Add test check on labelValues

Signed-off-by: Andrea Lamparelli <[email protected]>
johnaohara · Jul 17, 2024 · 9aa4447 · 9aa4447
1 parent 68169eb
commit 9aa4447
Showing 1 changed file with 27 additions and 2 deletions.
diff --git a/horreum-backend/src/main/java/io/hyperfoil/tools/horreum/exp/svc/LabelServiceImpl.java b/horreum-backend/src/main/java/io/hyperfoil/tools/horreum/exp/svc/LabelServiceImpl.java
@@ -12,6 +12,7 @@
 import io.hyperfoil.tools.horreum.hibernate.JsonBinaryType;
 import io.hyperfoil.tools.horreum.server.WithRoles;
 import io.hyperfoil.tools.horreum.svc.Roles;
+import io.hyperfoil.tools.horreum.svc.ServiceException;
 import jakarta.annotation.security.RolesAllowed;
 import jakarta.enterprise.context.ApplicationScoped;
 import jakarta.inject.Inject;
@@ -25,6 +26,8 @@
 @ApplicationScoped
 public class LabelServiceImpl implements LabelService {
 
+    private static final String COUNT_TEST_BY_ID_QUERY = "SELECT count(id) FROM exp_test WHERE id = ?1";
+
     @Transactional
     @WithRoles
     @RolesAllowed(Roles.VIEWER)
@@ -297,9 +300,26 @@ public List<LabelValueDao> getDerivedValues(LabelValueDao parent,int index){
         return LabelValueDao.find("from LabelValueDao lv where exists (from LabelValuePointerDao lvp where lvp.child = lv and lvp.target=?1 and lvp.targetIndex = ?2)",parent,index).list();
     }
 
+    /**
+     * Checks whether the provided id belongs to an existing test and if the user can access it
+     * the security check is performed by triggering the RLS at database level
+     * @param id test ID
+     */
+    @WithRoles
+    @Transactional
+    protected boolean checkTestExists(long id) {
+        return 0 != (Long) em.createNativeQuery(COUNT_TEST_BY_ID_QUERY, Long.class)
+              .setParameter(1, id)
+              .getSingleResult();
+    }
+
     //get the labelValues for all instances of a target schema for a test
     //could also have a labelValues based on label name, would that be useful? label name would not be merge-able across multiple labels
     public List<LabelService.ValueMap> labelValues(String schema,long testId, List<String> include, List<String> exclude){
+        if (!checkTestExists(testId)) {
+            throw ServiceException.serverError("Cannot find test "+testId);
+        }
+
         List<LabelService.ValueMap> rtrn = new ArrayList<>();
         String labelNameFilter = "";
         if (include!=null && !include.isEmpty()){
@@ -358,7 +378,7 @@ with bag as (
                 .addScalar("run_id",Long.class)
                 .addScalar("test_id",Long.class)
                 .addScalar("data", JsonBinaryType.INSTANCE)
-                .list();
+                .getResultList();
 
         for(Object[] object : found){
             // tuple (labelId,index) should uniquely identify which label_value entry "owns" the ValueMap for the given test and run
@@ -388,6 +408,10 @@ List<LabelService.ValueMap> labelValues(
             List<String> include,
             List<String> exclude,
             boolean multiFilter){
+        if (!checkTestExists(testId)) {
+            throw ServiceException.serverError("Cannot find test "+testId);
+        }
+
         List<LabelService.ValueMap> rtrn = new ArrayList<>();
         String labelNameFilter = "";
         if (include!=null && !include.isEmpty()){
@@ -441,7 +465,8 @@ with bag as (
                 .addScalar("run_id",Long.class)
                 .addScalar("test_id",Long.class)
                 .addScalar("data",JsonBinaryType.INSTANCE)
-                .list();
+                .getResultList();
+
         for(Object[] object : found){
             // tuple (labelId,index) should uniquely identify which label_value entry "owns" the ValueMap for the given test and run
             // note a label_value can have multiple values that are associated with a (labelId,index) if it is NxN