Spring Security RoleHierarchyImpl should support simple tree hierarchies

Expected Behavior

Using the following RoleHierarchyImpl, I would expect ROLE_ADMIN contains ROLE_EDITOR_A and ROLE_EDITOR_B:

RoleHierarchyImpl roleHierarchy = new RoleHierarchyImpl();
roleHierarchy.setHierarchy("ROLE_ADMIN > ROLE_EDITOR_A \n ROLE_ADMIN > ROLE_EDITOR_B");

Current Behavior

Only ROLE_ADMIN > ROLE_EDITOR_A is parsed, due to this condition in buildRolesReachableInOneStepMap

Context

On the one hand, I do not think this is a bug, since the code is that old that such a simple non-working role mapping as defined should have been discovered much earlier.

On the other hand,

RoleHierarchyUtils.roleHierarchyFromMap(Map.of("ROLE_ADMIN", Arrays.asList("ROLE_EDITOR_A", "ROLE_EDITOR_B")))

is returning this non-working roleHierarchyStringRepresentation.

Comment From: jzheaux

Hi, @chkpnt, thanks for reaching out.

I'm sorry, I'm not able to reproduce the behavior you are describing. Please see this test which demonstrates the behavior working as you describe (or at least how I'm understanding your report).

While there may still be a bug, I'm going to need more information from you. Would you please post a failing unit test?

Comment From: chkpnt

Well... I have to say, I'm a little embarrassed not to be able to reproduce it myself! Furthermore, I do not see the issue in the code which I saw last week. I really can't tell what I did wrong last week. But this is working as it should:

@Test
public void testSimpleComplexRoleHierarchy() {
    List<GrantedAuthority> authoritiesInput1 = AuthorityUtils.createAuthorityList("ROLE_A");
    List<GrantedAuthority> authoritiesOutput1 = AuthorityUtils.createAuthorityList("ROLE_A", "ROLE_B", "ROLE_C");
    RoleHierarchyImpl roleHierarchyImpl = new RoleHierarchyImpl();
    roleHierarchyImpl.setHierarchy("ROLE_A > ROLE_B\nROLE_A > ROLE_C");
    assertThat(HierarchicalRolesTestHelper.containTheSameGrantedAuthorities(
        roleHierarchyImpl.getReachableGrantedAuthorities(authoritiesInput1), authoritiesOutput1)).isTrue();
}

Sorry for wasting your time. :-/