consider force suffix while doing resource ownership check during delete operations

Signed-off-by: Abhijeet V <31417623+abvaidya@users.noreply.github.com>

Author: abvaidya

libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/util/ResourceOwnership.java

@@ -829,7 +829,7 @@ public static void verifyGroupMembersDeleteResourceOwnership(Group group, final
         verifyDeleteResourceOwnership(resourceOwner, resourceOwnership.getMembersOwner(), caller);
     }
 
-    public static void verifyDeleteResourceOwnership(final String resourceOwner, final String objectOwner,
+    public static void verifyDeleteResourceOwnership(String resourceOwner, final String objectOwner,
             final String caller) throws ServerResourceException {
 
         // first check if we're explicitly asked to ignore the check
@@ -839,6 +839,12 @@ public static void verifyDeleteResourceOwnership(final String resourceOwner, fin
             return;
         }
 
+        // if the current resource owner includes the force suffix then we need to drop it and
+        // then do the match
+        if (resourceOwner != null && resourceOwner.endsWith(RESOURCE_OWNER_FORCE_SUFFIX)) {
+            resourceOwner = resourceOwner.substring(0, resourceOwner.length() - RESOURCE_OWNER_FORCE_SUFFIX.length());
+        }
+
         // at this point we have an object owner so the value must match
         // otherwise we'll throw a conflict error exception
 

libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/util/ResourceOwnershipTest.java

@@ -274,18 +274,52 @@ public void testVerifyDeleteResourceObjectOwnership() throws ServerResourceExcep
         ResourceOwnership.verifyRoleDeleteResourceOwnership(new Role(), "resourceOwner", "unit-test");
         ResourceOwnership.verifyRoleDeleteResourceOwnership(new Role()
                         .setResourceOwnership(new ResourceRoleOwnership()), "resourceOwner", "unit-test");
+        ResourceOwnership.verifyRoleDeleteResourceOwnership(new Role()
+                .setResourceOwnership(new ResourceRoleOwnership().setObjectOwner("A")), "A:force", "unit-test");
+        try {
+            ResourceOwnership.verifyRoleDeleteResourceOwnership(new Role()
+                    .setResourceOwnership(new ResourceRoleOwnership().setObjectOwner("A")), "B:force", "unit-test");
+            fail();
+        }catch (ServerResourceException ignored) {
+
+        }
 
         ResourceOwnership.verifyPolicyDeleteResourceOwnership(new Policy(), "resourceOwner", "unit-test");
         ResourceOwnership.verifyPolicyDeleteResourceOwnership(new Policy()
                         .setResourceOwnership(new ResourcePolicyOwnership()), "resourceOwner", "unit-test");
+        ResourceOwnership.verifyPolicyDeleteResourceOwnership(new Policy()
+                .setResourceOwnership(new ResourcePolicyOwnership().setObjectOwner("A")), "A:force", "unit-test");
+        try {
+            ResourceOwnership.verifyPolicyDeleteResourceOwnership(new Policy()
+                    .setResourceOwnership(new ResourcePolicyOwnership().setObjectOwner("A")), "B:force", "unit-test");
+            fail();
+        } catch (ServerResourceException ignored) {
+        }
+
 
         ResourceOwnership.verifyGroupDeleteResourceOwnership(new Group(), "resourceOwner", "unit-test");
         ResourceOwnership.verifyGroupDeleteResourceOwnership(new Group()
                         .setResourceOwnership(new ResourceGroupOwnership()), "resourceOwner", "unit-test");
+        ResourceOwnership.verifyGroupDeleteResourceOwnership(new Group()
+                .setResourceOwnership(new ResourceGroupOwnership().setObjectOwner("A")), "A:force", "unit-test");
+        try {
+            ResourceOwnership.verifyGroupDeleteResourceOwnership(new Group()
+                    .setResourceOwnership(new ResourceGroupOwnership().setObjectOwner("A")), "B:force", "unit-test");
+            fail();
+        } catch (ServerResourceException ignored) {
+        }
 
         ResourceOwnership.verifyServiceDeleteResourceOwnership(new ServiceIdentity(), "resourceOwner", "unit-test");
         ResourceOwnership.verifyServiceDeleteResourceOwnership(new ServiceIdentity()
                         .setResourceOwnership(new ResourceServiceIdentityOwnership()), "resourceOwner", "unit-test");
+        ResourceOwnership.verifyServiceDeleteResourceOwnership(new ServiceIdentity()
+                .setResourceOwnership(new ResourceServiceIdentityOwnership().setObjectOwner("A")), "A:force", "unit-test");
+        try {
+            ResourceOwnership.verifyServiceDeleteResourceOwnership(new ServiceIdentity()
+                    .setResourceOwnership(new ResourceServiceIdentityOwnership().setObjectOwner("A")), "B:force", "unit-test");
+            fail();
+        } catch (ServerResourceException ignored) {
+        }
     }
 
     @Test