Fix conflicts on checkAccess

Author: Nicole Schmidt

plugins/acl/dynamic-role-based/src/main/java/org/apache/cloudstack/acl/DynamicRoleBasedAPIAccessChecker.java

@@ -160,8 +160,11 @@ public boolean checkAccess(User user, String commandName, ApiKeyPairPermission .
             logger.info("Account for user id {} is Root Admin or Domain Admin, all APIs are allowed.", user.getUuid());
             return true;
         }
-        List<RolePermission> allPermissions = roleAndPermissions.second();
-        if (checkApiPermissionByRole(accountRole, commandName, allPermissions)) {
+
+        List<RolePermissionEntity> allRules = defineNewKeypairRules(accountRole, apiKeyPairPermissions);
+        boolean override = apiKeyPairPermissions.length != 0;
+
+        if (checkApiPermissionByRole(accountRole, commandName, allRules, override)) {
             return true;
         }
         throw new UnavailableCommandException(String.format("The API [%s] does not exist or is not available for the account for user id [%s].", commandName, user.getUuid()));

plugins/acl/dynamic-role-based/src/test/java/org/apache/cloudstack/acl/DynamicRoleBasedAPIAccessCheckerTest.java

@@ -248,7 +248,7 @@ public void checkAccessTestValidApiKeyPairPermissionWithNullOverride() {
         Mockito.doReturn(Collections.singletonList(permission)).when(roleServiceMock).findAllPermissionsBy(Mockito.anyLong());
 
         assertTrue(apiAccessCheckerSpy.checkAccess(getTestUser(), api, emptyPermissionArray));
-        Mockito.verify(roleServiceMock, Mockito.times(1)).findAllPermissionsBy(Mockito.anyLong());
+        Mockito.verify(roleServiceMock, Mockito.times(2)).findAllPermissionsBy(Mockito.anyLong());
     }
 
     @Test(expected = UnavailableCommandException.class)