Fix request deletion based on PROVISION requestable flag

openapi/openapi-component_catalog-v1.0.0.yaml

@@ -1156,6 +1156,9 @@ components:
         deletionWorkflowJobId:
           type: string
           example: '123456'
+        canBeDeleted:
+          type: boolean
+          example: 'true'
         parameters:
           type: array
           items:

src/main/java/org/opendevstack/component_provisioner/server/controllers/validators/ProjectComponentDeletePermissionsValidator.java

@@ -0,0 +1,18 @@
+package org.opendevstack.component_provisioner.server.controllers.validators;
+
+import lombok.extern.slf4j.Slf4j;
+import org.opendevstack.component_provisioner.client.component_catalog.v1.model.ProjectComponentExtendedInfo;
+import org.opendevstack.component_provisioner.server.controllers.exceptions.UserNotAllowedException;
+import org.springframework.stereotype.Service;
+
+@Service
+@Slf4j
+public class ProjectComponentDeletePermissionsValidator {
+
+    public void validate(ProjectComponentExtendedInfo projectComponentExtendedInfo) {
+        log.debug("Validating user has permissions to delete. ProjectComponentExtendedInfo: {}", projectComponentExtendedInfo);
+        if (!Boolean.TRUE.equals(projectComponentExtendedInfo.getCanBeDeleted())) {
+            throw new UserNotAllowedException("User has no permissions to delete this project component");
+        }
+    }
+}

src/main/java/org/opendevstack/component_provisioner/server/facade/ProvisionResultsApiFacade.java

@@ -15,6 +15,7 @@
 import org.opendevstack.component_provisioner.server.controllers.validators.InputParamsValidator;
 import org.opendevstack.component_provisioner.server.controllers.validators.ParameterType;
 import org.opendevstack.component_provisioner.server.controllers.validators.WorkflowsValidator;
+import org.opendevstack.component_provisioner.server.controllers.validators.ProjectComponentDeletePermissionsValidator;
 import org.opendevstack.component_provisioner.server.mappers.EntitiesMapper;
 import org.opendevstack.component_provisioner.server.model.CreateIncidentAction;
 import org.opendevstack.component_provisioner.server.model.CreateIncidentParameter;
@@ -65,6 +66,7 @@ public class ProvisionResultsApiFacade {
     private final WorkflowsValidator workflowsValidator;
     private final DeletionSentinelWorkflowValidator deletionSentinelWorkflowValidator;
     private final InputParamsValidator inputParamsValidator;
+    private final ProjectComponentDeletePermissionsValidator projectComponentDeletePermissionsValidator;
 
     @Value("${component-provisioner.awx.workflows.create-incident-workflow-id}")
     private String createIncidentWorkflowId;
@@ -82,6 +84,8 @@ public AwxResponse requestDeletion(
         var accessToken = authenticationProvider.getAccessToken();
         var projectComponent = componentCatalogService.getProjectComponentById(accessToken, projectKey, componentId);
 
+        projectComponentDeletePermissionsValidator.validate(projectComponent);
+
         String deletionWorkflowId = getDeletionWorkflowId(projectComponent);
         String deletionWorkflowName = getDeletionWorkflowName(projectComponent);
         String deletionWorkflowTimeoutSeconds = getDeletionWorkflowTimeoutSeconds(projectComponent);

src/test/java/org/opendevstack/component_provisioner/server/controllers/validators/ProjectComponentDeletePermissionsValidatorTest.java

@@ -0,0 +1,32 @@
+package org.opendevstack.component_provisioner.server.controllers.validators;
+
+import org.junit.jupiter.api.Test;
+import org.opendevstack.component_provisioner.client.component_catalog.v1.model.ProjectComponentExtendedInfo;
+import org.opendevstack.component_provisioner.server.controllers.exceptions.UserNotAllowedException;
+import org.opendevstack.component_provisioner.server.model.ProjectComponentExtendedInfoMother;
+
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+public class ProjectComponentDeletePermissionsValidatorTest {
+
+    private final ProjectComponentDeletePermissionsValidator validator = new ProjectComponentDeletePermissionsValidator();
+
+    @Test
+    public void givenProjectComponentNotDeletable_whenValidate_thenThrowsUserNotAllowedException() {
+        // given
+        ProjectComponentExtendedInfo projectComponentExtendedInfo = ProjectComponentExtendedInfoMother.valid();
+        projectComponentExtendedInfo.setCanBeDeleted(false);
+
+        // when / then
+        assertThrows(UserNotAllowedException.class, () -> validator.validate(projectComponentExtendedInfo));
+    }
+
+    @Test
+    public void givenProjectComponentDeletable_whenValidate_thenDoesNotThrow() {
+        // given
+        ProjectComponentExtendedInfo projectComponentExtendedInfo = ProjectComponentExtendedInfoMother.valid();
+
+        // when / then
+        validator.validate(projectComponentExtendedInfo);
+    }
+}

src/test/java/org/opendevstack/component_provisioner/server/facade/ProvisionResultsApiFacadeTest.java

@@ -18,6 +18,7 @@
 import org.opendevstack.component_provisioner.server.controllers.exceptions.SlugNotFoundException;
 import org.opendevstack.component_provisioner.server.controllers.validators.DeletionSentinelWorkflowValidator;
 import org.opendevstack.component_provisioner.server.controllers.validators.InputParamsValidator;
+import org.opendevstack.component_provisioner.server.controllers.validators.ProjectComponentDeletePermissionsValidator;
 import org.opendevstack.component_provisioner.server.controllers.validators.WorkflowsValidator;
 import org.opendevstack.component_provisioner.server.mappers.EntitiesMapper;
 import org.opendevstack.component_provisioner.server.model.*;
@@ -86,6 +87,9 @@ class ProvisionResultsApiFacadeTest {
     @Mock
     private InputParamsValidator inputParamsValidator;
 
+    @Mock
+    private ProjectComponentDeletePermissionsValidator projectComponentDeletePermissionsValidator;
+
     @InjectMocks
     private ProvisionResultsApiFacade facade;
 
@@ -1020,6 +1024,7 @@ private static ProjectComponentExtendedInfo buildProjectComponentWithDeletionCon
                 .componentId(componentId)
                 .status(status)
                 .parameters(parameters)
+                .canBeDeleted(true)
                 .build();
     }
 

src/test/java/org/opendevstack/component_provisioner/server/model/ProjectComponentExtendedInfoMother.java

@@ -18,6 +18,7 @@ public static ProjectComponentExtendedInfo valid() {
                 .componentId("component-id")
                 .catalogItemId("aHR0cDovL2JpdGJ1Y2tldC10ZXN0LmNvbQ")
                 .catalogItemRef("L3JlZmVyZW5jZT9wYXJhbT0xMA")
+                .canBeDeleted(true)
                 .status(org.opendevstack.component_provisioner.client.component_catalog.v1.model.ProvisioningStatus.CREATED)
                 .componentUrl("https://example.com/component")
                 .parameters(Collections.emptyList())