merge

scm-webapp/src/test/java/sonia/scm/api/rest/resources/AbstractManagerResourceTest.java

@@ -12,10 +12,14 @@ import sonia.scm.ModelObject;
 
 import javax.ws.rs.core.GenericEntity;
 import javax.ws.rs.core.Request;
+import javax.ws.rs.core.UriInfo;
+import java.net.URI;
+import java.net.URISyntaxException;
 import java.util.Collection;
 import java.util.Comparator;
 
 import static java.util.Collections.emptyList;
+import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertTrue;
 import static org.mockito.Matchers.eq;
 import static org.mockito.Mockito.when;
@@ -25,8 +29,13 @@ public class AbstractManagerResourceTest {
 
   @Mock
   private Manager<Simple> manager;
+
   @Mock
   private Request request;
+
+  @Mock
+  private UriInfo uriInfo;
+
   @Captor
   private ArgumentCaptor<Comparator<Simple>> comparatorCaptor;
 
@@ -59,6 +68,24 @@ public class AbstractManagerResourceTest {
     abstractManagerResource.getAll(request, 0, 1, "x", true);
   }
 
+  @Test
+  public void testLocation() throws URISyntaxException {
+    URI uri = location("special-item");
+    assertEquals(new URI("https://scm.scm-manager.org/simple/special-item"), uri);
+  }
+
+  @Test
+  public void testLocationWithSpaces() throws URISyntaxException {
+    URI uri = location("Scm Special Group");
+    assertEquals(new URI("https://scm.scm-manager.org/simple/Scm%20Special%20Group"), uri);
+  }
+
+  private URI location(String id) throws URISyntaxException {
+    URI base = new URI("https://scm.scm-manager.org/");
+    when(uriInfo.getAbsolutePath()).thenReturn(base);
+
+    return abstractManagerResource.location(uriInfo, id);
+  }
 
   private class SimpleManagerResource extends AbstractManagerResource<Simple> {
 
@@ -82,7 +109,7 @@ public class AbstractManagerResourceTest {
 
     @Override
     protected String getPathPart() {
-      return null;
+      return "simple";
     }
   }
 

scm-webapp/src/test/java/sonia/scm/api/v2/resources/BranchToBranchDtoMapperTest.java

@@ -24,12 +24,12 @@ class BranchToBranchDtoMapperTest {
 
   @Test
   void shouldAppendLinks() {
-    LinkEnricherRegistry registry = new LinkEnricherRegistry();
+    HalEnricherRegistry registry = new HalEnricherRegistry();
     registry.register(Branch.class, (ctx, appender) -> {
       NamespaceAndName namespaceAndName = ctx.oneRequireByType(NamespaceAndName.class);
       Branch branch = ctx.oneRequireByType(Branch.class);
 
-      appender.appendOne("ka", "http://" + namespaceAndName.logString() + "/" + branch.getName());
+      appender.appendLink("ka", "http://" + namespaceAndName.logString() + "/" + branch.getName());
     });
     mapper.setRegistry(registry);
 

scm-webapp/src/test/java/sonia/scm/api/v2/resources/ConfigResourceTest.java

@@ -92,11 +92,7 @@ public class ConfigResourceTest {
   @Test
   @SubjectAware(username = "readWrite")
   public void shouldUpdateConfig() throws URISyntaxException, IOException {
-    URL url = Resources.getResource("sonia/scm/api/v2/config-test-update.json");
-    byte[] configJson = Resources.toByteArray(url);
-    MockHttpRequest request = MockHttpRequest.put("/" + ConfigResource.CONFIG_PATH_V2)
-      .contentType(VndMediaType.CONFIG)
-      .content(configJson);
+    MockHttpRequest request = post("sonia/scm/api/v2/config-test-update.json");
 
     MockHttpResponse response = new MockHttpResponse();
     dispatcher.invoke(request, response);
@@ -113,11 +109,7 @@ public class ConfigResourceTest {
   @Test
   @SubjectAware(username = "readOnly")
   public void shouldNotUpdateConfigWhenNotAuthorized() throws URISyntaxException, IOException {
-    URL url = Resources.getResource("sonia/scm/api/v2/config-test-update.json");
-    byte[] configJson = Resources.toByteArray(url);
-    MockHttpRequest request = MockHttpRequest.put("/" + ConfigResource.CONFIG_PATH_V2)
-      .contentType(VndMediaType.CONFIG)
-      .content(configJson);
+    MockHttpRequest request = post("sonia/scm/api/v2/config-test-update.json");
     MockHttpResponse response = new MockHttpResponse();
 
     thrown.expectMessage("Subject does not have permission [configuration:write:global]");
@@ -125,6 +117,36 @@ public class ConfigResourceTest {
     dispatcher.invoke(request, response);
   }
 
+  @Test
+  @SubjectAware(username = "readWrite")
+  public void shouldFailForEmptyAdminUsers() throws URISyntaxException, IOException {
+    MockHttpRequest request = post("sonia/scm/api/v2/config-test-empty-admin-user.json");
+
+    MockHttpResponse response = new MockHttpResponse();
+    dispatcher.invoke(request, response);
+
+    assertEquals(HttpServletResponse.SC_BAD_REQUEST, response.getStatus());
+  }
+
+  @Test
+  @SubjectAware(username = "readWrite")
+  public void shouldFailForEmptyAdminGroups() throws URISyntaxException, IOException {
+    MockHttpRequest request = post("sonia/scm/api/v2/config-test-empty-admin-group.json");
+
+    MockHttpResponse response = new MockHttpResponse();
+    dispatcher.invoke(request, response);
+
+    assertEquals(HttpServletResponse.SC_BAD_REQUEST, response.getStatus());
+  }
+
+  private MockHttpRequest post(String resourceName) throws IOException, URISyntaxException {
+    URL url = Resources.getResource(resourceName);
+    byte[] configJson = Resources.toByteArray(url);
+    return MockHttpRequest.put("/" + ConfigResource.CONFIG_PATH_V2)
+      .contentType(VndMediaType.CONFIG)
+      .content(configJson);
+  }
+
   private static ScmConfiguration createConfiguration() {
     ScmConfiguration scmConfiguration = new ScmConfiguration();
     scmConfiguration.setProxyPassword("heartOfGold");

scm-webapp/src/test/java/sonia/scm/api/v2/resources/EdisonHalAppenderTest.java

@@ -0,0 +1,61 @@
+package sonia.scm.api.v2.resources;
+
+import de.otto.edison.hal.Embedded;
+import de.otto.edison.hal.HalRepresentation;
+import de.otto.edison.hal.Link;
+import de.otto.edison.hal.Links;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import java.util.List;
+
+import static de.otto.edison.hal.Embedded.embeddedBuilder;
+import static de.otto.edison.hal.Links.linkingTo;
+import static org.assertj.core.api.Assertions.assertThat;
+
+class EdisonHalAppenderTest {
+
+  private Links.Builder linksBuilder;
+  private Embedded.Builder embeddedBuilder;
+  private EdisonHalAppender appender;
+
+  @BeforeEach
+  void prepare() {
+    linksBuilder = linkingTo();
+    embeddedBuilder = embeddedBuilder();
+    appender = new EdisonHalAppender(linksBuilder, embeddedBuilder);
+  }
+
+  @Test
+  void shouldAppendOneLink() {
+    appender.appendLink("self", "https://scm.hitchhiker.com");
+
+    Links links = linksBuilder.build();
+    assertThat(links.getLinkBy("self").get().getHref()).isEqualTo("https://scm.hitchhiker.com");
+  }
+
+  @Test
+  void shouldAppendMultipleLinks() {
+    appender.linkArrayBuilder("items")
+        .append("one", "http://one")
+        .append("two", "http://two")
+        .build();
+
+    List<Link> items = linksBuilder.build().getLinksBy("items");
+    assertThat(items).hasSize(2);
+  }
+
+  @Test
+  void shouldAppendEmbedded() {
+    HalRepresentation one = new HalRepresentation();
+    appender.appendEmbedded("one", one);
+
+    HalRepresentation two = new HalRepresentation();
+    appender.appendEmbedded("two", new HalRepresentation());
+
+    Embedded embedded = embeddedBuilder.build();
+    assertThat(embedded.getItemsBy("one")).containsOnly(one);
+    assertThat(embedded.getItemsBy("two")).containsOnly(two);
+  }
+
+}

scm-webapp/src/test/java/sonia/scm/api/v2/resources/EdisonLinkAppenderTest.java

@@ -1,43 +0,0 @@
-package sonia.scm.api.v2.resources;
-
-import de.otto.edison.hal.Link;
-import de.otto.edison.hal.Links;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-
-import java.util.List;
-
-import static de.otto.edison.hal.Links.linkingTo;
-import static org.assertj.core.api.Assertions.assertThat;
-
-class EdisonLinkAppenderTest {
-
-  private Links.Builder builder;
-  private EdisonLinkAppender appender;
-
-  @BeforeEach
-  void prepare() {
-    builder = linkingTo();
-    appender = new EdisonLinkAppender(builder);
-  }
-
-  @Test
-  void shouldAppendOneLink() {
-    appender.appendOne("self", "https://scm.hitchhiker.com");
-
-    Links links = builder.build();
-    assertThat(links.getLinkBy("self").get().getHref()).isEqualTo("https://scm.hitchhiker.com");
-  }
-
-  @Test
-  void shouldAppendMultipleLinks() {
-    appender.arrayBuilder("items")
-        .append("one", "http://one")
-        .append("two", "http://two")
-        .build();
-
-    List<Link> items = builder.build().getLinksBy("items");
-    assertThat(items).hasSize(2);
-  }
-
-}

scm-webapp/src/test/java/sonia/scm/api/v2/resources/FileObjectToFileObjectDtoMapperTest.java

@@ -73,13 +73,13 @@ public class FileObjectToFileObjectDtoMapperTest {
 
   @Test
   public void shouldAppendLinks() {
-    LinkEnricherRegistry registry = new LinkEnricherRegistry();
+    HalEnricherRegistry registry = new HalEnricherRegistry();
     registry.register(FileObject.class, (ctx, appender) -> {
       NamespaceAndName repository = ctx.oneRequireByType(NamespaceAndName.class);
       FileObject fo = ctx.oneRequireByType(FileObject.class);
       String rev = ctx.oneRequireByType(String.class);
 
-      appender.appendOne("hog", "http://" + repository.logString() + "/" + fo.getName() + "/" + rev);
+      appender.appendLink("hog", "http://" + repository.logString() + "/" + fo.getName() + "/" + rev);
     });
     mapper.setRegistry(registry);
 

scm-webapp/src/test/java/sonia/scm/api/v2/resources/GroupToGroupDtoMapperTest.java

@@ -11,7 +11,6 @@ import org.mockito.InjectMocks;
 import sonia.scm.group.Group;
 
 import java.net.URI;
-import java.net.URISyntaxException;
 import java.util.stream.IntStream;
 
 import static java.util.stream.Collectors.toList;
@@ -91,10 +90,10 @@ public class GroupToGroupDtoMapperTest {
 
   @Test
   public void shouldAppendLinks() {
-    LinkEnricherRegistry registry = new LinkEnricherRegistry();
+    HalEnricherRegistry registry = new HalEnricherRegistry();
     registry.register(Group.class, (ctx, appender) -> {
       Group group = ctx.oneRequireByType(Group.class);
-      appender.appendOne("some", "http://" + group.getName());
+      appender.appendLink("some", "http://" + group.getName());
     });
     mapper.setRegistry(registry);
 

scm-webapp/src/test/java/sonia/scm/api/v2/resources/HalEnricherAutoRegistrationTest.java

@@ -0,0 +1,64 @@
+package sonia.scm.api.v2.resources;
+
+import com.google.common.collect.ImmutableSet;
+import org.junit.jupiter.api.Test;
+
+import java.util.Set;
+
+import static org.assertj.core.api.Java6Assertions.assertThat;
+
+class HalEnricherAutoRegistrationTest {
+
+  @Test
+  void shouldRegisterAllAvailableLinkEnrichers() {
+    HalEnricher one = new One();
+    HalEnricher two = new Two();
+    HalEnricher three = new Three();
+    HalEnricher four = new Four();
+    Set<HalEnricher> enrichers = ImmutableSet.of(one, two, three, four);
+
+    HalEnricherRegistry registry = new HalEnricherRegistry();
+
+    LinkEnricherAutoRegistration autoRegistration = new LinkEnricherAutoRegistration(registry, enrichers);
+    autoRegistration.contextInitialized(null);
+
+    assertThat(registry.allByType(String.class)).containsOnly(one, two);
+    assertThat(registry.allByType(Integer.class)).containsOnly(three);
+  }
+
+  @Enrich(String.class)
+  public static class One implements HalEnricher {
+
+    @Override
+    public void enrich(HalEnricherContext context, HalAppender appender) {
+
+    }
+  }
+
+  @Enrich(String.class)
+  public static class Two implements HalEnricher {
+
+    @Override
+    public void enrich(HalEnricherContext context, HalAppender appender) {
+
+    }
+  }
+
+  @Enrich(Integer.class)
+  public static class Three implements HalEnricher {
+
+    @Override
+    public void enrich(HalEnricherContext context, HalAppender appender) {
+
+    }
+  }
+
+  public static class Four implements HalEnricher {
+
+    @Override
+    public void enrich(HalEnricherContext context, HalAppender appender) {
+
+    }
+  }
+
+}

scm-webapp/src/test/java/sonia/scm/api/v2/resources/LinkEnricherAutoRegistrationTest.java

@@ -1,64 +0,0 @@
-package sonia.scm.api.v2.resources;
-
-import com.google.common.collect.ImmutableSet;
-import org.junit.jupiter.api.Test;
-
-import java.util.Set;
-
-import static org.assertj.core.api.Java6Assertions.assertThat;
-
-class LinkEnricherAutoRegistrationTest {
-
-  @Test
-  void shouldRegisterAllAvailableLinkEnrichers() {
-    LinkEnricher one = new One();
-    LinkEnricher two = new Two();
-    LinkEnricher three = new Three();
-    LinkEnricher four = new Four();
-    Set<LinkEnricher> enrichers = ImmutableSet.of(one, two, three, four);
-
-    LinkEnricherRegistry registry = new LinkEnricherRegistry();
-
-    LinkEnricherAutoRegistration autoRegistration = new LinkEnricherAutoRegistration(registry, enrichers);
-    autoRegistration.contextInitialized(null);
-
-    assertThat(registry.allByType(String.class)).containsOnly(one, two);
-    assertThat(registry.allByType(Integer.class)).containsOnly(three);
-  }
-
-  @Enrich(String.class)
-  public static class One implements LinkEnricher {
-
-    @Override
-    public void enrich(LinkEnricherContext context, LinkAppender appender) {
-
-    }
-  }
-
-  @Enrich(String.class)
-  public static class Two implements LinkEnricher {
-
-    @Override
-    public void enrich(LinkEnricherContext context, LinkAppender appender) {
-
-    }
-  }
-
-  @Enrich(Integer.class)
-  public static class Three implements LinkEnricher {
-
-    @Override
-    public void enrich(LinkEnricherContext context, LinkAppender appender) {
-
-    }
-  }
-
-  public static class Four implements LinkEnricher {
-
-    @Override
-    public void enrich(LinkEnricherContext context, LinkAppender appender) {
-
-    }
-  }
-
-}

scm-webapp/src/test/java/sonia/scm/api/v2/resources/MeDtoFactoryTest.java

@@ -15,7 +15,6 @@ import org.mockito.quality.Strictness;
 import sonia.scm.group.GroupNames;
 import sonia.scm.user.User;
 import sonia.scm.user.UserManager;
-import sonia.scm.user.UserPermissions;
 import sonia.scm.user.UserTestData;
 
 import java.net.URI;
@@ -170,12 +169,12 @@ class MeDtoFactoryTest {
   void shouldAppendLinks() {
     prepareSubject(UserTestData.createTrillian());
 
-    LinkEnricherRegistry registry = new LinkEnricherRegistry();
+    HalEnricherRegistry registry = new HalEnricherRegistry();
     meDtoFactory.setRegistry(registry);
 
     registry.register(Me.class, (ctx, appender) -> {
       User user = ctx.oneRequireByType(User.class);
-      appender.appendOne("profile", "http://hitchhiker.com/users/" + user.getName());
+      appender.appendLink("profile", "http://hitchhiker.com/users/" + user.getName());
     });
 
     MeDto dto = meDtoFactory.create();

scm-webapp/src/test/java/sonia/scm/api/v2/resources/NoBlankStringsValidatorTest.java

@@ -0,0 +1,28 @@
+package sonia.scm.api.v2.resources;
+
+import org.junit.jupiter.api.Test;
+
+import java.util.Arrays;
+import java.util.Collections;
+
+import static java.util.Collections.emptySet;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class NoBlankStringsValidatorTest {
+
+  @Test
+  void shouldAcceptNonEmptyElements() {
+    assertTrue(new NoBlankStringsValidator().isValid(Arrays.asList("not", "empty"), null));
+  }
+
+  @Test
+  void shouldFailForEmptyElements() {
+    assertFalse(new NoBlankStringsValidator().isValid(Arrays.asList("one", "", "three"), null));
+  }
+
+  @Test
+  void shouldAcceptEmptyList() {
+    assertTrue(new NoBlankStringsValidator().isValid(emptySet(), null));
+  }
+}

scm-webapp/src/test/java/sonia/scm/api/v2/resources/RepositoryPermissionRootResourceTest.java

@@ -1,5 +1,6 @@
 package sonia.scm.api.v2.resources;
 
+import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.github.sdorra.shiro.ShiroRule;
 import com.github.sdorra.shiro.SubjectAware;
@@ -29,10 +30,9 @@ import org.junit.jupiter.api.TestFactory;
 import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import sonia.scm.repository.NamespaceAndName;
-import sonia.scm.repository.RepositoryPermission;
-import sonia.scm.repository.PermissionType;
 import sonia.scm.repository.Repository;
 import sonia.scm.repository.RepositoryManager;
+import sonia.scm.repository.RepositoryPermission;
 import sonia.scm.web.VndMediaType;
 
 import java.io.IOException;
@@ -47,6 +47,8 @@ import java.util.stream.Stream;
 
 import static de.otto.edison.hal.Link.link;
 import static de.otto.edison.hal.Links.linkingTo;
+import static java.util.Arrays.asList;
+import static java.util.Collections.singletonList;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.fail;
@@ -66,7 +68,7 @@ import static sonia.scm.api.v2.resources.RepositoryPermissionDto.GROUP_PREFIX;
   password = "secret",
   configuration = "classpath:sonia/scm/repository/shiro.ini"
 )
-public class PermissionRootResourceTest extends RepositoryTestBase {
+public class RepositoryPermissionRootResourceTest extends RepositoryTestBase {
   private static final String REPOSITORY_NAMESPACE = "repo_namespace";
   private static final String REPOSITORY_NAME = "repo";
   private static final String PERMISSION_WRITE = "repository:permissionWrite:" + REPOSITORY_NAME;
@@ -76,15 +78,15 @@ public class PermissionRootResourceTest extends RepositoryTestBase {
   private static final String PERMISSION_NAME = "perm";
   private static final String PATH_OF_ALL_PERMISSIONS = REPOSITORY_NAMESPACE + "/" + REPOSITORY_NAME + "/permissions/";
   private static final String PATH_OF_ONE_PERMISSION = PATH_OF_ALL_PERMISSIONS + PERMISSION_NAME;
-  private static final String PERMISSION_TEST_PAYLOAD = "{ \"name\" : \"permission_name\", \"type\" : \"READ\"  }";
+  private static final String PERMISSION_TEST_PAYLOAD = "{ \"name\" : \"permission_name\", \"verbs\" : [\"read\",\"pull\"]  }";
   private static final ArrayList<RepositoryPermission> TEST_PERMISSIONS = Lists
     .newArrayList(
-      new RepositoryPermission("user_write", PermissionType.WRITE, false),
-      new RepositoryPermission("user_read", PermissionType.READ, false),
-      new RepositoryPermission("user_owner", PermissionType.OWNER, false),
-      new RepositoryPermission("group_read", PermissionType.READ, true),
-      new RepositoryPermission("group_write", PermissionType.WRITE, true),
-      new RepositoryPermission("group_owner", PermissionType.OWNER, true)
+      new RepositoryPermission("user_write", asList("read","modify"), false),
+      new RepositoryPermission("user_read", singletonList("read"), false),
+      new RepositoryPermission("user_owner", singletonList("*"), false),
+      new RepositoryPermission("group_read", singletonList("read"), true),
+      new RepositoryPermission("group_write", asList("read","modify"), true),
+      new RepositoryPermission("group_owner", singletonList("*"), true)
     );
   private final ExpectedRequest requestGETAllPermissions = new ExpectedRequest()
     .description("GET all permissions")
@@ -124,11 +126,11 @@ public class PermissionRootResourceTest extends RepositoryTestBase {
   private RepositoryPermissionToRepositoryPermissionDtoMapperImpl permissionToPermissionDtoMapper;
 
   @InjectMocks
-  private PermissionDtoToPermissionMapperImpl permissionDtoToPermissionMapper;
+  private RepositoryPermissionDtoToRepositoryPermissionMapperImpl permissionDtoToPermissionMapper;
 
   private RepositoryPermissionCollectionToDtoMapper repositoryPermissionCollectionToDtoMapper;
 
-  private PermissionRootResource permissionRootResource;
+  private RepositoryPermissionRootResource repositoryPermissionRootResource;
 
   private final Subject subject = mock(Subject.class);
   private final ThreadState subjectThreadState = new SubjectThreadState(subject);
@@ -138,8 +140,8 @@ public class PermissionRootResourceTest extends RepositoryTestBase {
   public void prepareEnvironment() {
     initMocks(this);
     repositoryPermissionCollectionToDtoMapper = new RepositoryPermissionCollectionToDtoMapper(permissionToPermissionDtoMapper, resourceLinks);
-    permissionRootResource = new PermissionRootResource(permissionDtoToPermissionMapper, permissionToPermissionDtoMapper, repositoryPermissionCollectionToDtoMapper, resourceLinks, repositoryManager);
-    super.permissionRootResource = Providers.of(permissionRootResource);
+    repositoryPermissionRootResource = new RepositoryPermissionRootResource(permissionDtoToPermissionMapper, permissionToPermissionDtoMapper, repositoryPermissionCollectionToDtoMapper, resourceLinks, repositoryManager);
+    super.permissionRootResource = Providers.of(repositoryPermissionRootResource);
     dispatcher = createDispatcher(getRepositoryRootResource());
     subjectThreadState.bind();
     ThreadContext.bind(subject);
@@ -232,11 +234,11 @@ public class PermissionRootResourceTest extends RepositoryTestBase {
   public void shouldGet400OnCreatingNewPermissionWithNotAllowedCharacters() throws URISyntaxException {
     // the @ character at the begin of the name is not allowed
     createUserWithRepository("user");
-    String permissionJson = "{ \"name\": \"@permission\", \"type\": \"OWNER\" }";
+    String permissionJson = "{ \"name\": \"@permission\", \"verbs\": [\"*\"] }";
     MockHttpRequest request = MockHttpRequest
       .post("/" + RepositoryRootResource.REPOSITORIES_PATH_V2 + PATH_OF_ALL_PERMISSIONS)
       .content(permissionJson.getBytes())
-      .contentType(VndMediaType.PERMISSION);
+      .contentType(VndMediaType.REPOSITORY_PERMISSION);
     MockHttpResponse response = new MockHttpResponse();
 
     dispatcher.invoke(request, response);
@@ -244,11 +246,11 @@ public class PermissionRootResourceTest extends RepositoryTestBase {
     assertEquals(400, response.getStatus());
 
     // the whitespace at the begin opf the name is not allowed
-    permissionJson = "{ \"name\": \" permission\", \"type\": \"OWNER\" }";
+    permissionJson = "{ \"name\": \" permission\", \"verbs\": [\"*\"] }";
     request = MockHttpRequest
       .post("/" + RepositoryRootResource.REPOSITORIES_PATH_V2 + PATH_OF_ALL_PERMISSIONS)
       .content(permissionJson.getBytes())
-      .contentType(VndMediaType.PERMISSION);
+      .contentType(VndMediaType.REPOSITORY_PERMISSION);
     response = new MockHttpResponse();
 
     dispatcher.invoke(request, response);
@@ -259,12 +261,12 @@ public class PermissionRootResourceTest extends RepositoryTestBase {
   @Test
   public void shouldGetCreatedPermissions() throws URISyntaxException {
     createUserWithRepositoryAndPermissions(TEST_PERMISSIONS, PERMISSION_WRITE);
-    RepositoryPermission newPermission = new RepositoryPermission("new_group_perm", PermissionType.WRITE, true);
+    RepositoryPermission newPermission = new RepositoryPermission("new_group_perm", asList("read", "pull", "push"), true);
     ArrayList<RepositoryPermission> permissions = Lists.newArrayList(TEST_PERMISSIONS);
     permissions.add(newPermission);
     ImmutableList<RepositoryPermission> expectedPermissions = ImmutableList.copyOf(permissions);
     assertExpectedRequest(requestPOSTPermission
-      .content("{\"name\" : \"" + newPermission.getName() + "\" , \"type\" : \"WRITE\" , \"groupPermission\" : true}")
+      .content("{\"name\" : \"" + newPermission.getName() + "\" , \"verbs\" : [\"read\",\"pull\",\"push\"], \"groupPermission\" : true}")
       .expectedResponseStatus(201)
       .responseValidator(response -> assertThat(response.getContentAsString())
         .as("POST response has no body")
@@ -278,7 +280,7 @@ public class PermissionRootResourceTest extends RepositoryTestBase {
     createUserWithRepositoryAndPermissions(TEST_PERMISSIONS, PERMISSION_WRITE);
     RepositoryPermission newPermission = TEST_PERMISSIONS.get(0);
     assertExpectedRequest(requestPOSTPermission
-      .content("{\"name\" : \"" + newPermission.getName() + "\" , \"type\" : \"WRITE\" , \"groupPermission\" : false}")
+      .content("{\"name\" : \"" + newPermission.getName() + "\" , \"verbs\" : [\"read\",\"pull\",\"push\"], \"groupPermission\" : false}")
       .expectedResponseStatus(409)
     );
   }
@@ -288,10 +290,10 @@ public class PermissionRootResourceTest extends RepositoryTestBase {
     createUserWithRepositoryAndPermissions(TEST_PERMISSIONS, PERMISSION_WRITE);
     RepositoryPermission modifiedPermission = TEST_PERMISSIONS.get(0);
     // modify the type to owner
-    modifiedPermission.setType(PermissionType.OWNER);
+    modifiedPermission.setVerbs(new ArrayList<>(singletonList("*")));
     ImmutableList<RepositoryPermission> expectedPermissions = ImmutableList.copyOf(TEST_PERMISSIONS);
     assertExpectedRequest(requestPUTPermission
-      .content("{\"name\" : \"" + modifiedPermission.getName() + "\" , \"type\" : \"OWNER\" , \"groupPermission\" : false}")
+      .content("{\"name\" : \"" + modifiedPermission.getName() + "\" , \"verbs\" : [\"*\"], \"groupPermission\" : false}")
       .path(PATH_OF_ALL_PERMISSIONS + modifiedPermission.getName())
       .expectedResponseStatus(204)
       .responseValidator(response -> assertThat(response.getContentAsString())
@@ -353,7 +355,10 @@ public class PermissionRootResourceTest extends RepositoryTestBase {
             .map(hal -> {
               RepositoryPermissionDto result = new RepositoryPermissionDto();
               result.setName(hal.getAttribute("name").asText());
-              result.setType(hal.getAttribute("type").asText());
+              JsonNode attribute = hal.getAttribute("verbs");
+              List<String> verbs = new ArrayList<>();
+              attribute.iterator().forEachRemaining(v -> verbs.add(v.asText()));
+              result.setVerbs(verbs);
               result.setGroupPermission(hal.getAttribute("groupPermission").asBoolean());
               result.add(hal.getLinks());
               return result;
@@ -382,7 +387,7 @@ public class PermissionRootResourceTest extends RepositoryTestBase {
     RepositoryPermissionDto result = new RepositoryPermissionDto();
     result.setName(permission.getName());
     result.setGroupPermission(permission.isGroupPermission());
-    result.setType(permission.getType().name());
+    result.setVerbs(permission.getVerbs());
     String permissionName = Optional.of(permission.getName())
       .filter(p -> !permission.isGroupPermission())
       .orElse(GROUP_PREFIX + permission.getName());
@@ -425,7 +430,7 @@ public class PermissionRootResourceTest extends RepositoryTestBase {
     HttpRequest request = MockHttpRequest
       .create(entry.method, "/" + RepositoryRootResource.REPOSITORIES_PATH_V2 + entry.path)
       .content(entry.content)
-      .contentType(VndMediaType.PERMISSION);
+      .contentType(VndMediaType.REPOSITORY_PERMISSION);
     dispatcher.invoke(request, response);
     log.info("Test the Request :{}", entry);
     assertThat(response.getStatus())

scm-webapp/src/test/java/sonia/scm/api/v2/resources/RepositoryPermissionToRepositoryPermissionDtoMapperTest.java

@@ -8,11 +8,11 @@ import org.junit.runner.RunWith;
 import org.mockito.InjectMocks;
 import org.mockito.junit.MockitoJUnitRunner;
 import sonia.scm.repository.RepositoryPermission;
-import sonia.scm.repository.PermissionType;
 import sonia.scm.repository.Repository;
 
 import java.net.URI;
 
+import static java.util.Arrays.asList;
 import static org.assertj.core.api.Assertions.assertThat;
 
 @RunWith(MockitoJUnitRunner.Silent.class)
@@ -36,7 +36,7 @@ public class RepositoryPermissionToRepositoryPermissionDtoMapperTest {
   @SubjectAware(username = "trillian", password = "secret")
   public void shouldMapGroupPermissionCorrectly() {
     Repository repository = getDummyRepository();
-    RepositoryPermission permission = new RepositoryPermission("42", PermissionType.OWNER, true);
+    RepositoryPermission permission = new RepositoryPermission("42", asList("read","modify","delete"), true);
 
     RepositoryPermissionDto repositoryPermissionDto = mapper.map(permission, repository);
 
@@ -48,7 +48,7 @@ public class RepositoryPermissionToRepositoryPermissionDtoMapperTest {
   @SubjectAware(username = "trillian", password = "secret")
   public void shouldMapNonGroupPermissionCorrectly() {
     Repository repository = getDummyRepository();
-    RepositoryPermission permission = new RepositoryPermission("42", PermissionType.OWNER, false);
+    RepositoryPermission permission = new RepositoryPermission("42", asList("read","modify","delete"), false);
 
     RepositoryPermissionDto repositoryPermissionDto = mapper.map(permission, repository);
 

scm-webapp/src/test/java/sonia/scm/api/v2/resources/RepositoryRootResourceTest.java

@@ -6,7 +6,6 @@ import com.google.common.io.Resources;
 import com.google.inject.util.Providers;
 import org.apache.shiro.subject.SimplePrincipalCollection;
 import org.apache.shiro.subject.Subject;
-import org.assertj.core.api.Assertions;
 import org.jboss.resteasy.core.Dispatcher;
 import org.jboss.resteasy.mock.MockHttpRequest;
 import org.jboss.resteasy.mock.MockHttpResponse;
@@ -18,8 +17,6 @@ import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import sonia.scm.PageResult;
 import sonia.scm.repository.NamespaceAndName;
-import sonia.scm.repository.RepositoryPermission;
-import sonia.scm.repository.PermissionType;
 import sonia.scm.repository.Repository;
 import sonia.scm.repository.RepositoryIsNotArchivedException;
 import sonia.scm.repository.RepositoryManager;
@@ -41,15 +38,12 @@ import static javax.servlet.http.HttpServletResponse.SC_NOT_FOUND;
 import static javax.servlet.http.HttpServletResponse.SC_NO_CONTENT;
 import static javax.servlet.http.HttpServletResponse.SC_OK;
 import static javax.servlet.http.HttpServletResponse.SC_PRECONDITION_FAILED;
-import static org.assertj.core.api.AssertionsForClassTypes.assertThat;
+import static org.assertj.core.api.Assertions.assertThat;
 import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertTrue;
-import static org.mockito.ArgumentCaptor.forClass;
 import static org.mockito.Matchers.any;
 import static org.mockito.Matchers.anyObject;
 import static org.mockito.Matchers.eq;
-import static org.mockito.Mockito.doNothing;
 import static org.mockito.Mockito.doThrow;
 import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.verify;
@@ -291,36 +285,14 @@ public class RepositoryRootResourceTest extends RepositoryTestBase {
 
     dispatcher.invoke(request, response);
 
-    Assertions.assertThat(createCaptor.getValue().getPermissions())
+    assertThat(createCaptor.getValue().getPermissions())
       .hasSize(1)
       .allSatisfy(p -> {
         assertThat(p.getName()).isEqualTo("trillian");
-        assertThat(p.getType()).isEqualTo(PermissionType.OWNER);
+        assertThat(p.getVerbs()).containsExactly("*");
       });
   }
 
-  @Test
-  public void shouldNotOverwriteExistingPermissionsOnUpdate() throws Exception {
-    Repository existingRepository = mockRepository("space", "repo");
-    existingRepository.setPermissions(singletonList(new RepositoryPermission("user", PermissionType.READ)));
-
-    URL url = Resources.getResource("sonia/scm/api/v2/repository-test-update.json");
-    byte[] repository = Resources.toByteArray(url);
-
-    ArgumentCaptor<Repository> modifiedRepositoryCaptor = forClass(Repository.class);
-    doNothing().when(repositoryManager).modify(modifiedRepositoryCaptor.capture());
-
-    MockHttpRequest request = MockHttpRequest
-      .put("/" + RepositoryRootResource.REPOSITORIES_PATH_V2 + "space/repo")
-      .contentType(VndMediaType.REPOSITORY)
-      .content(repository);
-    MockHttpResponse response = new MockHttpResponse();
-
-    dispatcher.invoke(request, response);
-
-    assertFalse(modifiedRepositoryCaptor.getValue().getPermissions().isEmpty());
-  }
-
   @Test
   public void shouldCreateArrayOfProtocolUrls() throws Exception {
     mockRepository("space", "repo");

scm-webapp/src/test/java/sonia/scm/api/v2/resources/RepositoryTestBase.java

@@ -16,7 +16,7 @@ public abstract class RepositoryTestBase {
   protected Provider<ChangesetRootResource> changesetRootResource;
   protected Provider<SourceRootResource> sourceRootResource;
   protected Provider<ContentResource> contentResource;
-  protected Provider<PermissionRootResource> permissionRootResource;
+  protected Provider<RepositoryPermissionRootResource> permissionRootResource;
   protected Provider<DiffRootResource> diffRootResource;
   protected Provider<ModificationsRootResource> modificationsRootResource;
   protected Provider<FileHistoryRootResource> fileHistoryRootResource;

scm-webapp/src/test/java/sonia/scm/api/v2/resources/RepositoryToRepositoryDtoMapperTest.java

@@ -10,8 +10,6 @@ import org.junit.Test;
 import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import sonia.scm.repository.HealthCheckFailure;
-import sonia.scm.repository.RepositoryPermission;
-import sonia.scm.repository.PermissionType;
 import sonia.scm.repository.Repository;
 import sonia.scm.repository.api.Command;
 import sonia.scm.repository.api.RepositoryService;
@@ -213,10 +211,10 @@ public class RepositoryToRepositoryDtoMapperTest {
 
   @Test
   public void shouldAppendLinks() {
-    LinkEnricherRegistry registry = new LinkEnricherRegistry();
+    HalEnricherRegistry registry = new HalEnricherRegistry();
     registry.register(Repository.class, (ctx, appender) -> {
       Repository repository = ctx.oneRequireByType(Repository.class);
-      appender.appendOne("id", "http://" + repository.getId());
+      appender.appendLink("id", "http://" + repository.getId());
     });
     mapper.setRegistry(registry);
 
@@ -238,7 +236,6 @@ public class RepositoryToRepositoryDtoMapperTest {
     repository.setId("1");
     repository.setCreationDate(System.currentTimeMillis());
     repository.setHealthCheckFailures(singletonList(new HealthCheckFailure("1", "summary", "url", "failure")));
-    repository.setPermissions(singletonList(new RepositoryPermission("permission", PermissionType.READ)));
 
     return repository;
   }

scm-webapp/src/test/java/sonia/scm/api/v2/resources/ResourceLinksMock.java

@@ -42,6 +42,7 @@ public class ResourceLinksMock {
     when(resourceLinks.index()).thenReturn(new ResourceLinks.IndexLinks(uriInfo));
     when(resourceLinks.merge()).thenReturn(new ResourceLinks.MergeLinks(uriInfo));
     when(resourceLinks.permissions()).thenReturn(new ResourceLinks.PermissionsLinks(uriInfo));
+    when(resourceLinks.availableRepositoryPermissions()).thenReturn(new ResourceLinks.AvailableRepositoryPermissionLinks(uriInfo));
 
     return resourceLinks;
   }

scm-webapp/src/test/java/sonia/scm/api/v2/resources/TagToTagDtoMapperTest.java

@@ -22,11 +22,11 @@ class TagToTagDtoMapperTest {
 
   @Test
   void shouldAppendLinks() {
-    LinkEnricherRegistry registry = new LinkEnricherRegistry();
+    HalEnricherRegistry registry = new HalEnricherRegistry();
     registry.register(Tag.class, (ctx, appender) -> {
       NamespaceAndName repository = ctx.oneRequireByType(NamespaceAndName.class);
       Tag tag = ctx.oneRequireByType(Tag.class);
-      appender.appendOne("yo", "http://" + repository.logString() + "/" + tag.getName());
+      appender.appendLink("yo", "http://" + repository.logString() + "/" + tag.getName());
     });
     mapper.setRegistry(registry);
 

scm-webapp/src/test/java/sonia/scm/api/v2/resources/UserToUserDtoMapperTest.java

@@ -155,8 +155,8 @@ public class UserToUserDtoMapperTest {
   public void shouldAppendLink() {
     User trillian = UserTestData.createTrillian();
 
-    LinkEnricherRegistry registry = new LinkEnricherRegistry();
-    registry.register(User.class, (ctx, appender) -> appender.appendOne("sample", "http://" + ctx.oneByType(User.class).get().getName()));
+    HalEnricherRegistry registry = new HalEnricherRegistry();
+    registry.register(User.class, (ctx, appender) -> appender.appendLink("sample", "http://" + ctx.oneByType(User.class).get().getName()));
     mapper.setRegistry(registry);
 
     UserDto userDto = mapper.map(trillian);

scm-webapp/src/test/java/sonia/scm/it/GitLfsITCase.java

@@ -50,7 +50,6 @@ import sonia.scm.api.rest.ObjectMapperProvider;
 import sonia.scm.api.v2.resources.RepositoryDto;
 import sonia.scm.api.v2.resources.UserDto;
 import sonia.scm.api.v2.resources.UserToUserDtoMapperImpl;
-import sonia.scm.repository.PermissionType;
 import sonia.scm.user.User;
 import sonia.scm.user.UserTestData;
 import sonia.scm.util.HttpUtil;
@@ -117,10 +116,6 @@ public class GitLfsITCase {
 
   @Test
   public void testLfsAPIWithOwnerPermissions() throws IOException {
-    uploadAndDownloadAsUser(PermissionType.OWNER);
-  }
-
-  private void uploadAndDownloadAsUser(PermissionType permissionType) throws IOException {
     User trillian = UserTestData.createTrillian();
     trillian.setPassword("secret123");
     createUser(trillian);
@@ -129,8 +124,8 @@ public class GitLfsITCase {
       String permissionsUrl = repository.getLinks().getLinkBy("permissions").get().getHref();
       IntegrationTestUtil.createResource(adminClient, URI.create(permissionsUrl))
         .accept("*/*")
-        .type(VndMediaType.PERMISSION)
-        .post(ClientResponse.class, "{\"name\": \""+ trillian.getId() +"\", \"type\":\"WRITE\"}");
+        .type(VndMediaType.REPOSITORY_PERMISSION)
+        .post(ClientResponse.class, "{\"name\": \""+ trillian.getId() +"\", \"verbs\":[\"*\"]}");
 
       ScmClient client = new ScmClient(trillian.getId(), "secret123");
 
@@ -140,16 +135,14 @@ public class GitLfsITCase {
     }
   }
 
-  @Test
-  public void testLfsAPIWithWritePermissions() throws IOException {
-    uploadAndDownloadAsUser(PermissionType.WRITE);
-  }
-
   private void createUser(User user) {
-    UserDto dto = new UserToUserDtoMapperImpl(){
-      @Override
-      protected void appendLinks(User user, UserDto target) {}
-    }.map(user);
+    UserDto dto = new UserDto();
+    dto.setName(user.getName());
+    dto.setMail(user.getMail());
+    dto.setDisplayName(user.getDisplayName());
+    dto.setType(user.getType());
+    dto.setActive(user.isActive());
+    dto.setAdmin(user.isAdmin());
     dto.setPassword(user.getPassword());
     createResource(adminClient, "users")
       .accept("*/*")
@@ -175,8 +168,8 @@ public class GitLfsITCase {
       String permissionsUrl = repository.getLinks().getLinkBy("permissions").get().getHref();
       IntegrationTestUtil.createResource(adminClient, URI.create(permissionsUrl))
         .accept("*/*")
-        .type(VndMediaType.PERMISSION)
-        .post(ClientResponse.class, "{\"name\": \""+ trillian.getId() +"\", \"type\":\"READ\"}");
+        .type(VndMediaType.REPOSITORY_PERMISSION)
+        .post(ClientResponse.class, "{\"name\": \""+ trillian.getId() +"\", \"verbs\":[\"read\"]}");
 
       ScmClient client = new ScmClient(trillian.getId(), "secret123");
       uploadAndDownload(client);
@@ -196,8 +189,8 @@ public class GitLfsITCase {
       String permissionsUrl = repository.getLinks().getLinkBy("permissions").get().getHref();
       IntegrationTestUtil.createResource(adminClient, URI.create(permissionsUrl))
         .accept("*/*")
-        .type(VndMediaType.PERMISSION)
-        .post(ClientResponse.class, "{\"name\": \""+ trillian.getId() +"\", \"type\":\"READ\"}");
+        .type(VndMediaType.REPOSITORY_PERMISSION)
+        .post(ClientResponse.class, "{\"name\": \""+ trillian.getId() +"\", \"verbs\":[\"read\",\"pull\"]}");
 
       // upload data as admin
       String data = UUID.randomUUID().toString();

scm-webapp/src/test/java/sonia/scm/repository/DefaultRepositoryManagerPerfTest.java

@@ -111,7 +111,6 @@ public class DefaultRepositoryManagerPerfTest {
   public void setUpObjectUnderTest(){
     when(repositoryHandler.getType()).thenReturn(new RepositoryType(REPOSITORY_TYPE, REPOSITORY_TYPE, Sets.newHashSet()));
     Set<RepositoryHandler> handlerSet = ImmutableSet.of(repositoryHandler);
-    RepositoryMatcher repositoryMatcher = new RepositoryMatcher(Collections.<RepositoryPathMatcher>emptySet());
     NamespaceStrategy namespaceStrategy = mock(NamespaceStrategy.class);
     repositoryManager = new DefaultRepositoryManager(
       configuration, 
@@ -138,7 +137,7 @@ public class DefaultRepositoryManagerPerfTest {
   /**
    * Start performance test and ensure that the timeout is not reached.
    */
-  @Test(timeout = 6000l)
+  @Test(timeout = 6000L)
   public void perfTestGetAll(){
     SecurityUtils.getSubject().login(new UsernamePasswordToken("trillian", "secret"));
     
@@ -155,7 +154,7 @@ public class DefaultRepositoryManagerPerfTest {
   }
   
 private long calculateAverage(List<Long> times) {
-  Long sum = 0l;
+  Long sum = 0L;
   if(!times.isEmpty()) {
     for (Long time : times) {
         sum += time;
@@ -183,9 +182,8 @@ private long calculateAverage(List<Long> times) {
   }
   
   private Repository createTestRepository(int number) {
-    Repository repository = new Repository(keyGenerator.createKey(), REPOSITORY_TYPE, "namespace", "repo-" + number);
-    repository.addPermission(new RepositoryPermission("trillian", PermissionType.READ));
-    return repository;
+    return new Repository(keyGenerator.createKey(), REPOSITORY_TYPE, "namespace", "repo-" + number);
+
   }
   
   static class DummyRealm extends AuthorizingRealm {

scm-webapp/src/test/java/sonia/scm/security/AuthorizationChangedEventProducerTest.java

@@ -32,14 +32,12 @@
 package sonia.scm.security;
 
 import com.google.common.collect.Lists;
-import org.junit.Test;
-import static org.junit.Assert.*;
 import org.junit.Before;
+import org.junit.Test;
 import sonia.scm.HandlerEventType;
 import sonia.scm.group.Group;
 import sonia.scm.group.GroupEvent;
 import sonia.scm.group.GroupModificationEvent;
-import sonia.scm.repository.PermissionType;
 import sonia.scm.repository.Repository;
 import sonia.scm.repository.RepositoryEvent;
 import sonia.scm.repository.RepositoryModificationEvent;
@@ -50,6 +48,14 @@ import sonia.scm.user.UserEvent;
 import sonia.scm.user.UserModificationEvent;
 import sonia.scm.user.UserTestData;
 
+import static java.util.Arrays.asList;
+import static java.util.Collections.singletonList;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+
 /**
  * Unit tests for {@link AuthorizationChangedEventProducer}.
  * 
@@ -87,7 +93,12 @@ public class AuthorizationChangedEventProducerTest {
     assertTrue(producer.event.isEveryUserAffected());
     assertEquals(username, producer.event.getNameOfAffectedUser());
   }
-  
+
+  private void assertGlobalEventIsFired(){
+    assertNotNull(producer.event);
+    assertFalse(producer.event.isEveryUserAffected());
+  }
+
   /**
    * Tests {@link AuthorizationChangedEventProducer#onEvent(sonia.scm.user.UserEvent)} with modified user.
    */
@@ -127,11 +138,6 @@ public class AuthorizationChangedEventProducerTest {
     assertGlobalEventIsFired();
   }
   
-  private void assertGlobalEventIsFired(){
-    assertNotNull(producer.event);
-    assertFalse(producer.event.isEveryUserAffected());
-  }
-  
   /**
    * Tests {@link AuthorizationChangedEventProducer#onEvent(sonia.scm.group.GroupEvent)} with modified groups.
    */
@@ -174,40 +180,49 @@ public class AuthorizationChangedEventProducerTest {
   {
     Repository repositoryModified = RepositoryTestData.createHeartOfGold();
     repositoryModified.setName("test123");
-    repositoryModified.setPermissions(Lists.newArrayList(new RepositoryPermission("test")));
-    
+    repositoryModified.setPermissions(Lists.newArrayList(new RepositoryPermission("test", singletonList("read"), false)));
+
     Repository repository = RepositoryTestData.createHeartOfGold();
-    repository.setPermissions(Lists.newArrayList(new RepositoryPermission("test")));
-    
+    repository.setPermissions(Lists.newArrayList(new RepositoryPermission("test", singletonList("read"), false)));
+
     producer.onEvent(new RepositoryModificationEvent(HandlerEventType.BEFORE_CREATE, repositoryModified, repository));
     assertEventIsNotFired();
-    
+
     producer.onEvent(new RepositoryModificationEvent(HandlerEventType.CREATE, repositoryModified, repository));
     assertEventIsNotFired();
-    
-    repositoryModified.setPermissions(Lists.newArrayList(new RepositoryPermission("test")));
+
+    repositoryModified.setPermissions(Lists.newArrayList(new RepositoryPermission("test", singletonList("read"), false)));
     producer.onEvent(new RepositoryModificationEvent(HandlerEventType.CREATE, repositoryModified, repository));
     assertEventIsNotFired();
-    
-    repositoryModified.setPermissions(Lists.newArrayList(new RepositoryPermission("test123")));
+
+    repositoryModified.setPermissions(Lists.newArrayList(new RepositoryPermission("test123", singletonList("read"), false)));
     producer.onEvent(new RepositoryModificationEvent(HandlerEventType.CREATE, repositoryModified, repository));
     assertGlobalEventIsFired();
-    
+
     resetStoredEvent();
 
     repositoryModified.setPermissions(
-      Lists.newArrayList(new RepositoryPermission("test", PermissionType.READ, true))
+      Lists.newArrayList(new RepositoryPermission("test", singletonList("read"), true))
     );
     producer.onEvent(new RepositoryModificationEvent(HandlerEventType.CREATE, repositoryModified, repository));
     assertGlobalEventIsFired();
-    
+
     resetStoredEvent();
-    
+
     repositoryModified.setPermissions(
-      Lists.newArrayList(new RepositoryPermission("test", PermissionType.WRITE))
+      Lists.newArrayList(new RepositoryPermission("test", asList("read", "write"), false))
     );
     producer.onEvent(new RepositoryModificationEvent(HandlerEventType.CREATE, repositoryModified, repository));
     assertGlobalEventIsFired();
+
+    resetStoredEvent();
+    repository.setPermissions(Lists.newArrayList(new RepositoryPermission("test", asList("read", "write"), false)));
+
+    repositoryModified.setPermissions(
+      Lists.newArrayList(new RepositoryPermission("test", asList("write", "read"), false))
+    );
+    producer.onEvent(new RepositoryModificationEvent(HandlerEventType.CREATE, repositoryModified, repository));
+    assertEventIsNotFired();
   }
   
   private void resetStoredEvent(){

scm-webapp/src/test/java/sonia/scm/security/DefaultAuthorizationCollectorTest.java

@@ -51,7 +51,6 @@ import sonia.scm.cache.Cache;
 import sonia.scm.cache.CacheManager;
 import sonia.scm.config.ScmConfiguration;
 import sonia.scm.group.GroupNames;
-import sonia.scm.repository.PermissionType;
 import sonia.scm.repository.Repository;
 import sonia.scm.repository.RepositoryDAO;
 import sonia.scm.repository.RepositoryPermission;
@@ -59,6 +58,7 @@ import sonia.scm.repository.RepositoryTestData;
 import sonia.scm.user.User;
 import sonia.scm.user.UserTestData;
 
+import static java.util.Arrays.asList;
 import static org.hamcrest.Matchers.containsInAnyOrder;
 import static org.hamcrest.Matchers.hasSize;
 import static org.hamcrest.Matchers.nullValue;
@@ -225,10 +225,10 @@ public class DefaultAuthorizationCollectorTest {
     authenticate(UserTestData.createTrillian(), group);
     Repository heartOfGold = RepositoryTestData.createHeartOfGold();
     heartOfGold.setId("one");
-    heartOfGold.setPermissions(Lists.newArrayList(new RepositoryPermission("trillian")));
+    heartOfGold.setPermissions(Lists.newArrayList(new RepositoryPermission("trillian", asList("read", "pull"), false)));
     Repository puzzle42 = RepositoryTestData.create42Puzzle();
     puzzle42.setId("two");
-    RepositoryPermission permission = new RepositoryPermission(group, PermissionType.WRITE, true);
+    RepositoryPermission permission = new RepositoryPermission(group, asList("read", "pull", "push"), true);
     puzzle42.setPermissions(Lists.newArrayList(permission));
     when(repositoryDAO.getAll()).thenReturn(Lists.newArrayList(heartOfGold, puzzle42));
 

scm-webapp/src/test/java/sonia/scm/security/RepositoryPermissionProviderTest.java

@@ -0,0 +1,58 @@
+package sonia.scm.security;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import sonia.scm.plugin.PluginLoader;
+import sonia.scm.repository.RepositoryPermissions;
+import sonia.scm.util.ClassLoaders;
+
+import java.lang.reflect.Field;
+import java.util.Arrays;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.junit.jupiter.api.Assertions.fail;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+class RepositoryPermissionProviderTest {
+
+  private RepositoryPermissionProvider repositoryPermissionProvider;
+  private String[] allVerbsFromRepositoryClass;
+
+
+  @BeforeEach
+  void init() {
+    PluginLoader pluginLoader = mock(PluginLoader.class);
+    when(pluginLoader.getUberClassLoader()).thenReturn(ClassLoaders.getContextClassLoader(DefaultSecuritySystem.class));
+    repositoryPermissionProvider = new RepositoryPermissionProvider(pluginLoader);
+    allVerbsFromRepositoryClass = Arrays.stream(RepositoryPermissions.class.getDeclaredFields())
+      .filter(field -> field.getName().startsWith("ACTION_"))
+      .map(this::getString)
+      .filter(verb -> !"create".equals(verb))
+      .toArray(String[]::new);
+  }
+
+  @Test
+  void shouldReadAvailableRoles() {
+    assertThat(repositoryPermissionProvider.availableRoles()).isNotEmpty();
+    assertThat(repositoryPermissionProvider.availableRoles()).allSatisfy(this::containsOnlyAvailableVerbs);
+  }
+
+  private void containsOnlyAvailableVerbs(RepositoryRole role) {
+    assertThat(role.getVerbs()).isSubsetOf(repositoryPermissionProvider.availableVerbs());
+  }
+
+  @Test
+  void shouldReadAvailableVerbsFromRepository() {
+    assertThat(repositoryPermissionProvider.availableVerbs()).contains(allVerbsFromRepositoryClass);
+  }
+
+  private String getString(Field field) {
+    try {
+      return (String) field.get(null);
+    } catch (IllegalAccessException e) {
+      fail(e);
+      return null;
+    }
+  }
+}

scm-webapp/src/test/java/sonia/scm/web/cgi/DefaultCGIExecutorTest.java

@@ -0,0 +1,54 @@
+package sonia.scm.web.cgi;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.runners.MockitoJUnitRunner;
+
+import javax.servlet.http.HttpServletRequest;
+
+import static org.junit.Assert.*;
+import static org.mockito.Mockito.when;
+
+/**
+ * Unit tests for {@link DefaultCGIExecutor}.
+ */
+@RunWith(MockitoJUnitRunner.class)
+public class DefaultCGIExecutorTest {
+
+  @Mock
+  private HttpServletRequest request;
+
+  @Test
+  public void testCreateCGIContentLength() {
+    when(request.getHeader("Content-Length")).thenReturn("42");
+    assertEquals("42", DefaultCGIExecutor.createCGIContentLength(request, false));
+    assertEquals("42", DefaultCGIExecutor.createCGIContentLength(request, true));
+  }
+
+  @Test
+  public void testCreateCGIContentLengthWithZeroLength() {
+    when(request.getHeader("Content-Length")).thenReturn("0");
+    assertEquals("", DefaultCGIExecutor.createCGIContentLength(request, false));
+    assertEquals("-1", DefaultCGIExecutor.createCGIContentLength(request, true));
+  }
+
+  @Test
+  public void testCreateCGIContentLengthWithoutContentLengthHeader() {
+    assertEquals("", DefaultCGIExecutor.createCGIContentLength(request, false));
+    assertEquals("-1", DefaultCGIExecutor.createCGIContentLength(request, true));
+  }
+
+  @Test
+  public void testCreateCGIContentLengthWithLengthThatExeedsInteger() {
+    when(request.getHeader("Content-Length")).thenReturn("6314297259");
+    assertEquals("6314297259", DefaultCGIExecutor.createCGIContentLength(request, false));
+  }
+
+  @Test
+  public void testCreateCGIContentLengthWithNonNumberHeader() {
+    when(request.getHeader("Content-Length")).thenReturn("abc");
+    assertEquals("", DefaultCGIExecutor.createCGIContentLength(request, false));
+  }
+
+}

scm-webapp/src/test/java/sonia/scm/web/i18n/I18nServletTest.java

@@ -2,8 +2,6 @@ package sonia.scm.web.i18n;
 
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
-import com.github.sdorra.shiro.ShiroRule;
-import com.github.sdorra.shiro.SubjectAware;
 import com.google.common.base.Charsets;
 import com.google.common.io.Files;
 import org.apache.commons.lang3.StringUtils;
@@ -42,12 +40,8 @@ import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.Mockito.*;
 
 @RunWith(MockitoJUnitRunner.Silent.class)
-@SubjectAware(configuration = "classpath:sonia/scm/shiro-001.ini")
 public class I18nServletTest {
 
-  @Rule
-  public ShiroRule shiro = new ShiroRule();
-
   private static final String GIT_PLUGIN_JSON = json(
     "{",
       "'scm-git-plugin': {",
@@ -88,15 +82,15 @@ public class I18nServletTest {
   public TemporaryFolder temporaryFolder = new TemporaryFolder();
 
   @Mock
-  PluginLoader pluginLoader;
+  private PluginLoader pluginLoader;
 
   @Mock
-  CacheManager cacheManager;
+  private CacheManager cacheManager;
 
   @Mock
-  ClassLoader classLoader;
+  private ClassLoader classLoader;
 
-  I18nServlet servlet;
+  private I18nServlet servlet;
 
   @Mock
   private Cache cache;
@@ -106,9 +100,9 @@ public class I18nServletTest {
   @SuppressWarnings("unchecked")
   public void init() throws IOException {
     resources = Collections.enumeration(Lists.newArrayList(
-      createFileFromString(SVN_PLUGIN_JSON).toURL(),
-      createFileFromString(GIT_PLUGIN_JSON).toURL(),
-      createFileFromString(HG_PLUGIN_JSON).toURL()
+      createFileFromString(SVN_PLUGIN_JSON).toURI().toURL(),
+      createFileFromString(GIT_PLUGIN_JSON).toURI().toURL(),
+      createFileFromString(HG_PLUGIN_JSON).toURI().toURL()
     ));
     when(pluginLoader.getUberClassLoader()).thenReturn(classLoader);
     when(cacheManager.getCache(I18nServlet.CACHE_NAME)).thenReturn(cache);
@@ -194,6 +188,8 @@ public class I18nServletTest {
     assertJson(json);
     verify(cache).get(path);
     verify(cache).put(eq(path), any());
+
+    verifyHeaders(response);
   }
 
   @Test
@@ -221,6 +217,8 @@ public class I18nServletTest {
     verify(cache, never()).put(eq(path), any());
     verify(cache).get(path);
     assertJson(json);
+
+    verifyHeaders(response);
   }
 
   @Test
@@ -234,11 +232,16 @@ public class I18nServletTest {
     assertJson(jsonNodeOptional.orElse(null));
   }
 
+  private void verifyHeaders(HttpServletResponse response) {
+    verify(response).setCharacterEncoding("UTF-8");
+    verify(response).setContentType("application/json");
+  }
+
   public void assertJson(JsonNode actual) throws IOException {
     assertJson(actual.toString());
   }
 
-  public void assertJson(String actual) throws IOException {
+  private void assertJson(String actual) throws IOException {
     assertThat(actual)
       .isNotEmpty()
       .contains(StringUtils.deleteWhitespace(GIT_PLUGIN_JSON.substring(1, GIT_PLUGIN_JSON.length() - 1)))
@@ -246,7 +249,7 @@ public class I18nServletTest {
       .contains(StringUtils.deleteWhitespace(SVN_PLUGIN_JSON.substring(1, SVN_PLUGIN_JSON.length() - 1)));
   }
 
-  public File createFileFromString(String json) throws IOException {
+  private File createFileFromString(String json) throws IOException {
     File file = temporaryFolder.newFile();
     Files.write(json.getBytes(Charsets.UTF_8), file);
     return file;