Remove visibility of "old" roles

7 files changed, 62 insertions, 164 deletions

diff --git a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/user/UserApiHandler.java b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/user/UserApiHandler.java
index 060e3f52c70..59cfc188ebe 100644
--- a/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/user/UserApiHandler.java
+++ b/controller-server/src/main/java/com/yahoo/vespa/hosted/controller/restapi/user/UserApiHandler.java
@@ -194,7 +194,7 @@ public class UserApiHandler extends LoggingRequestHandler {
 
         if (   role.definition() == RoleDefinition.administrator
             && Set.of(user.value()).equals(users.listUsers(role).stream().map(User::email).collect(Collectors.toSet())))
-        throw new IllegalArgumentException("Can't remove the last owner of a tenant.");
+        throw new IllegalArgumentException("Can't remove the last administrator of a tenant.");
 
         if (role.definition().equals(RoleDefinition.developer))
             controller.tenants().lockIfPresent(TenantName.from(tenantName), LockedTenant.Cloud.class, tenant -> {
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/user/UserApiTest.java b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/user/UserApiTest.java
index 212e9dcbd22..d50114f2636 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/user/UserApiTest.java
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/user/UserApiTest.java
@@ -64,7 +64,7 @@ public class UserApiTest extends ControllerContainerCloudTest {
         // POST a tenant is available to operators.
         tester.assertResponse(request("/application/v4/tenant/my-tenant", POST)
                                       .roles(operator)
-                                      .user("owner@tenant")
+                                      .user("administrator@tenant")
                                       .data("{\"token\":\"hello\"}"),
                               new File("tenant-without-applications.json"));
 
@@ -79,134 +79,121 @@ public class UserApiTest extends ControllerContainerCloudTest {
 
         // POST a hosted operator role is not allowed.
         tester.assertResponse(request("/user/v1/tenant/my-tenant", POST)
-                                      .roles(Set.of(Role.tenantOwner(id.tenant())))
+                                      .roles(Set.of(Role.administrator(id.tenant())))
                                       .data("{\"user\":\"evil@evil\",\"roleName\":\"hostedOperator\"}"),
                               "{\"error-code\":\"BAD_REQUEST\",\"message\":\"Malformed or illegal role name 'hostedOperator'.\"}", 400);
 
-        // POST a tenant operator is available to the tenant owner.
+        // POST a tenant developer is available to the tenant owner.
         tester.assertResponse(request("/user/v1/tenant/my-tenant", POST)
-                                      .roles(Set.of(Role.tenantOwner(id.tenant())))
-                                      .data("{\"user\":\"operator@tenant\",\"roleName\":\"tenantOperator\"}"),
-                              "{\"message\":\"user 'operator@tenant' is now a member of role 'tenantOperator' of 'my-tenant'\"}");
+                                      .roles(Set.of(Role.administrator(id.tenant())))
+                                      .data("{\"user\":\"developer@tenant\",\"roleName\":\"developer\"}"),
+                              "{\"message\":\"user 'developer@tenant' is now a member of role 'developer' of 'my-tenant'\"}");
 
-        // POST a tenant admin is not available to a tenant operator.
+        // POST a tenant admin is not available to a tenant developer.
         tester.assertResponse(request("/user/v1/tenant/my-tenant", POST)
-                                      .roles(Set.of(Role.tenantOperator(id.tenant())))
-                                      .data("{\"user\":\"admin@tenant\",\"roleName\":\"tenantAdmin\"}"),
+                                      .roles(Set.of(Role.developer(id.tenant())))
+                                      .data("{\"user\":\"developer@tenant\",\"roleName\":\"administrator\"}"),
                               accessDenied, 403);
 
-        // POST an application admin for a non-existent application fails.
+        // POST a headless for a non-existent application fails.
         tester.assertResponse(request("/user/v1/tenant/my-tenant/application/my-app", POST)
-                                      .roles(Set.of(Role.tenantOwner(TenantName.from("my-tenant"))))
-                                      .data("{\"user\":\"admin@app\",\"roleName\":\"applicationAdmin\"}"),
+                                      .roles(Set.of(Role.administrator(TenantName.from("my-tenant"))))
+                                      .data("{\"user\":\"headless@app\",\"roleName\":\"headless\"}"),
                               "{\"error-code\":\"INTERNAL_SERVER_ERROR\",\"message\":\"NullPointerException\"}", 500);
 
-        // POST an application is allowed for a tenant operator.
+        // POST an application is allowed for a tenant developer.
         tester.assertResponse(request("/application/v4/tenant/my-tenant/application/my-app", POST)
-                                      .user("operator@tenant")
-                                      .roles(Set.of(Role.tenantOperator(id.tenant()))),
+                                      .user("developer@tenant")
+                                      .roles(Set.of(Role.developer(id.tenant()))),
                               new File("application-created.json"));
 
         // POST an application is not allowed under a different tenant.
         tester.assertResponse(request("/application/v4/tenant/other-tenant/application/my-app", POST)
-                                      .roles(Set.of(Role.tenantOperator(id.tenant()))),
+                                      .roles(Set.of(Role.administrator(id.tenant()))),
                               accessDenied, 403);
 
-        // POST an application role is allowed for a tenant admin.
-        tester.assertResponse(request("/user/v1/tenant/my-tenant/application/my-app", POST)
-                                      .roles(Set.of(Role.tenantAdmin(id.tenant())))
-                                      .data("{\"user\":\"reader@app\",\"roleName\":\"applicationReader\"}"),
-                              "{\"message\":\"user 'reader@app' is now a member of role 'applicationReader' of 'my-app' owned by 'my-tenant'\"}");
-
         // POST a tenant role is not allowed to an application.
         tester.assertResponse(request("/user/v1/tenant/my-tenant/application/my-app", POST)
                                       .roles(Set.of(Role.hostedOperator()))
-                                      .data("{\"user\":\"reader@app\",\"roleName\":\"tenantOperator\"}"),
-                              "{\"error-code\":\"BAD_REQUEST\",\"message\":\"Malformed or illegal role name 'tenantOperator'.\"}", 400);
+                                      .data("{\"user\":\"developer@app\",\"roleName\":\"developer\"}"),
+                              "{\"error-code\":\"BAD_REQUEST\",\"message\":\"Malformed or illegal role name 'developer'.\"}", 400);
 
-        // GET tenant role information is available to application readers.
+        // GET tenant role information is available to readers.
         tester.assertResponse(request("/user/v1/tenant/my-tenant")
-                             .roles(Set.of(Role.applicationReader(id.tenant(), id.application()))),
+                             .roles(Set.of(Role.reader(id.tenant()))),
                               new File("tenant-roles.json"));
 
-        // GET application role information is available to tenant operators.
+        // GET application role information is available to tenant administrators.
         tester.assertResponse(request("/user/v1/tenant/my-tenant/application/my-app")
-                                      .roles(Set.of(Role.tenantOperator(id.tenant()))),
+                                      .roles(Set.of(Role.administrator(id.tenant()))),
                               new File("application-roles.json"));
 
         // GET application role information is available also under the /api prefix.
         tester.assertResponse(request("/api/user/v1/tenant/my-tenant/application/my-app")
-                                      .roles(Set.of(Role.tenantOperator(id.tenant()))),
+                                      .roles(Set.of(Role.administrator(id.tenant()))),
                               new File("application-roles.json"));
 
         // POST a pem deploy key
         tester.assertResponse(request("/application/v4/tenant/my-tenant/application/my-app/key", POST)
-                                      .roles(Set.of(Role.tenantOperator(id.tenant())))
+                                      .roles(Set.of(Role.developer(id.tenant())))
                                       .data("{\"key\":\"" + pemPublicKey + "\"}"),
                               new File("first-deploy-key.json"));
 
         // POST a pem developer key
         tester.assertResponse(request("/application/v4/tenant/my-tenant/key", POST)
                                       .user("joe@dev")
-                                      .roles(Set.of(Role.tenantOperator(id.tenant())))
+                                      .roles(Set.of(Role.developer(id.tenant())))
                                       .data("{\"key\":\"" + pemPublicKey + "\"}"),
                               new File("first-developer-key.json"));
 
         // POST the same pem developer key for a different user is forbidden
         tester.assertResponse(request("/application/v4/tenant/my-tenant/key", POST)
                                       .user("operator@tenant")
-                                      .roles(Set.of(Role.tenantOperator(id.tenant())))
+                                      .roles(Set.of(Role.developer(id.tenant())))
                                       .data("{\"key\":\"" + pemPublicKey + "\"}"),
                               "{\"error-code\":\"BAD_REQUEST\",\"message\":\"Key "+  quotedPemPublicKey + " is already owned by joe@dev\"}",
                               400);
 
         // PATCH in a different pem developer key
         tester.assertResponse(request("/application/v4/tenant/my-tenant/key", POST)
-                                      .user("operator@tenant")
-                                      .roles(Set.of(Role.tenantOperator(id.tenant())))
+                                      .user("developer@tenant")
+                                      .roles(Set.of(Role.developer(id.tenant())))
                                       .data("{\"key\":\"" + otherPemPublicKey + "\"}"),
                               new File("both-developer-keys.json"));
 
         // GET tenant information with keys
         tester.assertResponse(request("/application/v4/tenant/my-tenant/")
-                                      .roles(Set.of(Role.applicationReader(id.tenant(), id.application()))),
+                                      .roles(Set.of(Role.reader(id.tenant()))),
                               new File("tenant-with-keys.json"));
 
         // DELETE a pem developer key
         tester.assertResponse(request("/application/v4/tenant/my-tenant/key", DELETE)
-                                      .roles(Set.of(Role.tenantOperator(id.tenant())))
+                                      .roles(Set.of(Role.developer(id.tenant())))
                                       .data("{\"key\":\"" + pemPublicKey + "\"}"),
                               new File("second-developer-key.json"));
 
-        // DELETE an application role is allowed for an application admin.
-        tester.assertResponse(request("/user/v1/tenant/my-tenant/application/my-app", DELETE)
-                                      .roles(Set.of(Role.applicationAdmin(id.tenant(), id.application())))
-                                      .data("{\"user\":\"operator@tenant\",\"roleName\":\"applicationAdmin\"}"),
-                              "{\"message\":\"user 'operator@tenant' is no longer a member of role 'applicationAdmin' of 'my-app' owned by 'my-tenant'\"}");
-
         // DELETE an application is available to application admins.
         tester.assertResponse(request("/application/v4/tenant/my-tenant/application/my-app", DELETE)
-                             .roles(Set.of(Role.applicationAdmin(id.tenant(), id.application()))),
+                             .roles(Set.of(Role.developer(id.tenant()))),
                               "{\"message\":\"Deleted application my-tenant.my-app\"}");
 
         // DELETE a tenant role is available to tenant admins.
         // DELETE the developer role clears any developer key.
         tester.assertResponse(request("/user/v1/tenant/my-tenant", DELETE)
-                                      .roles(Set.of(Role.tenantAdmin(id.tenant())))
-                                      .data("{\"user\":\"operator@tenant\",\"roleName\":\"tenantOperator\"}"),
-                              "{\"message\":\"user 'operator@tenant' is no longer a member of role 'tenantOperator' of 'my-tenant'\"}");
-
-        // TODO: Fix these tests once we update test for new roles
-//        // DELETE the last tenant owner is not allowed.
-//        tester.assertResponse(request("/user/v1/tenant/my-tenant", DELETE)
-//                             .roles(operator)
-//                             .data("{\"user\":\"owner@tenant\",\"roleName\":\"tenantOwner\"}"),
-//                              "{\"error-code\":\"BAD_REQUEST\",\"message\":\"Can't remove the last owner of a tenant.\"}", 400);
-
-//        // DELETE the tenant is available to the tenant owner.
-//        tester.assertResponse(request("/application/v4/tenant/my-tenant", DELETE)
-//                                      .roles(Set.of(Role.tenantOwner(id.tenant()))),
-//                              new File("tenant-without-applications.json"));
+                                      .roles(Set.of(Role.administrator(id.tenant())))
+                                      .data("{\"user\":\"developer@tenant\",\"roleName\":\"developer\"}"),
+                              "{\"message\":\"user 'developer@tenant' is no longer a member of role 'developer' of 'my-tenant'\"}");
+
+        // DELETE the last tenant owner is not allowed.
+        tester.assertResponse(request("/user/v1/tenant/my-tenant", DELETE)
+                             .roles(operator)
+                             .data("{\"user\":\"administrator@tenant\",\"roleName\":\"administrator\"}"),
+                              "{\"error-code\":\"BAD_REQUEST\",\"message\":\"Can't remove the last administrator of a tenant.\"}", 400);
+
+        // DELETE the tenant is available to the tenant owner.
+        tester.assertResponse(request("/application/v4/tenant/my-tenant", DELETE)
+                                      .roles(Set.of(Role.tenantOwner(id.tenant()))),
+                              new File("tenant-without-applications.json"));
     }
 
 }
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/user/responses/application-roles.json b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/user/responses/application-roles.json
index c391bd2d61f..e05156e3eef 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/user/responses/application-roles.json
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/user/responses/application-roles.json
@@ -2,33 +2,13 @@
   "tenant": "my-tenant",
   "application": "my-app",
   "roleNames": [
-    "applicationAdmin",
-    "applicationOperator",
-    "applicationDeveloper",
-    "applicationReader",
     "headless"
   ],
   "users": [
     {
-      "name": "operator@tenant",
-      "email": "operator@tenant",
+      "name": "administrator@tenant",
+      "email": "administrator@tenant",
       "roles": {
-        "applicationAdmin": {
-          "explicit": false,
-          "implied": false
-        },
-        "applicationOperator": {
-          "explicit": false,
-          "implied": false
-        },
-        "applicationDeveloper": {
-          "explicit": false,
-          "implied": false
-        },
-        "applicationReader": {
-          "explicit": false,
-          "implied": false
-        },
         "headless": {
           "explicit": false,
           "implied": false
@@ -36,51 +16,9 @@
       }
     },
     {
-      "name": "owner@tenant",
-      "email": "owner@tenant",
+      "name": "developer@tenant",
+      "email": "developer@tenant",
       "roles": {
-        "applicationAdmin": {
-          "explicit": false,
-          "implied": false
-        },
-        "applicationOperator": {
-          "explicit": false,
-          "implied": false
-        },
-        "applicationDeveloper": {
-          "explicit": false,
-          "implied": false
-        },
-        "applicationReader": {
-          "explicit": false,
-          "implied": false
-        },
-        "headless": {
-          "explicit": false,
-          "implied": false
-        }
-      }
-    },
-    {
-      "name": "reader@app",
-      "email": "reader@app",
-      "roles": {
-        "applicationAdmin": {
-          "explicit": false,
-          "implied": false
-        },
-        "applicationOperator": {
-          "explicit": false,
-          "implied": false
-        },
-        "applicationDeveloper": {
-          "explicit": false,
-          "implied": false
-        },
-        "applicationReader": {
-          "explicit": true,
-          "implied": false
-        },
         "headless": {
           "explicit": false,
           "implied": false
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/user/responses/both-developer-keys.json b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/user/responses/both-developer-keys.json
index 2ff1c29fe29..bc49135a1db 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/user/responses/both-developer-keys.json
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/user/responses/both-developer-keys.json
@@ -6,7 +6,7 @@
     },
     {
       "key": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEFELzPyinTfQ/sZnTmRp5E4Ve/sbE\npDhJeqczkyFcT2PysJ5sZwm7rKPEeXDOhzTPCyRvbUqc2SGdWbKUGGa/Yw==\n-----END PUBLIC KEY-----\n",
-      "user": "operator@tenant"
+      "user": "developer@tenant"
     }
   ]
 }
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/user/responses/second-developer-key.json b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/user/responses/second-developer-key.json
index f7d90f31116..64098a775a1 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/user/responses/second-developer-key.json
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/user/responses/second-developer-key.json
@@ -2,7 +2,7 @@
   "keys": [
     {
       "key": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEFELzPyinTfQ/sZnTmRp5E4Ve/sbE\npDhJeqczkyFcT2PysJ5sZwm7rKPEeXDOhzTPCyRvbUqc2SGdWbKUGGa/Yw==\n-----END PUBLIC KEY-----\n",
-      "user": "operator@tenant"
+      "user": "developer@tenant"
     }
   ]
 }
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/user/responses/tenant-roles.json b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/user/responses/tenant-roles.json
index d49afd2da9e..61c1c94d4ca 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/user/responses/tenant-roles.json
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/user/responses/tenant-roles.json
@@ -1,62 +1,35 @@
 {
   "tenant": "my-tenant",
   "roleNames": [
-    "tenantOwner",
-    "tenantAdmin",
-    "tenantOperator",
     "administrator",
     "developer",
     "reader"
   ],
   "users": [
     {
-      "name": "operator@tenant",
-      "email": "operator@tenant",
+      "name": "administrator@tenant",
+      "email": "administrator@tenant",
       "roles": {
-        "tenantOwner": {
-          "explicit": false,
-          "implied": false
-        },
-        "tenantAdmin": {
-          "explicit": false,
-          "implied": false
-        },
-        "tenantOperator": {
-          "explicit": true,
-          "implied": false
-        },
         "administrator": {
-          "explicit": false,
+          "explicit": true,
           "implied": false
         },
         "developer": {
-          "explicit": false,
+          "explicit": true,
           "implied": false
         },
         "reader": {
-          "explicit": false,
+          "explicit": true,
           "implied": false
         }
       }
     },
     {
-      "name": "owner@tenant",
-      "email": "owner@tenant",
+      "name": "developer@tenant",
+      "email": "developer@tenant",
       "roles": {
-        "tenantOwner": {
-          "explicit": false,
-          "implied": false
-        },
-        "tenantAdmin": {
-          "explicit": false,
-          "implied": false
-        },
-        "tenantOperator": {
-          "explicit": false,
-          "implied": false
-        },
         "administrator": {
-          "explicit": true,
+          "explicit": false,
           "implied": false
         },
         "developer": {
@@ -64,7 +37,7 @@
           "implied": false
         },
         "reader": {
-          "explicit": true,
+          "explicit": false,
           "implied": false
         }
       }
diff --git a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/user/responses/tenant-with-keys.json b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/user/responses/tenant-with-keys.json
index b7970a48963..24ac6633f6c 100644
--- a/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/user/responses/tenant-with-keys.json
+++ b/controller-server/src/test/java/com/yahoo/vespa/hosted/controller/restapi/user/responses/tenant-with-keys.json
@@ -8,7 +8,7 @@
     },
     {
       "key": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEFELzPyinTfQ/sZnTmRp5E4Ve/sbE\npDhJeqczkyFcT2PysJ5sZwm7rKPEeXDOhzTPCyRvbUqc2SGdWbKUGGa/Yw==\n-----END PUBLIC KEY-----\n",
-      "user": "operator@tenant"
+      "user": "developer@tenant"
     }],
   "applications": []
 }