Checking if canMerge with escalated (ADMIN) permission #221

Author: tomasbjerre

src/main/java/se/bjurr/prnfb/listener/PrnfbPullRequestEventListener.java

@@ -1,5 +1,6 @@
 package se.bjurr.prnfb.listener;
 
+import static com.atlassian.bitbucket.permission.Permission.ADMIN;
 import static com.google.common.base.Optional.absent;
 import static com.google.common.base.Optional.of;
 import static java.lang.Boolean.FALSE;
@@ -16,6 +17,22 @@
 
 import org.slf4j.Logger;
 
+import se.bjurr.prnfb.http.ClientKeyStore;
+import se.bjurr.prnfb.http.HttpResponse;
+import se.bjurr.prnfb.http.Invoker;
+import se.bjurr.prnfb.http.NotificationResponse;
+import se.bjurr.prnfb.http.UrlInvoker;
+import se.bjurr.prnfb.service.PrnfbRenderer;
+import se.bjurr.prnfb.service.PrnfbRenderer.ENCODE_FOR;
+import se.bjurr.prnfb.service.PrnfbRendererFactory;
+import se.bjurr.prnfb.service.SettingsService;
+import se.bjurr.prnfb.service.VariablesContext;
+import se.bjurr.prnfb.service.VariablesContext.VariablesContextBuilder;
+import se.bjurr.prnfb.settings.PrnfbHeader;
+import se.bjurr.prnfb.settings.PrnfbNotification;
+import se.bjurr.prnfb.settings.PrnfbSettingsData;
+import se.bjurr.prnfb.settings.TRIGGER_IF_MERGE;
+
 import com.atlassian.bitbucket.event.pull.PullRequestCommentAddedEvent;
 import com.atlassian.bitbucket.event.pull.PullRequestCommentDeletedEvent;
 import com.atlassian.bitbucket.event.pull.PullRequestCommentEditedEvent;
@@ -31,26 +48,12 @@
 import com.atlassian.bitbucket.event.pull.PullRequestUpdatedEvent;
 import com.atlassian.bitbucket.pull.PullRequest;
 import com.atlassian.bitbucket.pull.PullRequestService;
+import com.atlassian.bitbucket.user.SecurityService;
+import com.atlassian.bitbucket.util.Operation;
 import com.atlassian.event.api.EventListener;
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.base.Optional;
 
-import se.bjurr.prnfb.http.ClientKeyStore;
-import se.bjurr.prnfb.http.HttpResponse;
-import se.bjurr.prnfb.http.Invoker;
-import se.bjurr.prnfb.http.NotificationResponse;
-import se.bjurr.prnfb.http.UrlInvoker;
-import se.bjurr.prnfb.service.PrnfbRenderer;
-import se.bjurr.prnfb.service.PrnfbRenderer.ENCODE_FOR;
-import se.bjurr.prnfb.service.PrnfbRendererFactory;
-import se.bjurr.prnfb.service.SettingsService;
-import se.bjurr.prnfb.service.VariablesContext;
-import se.bjurr.prnfb.service.VariablesContext.VariablesContextBuilder;
-import se.bjurr.prnfb.settings.PrnfbHeader;
-import se.bjurr.prnfb.settings.PrnfbNotification;
-import se.bjurr.prnfb.settings.PrnfbSettingsData;
-import se.bjurr.prnfb.settings.TRIGGER_IF_MERGE;
-
 public class PrnfbPullRequestEventListener {
 
   private static final Logger LOG = getLogger(PrnfbPullRequestEventListener.class);
@@ -64,18 +67,21 @@ public static void setInvoker(Invoker invoker) {
   private final ExecutorService executorService;
   private final PrnfbRendererFactory prnfbRendererFactory;
   private final PullRequestService pullRequestService;
+  private final SecurityService securityService;
 
   private final SettingsService settingsService;
 
   public PrnfbPullRequestEventListener(
       PrnfbRendererFactory prnfbRendererFactory,
       PullRequestService pullRequestService,
       ExecutorService executorService,
-      SettingsService settingsService) {
+      SettingsService settingsService,
+      SecurityService securityService) {
     this.prnfbRendererFactory = prnfbRendererFactory;
     this.pullRequestService = pullRequestService;
     this.executorService = executorService;
     this.settingsService = settingsService;
+    this.securityService = securityService;
   }
 
   private Invoker createInvoker() {
@@ -187,9 +193,19 @@ public boolean isNotificationTriggeredByAction(
     if (notification.getTriggerIfCanMerge() != ALWAYS && pullRequest.isOpen()) {
       // Cannot perform canMerge unless PR is open
       boolean isConflicted =
-          pullRequestService
-              .canMerge(pullRequest.getToRef().getRepository().getId(), pullRequest.getId())
-              .isConflicted();
+          securityService //
+              .withPermission(ADMIN, "Can merge") //
+              .call(
+                  new Operation<Boolean, RuntimeException>() {
+                    @Override
+                    public Boolean perform() throws RuntimeException {
+                      return pullRequestService //
+                          .canMerge(
+                              pullRequest.getToRef().getRepository().getId(),
+                              pullRequest.getId()) //
+                          .isConflicted();
+                    }
+                  });
       if (ignoreBecauseOfConflicting(notification.getTriggerIfCanMerge(), isConflicted)) {
         return FALSE;
       }

src/test/java/se/bjurr/prnfb/listener/PrnfbPullRequestEventListenerTest.java

@@ -26,6 +26,7 @@
 import org.junit.Before;
 import org.junit.Test;
 import org.mockito.Mock;
+import org.mockito.Mockito;
 import org.mockito.invocation.InvocationOnMock;
 import org.mockito.stubbing.Answer;
 
@@ -49,6 +50,8 @@
 import com.atlassian.bitbucket.pull.PullRequestService;
 import com.atlassian.bitbucket.repository.Repository;
 import com.atlassian.bitbucket.user.ApplicationUser;
+import com.atlassian.bitbucket.user.EscalatedSecurityContext;
+import com.atlassian.bitbucket.user.SecurityService;
 import com.google.common.base.Function;
 
 public class PrnfbPullRequestEventListenerTest {
@@ -87,9 +90,26 @@ public String apply(UrlInvoker input) {
   @Before
   public void before() throws ValidationException {
     initMocks(this);
+    SecurityService securityService = mock(SecurityService.class);
+    EscalatedSecurityContext escalatedSecurityContext = mock(EscalatedSecurityContext.class);
+    when(securityService.withPermission(Mockito.any(), Mockito.any())) //
+        .thenReturn(escalatedSecurityContext);
+    when(escalatedSecurityContext.call(Mockito.any())) //
+        .thenAnswer(
+            new Answer<Boolean>() {
+              @Override
+              public Boolean answer(InvocationOnMock invocation) throws Throwable {
+                return (Boolean) invocation.callRealMethod();
+              }
+            });
+
     sut =
         new PrnfbPullRequestEventListener(
-            prnfbRendererFactory, pullRequestService, executorService, settingsService);
+            prnfbRendererFactory,
+            pullRequestService,
+            executorService,
+            settingsService,
+            securityService);
     setInvoker(
         new Invoker() {
           @Override