEmpty(); queryInput.setFilter(new QQueryFilter(new QFilterCriteria("storeId", QCriteriaOperator.IN, List.of(1, 2)))); - QContext.setQSession(new QSession().withSecurityKeyValues(TestUtils.TABLE_NAME_STORE, List.of(1, 3))); + QContext.setQSession(new QSession().withSecurityKeyValue(TestUtils.TABLE_NAME_STORE, 1).withSecurityKeyValue(TestUtils.TABLE_NAME_STORE, 3)); assertThat(new QueryAction().execute(queryInput).getRecords()) .hasSize(3) .allMatch(r -> r.getValueInteger("storeId").equals(1));