commit 6038d5806b2492004f31c7c9a1977155b1554bd2
author Ivan Pilat <ivanpi@google.com> Tue Jun 07 04:18:18 2016 -0700
committer Ivan Pilat <ivanpi@google.com> Tue Jun 07 19:43:27 2016 +0000
tree a5c0102853738bba8bffc179070d494b997ef0c5
parent 3ec6cb4d9b0239ae5ab6d9926661047f51eb7be7

security: Do not skip ACL checks when using same principal.

Syncbase is frequently run using the same principal (key pair) as
its clients. The default authorizer would skip all ACL checks in
this case, which is undesirable since it can e.g. allow the client
to put rows into a read-only collection, which would be rejected
by a remote peer when synced.

For this reason, this CL removes the short-circuit check for the
same public key and always checks the ACL.

MultiPart: 3/3
Change-Id: I44a5468a74bf937a4bf288defc4e2abca411a454

lib/src/test/java/io/v/v23/services/groups/PermissionsAuthorizerTest.java

diff --git a/lib/src/test/java/io/v/v23/services/groups/PermissionsAuthorizerTest.java b/lib/src/test/java/io/v/v23/services/groups/PermissionsAuthorizerTest.java
index 7a9b73f..c1ee7e6 100644
--- a/lib/src/test/java/io/v/v23/services/groups/PermissionsAuthorizerTest.java
+++ b/lib/src/test/java/io/v/v23/services/groups/PermissionsAuthorizerTest.java
@@ -63,6 +63,7 @@
             AccessList acl = new AccessList(
                     ImmutableList.of(new BlessingPattern("...")), ImmutableList.<String>of());
             Permissions allowAll = new Permissions(ImmutableMap.of(
+                    io.v.v23.security.access.Constants.RESOLVE.getValue(), acl,
                     io.v.v23.security.access.Constants.READ.getValue(), acl,
                     io.v.v23.security.access.Constants.WRITE.getValue(), acl,
                     io.v.v23.security.access.Constants.ADMIN.getValue(), acl));
@@ -94,10 +95,10 @@
             }
 
             AUTHORIZER = PermissionsAuthorizer.create(new Permissions(ImmutableMap.of(
-                    "Read", new AccessList(
+                    io.v.v23.security.access.Constants.READ.getValue(), new AccessList(
                             ImmutableList.of(new BlessingPattern("<grp:" + groupNameReaders + ">")),
                             null),
-                    "Write", new AccessList(
+                    io.v.v23.security.access.Constants.WRITE.getValue(), new AccessList(
                             ImmutableList.of(new BlessingPattern("<grp:" + groupNameWriters + ">")),
                             null))), Access.typicalTagType());
         } catch (VException e) {
@@ -122,7 +123,7 @@
         return Arrays.asList(new Object[][]{
                 {"get", io.v.v23.security.access.Constants.READ,
                         ImmutableList.of("root:alice"), true},
-                {"get", io.v.v23.security.access.Constants.WRITE,
+                {"put", io.v.v23.security.access.Constants.WRITE,
                         ImmutableList.of("root:alice"), true},
                 {"get", io.v.v23.security.access.Constants.READ,
                         ImmutableList.of("root:bob"), true},