[fli-iam#1864] Correct unit test

youennmerel · Sep 20, 2023 · 30c2d28 · 30c2d28
1 parent 4de1b45
commit 30c2d28
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 6 deletions.
diff --git a/...oir-ng-datasets/src/main/java/org/shanoir/ng/dataset/security/DatasetSecurityService.java b/...oir-ng-datasets/src/main/java/org/shanoir/ng/dataset/security/DatasetSecurityService.java
@@ -617,7 +617,7 @@ public boolean hasUpdateRightOnDatasetAcquisition(DatasetAcquisition datasetAcq,
      * @return true or false
      * @throws EntityNotFoundException
      */
-    public boolean hasUpdateRightOnDatasetAcquisition(DatasetAcquisitionDTO datasetAcqDto, String rightStr) throws EntityNotFoundException {
+    public boolean hasUpdateRightOnDatasetAcquisitionDTO(DatasetAcquisitionDTO datasetAcqDto, String rightStr) throws EntityNotFoundException {
     	if (KeycloakUtil.getTokenRoles().contains("ROLE_ADMIN")) {
 			return true;
 		}
@@ -635,9 +635,9 @@ public boolean hasUpdateRightOnDatasetAcquisition(DatasetAcquisitionDTO datasetA
 			throw new EntityNotFoundException("Cannot find dataset acquisition with id " + datasetAcqDto.getId());
 		}
     	if (datasetAcqDto.getExamination().getStudyId() == dbDatasetAcq.getExamination().getStudyId()) { // study hasn't changed
-    		return this.hasRightOnStudyCenter(datasetAcqDto.getExamination().getCenterId(), datasetAcqDto.getExamination().getStudyId(), rightStr);
-    	} else { // study has changed : check user has right on both studies
-    		return this.hasRightOnStudyCenter(datasetAcqDto.getExamination().getCenterId(), datasetAcqDto.getExamination().getStudyId(), rightStr) &&
+			return this.hasRightOnStudyCenter(datasetAcqDto.getExamination().getCenterId(), datasetAcqDto.getExamination().getStudyId(), rightStr);
+		} else { // study has changed : check user has right on both studies
+			return this.hasRightOnStudyCenter(datasetAcqDto.getExamination().getCenterId(), datasetAcqDto.getExamination().getStudyId(), rightStr) &&
     				this.hasRightOnStudyCenter(dbDatasetAcq.getExamination().getCenterId(), dbDatasetAcq.getExamination().getStudyId(), rightStr);
     	}
     }

diff --git a/...sets/src/main/java/org/shanoir/ng/datasetacquisition/controler/DatasetAcquisitionApi.java b/...sets/src/main/java/org/shanoir/ng/datasetacquisition/controler/DatasetAcquisitionApi.java
@@ -138,7 +138,7 @@ ResponseEntity<List<DatasetAcquisitionDatasetsDTO>> findDatasetAcquisitionByData
 			@ApiResponse(responseCode = "500", description = "unexpected error") })
 	@RequestMapping(value = "/datasetacquisition/{datasetAcquisitionId}", produces = { "application/json" }, consumes = {
 			"application/json" }, method = RequestMethod.PUT)
-	@PreAuthorize("hasAnyRole('ADMIN', 'EXPERT') and #datasetAcquisitionId == #datasetAcquisition.getId() and @datasetSecurityService.hasUpdateRightOnDatasetAcquisition(#datasetAcquisition, 'CAN_ADMINISTRATE')")
+	@PreAuthorize("hasAnyRole('ADMIN', 'EXPERT') and #datasetAcquisitionId == #datasetAcquisition.getId() and @datasetSecurityService.hasUpdateRightOnDatasetAcquisitionDTO(#datasetAcquisition, 'CAN_ADMINISTRATE')")
 	ResponseEntity<Void> updateDatasetAcquisition(
 			@Parameter(name = "id of the datasetAcquisition", required = true) @PathVariable("datasetAcquisitionId") Long datasetAcquisitionId,
 			@Parameter(name = "datasetAcquisition to update", required = true) @Valid @RequestBody DatasetAcquisitionDTO datasetAcquisition, BindingResult result)

diff --git a/...ts/src/test/java/org/shanoir/ng/datasetacquisition/DatasetAcquisitionApiSecurityTest.java b/...ts/src/test/java/org/shanoir/ng/datasetacquisition/DatasetAcquisitionApiSecurityTest.java
@@ -246,7 +246,8 @@ private void testAll(String role) throws ShanoirException, RestServiceException
 
 		// findDatasetAcquisitions(Pageable)
 		assertThat(api.findDatasetAcquisitions(PageRequest.of(0, 10)).getBody()).hasSize(1);
-
+
+		given(rightsService.hasRightOnStudy(1L, "CAN_ADMINISTRATE")).willReturn(true);
 		// updateDatasetAcquisition(Long, DatasetAcquisitionDTO, BindingResult)
 		if ("ROLE_USER".equals(role)) {
 			assertAccessDenied(api::updateDatasetAcquisition, 1L, mockDsAcqDTO(1L), mockBindingResult);			
@@ -291,6 +292,8 @@ private DatasetAcquisitionDTO mockDsAcqDTO(Long id) {
 		dto.setId(id);
 		dto.setAcquisitionEquipmentId(1L);
 		dto.setExamination(new ExaminationDTO());
+		dto.getExamination().setStudyId(1L);
+		dto.getExamination().setCenterId(1L);
 		dto.setRank(1);
 		dto.setSoftwareRelease("v1.0.0");
 		dto.setSortingIndex(1);