Merge pull request rundeck#8387 from rundeck/fix/project-type-authz-r…

…esolver

RUN-1797: fix: authz checks for project type annotations

rundeckapp/src/main/groovy/org/rundeck/app/authorization/domain/projectType/AppAuthorizingProjectType.groovy

@@ -20,7 +20,7 @@ import javax.security.auth.Subject
 class AppAuthorizingProjectType extends BaseAuthorizingIdResource<Singleton, ProjectTypeIdentifier>
     implements AuthorizingProjectType {
     final String resourceTypeName = 'Project Resource'
-    final boolean authContextWithProject = false
+    final boolean authContextWithProject = true
 
     @Override
     protected AuthResource getAuthResource(final Singleton resource) {
@@ -45,7 +45,7 @@ class AppAuthorizingProjectType extends BaseAuthorizingIdResource<Singleton, Pro
     @Override
     protected AuthResource getAuthResource() throws NotFound {
         return AuthorizationUtil.authResource(
-            AuthResource.Context.System,
+            AuthResource.Context.Project,
             AuthorizationUtil.resourceType(identifier.type)
         )
     }

rundeckapp/src/main/groovy/org/rundeck/app/authorization/domain/projectType/AppProjectTypeAuthorizingProvider.groovy

@@ -39,7 +39,7 @@ class AppProjectTypeAuthorizingProvider
         return getAuthorizingResource(
             subject,
             resolver.idForType(RundeckAccess.Project.TYPE),
-            resolver.idForType(RundeckAccess.ApplicationType.TYPE)
+            resolver.idForType(RundeckAccess.ProjectType.TYPE)
         )
     }
 }

rundeckapp/src/test/groovy/org/rundeck/app/authorization/domain/projectType/AppAuthorizingProjectTypeSpec.groovy

@@ -0,0 +1,56 @@
+package org.rundeck.app.authorization.domain.projectType
+
+import com.dtolabs.rundeck.core.authorization.AuthContext
+import com.dtolabs.rundeck.core.authorization.AuthContextProcessor
+import com.dtolabs.rundeck.core.authorization.UserAndRolesAuthContext
+import groovy.transform.CompileStatic
+import org.rundeck.core.auth.access.AuthActions
+import org.rundeck.core.auth.access.NamedAuthProvider
+import org.rundeck.core.auth.app.type.ProjectTypeIdentifier
+import spock.lang.Specification
+
+import javax.security.auth.Subject
+
+class AppAuthorizingProjectTypeSpec extends Specification {
+    def "is authorized correct auth resource"() {
+
+        given:
+            def projectName = 'aproject'
+            def typeName = 'atype'
+            def testActions = ['read', 'write']
+            def processor = Mock(AuthContextProcessor)
+            def subject = new Subject()
+            def named = Mock(NamedAuthProvider)
+
+            def ptypeid = Mock(ProjectTypeIdentifier) {
+                getProject() >> projectName
+
+                getType() >> typeName
+            }
+
+            def sut = new AppAuthorizingProjectType(
+                processor,
+                subject,
+                named,
+                ptypeid
+            )
+            def actions = Mock(AuthActions) {
+
+                getActions() >> testActions
+            }
+            def authContext = Mock(UserAndRolesAuthContext)
+        when:
+            def result = sut.isAuthorized(actions)
+        then:
+            1 * processor.getAuthContextForSubjectAndProject(subject, projectName) >> authContext
+            1 * processor.authorizeProjectResourceAny(
+                authContext,
+                [type: 'resource', kind: typeName],
+                testActions,
+                projectName
+            ) >> isAuthorized
+            result == isAuthorized
+        where:
+            isAuthorized << [true, false]
+    }
+}

rundeckapp/src/test/groovy/org/rundeck/app/authorization/domain/projectType/AppProjectTypeAuthorizingProviderSpec.groovy

@@ -0,0 +1,32 @@
+package org.rundeck.app.authorization.domain.projectType
+
+import com.dtolabs.rundeck.core.authorization.AuthContextProcessor
+import groovy.transform.CompileStatic
+import org.rundeck.core.auth.access.NamedAuthProvider
+import org.rundeck.core.auth.access.ResIdResolver
+import org.rundeck.core.auth.app.RundeckAccess
+import spock.lang.Specification
+
+import javax.security.auth.Subject
+
+class AppProjectTypeAuthorizingProviderSpec extends Specification {
+    def "getAuthorizingResource with resolver"() {
+        given:
+            def sut = new AppProjectTypeAuthorizingProvider()
+            sut.namedAuthProvider = Mock(NamedAuthProvider)
+            sut.rundeckAuthContextProcessor = Mock(AuthContextProcessor)
+            def resolver = Mock(ResIdResolver)
+            def subject = new Subject()
+        when:
+            def result = sut.getAuthorizingResource(subject, resolver)
+        then:
+            1 * resolver.idForType(RundeckAccess.Project.TYPE) >> 'ProjectName'
+            1 * resolver.idForType(RundeckAccess.ProjectType.TYPE) >> 'restype'
+            result != null
+            result instanceof AppAuthorizingProjectType
+            AppAuthorizingProjectType auth = (AppAuthorizingProjectType) result
+            auth.project == 'ProjectName'
+            auth.resourceIdent == 'restype'
+
+    }
+}