Merge pull request #19256 from vespa-engine/bjorncs/s3-athenz-access-control

Bjorncs/s3 athenz access control

1 files changed, 20 insertions, 0 deletions

diff --git a/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/integration/athenz/ZmsClientMock.java b/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/integration/athenz/ZmsClientMock.java
index f02ba85c9bf..42a5e2b42be 100644
--- a/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/integration/athenz/ZmsClientMock.java
+++ b/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/integration/athenz/ZmsClientMock.java
@@ -17,6 +17,7 @@ import com.yahoo.vespa.hosted.controller.api.identifiers.ApplicationId;
 
 import java.time.Instant;
 import java.util.ArrayList;
+import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
@@ -80,6 +81,25 @@ public class ZmsClientMock implements ZmsClient {
     }
 
     @Override
+    public void createTenantResourceGroup(AthenzDomain tenantDomain, AthenzIdentity provider, String resourceGroup,
+                                          Set<RoleAction> roleActions) {
+        log("createTenantResourceGroup(tenantDomain='%s', resourceGroup='%s')", tenantDomain, resourceGroup);
+        AthenzDbMock.Domain domain = getDomainOrThrow(tenantDomain, true);
+        ApplicationId applicationId = new ApplicationId(resourceGroup);
+        if (!domain.applications.containsKey(applicationId)) {
+            domain.applications.put(applicationId, new AthenzDbMock.Application());
+        }
+    }
+
+    @Override
+    public Set<RoleAction> getTenantResourceGroups(AthenzDomain tenantDomain, AthenzIdentity provider, String resourceGroup) {
+        Set<RoleAction> result = new HashSet<>();
+        getDomainOrThrow(tenantDomain, true).applications.get(resourceGroup).acl
+                .forEach((role, roleMembers) -> result.add(new RoleAction(role.roleName, role.roleName)));
+        return result;
+    }
+
+    @Override
     public void addRoleMember(AthenzRole role, AthenzIdentity member, Optional<String> reason) {
         if ( ! role.roleName().equals("tenancy.vespa.hosting.admin"))
             throw new IllegalArgumentException("Mock only supports adding tenant admins, not " + role.roleName());