check namespace permission and retrieve namespace id from db

apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/controller/ConfigsExportController.java

@@ -14,6 +14,7 @@ import com.ctrip.framework.apollo.portal.util.ConfigToFileUtils;
 import com.google.common.base.Joiner;
 import com.google.common.base.Splitter;
 import org.springframework.context.annotation.Lazy;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PathVariable;
 import org.springframework.web.bind.annotation.PostMapping;
@@ -45,6 +46,7 @@ public class ConfigsExportController {
     this.namespaceService = namespaceService;
   }
 
+  @PreAuthorize(value = "@permissionValidator.hasModifyNamespacePermission(#appId, #namespaceName, #env)")
   @PostMapping("/apps/{appId}/envs/{env}/clusters/{clusterName}/namespaces/{namespaceName}/items/import")
   public void importConfigFile(@PathVariable String appId, @PathVariable String env,
       @PathVariable String clusterName, @PathVariable String namespaceName,

apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/service/ItemService.java

@@ -72,7 +72,14 @@ public class ItemService {
     Env env = model.getEnv();
     String clusterName = model.getClusterName();
     String namespaceName = model.getNamespaceName();
-    long namespaceId = model.getNamespaceId();
+
+    NamespaceDTO namespace = namespaceAPI.loadNamespace(appId, env, clusterName, namespaceName);
+    if (namespace == null) {
+      throw new BadRequestException(
+          "namespace:" + namespaceName + " not exist in env:" + env + ", cluster:" + clusterName);
+    }
+    long namespaceId = namespace.getId();
+
     String configText = model.getConfigText();
 
     ConfigTextResolver resolver =

apollo-portal/src/test/java/com/ctrip/framework/apollo/portal/service/ConfigServiceTest.java

@@ -26,6 +26,7 @@ import java.util.Arrays;
 import java.util.List;
 
 import static org.junit.Assert.assertEquals;
+import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 
 public class ConfigServiceTest extends AbstractUnitTest {
@@ -54,6 +55,7 @@ public class ConfigServiceTest extends AbstractUnitTest {
     String appId = "6666";
     String clusterName = "default";
     String namespaceName = "application";
+    long someNamespaceId = 123L;
 
     NamespaceTextModel model = new NamespaceTextModel();
     model.setEnv("DEV");
@@ -66,8 +68,12 @@ public class ConfigServiceTest extends AbstractUnitTest {
     ItemChangeSets changeSets = new ItemChangeSets();
     changeSets.addCreateItem(new ItemDTO("d", "c", "", 4));
 
+    NamespaceDTO someNamespaceDto = mock(NamespaceDTO.class);
+    when(someNamespaceDto.getId()).thenReturn(someNamespaceId);
+    when(namespaceAPI.loadNamespace(appId, model.getEnv(), clusterName, namespaceName))
+        .thenReturn(someNamespaceDto);
     when(itemAPI.findItems(appId, Env.DEV, clusterName, namespaceName)).thenReturn(itemDTOs);
-    when(resolver.resolve(0, model.getConfigText(), itemDTOs)).thenReturn(changeSets);
+    when(resolver.resolve(someNamespaceId, model.getConfigText(), itemDTOs)).thenReturn(changeSets);
 
     UserInfo userInfo = new UserInfo();
     userInfo.setUserId("test");