Merge pull request #539 from Netcentric/feature/538-better-yaml-validation

#538 Fail for yaml lists with more than one item underneath authorizable config

Author: ghenzler

accesscontroltool-bundle/src/main/java/biz/netcentric/cq/tools/actool/configreader/YamlConfigReader.java

@@ -218,17 +218,20 @@ private AuthorizablesConfig getAuthorizableBeans(
 
             if ((currentAuthorizableData != null) && !currentAuthorizableData.isEmpty()) {
 
-                for (final Map<String, Object> currentPrincipalDataMap : currentAuthorizableData) {
-                    try {
-                        final AuthorizableConfigBean tmpPrincipalConfigBean = getNewAuthorizableConfigBean();
-                        setupAuthorizableBean(tmpPrincipalConfigBean, currentPrincipalDataMap, currentAuthorizableIdFromYaml, isGroupSection);
-                        if (authorizableValidator != null) {
-                            authorizableValidator.validate(tmpPrincipalConfigBean);
-                        }
-                        authorizableBeans.add(tmpPrincipalConfigBean);
-                    } catch (AcConfigBeanValidationException e) {
-                        throw new AcConfigBeanValidationException("Invalid authorizable " + currentAuthorizableIdFromYaml, e);
+                if (currentAuthorizableData.size() > 1) {
+                    throw new AcConfigBeanValidationException("Invalid authorizable " + currentAuthorizableIdFromYaml
+                            + " - configuration needs to contain exactly one yaml list entry");
+                }
+                try {
+                    Map<String, Object> currentPrincipalDataMap = currentAuthorizableData.get(0);
+                    final AuthorizableConfigBean tmpPrincipalConfigBean = getNewAuthorizableConfigBean();
+                    setupAuthorizableBean(tmpPrincipalConfigBean, currentPrincipalDataMap, currentAuthorizableIdFromYaml, isGroupSection);
+                    if (authorizableValidator != null) {
+                        authorizableValidator.validate(tmpPrincipalConfigBean);
                     }
+                    authorizableBeans.add(tmpPrincipalConfigBean);
+                } catch (AcConfigBeanValidationException e) {
+                    throw new AcConfigBeanValidationException("Invalid authorizable " + currentAuthorizableIdFromYaml, e);
                 }
             }
 

accesscontroltool-bundle/src/test/java/biz/netcentric/cq/tools/actool/configreader/YamlConfigurationMergerTest.java

@@ -88,6 +88,11 @@ public void testReadInvalidYaml2() throws IOException, RepositoryException, AcCo
         getAcConfigurationForFile(getConfigurationMerger(), session, "test-invalid2.yaml");
     }
 
+    @Test(expected = AcConfigBeanValidationException.class)
+    public void testReadInvalidYaml3() throws IOException, RepositoryException, AcConfigBeanValidationException {
+        getAcConfigurationForFile(getConfigurationMerger(), session, "test-invalid3.yaml");
+    }
+    
     @Test()
     public void testReadEmptyYaml() throws IOException, RepositoryException, AcConfigBeanValidationException {
         getAcConfigurationForFile(getConfigurationMerger(), session, "test-empty.yaml");

accesscontroltool-bundle/src/test/resources/test-invalid3.yaml

@@ -0,0 +1,8 @@
+
+- group_config:
+
+    - fragment-xyz-editor:
+        - path: /home/groups/test
+        # only one item allowed underneath group name 
+        - isMemberOf:
+            - fragment-xyz