Define access control for '/system-flags/v1' on controller

1 files changed, 9 insertions, 0 deletions

diff --git a/controller-api/src/test/java/com/yahoo/vespa/hosted/controller/api/role/RoleTest.java b/controller-api/src/test/java/com/yahoo/vespa/hosted/controller/api/role/RoleTest.java
index fcac8c1efd2..6dd815f4f51 100644
--- a/controller-api/src/test/java/com/yahoo/vespa/hosted/controller/api/role/RoleTest.java
+++ b/controller-api/src/test/java/com/yahoo/vespa/hosted/controller/api/role/RoleTest.java
@@ -126,4 +126,13 @@ public class RoleTest {
         assertFalse(tenantAdmin1.implies(applicationHeadless11));
         assertFalse(applicationHeadless11.implies(applicationHeadless12));
     }
+
+    @Test
+    public void system_flags() {
+        URI uri = URI.create("/system-flags/v1/deploy");
+        Action action = Action.update;
+        assertTrue(mainEnforcer.allows(Role.systemFlagsDeployer(), action, uri));
+        assertTrue(mainEnforcer.allows(Role.hostedOperator(), action, uri));
+        assertFalse(mainEnforcer.allows(Role.everyone(), action, uri));
+    }
 }