add user role related entity, repository and service and rename username to userId

apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/auth/CtripUserInfoHolder.java

@@ -36,7 +36,7 @@ public class CtripUserInfoHolder implements UserInfoHolder{
       String name = (String) getName.invoke(principal);
 
       UserInfo userInfo = new UserInfo();
-      userInfo.setUsername(name);
+      userInfo.setUserId(name);
 
       return userInfo;
     } catch (Exception e) {

apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/auth/DefaultUserInfoHolder.java

@@ -15,7 +15,7 @@ public class DefaultUserInfoHolder implements UserInfoHolder{
   @Override
   public UserInfo getUser() {
     UserInfo userInfo = new UserInfo();
-    userInfo.setUsername("apollo");
+    userInfo.setUserId("apollo");
     return userInfo;
   }
 }

apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/controller/PortalServerConfigController.java

@@ -32,7 +32,7 @@ public class PortalServerConfigController {
       throw new BadRequestException("request payload contains empty");
     }
 
-    String modifiedBy = userInfoHolder.getUser().getUsername();
+    String modifiedBy = userInfoHolder.getUser().getUserId();
 
     ServerConfig storedConfig = serverConfigRepository.findByKey(serverConfig.getKey());
 

apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/entity/po/Permission.java

+package com.ctrip.framework.apollo.portal.entity.po;
+
+import com.ctrip.framework.apollo.common.entity.BaseEntity;
+
+import org.hibernate.annotations.SQLDelete;
+import org.hibernate.annotations.Where;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.Table;
+
+/**
+ * @author Jason Song(song_s@ctrip.com)
+ */
+@Entity
+@Table(name = "Permission")
+@SQLDelete(sql = "Update Permission set isDeleted = 1 where id = ?")
+@Where(clause = "isDeleted = 0")
+public class Permission extends BaseEntity {
+  @Column(name = "PermissionType", nullable = false)
+  private String permissionType;
+
+  @Column(name = "TargetId", nullable = false)
+  private String targetId;
+
+  public String getPermissionType() {
+    return permissionType;
+  }
+
+  public void setPermissionType(String permissionType) {
+    this.permissionType = permissionType;
+  }
+
+  public String getTargetId() {
+    return targetId;
+  }
+
+  public void setTargetId(String targetId) {
+    this.targetId = targetId;
+  }
+}

apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/entity/po/Role.java

+package com.ctrip.framework.apollo.portal.entity.po;
+
+import com.ctrip.framework.apollo.common.entity.BaseEntity;
+
+import org.hibernate.annotations.SQLDelete;
+import org.hibernate.annotations.Where;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.Table;
+
+/**
+ * @author Jason Song(song_s@ctrip.com)
+ */
+@Entity
+@Table(name = "Role")
+@SQLDelete(sql = "Update Role set isDeleted = 1 where id = ?")
+@Where(clause = "isDeleted = 0")
+public class Role extends BaseEntity {
+  @Column(name = "RoleName", nullable = false)
+  private String roleName;
+
+  public String getRoleName() {
+    return roleName;
+  }
+
+  public void setRoleName(String roleName) {
+    this.roleName = roleName;
+  }
+}

apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/entity/po/RolePermission.java

+package com.ctrip.framework.apollo.portal.entity.po;
+
+import com.ctrip.framework.apollo.common.entity.BaseEntity;
+
+import org.hibernate.annotations.SQLDelete;
+import org.hibernate.annotations.Where;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.Table;
+
+/**
+ * @author Jason Song(song_s@ctrip.com)
+ */
+@Entity
+@Table(name = "RolePermission")
+@SQLDelete(sql = "Update RolePermission set isDeleted = 1 where id = ?")
+@Where(clause = "isDeleted = 0")
+public class RolePermission extends BaseEntity {
+  @Column(name = "RoleId", nullable = false)
+  private long roleId;
+
+  @Column(name = "PermissionId", nullable = false)
+  private long permissionId;
+
+  public long getRoleId() {
+    return roleId;
+  }
+
+  public void setRoleId(long roleId) {
+    this.roleId = roleId;
+  }
+
+  public long getPermissionId() {
+    return permissionId;
+  }
+
+  public void setPermissionId(long permissionId) {
+    this.permissionId = permissionId;
+  }
+}

apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/entity/po/UserInfo.java

 package com.ctrip.framework.apollo.portal.entity.po;
 
 public class UserInfo {
-  private String username;
+  private String userId;
 
-  public String getUsername() {
-    return username;
+  public String getUserId() {
+    return userId;
   }
 
-  public void setUsername(String username) {
-    this.username = username;
+  public void setUserId(String userId) {
+    this.userId = userId;
   }
 }

apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/entity/po/UserRole.java

+package com.ctrip.framework.apollo.portal.entity.po;
+
+import com.ctrip.framework.apollo.common.entity.BaseEntity;
+
+import org.hibernate.annotations.SQLDelete;
+import org.hibernate.annotations.Where;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.Table;
+
+/**
+ * @author Jason Song(song_s@ctrip.com)
+ */
+@Entity
+@Table(name = "UserRole")
+@SQLDelete(sql = "Update UserRole set isDeleted = 1 where id = ?")
+@Where(clause = "isDeleted = 0")
+public class UserRole extends BaseEntity {
+  @Column(name = "UserId", nullable = false)
+  private String userId;
+
+  @Column(name = "RoleId", nullable = false)
+  private long roleId;
+
+  public String getUserId() {
+    return userId;
+  }
+
+  public void setUserId(String userId) {
+    this.userId = userId;
+  }
+
+  public long getRoleId() {
+    return roleId;
+  }
+
+  public void setRoleId(long roleId) {
+    this.roleId = roleId;
+  }
+}

apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/repository/PermissionRepository.java

+package com.ctrip.framework.apollo.portal.repository;
+
+import com.ctrip.framework.apollo.portal.entity.po.Permission;
+
+import org.springframework.data.repository.PagingAndSortingRepository;
+
+import java.util.Collection;
+import java.util.List;
+
+/**
+ * @author Jason Song(song_s@ctrip.com)
+ */
+public interface PermissionRepository extends PagingAndSortingRepository<Permission, Long> {
+  /**
+   * find permission by permission type and targetId
+   */
+  Permission findTopByPermissionTypeAndTargetId(String permissionType, String targetId);
+
+  /**
+   * find permissions by permission types and targetId
+   * @param permissionTypes
+   * @param targetId
+   * @return
+   */
+  List<Permission> findByPermissionTypeInAndTargetId(Collection<String> permissionTypes,
+                                                           String targetId);
+}

apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/repository/RolePermissionRepository.java

+package com.ctrip.framework.apollo.portal.repository;
+
+import com.ctrip.framework.apollo.portal.entity.po.RolePermission;
+
+import org.springframework.data.repository.PagingAndSortingRepository;
+
+import java.util.Collection;
+import java.util.List;
+
+/**
+ * @author Jason Song(song_s@ctrip.com)
+ */
+public interface RolePermissionRepository extends PagingAndSortingRepository<RolePermission, Long> {
+
+  /**
+   * find role permissions by role ids
+   */
+  List<RolePermission> findByRoleIdIn(Collection<Long> roleId);
+}

apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/repository/RoleRepository.java

+package com.ctrip.framework.apollo.portal.repository;
+
+import com.ctrip.framework.apollo.portal.entity.po.Role;
+
+import org.springframework.data.repository.PagingAndSortingRepository;
+
+/**
+ * @author Jason Song(song_s@ctrip.com)
+ */
+public interface RoleRepository extends PagingAndSortingRepository<Role, Long> {
+  /**
+   * find role by role name
+   * @param roleName
+   * @return
+   */
+  Role findTopByRoleName(String roleName);
+}

apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/repository/UserRoleRepository.java

+package com.ctrip.framework.apollo.portal.repository;
+
+import com.ctrip.framework.apollo.portal.entity.po.UserRole;
+
+import org.springframework.data.repository.PagingAndSortingRepository;
+
+import java.util.Collection;
+import java.util.List;
+import java.util.Set;
+
+/**
+ * @author Jason Song(song_s@ctrip.com)
+ */
+public interface UserRoleRepository extends PagingAndSortingRepository<UserRole, Long> {
+  /**
+   * find user roles by userId
+   * @param userId
+   * @return
+   */
+  List<UserRole> findByUserId(String userId);
+
+  /**
+   * find user roles by roleId
+   * @param roleId
+   * @return
+   */
+  List<UserRole> findByRoleId(long roleId);
+
+  /**
+   * find user roles by userIds and roleId
+   * @param userId
+   * @param roleId
+   * @return
+   */
+  List<UserRole> findByUserIdInAndRoleId(Collection<String> userId, long roleId);
+}

apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/service/PortalAppService.java

@@ -98,7 +98,7 @@ public class PortalAppService {
   }
 
   private void enrichUserInfo(AppDTO app){
-    String username = userInfoHolder.getUser().getUsername();
+    String username = userInfoHolder.getUser().getUserId();
     app.setDataChangeCreatedBy(username);
     app.setDataChangeLastModifiedBy(username);
   }

apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/service/PortalConfigService.java

@@ -67,7 +67,7 @@ public class PortalConfigService {
     }
 
     try {
-      changeSets.setDataChangeLastModifiedBy(userInfoHolder.getUser().getUsername());
+      changeSets.setDataChangeLastModifiedBy(userInfoHolder.getUser().getUserId());
       itemAPI.updateItems(appId, env, clusterName, namespaceName, changeSets);
     } catch (Exception e) {
       logger.error("itemAPI.updateItems error. appId{},env:{},clusterName:{},namespaceName:{}", appId, env, clusterName,
@@ -83,7 +83,7 @@ public class PortalConfigService {
       throw new BadRequestException(
           "namespace:" + namespaceName + " not exist in env:" + env + ", cluster:" + clusterName);
     }
-    String username = userInfoHolder.getUser().getUsername();
+    String username = userInfoHolder.getUser().getUserId();
     if (StringUtils.isEmpty(item.getDataChangeCreatedBy())) {
       item.setDataChangeCreatedBy(username);
     }
@@ -93,7 +93,7 @@ public class PortalConfigService {
   }
 
   public void deleteItem(Env env, long itemId) {
-    itemAPI.deleteItem(env, itemId, userInfoHolder.getUser().getUsername());
+    itemAPI.deleteItem(env, itemId, userInfoHolder.getUser().getUserId());
   }
 
   /**
@@ -102,7 +102,7 @@ public class PortalConfigService {
   public ReleaseDTO createRelease(NamespaceReleaseModel model) {
     return releaseAPI.release(model.getAppId(), model.getEnv(), model.getClusterName(),
                               model.getNamespaceName(), model.getReleaseBy(), model.getReleaseComment()
-        , userInfoHolder.getUser().getUsername());
+        , userInfoHolder.getUser().getUserId());
   }
 
   public List<ItemDTO> findItems(String appId, Env env, String clusterName, String namespaceName) {
@@ -114,7 +114,7 @@ public class PortalConfigService {
     for (ItemDiffs itemDiff : itemDiffs) {
       NamespaceIdentifer namespaceIdentifer = itemDiff.getNamespace();
       ItemChangeSets changeSets = itemDiff.getDiffs();
-      changeSets.setDataChangeLastModifiedBy(userInfoHolder.getUser().getUsername());
+      changeSets.setDataChangeLastModifiedBy(userInfoHolder.getUser().getUserId());
       try {
         itemAPI
             .updateItems(namespaceIdentifer.getAppId(), namespaceIdentifer.getEnv(),

apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/service/PortalNamespaceService.java

@@ -54,14 +54,14 @@ public class PortalNamespaceService {
 
   public NamespaceDTO createNamespace(Env env, NamespaceDTO namespace) {
     if (StringUtils.isEmpty(namespace.getDataChangeCreatedBy())){
-      namespace.setDataChangeCreatedBy(userInfoHolder.getUser().getUsername());
+      namespace.setDataChangeCreatedBy(userInfoHolder.getUser().getUserId());
     }
-    namespace.setDataChangeLastModifiedBy(userInfoHolder.getUser().getUsername());
+    namespace.setDataChangeLastModifiedBy(userInfoHolder.getUser().getUserId());
     return namespaceAPI.createNamespace(env, namespace);
   }
 
   public void createAppNamespace(AppNamespaceDTO appNamespace) {
-    String operator = userInfoHolder.getUser().getUsername();
+    String operator = userInfoHolder.getUser().getUserId();
     if (StringUtils.isEmpty(appNamespace.getDataChangeCreatedBy())){
       appNamespace.setDataChangeCreatedBy(operator);
     }

apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/service/RolePermissionService.java

+package com.ctrip.framework.apollo.portal.service;
+
+import com.google.common.base.Preconditions;
+import com.google.common.collect.FluentIterable;
+import com.google.common.collect.HashMultimap;
+import com.google.common.collect.Multimap;
+import com.google.common.collect.Sets;
+
+import com.ctrip.framework.apollo.portal.entity.po.Permission;
+import com.ctrip.framework.apollo.portal.entity.po.Role;
+import com.ctrip.framework.apollo.portal.entity.po.RolePermission;
+import com.ctrip.framework.apollo.portal.entity.po.UserInfo;
+import com.ctrip.framework.apollo.portal.entity.po.UserRole;
+import com.ctrip.framework.apollo.portal.repository.PermissionRepository;
+import com.ctrip.framework.apollo.portal.repository.RolePermissionRepository;
+import com.ctrip.framework.apollo.portal.repository.RoleRepository;
+import com.ctrip.framework.apollo.portal.repository.UserRoleRepository;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+import org.springframework.util.CollectionUtils;
+
+import java.util.Collection;
+import java.util.Collections;
+import java.util.Date;
+import java.util.List;
+import java.util.Set;
+
+/**
+ * @author Jason Song(song_s@ctrip.com)
+ */
+@Service
+public class RolePermissionService {
+  @Autowired
+  private RoleRepository roleRepository;
+
+  @Autowired
+  private RolePermissionRepository rolePermissionRepository;
+
+  @Autowired
+  private UserRoleRepository userRoleRepository;
+
+  @Autowired
+  private PermissionRepository permissionRepository;
+
+  /**
+   * Create role with permissions, note that role name should be unique
+   */
+  @Transactional
+  public Role createRoleWithPermissions(Role role, Set<Long> permissionIds) {
+    Role current = roleRepository.findTopByRoleName(role.getRoleName());
+    Preconditions.checkState(current == null, "Role %s already exists!", role.getRoleName());
+
+    Role createdRole = roleRepository.save(role);
+
+    if (!CollectionUtils.isEmpty(permissionIds)) {
+      Iterable<RolePermission> rolePermissions = FluentIterable.from(permissionIds).transform(
+          permissionId -> {
+            RolePermission rolePermission = new RolePermission();
+            rolePermission.setRoleId(createdRole.getId());
+            rolePermission.setPermissionId(permissionId);
+            rolePermission.setDataChangeCreatedBy(createdRole.getDataChangeCreatedBy());
+            rolePermission.setDataChangeLastModifiedBy(createdRole.getDataChangeLastModifiedBy());
+            return rolePermission;
+          });
+      rolePermissionRepository.save(rolePermissions);
+    }
+
+    return createdRole;
+  }
+
+  /**
+   * Assign role to users
+   */
+  @Transactional
+  public void assignRoleToUsers(String roleName, Set<String> userIds, String operatorUserId) {
+    Role role = roleRepository.findTopByRoleName(roleName);
+    Preconditions.checkState(role != null, "Role %s doesn't exist!", roleName);
+
+    List<UserRole> existedUserRoles =
+        userRoleRepository.findByUserIdInAndRoleId(userIds, role.getId());
+    Set<String> existedUserIds =
+        FluentIterable.from(existedUserRoles).transform(userRole -> userRole.getUserId()).toSet();
+
+    Set<String> toAssignUserIds = Sets.difference(userIds, existedUserIds);
+
+    Iterable<UserRole> toCreate = FluentIterable.from(toAssignUserIds).transform(userId -> {
+      UserRole userRole = new UserRole();
+      userRole.setRoleId(role.getId());
+      userRole.setUserId(userId);
+      userRole.setDataChangeCreatedBy(operatorUserId);
+      userRole.setDataChangeLastModifiedBy(operatorUserId);
+      return userRole;
+    });
+
+    userRoleRepository.save(toCreate);
+  }
+
+  /**
+   * Remove role from users
+   */
+  @Transactional
+  public void removeRoleFromUsers(String roleName, Set<String> userIds, String operatorUserId) {
+    Role role = roleRepository.findTopByRoleName(roleName);
+    Preconditions.checkState(role != null, "Role %s doesn't exist!", roleName);
+
+    List<UserRole> existedUserRoles =
+        userRoleRepository.findByUserIdInAndRoleId(userIds, role.getId());
+
+    for (UserRole userRole : existedUserRoles) {
+      userRole.setDeleted(true);
+      userRole.setDataChangeLastModifiedTime(new Date());
+      userRole.setDataChangeLastModifiedBy(operatorUserId);
+    }
+
+    userRoleRepository.save(existedUserRoles);
+  }
+
+  /**
+   * Query users with role
+   */
+  public Set<UserInfo> queryUsersWithRole(String roleName) {
+    Role role = roleRepository.findTopByRoleName(roleName);
+
+    if (role == null) {
+      return Collections.emptySet();
+    }
+
+    List<UserRole> userRoles = userRoleRepository.findByRoleId(role.getId());
+
+    Set<UserInfo> users = FluentIterable.from(userRoles).transform(userRole -> {
+      UserInfo userInfo = new UserInfo();
+      userInfo.setUserId(userRole.getUserId());
+      return userInfo;
+    }).toSet();
+
+    return users;
+  }
+
+  /**
+   * Check whether user has the permission
+   */
+  public boolean userHasPermission(String userId, String permissionType, String targetId) {
+    Permission permission =
+        permissionRepository.findTopByPermissionTypeAndTargetId(permissionType, targetId);
+    if (permission == null) {
+      return false;
+    }
+
+    List<UserRole> userRoles = userRoleRepository.findByUserId(userId);
+    if (CollectionUtils.isEmpty(userRoles)) {
+      return false;
+    }
+
+    Set<Long> roleIds =
+        FluentIterable.from(userRoles).transform(userRole -> userRole.getRoleId()).toSet();
+    List<RolePermission> rolePermissions = rolePermissionRepository.findByRoleIdIn(roleIds);
+    if (CollectionUtils.isEmpty(rolePermissions)) {
+      return false;
+    }
+
+    for (RolePermission rolePermission : rolePermissions) {
+      if (rolePermission.getPermissionId() == permission.getId()) {
+        return true;
+      }
+    }
+
+    return false;
+  }
+
+  /**
+   * Create permission, note that permissionType + targetId should be unique
+   */
+  @Transactional
+  public Permission createPermission(Permission permission) {
+    String permissionType = permission.getPermissionType();
+    String targetId = permission.getTargetId();
+    Permission current =
+        permissionRepository.findTopByPermissionTypeAndTargetId(permissionType, targetId);
+    Preconditions.checkState(current == null,
+        "Permission with permissionType %s targetId %s already exists!", permissionType, targetId);
+
+    return permissionRepository.save(permission);
+  }
+
+  /**
+   * Create permissions, note that permissionType + targetId should be unique
+   */
+  @Transactional
+  public Set<Permission> createPermissions(Set<Permission> permissions) {
+    Multimap<String, String> targetIdPermissionTypes = HashMultimap.create();
+    for (Permission permission : permissions) {
+      targetIdPermissionTypes.put(permission.getTargetId(), permission.getPermissionType());
+    }
+
+    for (String targetId : targetIdPermissionTypes.keySet()) {
+      Collection<String> permissionTypes = targetIdPermissionTypes.get(targetId);
+      List<Permission> current =
+          permissionRepository.findByPermissionTypeInAndTargetId(permissionTypes, targetId);
+      Preconditions.checkState(CollectionUtils.isEmpty(current),
+          "Permission with permissionType %s targetId %s already exists!", permissionTypes,
+          targetId);
+    }
+
+    Iterable<Permission> results = permissionRepository.save(permissions);
+    return FluentIterable.from(results).toSet();
+  }
+}

apollo-portal/src/test/java/com/ctrip/framework/apollo/portal/AllTests.java

 package com.ctrip.framework.apollo.portal;
 
 
+import com.ctrip.framework.apollo.portal.service.RolePermissionServiceTest;
+
 import org.junit.runner.RunWith;
 import org.junit.runners.Suite;
 import org.junit.runners.Suite.SuiteClasses;
@@ -8,7 +10,7 @@ import org.junit.runners.Suite.SuiteClasses;
 @RunWith(Suite.class)
 @SuiteClasses({
     ConfigServiceTest.class, PropertyResolverTest.class,
-    NamespaceServiceTest.class
+    NamespaceServiceTest.class, ServiceExceptionTest.class, RolePermissionServiceTest.class
 })
 public class AllTests {
 

apollo-portal/src/test/java/com/ctrip/framework/apollo/portal/ConfigServiceTest.java

@@ -70,7 +70,7 @@ public class ConfigServiceTest {
     when(resolver.resolve(0, model.getConfigText(), itemDTOs)).thenReturn(changeSets);
 
     UserInfo userInfo = new UserInfo();
-    userInfo.setUsername("test");
+    userInfo.setUserId("test");
     when(userInfoHolder.getUser()).thenReturn(userInfo);
 
     try {
@@ -105,7 +105,7 @@ public class ConfigServiceTest {
     when(itemAPI.findItems(appId, Env.valueOf(env), clusterName, namespaceName)).thenReturn(null);
 
     UserInfo userInfo = new UserInfo();
-    userInfo.setUsername("test");
+    userInfo.setUserId("test");
     when(userInfoHolder.getUser()).thenReturn(userInfo);
 
     List<ItemDiffs> itemDiffses = configService.compare(namespaceIdentifers, sourceItems);
@@ -146,7 +146,7 @@ public class ConfigServiceTest {
     when(itemAPI.findItems(appId, Env.valueOf(env), clusterName, namespaceName)).thenReturn(targetItems);
 
     UserInfo userInfo = new UserInfo();
-    userInfo.setUsername("test");
+    userInfo.setUserId("test");
     when(userInfoHolder.getUser()).thenReturn(userInfo);
 
     List<ItemDiffs> itemDiffses = configService.compare(namespaceIdentifers, sourceItems);

apollo-portal/src/test/java/com/ctrip/framework/apollo/portal/ServiceExceptionTest.java

@@ -45,7 +45,7 @@ public class ServiceExceptionTest extends AbstractPortalTest {
   }
 
   private String getBaseAppUrl() {
-    return "http://localhost:" + port + "/apps/";
+    return "http://localhost:" + port + "/apps/envs/ALL";
   }
 
   @Test

apollo-portal/src/test/java/com/ctrip/framework/apollo/portal/service/RolePermissionServiceTest.java

+package com.ctrip.framework.apollo.portal.service;
+
+import com.google.common.collect.FluentIterable;
+import com.google.common.collect.Sets;
+
+import com.ctrip.framework.apollo.common.entity.BaseEntity;
+import com.ctrip.framework.apollo.portal.AbstractPortalTest;
+import com.ctrip.framework.apollo.portal.entity.po.Permission;
+import com.ctrip.framework.apollo.portal.entity.po.Role;
+import com.ctrip.framework.apollo.portal.entity.po.RolePermission;
+import com.ctrip.framework.apollo.portal.entity.po.UserInfo;
+import com.ctrip.framework.apollo.portal.entity.po.UserRole;
+import com.ctrip.framework.apollo.portal.repository.PermissionRepository;
+import com.ctrip.framework.apollo.portal.repository.RolePermissionRepository;
+import com.ctrip.framework.apollo.portal.repository.RoleRepository;
+import com.ctrip.framework.apollo.portal.repository.UserRoleRepository;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.test.context.jdbc.Sql;
+
+import java.util.List;
+import java.util.Set;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+/**
+ * @author Jason Song(song_s@ctrip.com)
+ */
+public class RolePermissionServiceTest extends AbstractPortalTest {
+  @Autowired
+  private RolePermissionService rolePermissionService;
+
+  @Autowired
+  private RoleRepository roleRepository;
+
+  @Autowired
+  private RolePermissionRepository rolePermissionRepository;
+
+  @Autowired
+  private UserRoleRepository userRoleRepository;
+
+  @Autowired
+  private PermissionRepository permissionRepository;
+
+  private String someCreatedBy;
+
+  private String someLastModifiedBy;
+
+  @Before
+  public void setUp() throws Exception {
+    someCreatedBy = "someCreatedBy";
+    someLastModifiedBy = "someLastModifiedBy";
+  }
+
+  @Test
+  @Sql(scripts = "/sql/cleanup.sql", executionPhase = Sql.ExecutionPhase.AFTER_TEST_METHOD)
+  public void testCreatePermission() throws Exception {
+    String someTargetId = "someTargetId";
+    String somePermissionType = "somePermissionType";
+
+    Permission somePermission = assemblePermission(somePermissionType, someTargetId);
+
+    Permission created = rolePermissionService.createPermission(somePermission);
+
+    Permission createdFromDB = permissionRepository.findOne(created.getId());
+
+    assertEquals(somePermissionType, createdFromDB.getPermissionType());
+    assertEquals(someTargetId, createdFromDB.getTargetId());
+  }
+
+  @Test(expected = IllegalStateException.class)
+  @Sql(scripts = "/sql/insert-test-permissions.sql", executionPhase = Sql.ExecutionPhase.BEFORE_TEST_METHOD)
+  @Sql(scripts = "/sql/cleanup.sql", executionPhase = Sql.ExecutionPhase.AFTER_TEST_METHOD)
+  public void testCreatePermissionWithPermissionExisted() throws Exception {
+    String someTargetId = "someTargetId";
+    String somePermissionType = "somePermissionType";
+
+    Permission somePermission = assemblePermission(somePermissionType, someTargetId);
+
+    rolePermissionService.createPermission(somePermission);
+  }
+
+  @Test
+  @Sql(scripts = "/sql/cleanup.sql", executionPhase = Sql.ExecutionPhase.AFTER_TEST_METHOD)
+  public void testCreatePermissions() throws Exception {
+    String someTargetId = "someTargetId";
+    String anotherTargetId = "anotherTargetId";
+    String somePermissionType = "somePermissionType";
+    String anotherPermissionType = "anotherPermissionType";
+
+    Permission somePermission = assemblePermission(somePermissionType, someTargetId);
+    Permission anotherPermission = assemblePermission(anotherPermissionType, anotherTargetId);
+
+    Set<Permission> created =
+        rolePermissionService.createPermissions(Sets.newHashSet(somePermission, anotherPermission));
+
+    Set<Long> permissionIds =
+        FluentIterable.from(created).transform(BaseEntity::getId)
+            .toSet();
+
+    Iterable<Permission> permissionsFromDB = permissionRepository.findAll(permissionIds);
+
+    Set<String> targetIds = Sets.newHashSet();
+    Set<String> permissionTypes = Sets.newHashSet();
+    for (Permission permission : permissionsFromDB) {
+      targetIds.add(permission.getTargetId());
+      permissionTypes.add(permission.getPermissionType());
+    }
+
+    assertEquals(2, targetIds.size());
+    assertEquals(2, permissionTypes.size());
+    assertTrue(targetIds.containsAll(Sets.newHashSet(someTargetId, anotherTargetId)));
+    assertTrue(
+        permissionTypes.containsAll(Sets.newHashSet(somePermissionType, anotherPermissionType)));
+  }
+
+  @Test(expected = IllegalStateException.class)
+  @Sql(scripts = "/sql/insert-test-permissions.sql", executionPhase = Sql.ExecutionPhase.BEFORE_TEST_METHOD)
+  @Sql(scripts = "/sql/cleanup.sql", executionPhase = Sql.ExecutionPhase.AFTER_TEST_METHOD)
+  public void testCreatePermissionsWithPermissionsExisted() throws Exception {
+    String someTargetId = "someTargetId";
+    String anotherTargetId = "anotherTargetId";
+    String somePermissionType = "somePermissionType";
+    String anotherPermissionType = "anotherPermissionType";
+
+    Permission somePermission = assemblePermission(somePermissionType, someTargetId);
+    Permission anotherPermission = assemblePermission(anotherPermissionType, anotherTargetId);
+
+    rolePermissionService.createPermissions(Sets.newHashSet(somePermission, anotherPermission));
+  }
+
+  @Test
+  @Sql(scripts = "/sql/insert-test-permissions.sql", executionPhase = Sql.ExecutionPhase.BEFORE_TEST_METHOD)
+  @Sql(scripts = "/sql/cleanup.sql", executionPhase = Sql.ExecutionPhase.AFTER_TEST_METHOD)
+  public void testCreateRoleWithPermissions() throws Exception {
+    String someRoleName = "someRoleName";
+    Role role = assembleRole(someRoleName);
+
+    Set<Long> permissionIds = Sets.newHashSet(990L, 991L);
+
+    Role created = rolePermissionService.createRoleWithPermissions(role, permissionIds);
+
+    Role createdFromDB = roleRepository.findOne(created.getId());
+    List<RolePermission> rolePermissions =
+        rolePermissionRepository.findByRoleIdIn(Sets.newHashSet(createdFromDB.getId()));
+
+    Set<Long> rolePermissionIds =
+        FluentIterable.from(rolePermissions)
+            .transform(RolePermission::getPermissionId).toSet();
+
+    assertEquals(someRoleName, createdFromDB.getRoleName());
+    assertEquals(2, rolePermissionIds.size());
+    assertTrue(rolePermissionIds.containsAll(permissionIds));
+  }
+
+  @Test(expected = IllegalStateException.class)
+  @Sql(scripts = "/sql/insert-test-roles.sql", executionPhase = Sql.ExecutionPhase.BEFORE_TEST_METHOD)
+  @Sql(scripts = "/sql/cleanup.sql", executionPhase = Sql.ExecutionPhase.AFTER_TEST_METHOD)
+  public void testCreateRoleWithPermissionsWithRoleExisted() throws Exception {
+    String someRoleName = "someRoleName";
+    Role role = assembleRole(someRoleName);
+
+    rolePermissionService.createRoleWithPermissions(role, null);
+  }
+
+  @Test
+  @Sql(scripts = "/sql/insert-test-roles.sql", executionPhase = Sql.ExecutionPhase.BEFORE_TEST_METHOD)
+  @Sql(scripts = "/sql/cleanup.sql", executionPhase = Sql.ExecutionPhase.AFTER_TEST_METHOD)
+  public void testAssignRoleToUsers() throws Exception {
+    String someRoleName = "someRoleName";
+    String someUser = "someUser";
+    String anotherUser = "anotherUser";
+    String operator = "operator";
+
+    Set<String> users = Sets.newHashSet(someUser, anotherUser);
+
+    rolePermissionService
+        .assignRoleToUsers(someRoleName, users, operator);
+
+    List<UserRole> userRoles = userRoleRepository.findByRoleId(990);
+
+    Set<String> usersWithRole = Sets.newHashSet();
+    for (UserRole userRole : userRoles) {
+      assertEquals(operator, userRole.getDataChangeCreatedBy());
+      assertEquals(operator, userRole.getDataChangeLastModifiedBy());
+      usersWithRole.add(userRole.getUserId());
+    }
+
+    assertEquals(2, usersWithRole.size());
+    assertTrue(usersWithRole.containsAll(users));
+  }
+
+  @Test(expected = IllegalStateException.class)
+  @Sql(scripts = "/sql/cleanup.sql", executionPhase = Sql.ExecutionPhase.AFTER_TEST_METHOD)
+  public void testAssignRoleToUsersWithRoleNotExists() throws Exception {
+    String someRoleName = "someRoleName";
+    String someUser = "someUser";
+    String operator = "operator";
+
+    Set<String> users = Sets.newHashSet(someUser);
+
+    rolePermissionService
+        .assignRoleToUsers(someRoleName, users, operator);
+  }
+
+  @Test
+  @Sql(scripts = "/sql/insert-test-roles.sql", executionPhase = Sql.ExecutionPhase.BEFORE_TEST_METHOD)
+  @Sql(scripts = "/sql/insert-test-userroles.sql", executionPhase = Sql.ExecutionPhase.BEFORE_TEST_METHOD)
+  @Sql(scripts = "/sql/cleanup.sql", executionPhase = Sql.ExecutionPhase.AFTER_TEST_METHOD)
+  public void testAssignRoleToUsersWithUserRolesExisted() throws Exception {
+    String someRoleName = "someRoleName";
+    String someUser = "someUser";
+    String anotherUser = "anotherUser";
+    String operator = "operator";
+
+    Set<String> users = Sets.newHashSet(someUser, anotherUser);
+
+    rolePermissionService
+        .assignRoleToUsers(someRoleName, users, operator);
+
+    List<UserRole> userRoles = userRoleRepository.findByRoleId(990);
+
+    Set<String> usersWithRole = Sets.newHashSet();
+    for (UserRole userRole : userRoles) {
+      assertEquals("someOperator", userRole.getDataChangeCreatedBy());
+      assertEquals("someOperator", userRole.getDataChangeLastModifiedBy());
+      usersWithRole.add(userRole.getUserId());
+    }
+
+    assertEquals(2, usersWithRole.size());
+    assertTrue(usersWithRole.containsAll(users));
+  }
+
+  @Test
+  @Sql(scripts = "/sql/insert-test-roles.sql", executionPhase = Sql.ExecutionPhase.BEFORE_TEST_METHOD)
+  @Sql(scripts = "/sql/insert-test-userroles.sql", executionPhase = Sql.ExecutionPhase.BEFORE_TEST_METHOD)
+  @Sql(scripts = "/sql/cleanup.sql", executionPhase = Sql.ExecutionPhase.AFTER_TEST_METHOD)
+  public void testRemoveRoleFromUsers() throws Exception {
+    String someRoleName = "someRoleName";
+    String someUser = "someUser";
+    String anotherUser = "anotherUser";
+    String operator = "operator";
+
+    Set<String> users = Sets.newHashSet(someUser, anotherUser);
+
+    List<UserRole> userRoles = userRoleRepository.findByRoleId(990);
+    assertFalse(userRoles.isEmpty());
+
+    rolePermissionService.removeRoleFromUsers(someRoleName, users, operator);
+
+    List<UserRole> userRolesAfterRemoval = userRoleRepository.findByRoleId(990);
+    assertTrue(userRolesAfterRemoval.isEmpty());
+  }
+
+  @Test(expected = IllegalStateException.class)
+  @Sql(scripts = "/sql/insert-test-userroles.sql", executionPhase = Sql.ExecutionPhase.BEFORE_TEST_METHOD)
+  @Sql(scripts = "/sql/cleanup.sql", executionPhase = Sql.ExecutionPhase.AFTER_TEST_METHOD)
+  public void testRemoveRoleFromUsersWithRoleNotExisted() throws Exception {
+    String someRoleName = "someRoleName";
+    String someUser = "someUser";
+    String operator = "operator";
+
+    Set<String> users = Sets.newHashSet(someUser);
+
+    rolePermissionService.removeRoleFromUsers(someRoleName, users, operator);
+  }
+
+  @Test
+  @Sql(scripts = "/sql/insert-test-roles.sql", executionPhase = Sql.ExecutionPhase.BEFORE_TEST_METHOD)
+  @Sql(scripts = "/sql/insert-test-userroles.sql", executionPhase = Sql.ExecutionPhase.BEFORE_TEST_METHOD)
+  @Sql(scripts = "/sql/cleanup.sql", executionPhase = Sql.ExecutionPhase.AFTER_TEST_METHOD)
+  public void testQueryUsersWithRole() throws Exception {
+    String someRoleName = "someRoleName";
+
+    Set<UserInfo> users = rolePermissionService.queryUsersWithRole(someRoleName);
+
+    Set<String> userIds = FluentIterable.from(users).transform(UserInfo::getUserId).toSet();
+
+    assertTrue(userIds.containsAll(Sets.newHashSet("someUser", "anotherUser")));
+  }
+
+  @Test
+  @Sql(scripts = "/sql/insert-test-roles.sql", executionPhase = Sql.ExecutionPhase.BEFORE_TEST_METHOD)
+  @Sql(scripts = "/sql/insert-test-permissions.sql", executionPhase = Sql.ExecutionPhase.BEFORE_TEST_METHOD)
+  @Sql(scripts = "/sql/insert-test-userroles.sql", executionPhase = Sql.ExecutionPhase.BEFORE_TEST_METHOD)
+  @Sql(scripts = "/sql/insert-test-rolepermissions.sql", executionPhase = Sql.ExecutionPhase.BEFORE_TEST_METHOD)
+  @Sql(scripts = "/sql/cleanup.sql", executionPhase = Sql.ExecutionPhase.AFTER_TEST_METHOD)
+  public void testUserHasPermission() throws Exception {
+    String someTargetId = "someTargetId";
+    String anotherTargetId = "anotherTargetId";
+    String somePermissionType = "somePermissionType";
+    String anotherPermissionType = "anotherPermissionType";
+    String someUser = "someUser";
+    String anotherUser = "anotherUser";
+    String someUserWithNoPermission = "someUserWithNoPermission";
+
+    assertTrue(rolePermissionService.userHasPermission(someUser, somePermissionType, someTargetId));
+    assertTrue(rolePermissionService.userHasPermission(someUser, anotherPermissionType, anotherTargetId));
+    assertTrue(rolePermissionService.userHasPermission(anotherUser, somePermissionType, someTargetId));
+    assertTrue(rolePermissionService.userHasPermission(anotherUser, anotherPermissionType, anotherTargetId));
+
+    assertFalse(rolePermissionService.userHasPermission(someUserWithNoPermission, somePermissionType, someTargetId));
+    assertFalse(rolePermissionService.userHasPermission(someUserWithNoPermission, anotherPermissionType, anotherTargetId));
+
+  }
+
+  private Role assembleRole(String roleName) {
+    Role role = new Role();
+    role.setRoleName(roleName);
+    role.setDataChangeCreatedBy(someCreatedBy);
+    role.setDataChangeLastModifiedBy(someLastModifiedBy);
+
+    return role;
+  }
+
+  private Permission assemblePermission(String permissionType, String targetId) {
+    Permission permission = new Permission();
+    permission.setPermissionType(permissionType);
+    permission.setTargetId(targetId);
+    permission.setDataChangeCreatedBy(someCreatedBy);
+    permission.setDataChangeLastModifiedBy(someCreatedBy);
+
+    return permission;
+  }
+
+}

apollo-portal/src/test/resources/application.properties

-spring.datasource.url = jdbc:h2:mem:~/apolloconfigdb;mode=mysql;DB_CLOSE_ON_EXIT=FALSE;DB_CLOSE_DELAY=-1
+spring.datasource.url = jdbc:h2:mem:~/apolloportaldb;mode=mysql;DB_CLOSE_ON_EXIT=FALSE;DB_CLOSE_DELAY=-1
 spring.jpa.hibernate.naming_strategy=org.hibernate.cfg.EJB3NamingStrategy
 spring.jpa.properties.hibernate.show_sql=true
 spring.h2.console.enabled = true

apollo-portal/src/test/resources/sql/cleanup.sql

+delete from Permission;
+delete from Role;
+delete from RolePermission;
+delete from UserRole;

apollo-portal/src/test/resources/sql/insert-test-permissions.sql

+INSERT INTO `permission` (`Id`, `PermissionType`, `TargetId`) VALUES (990, 'somePermissionType', 'someTargetId');
+INSERT INTO `permission` (`Id`, `PermissionType`, `TargetId`) VALUES (991, 'anotherPermissionType', 'anotherTargetId');

apollo-portal/src/test/resources/sql/insert-test-rolepermissions.sql

+INSERT INTO `rolepermission` (`Id`, `RoleId`, `PermissionId`) VALUES (990, 990, 990);
+INSERT INTO `rolepermission` (`Id`, `RoleId`, `PermissionId`) VALUES (991, 990, 991);

apollo-portal/src/test/resources/sql/insert-test-roles.sql

+INSERT INTO `role` (`Id`, `RoleName`) VALUES (990, 'someRoleName');
+INSERT INTO `role` (`Id`, `RoleName`) VALUES (991, 'anotherRoleName');

apollo-portal/src/test/resources/sql/insert-test-userroles.sql

+INSERT INTO `userrole` (`Id`, `UserId`, `RoleId`, `DataChange_CreatedBy`, `DataChange_LastModifiedBy`)
+  VALUES (990, 'someUser', 990, 'someOperator', 'someOperator');
+INSERT INTO `userrole` (`Id`, `UserId`, `RoleId`, `DataChange_CreatedBy`, `DataChange_LastModifiedBy`)
+  VALUES (991, 'anotherUser', 990, 'someOperator', 'someOperator');