Add cli commands to modify repository permissions (#2090)

Co-authored-by: Konstantin Schaper <konstantin.schaper@cloudogu.com>

scm-webapp/src/test/java/sonia/scm/cli/CliProcessorTest.java

@@ -25,8 +25,10 @@
 package sonia.scm.cli;
 
 import com.google.common.collect.ImmutableList;
+import com.google.inject.Binder;
 import com.google.inject.Guice;
 import com.google.inject.Injector;
+import com.google.inject.Module;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Nested;
 import org.junit.jupiter.api.Test;
@@ -35,6 +37,7 @@ import org.mockito.Answers;
 import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
 import picocli.CommandLine;
+import sonia.scm.i18n.I18nCollector;
 import sonia.scm.plugin.PluginLoader;
 
 import javax.annotation.Nonnull;
@@ -44,6 +47,7 @@ import java.util.Locale;
 
 import static java.lang.String.format;
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
@@ -64,6 +68,8 @@ class CliProcessorTest {
   private CliExecutionExceptionHandler executionExceptionHandler;
   @Mock
   private CliParameterExceptionHandler parameterExceptionHandler;
+  @Mock
+  private PermissionDescriptionResolverFactory permissionDescriptionResolverFactory;
 
   @BeforeEach
   void mockPluginLoader() {
@@ -83,7 +89,7 @@ class CliProcessorTest {
     @Test
     void shouldExecutePingCommand() {
       when(registry.createCommandTree()).thenReturn(ImmutableList.of(new RegisteredCommandNode("ping", PingCommand.class)));
-      Injector injector = Guice.createInjector();
+      Injector injector = Guice.createInjector(new MockedModule());
       CliProcessor cliProcessor = new CliProcessor(registry, injector, exceptionHandlerFactory, pluginLoader);
 
       cliProcessor.execute(context, "ping");
@@ -94,7 +100,7 @@ class CliProcessorTest {
     @Test
     void shouldExecutePingCommandWithExitCode0() {
       when(registry.createCommandTree()).thenReturn(ImmutableList.of(new RegisteredCommandNode("ping", PingCommand.class)));
-      Injector injector = Guice.createInjector();
+      Injector injector = Guice.createInjector(new MockedModule());
       CliProcessor cliProcessor = new CliProcessor(registry, injector, exceptionHandlerFactory, pluginLoader);
 
       int exitCode = cliProcessor.execute(context, "ping");
@@ -177,7 +183,7 @@ class CliProcessorTest {
     ByteArrayOutputStream baos = new ByteArrayOutputStream();
     when(context.getStdout()).thenReturn(new PrintWriter(baos));
 
-    Injector injector = Guice.createInjector();
+    Injector injector = Guice.createInjector(new MockedModule());
     CliProcessor cliProcessor = new CliProcessor(registry, injector, exceptionHandlerFactory, pluginLoader);
 
     cliProcessor.execute(context, args);
@@ -210,4 +216,14 @@ class CliProcessorTest {
 
     }
   }
+
+  static class MockedModule implements Module {
+
+    @Override
+    public void configure(Binder binder) {
+      I18nCollector i18nCollector = mock(I18nCollector.class);
+      binder.bind(PermissionDescriptionResolverFactory.class)
+        .toInstance(new PermissionDescriptionResolverFactory(i18nCollector));
+    }
+  }
 }

scm-webapp/src/test/java/sonia/scm/repository/cli/RepositoryDeleteCommandTest.java

@@ -29,7 +29,6 @@ import org.junit.jupiter.api.extension.ExtendWith;
 import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
-import sonia.scm.cli.CliContext;
 import sonia.scm.repository.NamespaceAndName;
 import sonia.scm.repository.Repository;
 import sonia.scm.repository.RepositoryManager;

scm-webapp/src/test/java/sonia/scm/repository/cli/RepositoryGetCommandTest.java

@@ -33,10 +33,7 @@ import sonia.scm.repository.NamespaceAndName;
 import sonia.scm.repository.Repository;
 import sonia.scm.repository.RepositoryManager;
 import sonia.scm.repository.RepositoryTestData;
-import sonia.scm.repository.cli.RepositoryGetCommand;
-import sonia.scm.repository.cli.RepositoryTemplateRenderer;
 
-import static org.junit.jupiter.api.Assertions.*;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 

scm-webapp/src/test/java/sonia/scm/repository/cli/RepositoryListCommandTest.java

@@ -24,7 +24,6 @@
 
 package sonia.scm.repository.cli;
 
-import com.google.common.collect.ImmutableMap;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.mockito.ArgumentCaptor;
@@ -41,8 +40,6 @@ import java.util.Map;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyMap;
-import static org.mockito.ArgumentMatchers.anyString;
-import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.Mockito.doNothing;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.never;

scm-webapp/src/test/java/sonia/scm/repository/cli/RepositoryPermissionsAddCommandTest.java

@@ -0,0 +1,226 @@
+/*
+ * MIT License
+ *
+ * Copyright (c) 2020-present Cloudogu GmbH and Contributors
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+package sonia.scm.repository.cli;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Nested;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import sonia.scm.cli.PermissionDescriptionResolver;
+import sonia.scm.repository.NamespaceAndName;
+import sonia.scm.repository.Repository;
+import sonia.scm.repository.RepositoryManager;
+import sonia.scm.repository.RepositoryPermission;
+import sonia.scm.repository.RepositoryRole;
+import sonia.scm.repository.RepositoryRoleManager;
+import sonia.scm.repository.RepositoryTestData;
+
+import java.util.List;
+import java.util.Set;
+
+import static java.util.Optional.empty;
+import static java.util.Optional.of;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.groups.Tuple.tuple;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.ArgumentMatchers.argThat;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class RepositoryPermissionsAddCommandTest {
+
+  @Mock
+  private RepositoryManager repositoryManager;
+  @Mock
+  private RepositoryRoleManager roleManager;
+  @Mock
+  private PermissionDescriptionResolver permissionDescriptionResolver;
+  @Mock
+  private RepositoryTemplateRenderer templateRenderer;
+
+  @InjectMocks
+  private RepositoryPermissionsAddCommand command;
+
+  private final Repository repository = RepositoryTestData.createHeartOfGold();
+
+  @Nested
+  class ForExistingRepository {
+
+    @BeforeEach
+    void mockRepository() {
+      when(repositoryManager.get(new NamespaceAndName("hitchhiker", "HeartOfGold")))
+        .thenReturn(repository);
+    }
+
+    @Nested
+    class ForExistingVerbs {
+
+      @BeforeEach
+      void mockVerbs() {
+        when(permissionDescriptionResolver.getDescription(anyString()))
+          .thenAnswer(invocation -> of(invocation.getArgument(0, String.class)));
+      }
+
+      @Test
+      void shouldSetMultipleVerbsForNewUser() {
+        command.setRepositoryName("hitchhiker/HeartOfGold");
+        command.setName("trillian");
+        command.setVerbs("read", "pull", "push");
+
+        command.run();
+
+        verify(repositoryManager).modify(argThat(argument -> {
+          assertThat(argument.getPermissions()).extracting("name", "verbs", "groupPermission")
+            .containsExactly(tuple("trillian", Set.of("read", "pull", "push"), false));
+          return true;
+        }));
+      }
+
+      @Test
+      void shouldAddNewVerbToExistingVerbsForUser() {
+        repository.setPermissions(
+          List.of(
+            new RepositoryPermission("trillian", List.of("read"), false)
+          )
+        );
+
+        command.setRepositoryName("hitchhiker/HeartOfGold");
+        command.setName("trillian");
+        command.setVerbs("write");
+
+        command.run();
+
+        verify(repositoryManager).modify(argThat(argument -> {
+          assertThat(argument.getPermissions()).extracting("name", "verbs", "groupPermission")
+            .containsExactly(tuple("trillian", Set.of("read", "write"), false));
+          return true;
+        }));
+      }
+
+      @Test
+      void shouldAddNewVerbToExistingVerbsForGroup() {
+        repository.setPermissions(
+          List.of(
+            new RepositoryPermission("hog", List.of("read"), true)
+          )
+        );
+
+        command.setRepositoryName("hitchhiker/HeartOfGold");
+        command.setName("hog");
+        command.setVerbs("write");
+        command.setForGroup(true);
+
+        command.run();
+
+        verify(repositoryManager).modify(argThat(argument -> {
+          assertThat(argument.getPermissions()).extracting("name", "verbs", "groupPermission")
+            .containsExactly(tuple("hog", Set.of("read", "write"), true));
+          return true;
+        }));
+      }
+
+      @Test
+      void shouldAddNewVerbToRoleAndReplaceRoleWithCustomPermissionsForUser() {
+        repository.setPermissions(
+          List.of(
+            new RepositoryPermission("trillian", "READ", false)
+          )
+        );
+        when(roleManager.get("READ"))
+          .thenReturn(new RepositoryRole("READ", List.of("read", "pull"), ""));
+
+        command.setRepositoryName("hitchhiker/HeartOfGold");
+        command.setName("trillian");
+        command.setVerbs("write");
+
+        command.run();
+
+        verify(repositoryManager).modify(argThat(argument -> {
+          assertThat(argument.getPermissions()).extracting("name", "verbs", "groupPermission")
+            .containsExactly(tuple("trillian", Set.of("pull", "read", "write"), false));
+          return true;
+        }));
+      }
+
+      @Test
+      void shouldNotModifyRoleIfNewVerbIsPartOfRole() {
+        repository.setPermissions(
+          List.of(
+            new RepositoryPermission("trillian", "READ", false)
+          )
+        );
+        when(roleManager.get("READ"))
+          .thenReturn(new RepositoryRole("READ", List.of("read", "pull"), ""));
+
+        command.setRepositoryName("hitchhiker/HeartOfGold");
+        command.setName("trillian");
+        command.setVerbs("read");
+
+        command.run();
+
+        verify(repositoryManager, never()).modify(any());
+      }
+    }
+
+    @Test
+    void shouldHandleMissingVerb() {
+      command.setRepositoryName("hitchhiker/HeartOfGold");
+      command.setName("trillian");
+      command.setVerbs("make-party");
+
+      command.run();
+
+      verify(templateRenderer).renderVerbNotFoundError();
+    }
+  }
+
+  @Test
+  void shouldHandleIllegalNamespaceNameParameter() {
+    command.setRepositoryName("illegal name");
+    command.setName("trillian");
+    command.setVerbs("write");
+
+    command.run();
+
+    verify(templateRenderer).renderInvalidInputError();
+  }
+
+  @Test
+  void shouldHandleNotExistingRepository() {
+    command.setRepositoryName("no/repository");
+    command.setName("trillian");
+    command.setVerbs("write");
+
+    command.run();
+
+    verify(templateRenderer).renderNotFoundError();
+  }
+}

scm-webapp/src/test/java/sonia/scm/repository/cli/RepositoryPermissionsAvailableCommandTest.java

@@ -0,0 +1,153 @@
+/*
+ * MIT License
+ *
+ * Copyright (c) 2020-present Cloudogu GmbH and Contributors
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+package sonia.scm.repository.cli;
+
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Captor;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import sonia.scm.cli.PermissionDescriptionResolver;
+import sonia.scm.repository.RepositoryRole;
+import sonia.scm.repository.RepositoryRoleManager;
+import sonia.scm.security.RepositoryPermissionProvider;
+
+import java.util.Collection;
+import java.util.List;
+
+import static java.util.Collections.emptyList;
+import static java.util.Optional.empty;
+import static java.util.Optional.of;
+import static java.util.stream.Collectors.toList;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.doNothing;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class RepositoryPermissionsAvailableCommandTest {
+
+  @Mock
+  private RepositoryTemplateRenderer templateRenderer;
+  @Mock
+  private RepositoryPermissionProvider repositoryPermissionProvider;
+  @Mock
+  private PermissionDescriptionResolver permissionDescriptionResolver;
+  @Mock
+  private RepositoryRoleManager repositoryRoleManager;
+
+  @InjectMocks
+  private RepositoryPermissionsAvailableCommand command;
+
+  @Captor
+  private ArgumentCaptor<Collection<VerbBean>> verbsCaptor;
+  @Captor
+  private ArgumentCaptor<Collection<RoleBean>> rolesCaptor;
+
+  @Test
+  void shouldListVerbs() {
+    doNothing().when(templateRenderer).render(any(), verbsCaptor.capture());
+    when(repositoryPermissionProvider.availableVerbs())
+      .thenReturn(List.of("read", "write"));
+    when(permissionDescriptionResolver.getDescription("read"))
+      .thenReturn(of("read repository"));
+    when(permissionDescriptionResolver.getDescription("write"))
+      .thenReturn(of("write repository"));
+
+    command.run();
+
+    Collection<VerbBean> capturedVerbs = verbsCaptor.getValue();
+
+    assertThat(capturedVerbs).
+      extracting("verb")
+      .containsExactly("read", "write");
+    assertThat(capturedVerbs).
+      extracting("description")
+      .containsExactly("read repository", "write repository");
+  }
+
+  @Test
+  void shouldHandleMissingDescription() {
+    doNothing().when(templateRenderer).render(any(), verbsCaptor.capture());
+    when(repositoryPermissionProvider.availableVerbs())
+      .thenReturn(List.of("unknown"));
+    when(permissionDescriptionResolver.getDescription("unknown"))
+      .thenReturn(empty());
+
+    command.run();
+
+    Collection<VerbBean> capturedVerbs = verbsCaptor.getValue();
+
+    assertThat(capturedVerbs).
+      extracting("verb")
+      .containsExactly("unknown");
+    assertThat(capturedVerbs).
+      extracting("description")
+      .containsExactly("unknown");
+  }
+
+  @Test
+  void shouldRenderRoles() {
+    doNothing().when(templateRenderer).render(rolesCaptor.capture(), any());
+    when(repositoryRoleManager.getAll())
+      .thenReturn(List.of(new RepositoryRole("READ", List.of("read", "pull"), null)));
+
+    command.run();
+
+    Collection<RoleBean> capturedRoles = rolesCaptor.getValue();
+
+    assertThat(capturedRoles)
+      .extracting("name")
+      .containsExactly("READ");
+    assertThat(capturedRoles)
+      .extracting("verbs")
+      .map(c -> ((Collection) c).stream().collect(toList())) // to satisfy equal in the comparison, we have to use this form
+      .containsExactly(List.of("read", "pull"));
+  }
+
+  @Test
+  void shouldRenderRolesOnlyWithFlag() {
+    command.setRoles(true);
+
+    command.run();
+
+    verify(templateRenderer).renderRoles(emptyList());
+    verify(templateRenderer, never()).renderVerbs(any());
+  }
+
+  @Test
+  void shouldRenderVerbsOnlyWithFlag() {
+    command.setVerbs(true);
+
+    command.run();
+
+    verify(templateRenderer).renderVerbs(emptyList());
+    verify(templateRenderer, never()).renderRoles(any());
+  }
+}

scm-webapp/src/test/java/sonia/scm/repository/cli/RepositoryPermissionsClearCommandTest.java

@@ -0,0 +1,128 @@
+/*
+ * MIT License
+ *
+ * Copyright (c) 2020-present Cloudogu GmbH and Contributors
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+package sonia.scm.repository.cli;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Nested;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import sonia.scm.repository.NamespaceAndName;
+import sonia.scm.repository.Repository;
+import sonia.scm.repository.RepositoryManager;
+import sonia.scm.repository.RepositoryPermission;
+import sonia.scm.repository.RepositoryTestData;
+
+import java.util.List;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.argThat;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class RepositoryPermissionsClearCommandTest {
+
+  @Mock
+  private RepositoryManager repositoryManager;
+  @Mock
+  private RepositoryTemplateRenderer templateRenderer;
+
+  @InjectMocks
+  private RepositoryPermissionsClearCommand command;
+
+  private final Repository repository = RepositoryTestData.createHeartOfGold();
+
+  @Nested
+  class ForExistingRepository {
+
+    @BeforeEach
+    void mockRepository() {
+      when(repositoryManager.get(new NamespaceAndName("hitchhiker", "HeartOfGold")))
+        .thenReturn(repository);
+    }
+
+    @Test
+    void shouldClearPermissionsForUser() {
+      repository.setPermissions(
+        List.of(
+          new RepositoryPermission("trillian", List.of("read"), false)
+        )
+      );
+
+      command.setRepositoryName("hitchhiker/HeartOfGold");
+      command.setName("trillian");
+
+      command.run();
+
+      verify(repositoryManager).modify(argThat(argument -> {
+        assertThat(argument.getPermissions()).isEmpty();
+        return true;
+      }));
+    }
+
+    @Test
+    void shouldClearPermissionsForGroup() {
+      repository.setPermissions(
+        List.of(
+          new RepositoryPermission("hog", "READ", true)
+        )
+      );
+
+      command.setRepositoryName("hitchhiker/HeartOfGold");
+      command.setName("hog");
+      command.setForGroup(true);
+
+      command.run();
+
+      verify(repositoryManager).modify(argThat(argument -> {
+        assertThat(argument.getPermissions()).isEmpty();
+        return true;
+      }));
+    }
+  }
+
+  @Test
+  void shouldHandleIllegalNamespaceNameParameter() {
+    command.setRepositoryName("illegal name");
+    command.setName("trillian");
+
+    command.run();
+
+    verify(templateRenderer).renderInvalidInputError();
+  }
+
+  @Test
+  void shouldHandleNotExistingRepository() {
+    command.setRepositoryName("no/repository");
+    command.setName("trillian");
+
+    command.run();
+
+    verify(templateRenderer).renderNotFoundError();
+  }
+}

scm-webapp/src/test/java/sonia/scm/repository/cli/RepositoryPermissionsListCommandTest.java

@@ -0,0 +1,195 @@
+/*
+ * MIT License
+ *
+ * Copyright (c) 2020-present Cloudogu GmbH and Contributors
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+package sonia.scm.repository.cli;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Nested;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Captor;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import sonia.scm.cli.CommandValidator;
+import sonia.scm.cli.PermissionDescriptionResolver;
+import sonia.scm.repository.NamespaceAndName;
+import sonia.scm.repository.Repository;
+import sonia.scm.repository.RepositoryManager;
+import sonia.scm.repository.RepositoryPermission;
+import sonia.scm.repository.RepositoryRole;
+import sonia.scm.repository.RepositoryRoleManager;
+import sonia.scm.repository.RepositoryTestData;
+
+import java.util.Collection;
+import java.util.List;
+
+import static java.util.Optional.of;
+import static java.util.stream.Collectors.toList;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.groups.Tuple.tuple;
+import static org.mockito.Mockito.doNothing;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class RepositoryPermissionsListCommandTest {
+
+  @Mock
+  private RepositoryTemplateRenderer templateRenderer;
+  @Mock
+  private CommandValidator validator;
+  @Mock
+  private RepositoryManager manager;
+  @Mock
+  private RepositoryRoleManager roleManager;
+  @Mock
+  private PermissionDescriptionResolver permissionDescriptionResolver;
+
+  @InjectMocks
+  private RepositoryPermissionsListCommand command;
+
+  @Test
+  void shouldPrintNotFoundErrorForUnknownRepository() {
+    command.setRepository("hg2g/hog");
+
+    command.run();
+
+    verify(templateRenderer).renderNotFoundError();
+  }
+
+  @Nested
+  class ForExistingRepository {
+
+    @Captor
+    private ArgumentCaptor<Collection<RepositoryPermissionBean>> permissionsCaptor;
+
+    private final Repository repository = RepositoryTestData.createHeartOfGold();
+
+    @BeforeEach
+    void mockRepository() {
+      when(manager.get(new NamespaceAndName("hitchhiker", "HeartOfGold")))
+        .thenReturn(repository);
+      command.setRepository("hitchhiker/HeartOfGold");
+    }
+
+    @Nested
+    class WithoutVerboseFlag {
+
+      @BeforeEach
+      void setUpRenderer() {
+        doNothing().when(templateRenderer).render(permissionsCaptor.capture());
+      }
+
+      @Test
+      void shouldRenderEmptyTableWithoutPermissions() {
+        command.run();
+
+        Collection<RepositoryPermissionBean> beans = permissionsCaptor.getValue();
+        assertThat(beans).isEmpty();
+      }
+
+      @Test
+      void shouldListCustomUserPermission() {
+        RepositoryPermission permission = new RepositoryPermission("trillian", List.of("read", "write"), false);
+        repository.setPermissions(List.of(permission));
+        when(permissionDescriptionResolver.getDescription("read"))
+          .thenReturn(of("read repository"));
+        when(permissionDescriptionResolver.getDescription("write"))
+          .thenReturn(of("write repository"));
+
+        command.run();
+
+        Collection<RepositoryPermissionBean> beans = permissionsCaptor.getValue();
+        assertThat(beans).extracting("groupPermission", "name", "role")
+          .containsExactly(tuple(false, "trillian", "CUSTOM"));
+      }
+    }
+
+    @Nested
+    class WithVerboseFlag {
+
+      @BeforeEach
+      void setUpRenderer() {
+        doNothing().when(templateRenderer).renderVerbose(permissionsCaptor.capture());
+      }
+
+      @BeforeEach
+      void setVerbose() {
+        command.setVerbose(true);
+      }
+
+      @Test
+      void shouldListUserPermissionWithVerbs() {
+        RepositoryPermission permission = new RepositoryPermission("trillian", List.of("read", "write"), false);
+        repository.setPermissions(List.of(permission));
+        when(permissionDescriptionResolver.getDescription("read"))
+          .thenReturn(of("read repository"));
+        when(permissionDescriptionResolver.getDescription("write"))
+          .thenReturn(of("write repository"));
+
+        command.run();
+
+        Collection<RepositoryPermissionBean> beans = permissionsCaptor.getValue();
+        assertThat(beans).extracting("groupPermission", "name", "role", "verbs")
+          .containsExactly(tuple(false, "trillian", "CUSTOM", List.of("read repository", "write repository")));
+      }
+
+      @Test
+      void shouldListUserPermissionWithRole() {
+        RepositoryPermission permission = new RepositoryPermission("trillian", "READ", false);
+        repository.setPermissions(List.of(permission));
+        when(roleManager.get("READ"))
+          .thenReturn(new RepositoryRole("READ", List.of("read", "pull"), ""));
+        when(permissionDescriptionResolver.getDescription("read"))
+          .thenReturn(of("read repository"));
+        when(permissionDescriptionResolver.getDescription("pull"))
+          .thenReturn(of("clone/checkout repository"));
+
+        command.run();
+
+        Collection<RepositoryPermissionBean> beans = permissionsCaptor.getValue();
+        assertThat(beans).extracting("groupPermission", "name", "verbs")
+          .containsExactly(tuple(false, "trillian", List.of("read repository", "clone/checkout repository")));
+      }
+
+      @Test
+      void shouldListUserPermissionWithVerbsAsKeys() {
+        RepositoryPermission permission = new RepositoryPermission("trillian", List.of("read", "write"), false);
+        repository.setPermissions(List.of(permission));
+
+        command.setKeys(true);
+        command.run();
+
+        Collection<RepositoryPermissionBean> beans = permissionsCaptor.getValue();
+        assertThat(beans).extracting("groupPermission", "name", "role")
+          .containsExactly(tuple(false, "trillian", "CUSTOM"));
+        assertThat(beans).extracting("verbs")
+          .map(c -> ((Collection) c).stream().collect(toList())) // to satisfy equal in the comparison, we have to use this form
+          .containsExactly(List.of("read", "write"));
+      }
+    }
+  }
+}

scm-webapp/src/test/java/sonia/scm/repository/cli/RepositoryPermissionsRemoveCommandTest.java

@@ -0,0 +1,182 @@
+/*
+ * MIT License
+ *
+ * Copyright (c) 2020-present Cloudogu GmbH and Contributors
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+package sonia.scm.repository.cli;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Nested;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import sonia.scm.repository.NamespaceAndName;
+import sonia.scm.repository.Repository;
+import sonia.scm.repository.RepositoryManager;
+import sonia.scm.repository.RepositoryPermission;
+import sonia.scm.repository.RepositoryRole;
+import sonia.scm.repository.RepositoryRoleManager;
+import sonia.scm.repository.RepositoryTestData;
+
+import java.util.List;
+import java.util.Set;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.groups.Tuple.tuple;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.argThat;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class RepositoryPermissionsRemoveCommandTest {
+
+  @Mock
+  private RepositoryManager repositoryManager;
+  @Mock
+  private RepositoryRoleManager roleManager;
+  @Mock
+  private RepositoryTemplateRenderer templateRenderer;
+
+  @InjectMocks
+  private RepositoryPermissionsRemoveCommand command;
+
+  private final Repository repository = RepositoryTestData.createHeartOfGold();
+
+  @Nested
+  class ForExistingRepository {
+
+    @BeforeEach
+    void mockRepository() {
+      when(repositoryManager.get(new NamespaceAndName("hitchhiker", "HeartOfGold")))
+        .thenReturn(repository);
+    }
+
+    @Test
+    void shouldRemoveMultipleVerbsFromExistingVerbsForUser() {
+      repository.setPermissions(
+        List.of(
+          new RepositoryPermission("dent", List.of("read", "write", "push", "pull"), false)
+        )
+      );
+
+      command.setRepositoryName("hitchhiker/HeartOfGold");
+      command.setName("dent");
+      command.setVerbs("write", "push", "pull");
+
+      command.run();
+
+      verify(repositoryManager).modify(argThat(argument -> {
+        assertThat(argument.getPermissions()).extracting("name", "verbs", "groupPermission")
+          .containsExactly(tuple("dent", Set.of("read"), false));
+        return true;
+      }));
+    }
+
+    @Test
+    void shouldRemoveNewVerbFromExistingVerbsForGroup() {
+      repository.setPermissions(
+        List.of(
+          new RepositoryPermission("hog", List.of("read", "write"), true)
+        )
+      );
+
+      command.setRepositoryName("hitchhiker/HeartOfGold");
+      command.setName("hog");
+      command.setVerbs("write");
+      command.setForGroup(true);
+
+      command.run();
+
+      verify(repositoryManager).modify(argThat(argument -> {
+        assertThat(argument.getPermissions()).extracting("name", "verbs", "groupPermission")
+          .containsExactly(tuple("hog", Set.of("read"), true));
+        return true;
+      }));
+    }
+
+    @Test
+    void shouldRemoveNewVerbToRoleAndReplaceRoleWithCustomPermissionsForUser() {
+      repository.setPermissions(
+        List.of(
+          new RepositoryPermission("dent", "READ", false)
+        )
+      );
+      when(roleManager.get("READ"))
+        .thenReturn(new RepositoryRole("READ", List.of("read", "pull"), ""));
+
+      command.setRepositoryName("hitchhiker/HeartOfGold");
+      command.setName("dent");
+      command.setVerbs("pull");
+
+      command.run();
+
+      verify(repositoryManager).modify(argThat(argument -> {
+        assertThat(argument.getPermissions()).extracting("name", "verbs", "groupPermission")
+          .containsExactly(tuple("dent", Set.of("read"), false));
+        return true;
+      }));
+    }
+
+    @Test
+    void shouldNotModifyRepositoryIfVerbsAreNotSet() {
+      repository.setPermissions(
+        List.of(
+          new RepositoryPermission("dent", List.of("read", "write"), false)
+        )
+      );
+
+      command.setRepositoryName("hitchhiker/HeartOfGold");
+      command.setName("dent");
+      command.setVerbs("push", "pull");
+
+      command.run();
+
+      verify(repositoryManager, never()).modify(any());
+    }
+  }
+
+  @Test
+  void shouldHandleIllegalNamespaceNameParameter() {
+    command.setRepositoryName("illegal name");
+    command.setName("trillian");
+    command.setVerbs("write");
+
+    command.run();
+
+    verify(templateRenderer).renderInvalidInputError();
+  }
+
+  @Test
+  void shouldHandleNotExistingRepository() {
+    command.setRepositoryName("no/repository");
+    command.setName("trillian");
+    command.setVerbs("write");
+
+    command.run();
+
+    verify(templateRenderer).renderNotFoundError();
+  }
+}

scm-webapp/src/test/java/sonia/scm/repository/cli/RepositoryPermissionsSetRoleCommandTest.java

@@ -0,0 +1,196 @@
+/*
+ * MIT License
+ *
+ * Copyright (c) 2020-present Cloudogu GmbH and Contributors
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+package sonia.scm.repository.cli;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Nested;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import sonia.scm.repository.NamespaceAndName;
+import sonia.scm.repository.Repository;
+import sonia.scm.repository.RepositoryManager;
+import sonia.scm.repository.RepositoryPermission;
+import sonia.scm.repository.RepositoryRole;
+import sonia.scm.repository.RepositoryRoleManager;
+import sonia.scm.repository.RepositoryTestData;
+
+import java.util.List;
+
+import static java.util.Collections.emptyList;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.groups.Tuple.tuple;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.argThat;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class RepositoryPermissionsSetRoleCommandTest {
+
+  @Mock
+  private RepositoryManager repositoryManager;
+  @Mock
+  private RepositoryRoleManager roleManager;
+  @Mock
+  private RepositoryTemplateRenderer templateRenderer;
+
+  @InjectMocks
+  private RepositoryPermissionsSetRoleCommand command;
+
+  private final Repository repository = RepositoryTestData.createHeartOfGold();
+
+  @Nested
+  class ForExistingRepository {
+
+    @BeforeEach
+    void mockRepository() {
+      when(repositoryManager.get(new NamespaceAndName("hitchhiker", "HeartOfGold")))
+        .thenReturn(repository);
+    }
+
+    @Nested
+    class ForExistingRole {
+
+      @BeforeEach
+      void mockRole() {
+        when(roleManager.get(any())).thenAnswer(
+          invocation -> new RepositoryRole(invocation.getArgument(0, String.class), emptyList(), null));
+      }
+
+      @Test
+      void shouldSetRoleForUser() {
+        command.setRepositoryName("hitchhiker/HeartOfGold");
+        command.setName("trillian");
+        command.setRole("OWNER");
+
+        command.run();
+
+        verify(repositoryManager).modify(argThat(argument -> {
+          assertThat(argument.getPermissions()).extracting("name", "role", "groupPermission")
+            .containsExactly(tuple("trillian", "OWNER", false));
+          return true;
+        }));
+      }
+
+      @Test
+      void shouldSetRoleForGroup() {
+        command.setRepositoryName("hitchhiker/HeartOfGold");
+        command.setName("crew");
+        command.setRole("READ");
+        command.setForGroup(true);
+
+        command.run();
+
+        verify(repositoryManager).modify(argThat(argument -> {
+          assertThat(argument.getPermissions()).extracting("name", "role", "groupPermission")
+            .containsExactly(tuple("crew", "READ", true));
+          return true;
+        }));
+      }
+
+      @Test
+      void shouldReplaceRepositoryPermissionForUser() {
+        repository.setPermissions(
+          List.of(
+            new RepositoryPermission("trillian", List.of("read"), false)
+          )
+        );
+
+        command.setRepositoryName("hitchhiker/HeartOfGold");
+        command.setName("trillian");
+        command.setRole("OWNER");
+
+        command.run();
+
+        verify(repositoryManager).modify(argThat(argument -> {
+          assertThat(argument.getPermissions()).extracting("name", "role", "groupPermission")
+            .containsExactly(tuple("trillian", "OWNER", false));
+          return true;
+        }));
+      }
+
+      @Test
+      void shouldReplaceRepositoryPermissionForGroup() {
+        repository.setPermissions(
+          List.of(
+            new RepositoryPermission("trillian", List.of("read"), true)
+          )
+        );
+
+        command.setRepositoryName("hitchhiker/HeartOfGold");
+        command.setName("trillian");
+        command.setRole("OWNER");
+        command.setForGroup(true);
+
+        command.run();
+
+        verify(repositoryManager).modify(argThat(argument -> {
+          assertThat(argument.getPermissions()).extracting("name", "role", "groupPermission")
+            .containsExactly(tuple("trillian", "OWNER", true));
+          return true;
+        }));
+      }
+    }
+
+    @Test
+    void shouldHandleMissingRole() {
+      command.setRepositoryName("hitchhiker/HeartOfGold");
+      command.setName("trillian");
+      command.setRole("FUNNY");
+
+      command.run();
+
+      verify(templateRenderer).renderRoleNotFoundError();
+    }
+  }
+
+  @Test
+  void shouldHandleIllegalNamespaceNameParameter() {
+    command.setRepositoryName("illegal name");
+    command.setName("trillian");
+    command.setRole("READ");
+
+    command.run();
+
+    verify(templateRenderer).renderInvalidInputError();
+    verify(repositoryManager, never()).modify(any());
+  }
+
+  @Test
+  void shouldHandleNotExistingRepository() {
+    command.setRepositoryName("no/repository");
+    command.setName("trillian");
+    command.setRole("READ");
+
+    command.run();
+
+    verify(templateRenderer).renderNotFoundError();
+    verify(repositoryManager, never()).modify(any());
+  }
+}