#432 Amps are now deployed right before modules

Author: rjrudin

src/main/java/com/marklogic/appdeployer/command/SortOrderConstants.java

@@ -41,14 +41,15 @@ public abstract class SortOrderConstants {
 	// Module code may depend on schemas, but not vice-versa.
 	public static Integer LOAD_SCHEMAS = 350;
 
+	// The modules database must exist before we deploy amps, but in the event that loading modules depends
+	// on an amp (will be true in DHF 5.5), amps should be deployed before modules are loaded.
+	public static Integer DEPLOY_AMPS = 390;
+
 	// Modules have to be loaded after the REST API server has been updated, for if the deployer is expecting to load
 	// modules via SSL, then the REST API server must already be configured with a certificate template
 	public static Integer LOAD_MODULES = 400;
 	public static Integer DELETE_TEST_MODULES = 410;
 
-	// The modules database must exist before we deploy amps
-	public static Integer DEPLOY_AMPS = 450;
-
 	public static Integer DEPLOY_TRIGGERS = 700;
 
 	public static Integer DEPLOY_TEMPORAL_AXIS = 750;

src/test/java/com/marklogic/appdeployer/command/security/ManageAmpsTest.java

@@ -2,13 +2,43 @@
 
 import com.marklogic.appdeployer.command.AbstractManageResourceTest;
 import com.marklogic.appdeployer.command.Command;
+import com.marklogic.appdeployer.command.modules.LoadModulesCommand;
+import com.marklogic.appdeployer.command.restapis.DeployRestApiServersCommand;
+import com.marklogic.client.DatabaseClient;
+import com.marklogic.client.DatabaseClientFactory;
 import com.marklogic.mgmt.ManageClient;
+import com.marklogic.mgmt.ManageConfig;
 import com.marklogic.mgmt.resource.ResourceManager;
 import com.marklogic.mgmt.resource.security.AmpManager;
 import org.junit.Test;
 
 public class ManageAmpsTest extends AbstractManageResourceTest {
 
+	@Test
+	public void ampLoadedBeforeModules() {
+		initializeAppDeployer(new DeployUsersCommand(), new DeployRestApiServersCommand(true),
+			new DeployAmpsCommand(), new LoadModulesCommand());
+		appConfig.setModuleTimestampsPath(null);
+
+		try {
+			deploySampleApp();
+
+			// Create a client for a user that does not have the status privilege, which is required
+			// by the get-host-status function
+			DatabaseClient client = DatabaseClientFactory.newClient(super.manageConfig.getHost(), appConfig.getRestPort(),
+				new DatabaseClientFactory.DigestAuthContext("sample-app-jane", "password"));
+
+			String output = client.newServerEval().xquery(
+				"import module namespace sample = 'urn:sampleapp' at '/ext/sample-lib.xqy'; " +
+				"sample:get-host-status()").evalAs(String.class);
+
+			assertNotNull("The amp is loaded before the module, but it should still apply and allow the user " +
+				"to invoke the function that requires the status-builtins privilege", output);
+		} finally {
+			undeploySampleApp();
+		}
+	}
+
 	/**
 	 * This test verifies that AmpManager can correctly handle two amps that have the same local-name, document-uri,
 	 * and namespace, but with a different modules-database.

src/test/resources/sample-app/src/main/ml-config/security/amps/amp-1.json

@@ -1,7 +1,7 @@
 {
-  "namespace": "http://example.com/uri",
-  "local-name": "ml-app-deployer-test-1",
-  "document-uri": "/module/path/name",
-  "modules-database": "Modules",
-  "role": ["app-user"]
+  "namespace": "urn:sampleapp",
+  "local-name": "get-host-status",
+  "document-uri": "/ext/sample-lib.xqy",
+  "modules-database": "%%MODULES_DATABASE%%",
+  "role": ["admin"]
 }

src/test/resources/sample-app/src/main/ml-config/security/users/jane.json

@@ -1,4 +1,6 @@
 {
-  "user-name":"sample-app-jane", 
-  "password": "password"
+  "user-name":"sample-app-jane",
+  "password": "password",
+	"description": "temporal-admin is granted so the user can hit /v1/eval, as that grants the xdbc-eval privilege",
+	"role": ["rest-reader", "rest-extension-user", "temporal-admin"]
 }

src/test/resources/sample-app/src/main/ml-modules/ext/sample-lib.xqy

@@ -6,3 +6,8 @@ declare function echo($str as xs:string?) as xs:string
 {
   "You said: " || $str
 };
+
+declare function get-host-status()
+{
+	xdmp:host-status(xdmp:host())
+};