ifs-security/src/test/java/org/innovateuk/ifs/commons/AbstractServiceSecurityAnnotationsTest.java
/**
     * It is possible to accidentally secure on a primitive when trying to secure on a resource id.
     * This will appear to work but the problem is that it will open up unexpected permissions.
     * For example say you:
     * Write a permission rule that takes an application id which is a {@link Long}
     * It has a {@link PermissionRule} {@link Annotation} which specifies the permission "READ"
     * Now you have secured {@link Long} NOT application.
     * The next person does the same, but for project.
     * Now the application will allow a user to call the application method which you secured if the project permission
     * rule evaluates to true
     * <p>
     * This test should prevent primitive being secured.
     */
It is possible to accidentally secure on a primitive when trying to secure on a resource id.
This will appear to work but the problem is that it will open up unexpected permissions.
For example say you:
Write a permission rule that takes an application id which is a  Long
It has a  PermissionRule  Annotation which specifies the permission "READ"
Now you have secured  Long NOT application.
The next person does the same, but for project.
Now the application will allow a user to call the application method which you secured if the project permission
rule evaluates to true

This test should prevent primitive being secured.
It is possible to accidentally secure on a primitive when trying to secure on a resource id . This will appear to work but the problem is that it will open up unexpected permissions . For example say you : Write a permission rule that takes an application id which is a Long It has a PermissionRule Annotation which specifies the permission " READ " Now you have secured Long NOT application . The next person does the same but for project . Now the application will allow a user to call the application method which you secured if the project permission rule evaluates to true This test should prevent primitive being secured .
@Test
    public void testThatResourcesSecuredAreReallyResources() {
        PermissionedObjectClassToPermissionsToPermissionsMethods rulesMap = getRulesMap(evaluator());
        List<PermissionRulesClassResult> results = simpleMap(rulesMap.entrySet(), e -> fromClassAndPermissionMethods(e.getKey(), e.getValue()));
        List<Method> allRulesMethods = flattenLists(simpleMap(results, PermissionRulesClassResult::ruleMethods));
        List<Pair<Method, Class<?>>> allRulesMethodsWithSecuredType = simpleMap(allRulesMethods, m -> Pair.of(m, m.getParameterTypes()[0]));
        List<Pair<Method, Class<?>>> failed = simpleFilter(allRulesMethodsWithSecuredType, p -> !acceptableResourceType(p.getValue()));
        if (!failed.isEmpty()) {
            fail("The following methods are protecting primitives not resources:\n" +
                    join(",\n", simpleMap(failed, p -> p.getKey().getName() + " on class " + p.getKey().getDeclaringClass() +
                            " is protecting the primitive: " + p.getValue().getSimpleName())) +
                    "\n If its an id, then instead use a wrapper class for the id, and specify a PermissionEntityLookupStrategies");
        }
    }
@ Test public void testThatResourcesSecuredAreReallyResources ( ) { PermissionedObjectClassToPermissionsToPermissionsMethods rulesMap = getRulesMap ( evaluator ( ) ) ; List < PermissionRulesClassResult > results = simpleMap ( rulesMap . entrySet ( ) , e -> fromClassAndPermissionMethods ( e . getKey ( ) , e . getValue ( ) ) ) ; List < Method > allRulesMethods = flattenLists ( simpleMap ( results , PermissionRulesClassResult :: ruleMethods ) ) ; List < Pair < Method , Class < ? > > > allRulesMethodsWithSecuredType = simpleMap ( allRulesMethods , m -> Pair . of ( m , m . getParameterTypes ( ) [ 0 ] ) ) ; List < Pair < Method , Class < ? > > > failed = simpleFilter ( allRulesMethodsWithSecuredType , p -> ! acceptableResourceType ( p . getValue ( ) ) ) ; if ( ! failed . isEmpty ( ) ) { fail ( "The following methods are protecting primitives not resources:\n" + join ( ",\n" , simpleMap ( failed , p -> p . getKey ( ) . getName ( ) + " on class " + p . getKey ( ) . getDeclaringClass ( ) + " is protecting the primitive: " + p . getValue ( ) . getSimpleName ( ) ) ) + "\n If its an id, then instead use a wrapper class for the id, and specify a PermissionEntityLookupStrategies" ) ; } }
It is possible to accidentally secure on a primitive when trying to secure on a resource id.
It is possible to accidentally secure on a primitive when trying to secure on a resource id .