1 |
7667
|
tao
|
package edu.ucsb.nceas.metacat.dataone;
|
2 |
|
|
|
3 |
|
|
import java.io.ByteArrayInputStream;
|
4 |
|
|
import java.io.File;
|
5 |
|
|
import java.io.FileInputStream;
|
6 |
|
|
import java.io.InputStream;
|
7 |
|
|
import java.util.ArrayList;
|
8 |
|
|
import java.util.List;
|
9 |
|
|
|
10 |
|
|
import javax.xml.parsers.DocumentBuilder;
|
11 |
|
|
import javax.xml.parsers.DocumentBuilderFactory;
|
12 |
|
|
import javax.xml.xpath.XPath;
|
13 |
|
|
import javax.xml.xpath.XPathConstants;
|
14 |
|
|
import javax.xml.xpath.XPathExpression;
|
15 |
|
|
import javax.xml.xpath.XPathFactory;
|
16 |
|
|
|
17 |
|
|
import junit.framework.Test;
|
18 |
|
|
import junit.framework.TestSuite;
|
19 |
|
|
|
20 |
|
|
import org.dataone.client.ObjectFormatCache;
|
21 |
|
|
import org.dataone.configuration.Settings;
|
22 |
|
|
import org.dataone.service.types.v1.AccessPolicy;
|
23 |
|
|
import org.dataone.service.types.v1.AccessRule;
|
24 |
|
|
import org.dataone.service.types.v1.Identifier;
|
25 |
|
|
import org.dataone.service.types.v1.Permission;
|
26 |
|
|
import org.dataone.service.types.v1.Person;
|
27 |
|
|
import org.dataone.service.types.v1.Session;
|
28 |
|
|
import org.dataone.service.types.v1.Subject;
|
29 |
|
|
import org.dataone.service.types.v1.SubjectInfo;
|
30 |
|
|
import org.dataone.service.types.v1.SystemMetadata;
|
31 |
|
|
import org.dataone.service.util.Constants;
|
32 |
|
|
import org.junit.Before;
|
33 |
|
|
import org.w3c.dom.Document;
|
34 |
|
|
import org.w3c.dom.Node;
|
35 |
|
|
import org.w3c.dom.NodeList;
|
36 |
|
|
import org.xml.sax.InputSource;
|
37 |
|
|
|
38 |
|
|
|
39 |
|
|
/**
|
40 |
|
|
* A test class to test the access filter mechanism for the solr query
|
41 |
|
|
* @author tao
|
42 |
|
|
*
|
43 |
|
|
*/
|
44 |
|
|
public class SolrQueryAccessFilterTest extends D1NodeServiceTest {
|
45 |
|
|
|
46 |
|
|
private static final String SOLR = "solr";
|
47 |
|
|
private static final String EML201NAMESPACE = "eml://ecoinformatics.org/eml-2.0.1";
|
48 |
|
|
private static final String CREATEUSER = "CN=Christopher Jones A583,O=Google,C=US,DC=cilogon,DC=org";
|
49 |
|
|
private static final String QUERYUSER = "CN=ben leinfelder A756,O=Google,C=US,DC=cilogon,DC=org";
|
50 |
|
|
private static final String GROUP1 = "CN=PISCO-data-managers,DC=cilogon,DC=org";
|
51 |
|
|
private static final String GROUP2 = "CN=dataone-coredev,DC=cilogon,DC=org";
|
52 |
|
|
private static final String EMLFILE = "test/restfiles/knb-lter-gce.109.6.xml";
|
53 |
|
|
private static final String IDXPATH = "//response/result/doc/str[@name='id']/text()";
|
54 |
|
|
|
55 |
|
|
/**
|
56 |
|
|
* Build the test suite
|
57 |
|
|
* @return
|
58 |
|
|
*/
|
59 |
|
|
public static Test suite() {
|
60 |
|
|
|
61 |
|
|
TestSuite suite = new TestSuite();
|
62 |
|
|
suite.addTest(new SolrQueryAccessFilterTest("testPublicReadable"));
|
63 |
7670
|
tao
|
suite.addTest(new SolrQueryAccessFilterTest("testOnlyUserReadable"));
|
64 |
|
|
suite.addTest(new SolrQueryAccessFilterTest("testGroupReadable"));
|
65 |
|
|
suite.addTest(new SolrQueryAccessFilterTest("testOnlyRightHolderReadable"));
|
66 |
7667
|
tao
|
|
67 |
|
|
return suite;
|
68 |
|
|
|
69 |
|
|
}
|
70 |
|
|
|
71 |
|
|
/**
|
72 |
|
|
* Set up the test fixtures
|
73 |
|
|
*
|
74 |
|
|
* @throws Exception
|
75 |
|
|
*/
|
76 |
|
|
@Before
|
77 |
|
|
public void setUp() throws Exception {
|
78 |
|
|
super.setUp();
|
79 |
|
|
// set up the configuration for d1client
|
80 |
|
|
Settings.getConfiguration().setProperty("D1Client.cnClassName", MockCNode.class.getName());
|
81 |
|
|
}
|
82 |
|
|
|
83 |
|
|
/**
|
84 |
|
|
* Constructor for the tests
|
85 |
|
|
*
|
86 |
|
|
* @param name - the name of the test
|
87 |
|
|
*/
|
88 |
|
|
public SolrQueryAccessFilterTest(String name) {
|
89 |
|
|
super(name);
|
90 |
|
|
|
91 |
|
|
}
|
92 |
|
|
|
93 |
|
|
|
94 |
|
|
|
95 |
|
|
/**
|
96 |
|
|
* Test to query a public readable document
|
97 |
|
|
*/
|
98 |
|
|
public void testPublicReadable() throws Exception {
|
99 |
|
|
Session session = getSession(CREATEUSER, null);
|
100 |
|
|
Identifier id = generateIdentifier();
|
101 |
|
|
String[] allowUsers = {Constants.SUBJECT_PUBLIC};
|
102 |
|
|
File object = new File(EMLFILE);
|
103 |
|
|
SystemMetadata sysmeta = generateSystemMetadata(id, session.getSubject(), object , allowUsers);
|
104 |
|
|
createObject(session, id, object, sysmeta);
|
105 |
7670
|
tao
|
Thread.sleep(10000);
|
106 |
7667
|
tao
|
Session querySession = getSession(Constants.SUBJECT_PUBLIC, null);
|
107 |
|
|
String resultId = query(querySession, id);
|
108 |
7670
|
tao
|
assertTrue("In the testPublicReadable method, the query result should have the id "+id.getValue()+ " rather than "+resultId, resultId.equals(id.getValue()));
|
109 |
|
|
Session querySession2 = getSession(QUERYUSER, null);
|
110 |
|
|
String resultId2 = query(querySession2, id);
|
111 |
|
|
assertTrue("In the testPublicReadable method, the query result should have the id "+id.getValue()+ " rather than "+resultId2, resultId2.equals(id.getValue()));
|
112 |
7668
|
tao
|
archive(session, id);
|
113 |
7667
|
tao
|
}
|
114 |
|
|
|
115 |
|
|
|
116 |
|
|
/**
|
117 |
|
|
* Test to query a document which can only be read by a specified user
|
118 |
|
|
*/
|
119 |
7670
|
tao
|
public void testOnlyUserReadable() throws Exception {
|
120 |
|
|
Thread.sleep(15000);
|
121 |
|
|
Session session = getSession(CREATEUSER, null);
|
122 |
|
|
Identifier id = generateIdentifier();
|
123 |
|
|
String[] allowUsers = {QUERYUSER};
|
124 |
|
|
File object = new File(EMLFILE);
|
125 |
|
|
SystemMetadata sysmeta = generateSystemMetadata(id, session.getSubject(), object , allowUsers);
|
126 |
|
|
createObject(session, id, object, sysmeta);
|
127 |
7667
|
tao
|
|
128 |
7670
|
tao
|
Thread.sleep(10000);
|
129 |
|
|
Session querySession = getSession(Constants.SUBJECT_PUBLIC, null);
|
130 |
|
|
String resultId = query(querySession, id);
|
131 |
|
|
assertTrue("In the testOnlyUserReadable method, the query result id should be null for the public rather than "+resultId, resultId == null);
|
132 |
|
|
Session querySession2 = getSession(QUERYUSER, null);
|
133 |
|
|
resultId = query(querySession2, id);
|
134 |
|
|
assertTrue("In the testOnlyUserReadable method, the query result for the user "+QUERYUSER+" should have the id "+id.getValue()+" rather than "+resultId, resultId.equals(id.getValue()));
|
135 |
|
|
archive(session, id);
|
136 |
7667
|
tao
|
}
|
137 |
|
|
|
138 |
|
|
/**
|
139 |
|
|
* Test to query a document which can be read by a specified group
|
140 |
|
|
*/
|
141 |
7670
|
tao
|
public void testGroupReadable() throws Exception {
|
142 |
|
|
Thread.sleep(15000);
|
143 |
|
|
Session session = getSession(CREATEUSER, null);
|
144 |
|
|
Identifier id = generateIdentifier();
|
145 |
|
|
String[] allowUsers = {GROUP1, GROUP2};
|
146 |
|
|
File object = new File(EMLFILE);
|
147 |
|
|
SystemMetadata sysmeta = generateSystemMetadata(id, session.getSubject(), object , allowUsers);
|
148 |
|
|
createObject(session, id, object, sysmeta);
|
149 |
|
|
Thread.sleep(10000);
|
150 |
|
|
Session querySession = getSession(Constants.SUBJECT_PUBLIC, null);
|
151 |
|
|
String resultId = query(querySession, id);
|
152 |
|
|
assertTrue("In the testGroupReadable method, the query result id should be null for the public ", resultId == null);
|
153 |
|
|
Session querySession2 = getSession(QUERYUSER, null);
|
154 |
|
|
resultId = query(querySession2, id);
|
155 |
|
|
assertTrue("In the testGroupReadable method, the query result for the user "+QUERYUSER+" which doesn't belong to the group should be null ", resultId == null);
|
156 |
|
|
String[]groups = {GROUP1};
|
157 |
|
|
Session querySession3 = getSession(QUERYUSER, groups);
|
158 |
|
|
resultId = query(querySession3, id);
|
159 |
|
|
assertTrue("In the testGroupReadable method, the query result for the user "+QUERYUSER+" which belong to the group should have the id "+id.getValue(), resultId.equals(id.getValue()));
|
160 |
|
|
archive(session, id);
|
161 |
7667
|
tao
|
}
|
162 |
|
|
|
163 |
|
|
|
164 |
|
|
/**
|
165 |
|
|
* Test to query a document which only can be read by the rightHolder
|
166 |
|
|
*/
|
167 |
7670
|
tao
|
public void testOnlyRightHolderReadable() throws Exception {
|
168 |
|
|
Thread.sleep(15000);
|
169 |
|
|
Session session = getSession(CREATEUSER, null);
|
170 |
|
|
Identifier id = generateIdentifier();
|
171 |
|
|
String[] allowUsers = null;
|
172 |
|
|
File object = new File(EMLFILE);
|
173 |
|
|
SystemMetadata sysmeta = generateSystemMetadata(id, session.getSubject(), object , allowUsers);
|
174 |
|
|
createObject(session, id, object, sysmeta);
|
175 |
|
|
Thread.sleep(10000);
|
176 |
|
|
Session querySession = getSession(Constants.SUBJECT_PUBLIC, null);
|
177 |
|
|
String resultId = query(querySession, id);
|
178 |
|
|
assertTrue("In the testOnlyRightHolderReadable method, the query result id should be null for the public ", resultId == null);
|
179 |
|
|
Session querySession2 = getSession(QUERYUSER, null);
|
180 |
|
|
resultId = query(querySession2, id);
|
181 |
|
|
assertTrue("In the testOnlyRightHolderReadable method, the query result for the user "+QUERYUSER+" which doesn't belong to the group should be null.", resultId == null);
|
182 |
|
|
String[]groups = {GROUP1};
|
183 |
|
|
Session querySession3 = getSession(QUERYUSER, groups);
|
184 |
|
|
resultId = query(querySession3, id);
|
185 |
|
|
assertTrue("In the testOnlyRightHolderReadable method, the query result for the user "+QUERYUSER+" which belong to the group should be null.", resultId == null);
|
186 |
|
|
Session querySession4 = getSession(CREATEUSER, groups);
|
187 |
|
|
resultId = query(querySession4, id);
|
188 |
|
|
assertTrue("In the testOnlyRightHolderReadable method, the query result for the creator "+CREATEUSER+" should be "+id.getValue(), id.getValue().equals(resultId));
|
189 |
|
|
archive(session, id);
|
190 |
7667
|
tao
|
}
|
191 |
|
|
|
192 |
|
|
/*
|
193 |
|
|
* constructs a "fake" session with the specified subject and groups.
|
194 |
|
|
* If groups is not null, the session will have a subjectinfo which contains the person with the subject and is the member of the groups.
|
195 |
|
|
* @return
|
196 |
|
|
*/
|
197 |
|
|
private Session getSession(String subjectValue, String[]groups) throws Exception {
|
198 |
|
|
Session session = new Session();
|
199 |
|
|
Subject subject = new Subject();
|
200 |
|
|
subject.setValue(subjectValue);
|
201 |
|
|
session.setSubject(subject);
|
202 |
|
|
if(groups != null) {
|
203 |
|
|
Person person = new Person();
|
204 |
|
|
person.setSubject(subject);
|
205 |
|
|
person.setVerified(new Boolean(true));
|
206 |
|
|
List<Subject>groupSubjects = new ArrayList<Subject>();
|
207 |
|
|
for(String group: groups) {
|
208 |
|
|
Subject groupSub = new Subject();
|
209 |
|
|
groupSub.setValue(group);
|
210 |
|
|
groupSubjects.add(groupSub);
|
211 |
|
|
}
|
212 |
|
|
person.setIsMemberOfList(groupSubjects);
|
213 |
|
|
SubjectInfo subjectInfo = new SubjectInfo();
|
214 |
|
|
subjectInfo.addPerson(person);
|
215 |
|
|
session.setSubjectInfo(subjectInfo);
|
216 |
|
|
}
|
217 |
|
|
return session;
|
218 |
|
|
}
|
219 |
|
|
|
220 |
|
|
/*
|
221 |
|
|
* Create a data object in the dataone server.
|
222 |
|
|
* Return the identifier of the created object
|
223 |
|
|
*/
|
224 |
|
|
private void createObject(Session session, Identifier id, File object, SystemMetadata sysmeta) throws Exception {
|
225 |
|
|
MNodeService.getInstance(request).create(session, id, new FileInputStream(object), sysmeta);
|
226 |
|
|
|
227 |
|
|
}
|
228 |
|
|
|
229 |
|
|
private Identifier generateIdentifier() {
|
230 |
|
|
Identifier guid = new Identifier();
|
231 |
|
|
long random = Math.round(Math.random()*10000);
|
232 |
|
|
guid.setValue("test." + System.currentTimeMillis()+(new Long(random)).toString());
|
233 |
|
|
return guid;
|
234 |
|
|
}
|
235 |
|
|
|
236 |
|
|
/*
|
237 |
7668
|
tao
|
* Archive the given id.
|
238 |
7667
|
tao
|
*/
|
239 |
7668
|
tao
|
private void archive(Session session, Identifier id) throws Exception {
|
240 |
|
|
MNodeService.getInstance(request).archive(session, id);
|
241 |
7667
|
tao
|
}
|
242 |
|
|
|
243 |
|
|
|
244 |
|
|
|
245 |
|
|
/*
|
246 |
|
|
* Generate system metadata for the file
|
247 |
|
|
*/
|
248 |
|
|
private SystemMetadata generateSystemMetadata(Identifier id, Subject owner, File objectFile, String[] allowedSubjects) throws Exception{
|
249 |
|
|
SystemMetadata sysmeta = createSystemMetadata(id, owner, new FileInputStream(objectFile));
|
250 |
|
|
AccessPolicy accessPolicy = null;
|
251 |
|
|
if(allowedSubjects != null && allowedSubjects.length >0) {
|
252 |
|
|
accessPolicy = new AccessPolicy();
|
253 |
|
|
for(int i=0; i<allowedSubjects.length; i++) {
|
254 |
|
|
AccessRule allow = new AccessRule();
|
255 |
|
|
allow.addPermission(Permission.READ);
|
256 |
|
|
Subject subject = new Subject();
|
257 |
|
|
subject.setValue(allowedSubjects[i]);
|
258 |
|
|
allow.addSubject(subject);
|
259 |
|
|
accessPolicy.addAllow(allow);
|
260 |
|
|
}
|
261 |
|
|
}
|
262 |
|
|
sysmeta.setAccessPolicy(accessPolicy);
|
263 |
|
|
sysmeta.setFormatId(ObjectFormatCache.getInstance().getFormat(EML201NAMESPACE).getFormatId());
|
264 |
|
|
return sysmeta;
|
265 |
|
|
}
|
266 |
|
|
|
267 |
|
|
/*
|
268 |
|
|
* Query the server to find the doc which matches the specified id
|
269 |
|
|
*/
|
270 |
|
|
private String query(Session session, Identifier id) throws Exception{
|
271 |
|
|
String query = generateQuery(id.getValue());
|
272 |
7670
|
tao
|
MNodeService service = MNodeService.getInstance(request);
|
273 |
|
|
service.setSession(session);
|
274 |
|
|
InputStream input = service.query(SOLR, query);
|
275 |
7667
|
tao
|
return extractId(input);
|
276 |
|
|
}
|
277 |
|
|
|
278 |
|
|
/*
|
279 |
|
|
* Extract the return id from the query result input stream
|
280 |
|
|
*/
|
281 |
|
|
private String extractId(InputStream input ) throws Exception {
|
282 |
|
|
String id = null;
|
283 |
|
|
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
|
284 |
|
|
DocumentBuilder builder = factory.newDocumentBuilder();
|
285 |
|
|
Document doc = builder.parse(new InputSource(input));
|
286 |
|
|
|
287 |
|
|
XPathFactory xPathfactory = XPathFactory.newInstance();
|
288 |
|
|
XPath xpath = xPathfactory.newXPath();
|
289 |
|
|
XPathExpression expr = xpath.compile(IDXPATH);
|
290 |
|
|
Object result = expr.evaluate(doc, XPathConstants.NODESET);
|
291 |
|
|
System.out.println("================ result is "+result);
|
292 |
|
|
if(result != null) {
|
293 |
|
|
NodeList nodes = (NodeList) result;
|
294 |
|
|
if(nodes != null) {
|
295 |
|
|
System.out.println("the length of nodes is "+nodes.getLength());
|
296 |
|
|
Node node = nodes.item(0);
|
297 |
|
|
if(node != null) {
|
298 |
|
|
id = node.getNodeValue();
|
299 |
|
|
}
|
300 |
|
|
|
301 |
|
|
}
|
302 |
|
|
|
303 |
|
|
}
|
304 |
|
|
|
305 |
|
|
System.out.println("the id is ====== "+id);
|
306 |
|
|
return id;
|
307 |
|
|
|
308 |
|
|
|
309 |
|
|
}
|
310 |
|
|
/*
|
311 |
|
|
* Make a query string which will query "id= the specified id".
|
312 |
|
|
* @param id
|
313 |
|
|
* @return
|
314 |
|
|
*/
|
315 |
|
|
private String generateQuery(String id) {
|
316 |
|
|
String query = "q=id:"+id+"&fl=id,title";
|
317 |
|
|
return query;
|
318 |
|
|
}
|
319 |
|
|
}
|