[SYNCOPE-1806] Fixing all dynamic memberships refresh: Realms, Groups…

… and Roles

core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPADynRealmDAO.java

@@ -172,10 +172,11 @@ public void refreshDynMemberships(final Any<?> any) {
             boolean matches = anyMatchDAO.matches(
                     any, SearchCondConverter.convert(searchCondVisitor, memb.getFIQLCond()));
 
-            Query find = entityManager().createNativeQuery(
-                    "SELECT dynRealm_id FROM " + DYNMEMB_TABLE + " WHERE any_id=?");
-            find.setParameter(1, any.getKey());
-            boolean existing = !find.getResultList().isEmpty();
+            Query query = entityManager().createNativeQuery(
+                    "SELECT COUNT(dynRealm_id) FROM " + DYNMEMB_TABLE + " WHERE any_id=? AND dynRealm_id=?");
+            query.setParameter(1, any.getKey());
+            query.setParameter(2, dynRealm.getKey());
+            boolean existing = ((Number) query.getSingleResult()).longValue() > 0;
 
             if (matches && !existing) {
                 Query insert = entityManager().

core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAGroupDAO.java

@@ -315,7 +315,8 @@ public Group saveAndRefreshDynMemberships(final Group group) {
                         AnyTypeKind.USER);
 
                 matching.forEach(user -> {
-                    Query insert = entityManager().createNativeQuery("INSERT INTO " + UDYNMEMB_TABLE + " VALUES(?, ?)");
+                    Query insert = entityManager().createNativeQuery(
+                            "INSERT INTO " + UDYNMEMB_TABLE + " VALUES(?, ?)");
                     insert.setParameter(1, user.getKey());
                     insert.setParameter(2, merged.getKey());
                     insert.executeUpdate();
@@ -440,7 +441,7 @@ public boolean existsUMembership(final String userKey, final String groupKey) {
     @SuppressWarnings("unchecked")
     public List<String> findAMembers(final String groupKey) {
         Query query = entityManager().createNativeQuery(
-                "SELECT anyObject_id FROM " + JPAAMembership.TABLE + " WHERE group_id=?");
+                "SELECT DISTINCT anyObject_id FROM " + JPAAMembership.TABLE + " WHERE group_id=?");
         query.setParameter(1, groupKey);
 
         List<String> result = new ArrayList<>();
@@ -456,7 +457,7 @@ public List<String> findAMembers(final String groupKey) {
     @SuppressWarnings("unchecked")
     public List<String> findUMembers(final String groupKey) {
         Query query = entityManager().createNativeQuery(
-                "SELECT user_id FROM " + JPAUMembership.TABLE + " WHERE group_id=?");
+                "SELECT DISTINCT user_id FROM " + JPAUMembership.TABLE + " WHERE group_id=?");
         query.setParameter(1, groupKey);
 
         List<String> result = new ArrayList<>();
@@ -474,7 +475,7 @@ public List<String> findADynMembers(final Group group) {
 
         group.getADynMemberships().forEach(memb -> {
             Query query = entityManager().createNativeQuery(
-                    "SELECT any_id FROM " + ADYNMEMB_TABLE + " WHERE group_id=? AND anyType_id=?");
+                    "SELECT DISTINCT any_id FROM " + ADYNMEMB_TABLE + " WHERE group_id=? AND anyType_id=?");
             query.setParameter(1, group.getKey());
             query.setParameter(2, memb.getAnyType().getKey());
 
@@ -491,7 +492,7 @@ public List<String> findADynMembers(final Group group) {
     @Override
     public int countAMembers(final String groupKey) {
         Query query = entityManager().createNativeQuery(
-                "SELECT COUNT(anyObject_id) FROM " + JPAAMembership.TABLE + " WHERE group_id=?");
+                "SELECT COUNT(DISTINCT anyObject_id) FROM " + JPAAMembership.TABLE + " WHERE group_id=?");
         query.setParameter(1, groupKey);
 
         return ((Number) query.getSingleResult()).intValue();
@@ -500,7 +501,7 @@ public int countAMembers(final String groupKey) {
     @Override
     public int countUMembers(final String groupKey) {
         Query query = entityManager().createNativeQuery(
-                "SELECT COUNT(user_id) FROM " + JPAUMembership.TABLE + " WHERE group_id=?");
+                "SELECT COUNT(DISTINCT user_id) FROM " + JPAUMembership.TABLE + " WHERE group_id=?");
         query.setParameter(1, groupKey);
 
         return ((Number) query.getSingleResult()).intValue();
@@ -509,7 +510,7 @@ public int countUMembers(final String groupKey) {
     @Override
     public int countADynMembers(final Group group) {
         Query query = entityManager().createNativeQuery(
-                "SELECT COUNT(any_id) FROM " + ADYNMEMB_TABLE + " WHERE group_id=?");
+                "SELECT COUNT(DISTINCT any_id) FROM " + ADYNMEMB_TABLE + " WHERE group_id=?");
         query.setParameter(1, group.getKey());
 
         return ((Number) query.getSingleResult()).intValue();
@@ -522,7 +523,7 @@ public int countUDynMembers(final Group group) {
         }
 
         Query query = entityManager().createNativeQuery(
-                "SELECT COUNT(any_id) FROM " + UDYNMEMB_TABLE + " WHERE group_id=?");
+                "SELECT COUNT(DISTINCT any_id) FROM " + UDYNMEMB_TABLE + " WHERE group_id=?");
         query.setParameter(1, group.getKey());
 
         return ((Number) query.getSingleResult()).intValue();
@@ -554,11 +555,11 @@ public Pair<Set<String>, Set<String>> refreshDynMemberships(final AnyObject anyO
                 after.add(memb.getGroup().getKey());
             }
 
-            Query find = entityManager().createNativeQuery(
-                    "SELECT any_id FROM " + ADYNMEMB_TABLE + " WHERE group_id=? AND any_id=?");
-            find.setParameter(1, memb.getGroup().getKey());
-            find.setParameter(2, anyObject.getKey());
-            boolean existing = !find.getResultList().isEmpty();
+            Query query = entityManager().createNativeQuery(
+                    "SELECT COUNT(group_id) FROM " + ADYNMEMB_TABLE + " WHERE group_id=? AND any_id=?");
+            query.setParameter(1, memb.getGroup().getKey());
+            query.setParameter(2, anyObject.getKey());
+            boolean existing = ((Number) query.getSingleResult()).longValue() > 0;
             if (existing) {
                 before.add(memb.getGroup().getKey());
             }
@@ -612,7 +613,7 @@ public List<String> findUDynMembers(final Group group) {
         }
 
         Query query = entityManager().createNativeQuery(
-                "SELECT any_id FROM " + UDYNMEMB_TABLE + " WHERE group_id=?");
+                "SELECT DISTINCT any_id FROM " + UDYNMEMB_TABLE + " WHERE group_id=?");
         query.setParameter(1, group.getKey());
 
         List<String> result = new ArrayList<>();
@@ -649,11 +650,11 @@ public Pair<Set<String>, Set<String>> refreshDynMemberships(final User user) {
                 after.add(memb.getGroup().getKey());
             }
 
-            Query find = entityManager().createNativeQuery(
-                    "SELECT any_id FROM " + UDYNMEMB_TABLE + " WHERE group_id=? AND any_id=?");
-            find.setParameter(1, memb.getGroup().getKey());
-            find.setParameter(2, user.getKey());
-            boolean existing = !find.getResultList().isEmpty();
+            Query query = entityManager().createNativeQuery(
+                    "SELECT COUNT(group_id) FROM " + UDYNMEMB_TABLE + " WHERE group_id=? AND any_id=?");
+            query.setParameter(1, memb.getGroup().getKey());
+            query.setParameter(2, user.getKey());
+            boolean existing = ((Number) query.getSingleResult()).longValue() > 0;
             if (existing) {
                 before.add(memb.getGroup().getKey());
             }

core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPARoleDAO.java

@@ -172,7 +172,8 @@ public List<String> findDynMembers(final Role role) {
             return List.of();
         }
 
-        Query query = entityManager().createNativeQuery("SELECT any_id FROM " + DYNMEMB_TABLE + " WHERE role_id=?");
+        Query query = entityManager().createNativeQuery(
+                "SELECT DISTINCT any_id FROM " + DYNMEMB_TABLE + " WHERE role_id=?");
         query.setParameter(1, role.getKey());
 
         List<String> result = new ArrayList<>();
@@ -202,9 +203,10 @@ public void refreshDynMemberships(final User user) {
                     user, SearchCondConverter.convert(searchCondVisitor, role.getDynMembership().getFIQLCond()));
 
             Query find = entityManager().createNativeQuery(
-                    "SELECT any_id FROM " + DYNMEMB_TABLE + " WHERE role_id=?");
-            find.setParameter(1, role.getKey());
-            boolean existing = !find.getResultList().isEmpty();
+                    "SELECT COUNT(role_id) FROM " + DYNMEMB_TABLE + " WHERE any_id=? AND role_id=?");
+            find.setParameter(1, user.getKey());
+            find.setParameter(2, role.getKey());
+            boolean existing = ((Number) find.getSingleResult()).longValue() > 0;
 
             if (matches && !existing) {
                 Query insert = entityManager().createNativeQuery(

core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/outer/DynRealmTest.java

@@ -18,17 +18,20 @@
  */
 package org.apache.syncope.core.persistence.jpa.outer;
 
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
 
 import java.util.List;
 import org.apache.syncope.common.lib.types.AnyTypeKind;
+import org.apache.syncope.core.persistence.api.attrvalue.validation.PlainAttrValidationManager;
 import org.apache.syncope.core.persistence.api.dao.AnyMatchDAO;
 import org.apache.syncope.core.persistence.api.dao.AnySearchDAO;
 import org.apache.syncope.core.persistence.api.dao.AnyTypeDAO;
 import org.apache.syncope.core.persistence.api.dao.DynRealmDAO;
+import org.apache.syncope.core.persistence.api.dao.PlainSchemaDAO;
 import org.apache.syncope.core.persistence.api.dao.UserDAO;
 import org.apache.syncope.core.persistence.api.dao.search.DynRealmCond;
 import org.apache.syncope.core.persistence.api.dao.search.SearchCond;
@@ -58,6 +61,12 @@ public class DynRealmTest extends AbstractTest {
     @Autowired
     private UserDAO userDAO;
 
+    @Autowired
+    private PlainSchemaDAO plainSchemaDAO;
+
+    @Autowired
+    private PlainAttrValidationManager plainAttrValidationManager;
+
     @Test
     public void misc() {
         DynRealm dynRealm = entityFactory.newEntity(DynRealm.class);
@@ -96,4 +105,66 @@ public void misc() {
 
         assertTrue(userDAO.findDynRealms(user.getKey()).contains(actual.getKey()));
     }
+
+    @Test
+    public void issueSYNCOPE1806() {
+        // 1. create two dyn realms with same condition
+        DynRealm realm1 = entityFactory.newEntity(DynRealm.class);
+        realm1.setKey("realm1");
+
+        DynRealmMembership memb1 = entityFactory.newEntity(DynRealmMembership.class);
+        memb1.setDynRealm(realm1);
+        memb1.setAnyType(anyTypeDAO.findUser());
+        memb1.setFIQLCond("cool==true");
+
+        realm1.add(memb1);
+        memb1.setDynRealm(realm1);
+
+        realm1 = dynRealmDAO.saveAndRefreshDynMemberships(realm1);
+
+        DynRealm realm2 = entityFactory.newEntity(DynRealm.class);
+        realm2.setKey("realm2");
+
+        DynRealmMembership memb2 = entityFactory.newEntity(DynRealmMembership.class);
+        memb2.setDynRealm(realm2);
+        memb2.setAnyType(anyTypeDAO.findUser());
+        memb2.setFIQLCond("cool==true");
+
+        realm2.add(memb2);
+        memb2.setDynRealm(realm2);
+
+        realm2 = dynRealmDAO.saveAndRefreshDynMemberships(realm2);
+
+        entityManager().flush();
+
+        // 2. verify that dynamic members are the same
+        DynRealmCond dynRealmCond1 = new DynRealmCond();
+        dynRealmCond1.setDynRealm(realm1.getKey());
+        List<User> matching1 = searchDAO.search(SearchCond.getLeaf(dynRealmCond1), AnyTypeKind.USER);
+
+        DynRealmCond dynRealmCond2 = new DynRealmCond();
+        dynRealmCond2.setDynRealm(realm2.getKey());
+        List<User> matching2 = searchDAO.search(SearchCond.getLeaf(dynRealmCond2), AnyTypeKind.USER);
+
+        assertEquals(matching1, matching2);
+        assertEquals(1, matching1.size());
+        assertTrue(matching1.stream().anyMatch(u -> "c9b2dec2-00a7-4855-97c0-d854842b4b24".equals(u.getKey())));
+
+        // 3. update an user to let them become part of both dyn realms        
+        anyUtilsFactory.getInstance(AnyTypeKind.USER).addAttr(
+                plainAttrValidationManager,
+                "823074dc-d280-436d-a7dd-07399fae48ec",
+                plainSchemaDAO.find("cool"),
+                "true");
+
+        entityManager().flush();
+
+        // 4. verify that dynamic members are still the same
+        matching1 = searchDAO.search(SearchCond.getLeaf(dynRealmCond1), AnyTypeKind.USER);
+        matching2 = searchDAO.search(SearchCond.getLeaf(dynRealmCond2), AnyTypeKind.USER);
+        assertEquals(matching1, matching2);
+        assertEquals(2, matching1.size());
+        assertTrue(matching1.stream().anyMatch(u -> "c9b2dec2-00a7-4855-97c0-d854842b4b24".equals(u.getKey())));
+        assertTrue(matching1.stream().anyMatch(u -> "823074dc-d280-436d-a7dd-07399fae48ec".equals(u.getKey())));
+    }
 }

fit/core-reference/src/test/java/org/apache/syncope/fit/core/DynRealmITCase.java

@@ -31,8 +31,8 @@
 import javax.ws.rs.core.Response;
 import org.apache.commons.io.IOUtils;
 import org.apache.syncope.client.lib.SyncopeClient;
+import org.apache.syncope.common.lib.Attr;
 import org.apache.syncope.common.lib.SyncopeClientException;
-import org.apache.syncope.common.lib.SyncopeConstants;
 import org.apache.syncope.common.lib.request.AttrPatch;
 import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
@@ -244,74 +244,63 @@ private static ArrayNode fetchDynRealmsFromElasticsearch(final String userKey) t
     }
 
     @Test
-    public void issueSYNCOPE1480() throws Exception {
-        String ctype = getUUIDString();
-
-        DynRealmTO dynRealm = null;
+    public void issueSYNCOPE1806() {
+        DynRealmTO realm1 = null;
+        DynRealmTO realm2 = null;
         try {
-            // 1. create new dyn realm matching a very specific attribute value
-            dynRealm = new DynRealmTO();
-            dynRealm.setKey("name" + getUUIDString());
-            dynRealm.getDynMembershipConds().put(AnyTypeKind.USER.name(), "ctype==" + ctype);
-            DYN_REALM_SERVICE.create(dynRealm);
-
-            Response response = DYN_REALM_SERVICE.create(dynRealm);
-            dynRealm = getObject(response.getLocation(), DynRealmService.class, DynRealmTO.class);
-            assertNotNull(dynRealm);
-
-            // 2. no dyn realm members
-            PagedResult<UserTO> matching = USER_SERVICE.search(new AnyQuery.Builder().realm("/").fiql(
-                    SyncopeClient.getUserSearchConditionBuilder().inDynRealms(dynRealm.getKey()).query()).build());
-            assertEquals(0, matching.getSize());
-
-            // 3. create user with that attribute value
-            UserCR userCR = UserITCase.getUniqueSample("[email protected]");
-            userCR.getPlainAttr("ctype").get().getValues().set(0, ctype);
-            UserTO user = createUser(userCR).getEntity();
-            assertNotNull(user.getKey());
-
-            // 4a. check that Elasticsearch index was updated correctly
-            if (IS_EXT_SEARCH_ENABLED) {
-                try {
-                    Thread.sleep(2000);
-                } catch (InterruptedException ex) {
-                    // ignore
-                }
-
-                ArrayNode dynRealms = fetchDynRealmsFromElasticsearch(user.getKey());
-                assertEquals(1, dynRealms.size());
-                assertEquals(dynRealm.getKey(), dynRealms.get(0).asText());
-            }
-
-            // 4b. now there is 1 realm member
-            matching = USER_SERVICE.search(new AnyQuery.Builder().realm(SyncopeConstants.ROOT_REALM).fiql(
-                    SyncopeClient.getUserSearchConditionBuilder().inDynRealms(dynRealm.getKey()).query()).build());
-            assertEquals(1, matching.getSize());
-
-            // 5. change dyn realm condition
-            dynRealm.getDynMembershipConds().put(AnyTypeKind.USER.name(), "ctype==ANY");
-            DYN_REALM_SERVICE.update(dynRealm);
-
-            // 6a. check that Elasticsearch index was updated correctly
-            if (IS_EXT_SEARCH_ENABLED) {
-                try {
-                    Thread.sleep(2000);
-                } catch (InterruptedException ex) {
-                    // ignore
-                }
-
-                ArrayNode dynRealms = fetchDynRealmsFromElasticsearch(user.getKey());
-                assertTrue(dynRealms.isEmpty());
-            }
-
-            // 6b. no more dyn realm members
-            matching = USER_SERVICE.search(new AnyQuery.Builder().realm(SyncopeConstants.ROOT_REALM).fiql(
-                    SyncopeClient.getUserSearchConditionBuilder().inDynRealms(dynRealm.getKey()).query()).build());
-            assertEquals(0, matching.getSize());
+            // 1. create two dyn realms with same condition
+            realm1 = new DynRealmTO();
+            realm1.setKey("realm1");
+            realm1.getDynMembershipConds().put(AnyTypeKind.USER.name(), "cool==true");
+            realm1 = getObject(DYN_REALM_SERVICE.create(realm1).getLocation(), DynRealmService.class, DynRealmTO.class);
+            assertNotNull(realm1);
+
+            realm2 = new DynRealmTO();
+            realm2.setKey("realm2");
+            realm2.getDynMembershipConds().put(AnyTypeKind.USER.name(), "cool==true");
+            realm2 = getObject(DYN_REALM_SERVICE.create(realm2).getLocation(), DynRealmService.class, DynRealmTO.class);
+            assertNotNull(realm2);
+
+            // 2. verify that dynamic members are the same
+            PagedResult<UserTO> matching1 = USER_SERVICE.search(new AnyQuery.Builder().realm("/").fiql(
+                    SyncopeClient.getUserSearchConditionBuilder().inDynRealms(realm1.getKey()).query()).build());
+            PagedResult<UserTO> matching2 = USER_SERVICE.search(new AnyQuery.Builder().realm("/").fiql(
+                    SyncopeClient.getUserSearchConditionBuilder().inDynRealms(realm2.getKey()).query()).build());
+
+            assertEquals(matching1, matching2);
+            assertEquals(1, matching1.getResult().size());
+            assertTrue(matching1.getResult().stream().
+                    anyMatch(u -> "c9b2dec2-00a7-4855-97c0-d854842b4b24".equals(u.getKey())));
+
+            // 3. update an user to let them become part of both dyn realms
+            UserUR userUR = new UserUR();
+            userUR.setKey("823074dc-d280-436d-a7dd-07399fae48ec");
+            userUR.getPlainAttrs().add(new AttrPatch.Builder(new Attr.Builder("cool").value("true").build()).build());
+            updateUser(userUR);
+
+            // 4. verify that dynamic members are still the same
+            matching1 = USER_SERVICE.search(new AnyQuery.Builder().realm("/").fiql(
+                    SyncopeClient.getUserSearchConditionBuilder().inDynRealms(realm1.getKey()).query()).build());
+            matching2 = USER_SERVICE.search(new AnyQuery.Builder().realm("/").fiql(
+                    SyncopeClient.getUserSearchConditionBuilder().inDynRealms(realm2.getKey()).query()).build());
+            assertEquals(matching1, matching2);
+            assertEquals(2, matching1.getResult().size());
+            assertTrue(matching1.getResult().stream().
+                    anyMatch(u -> "c9b2dec2-00a7-4855-97c0-d854842b4b24".equals(u.getKey())));
+            assertTrue(matching1.getResult().stream().
+                    anyMatch(u -> "823074dc-d280-436d-a7dd-07399fae48ec".equals(u.getKey())));
         } finally {
-            if (dynRealm != null) {
-                DYN_REALM_SERVICE.delete(dynRealm.getKey());
+            if (realm1 != null) {
+                DYN_REALM_SERVICE.delete(realm1.getKey());
             }
+            if (realm2 != null) {
+                DYN_REALM_SERVICE.delete(realm2.getKey());
+            }
+            UserUR userUR = new UserUR();
+            userUR.setKey("823074dc-d280-436d-a7dd-07399fae48ec");
+            userUR.getPlainAttrs().add(new AttrPatch.Builder(new Attr.Builder("cool").build()).
+                    operation(PatchOperation.DELETE).build());
+            updateUser(userUR);
         }
     }
 }