ENG-4888 amend the BE APIs so that they return Bad Request

engine/src/main/java/org/entando/entando/web/page/PageController.java

@@ -380,6 +380,9 @@ public ResponseEntity<SimpleRestResponse<PageDto>> movePage(
             throw new ResourcePermissionsException(user.getUsername(), pageCode);
         }
 
+        this.getPageValidator().validateMovePagePermissions(user, pageCode, pageRequest.getParentCode(),
+                this.getAuthorizationService(), bindingResult);
+
         PageDto page = this.getPageService().movePage(pageCode, pageRequest, user);
         return new ResponseEntity<>(new SimpleRestResponse<>(page), HttpStatus.OK);
     }

engine/src/main/java/org/entando/entando/web/page/validator/PageValidator.java

@@ -17,9 +17,11 @@
 import com.agiletec.aps.system.services.lang.ILangManager;
 import com.agiletec.aps.system.services.page.IPage;
 import com.agiletec.aps.system.services.page.IPageManager;
+import com.agiletec.aps.system.services.user.UserDetails;
 import com.fasterxml.jackson.databind.JsonNode;
 import org.apache.commons.lang3.StringUtils;
 import org.entando.entando.aps.system.services.jsonpatch.validator.JsonPatchValidator;
+import org.entando.entando.aps.system.services.page.IPageAuthorizationService;
 import org.entando.entando.ent.util.EntLogging.EntLogFactory;
 import org.entando.entando.web.common.exceptions.ValidationGenericException;
 import org.entando.entando.web.common.exceptions.ValidationUnprocessableEntityException;
@@ -201,4 +203,29 @@ public void validateMovePage(String pageCode, BindingResult bindingResult,
         }
     }
 
+    public void validateMovePagePermissions(UserDetails user,
+            String pageCode,
+            String newParentPageCode,
+            IPageAuthorizationService pageAuthService,
+            BindingResult bindingResult) {
+
+        if(!canEditParentPage(user, pageCode, pageAuthService) ||
+                !canEditPage(user, newParentPageCode, pageAuthService)){
+            bindingResult.reject(ERRCODE_CHANGE_POSITION_INVALID_REQUEST, "page.move.position.invalid");
+        }
+
+        if (bindingResult.hasErrors()) {
+            throw new ValidationGenericException(bindingResult);
+        }
+    }
+
+    public boolean canEditParentPage(UserDetails user, String pageCode, IPageAuthorizationService pageAuthService){
+        IPage page = getPage(pageCode);
+        return canEditPage(user, page.getParentCode(), pageAuthService);
+    }
+
+    public boolean canEditPage(UserDetails user, String pageCode, IPageAuthorizationService pageAuthService){
+        return pageAuthService.canEdit(user, pageCode);
+    }
+
 }

engine/src/test/java/org/entando/entando/web/page/validator/PageValidatorTest.java

@@ -0,0 +1,96 @@
+package org.entando.entando.web.page.validator;
+
+import com.agiletec.aps.system.services.page.IPage;
+import com.agiletec.aps.system.services.page.IPageManager;
+import com.agiletec.aps.system.services.user.User;
+import com.agiletec.aps.system.services.user.UserDetails;
+import java.util.HashMap;
+import java.util.Map;
+import liquibase.pro.packaged.U;
+import org.assertj.core.util.Maps;
+import org.entando.entando.aps.system.services.page.PageAuthorizationService;
+import org.entando.entando.aps.system.services.widgettype.WidgetType;
+import org.entando.entando.aps.system.services.widgettype.WidgetTypeManager;
+import org.entando.entando.web.common.exceptions.ValidationGenericException;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.ArgumentMatchers;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.validation.BindingResult;
+import org.springframework.validation.DataBinder;
+import org.springframework.validation.Errors;
+
+@ExtendWith(MockitoExtension.class)
+class PageValidatorTest {
+
+    @Mock
+    private PageAuthorizationService pageAuthorizationService;
+    @Mock
+    private IPageManager pageManager;
+    @Mock
+    private IPage page;
+    @InjectMocks
+    private PageValidator validator;
+
+    @Test
+    void validateMovePagePermissionsShouldReturnOk() {
+        UserDetails mockUser = getMockUser();
+        BindingResult errors = (new DataBinder(new Object())).getBindingResult();
+
+        Mockito.when(pageAuthorizationService.canEdit(mockUser,"myNewParent")).thenReturn(true);
+        Mockito.when(pageAuthorizationService.canEdit(mockUser,"myOldParent")).thenReturn(true);
+        Mockito.when(page.getParentCode()).thenReturn("myOldParent");
+        Mockito.when(pageManager.getDraftPage("myCode")).thenReturn(page);
+
+        validator.validateMovePagePermissions(mockUser, "myCode", "myNewParent", pageAuthorizationService, errors);
+        Assertions.assertFalse(errors.hasErrors());
+    }
+
+    @Test
+    void validateMovePagePermissionsShouldReturnExceptionIfYouCannotWriteNewParent() {
+        UserDetails mockUser = getMockUser();
+        BindingResult errors = (new DataBinder(new Object())).getBindingResult();
+
+        Mockito.when(pageAuthorizationService.canEdit(mockUser,"myNewParent")).thenReturn(false);
+        Mockito.when(pageAuthorizationService.canEdit(mockUser,"myOldParent")).thenReturn(true);
+        Mockito.when(page.getParentCode()).thenReturn("myOldParent");
+        Mockito.when(pageManager.getDraftPage("myCode")).thenReturn(page);
+
+        Assertions.assertThrows(ValidationGenericException.class,
+                () -> validator.validateMovePagePermissions(mockUser,
+                        "myCode",
+                        "myNewParent",
+                        pageAuthorizationService,
+                        errors));
+        Assertions.assertTrue(errors.hasErrors());
+    }
+
+    @Test
+    void validateMovePagePermissionsShouldReturnExceptionIfYouCannotWriteOldParent() {
+        UserDetails mockUser = getMockUser();
+        BindingResult errors = (new DataBinder(new Object())).getBindingResult();
+
+        Mockito.when(pageAuthorizationService.canEdit(mockUser,"myOldParent")).thenReturn(false);
+        Mockito.when(page.getParentCode()).thenReturn("myOldParent");
+        Mockito.when(pageManager.getDraftPage("myCode")).thenReturn(page);
+
+        Assertions.assertThrows(ValidationGenericException.class,
+                () -> validator.validateMovePagePermissions(mockUser,
+                        "myCode",
+                        "myNewParent",
+                        pageAuthorizationService,
+                        errors));
+        Assertions.assertTrue(errors.hasErrors());
+    }
+
+    private UserDetails getMockUser(){
+        User u = new User();
+        u.setUsername("mockUser");
+        return u;
+    }
+}