DS-3651: Check bitstream authorizatoins + tests

dspace-spring-rest/src/main/java/org/dspace/app/rest/BitstreamContentRestController.java

@@ -20,8 +20,11 @@ import org.apache.log4j.Logger;
 import org.dspace.app.rest.model.BitstreamRest;
 import org.dspace.app.rest.utils.ContextUtil;
 import org.dspace.app.rest.utils.MultipartFileSender;
+import org.dspace.authorize.AuthorizeException;
+import org.dspace.authorize.service.AuthorizeService;
 import org.dspace.content.Bitstream;
 import org.dspace.content.service.BitstreamService;
+import org.dspace.core.Constants;
 import org.dspace.core.Context;
 import org.dspace.services.ConfigurationService;
 import org.dspace.services.EventService;
@@ -51,6 +54,9 @@ public class BitstreamContentRestController implements InitializingBean {
 	@Autowired
 	private ConfigurationService configurationService;
 
+	@Autowired
+    private AuthorizeService authorizeService;
+
 	private int bufferSize;
 
     @Override
@@ -64,9 +70,9 @@ public class BitstreamContentRestController implements InitializingBean {
 
 		Context context = ContextUtil.obtainContext(request);
 
-		Bitstream bit = bitstreamService.find(context, uuid);
+        Bitstream bit = getBitstreamIfAuthorized(context, uuid, response);
         if (bit == null) {
-			response.sendError(HttpServletResponse.SC_NOT_FOUND);
+            //The bitstream was not found or we're not authorized to read it.
             return;
         }
 
@@ -110,6 +116,22 @@ public class BitstreamContentRestController implements InitializingBean {
 		}
 	}
 
+    private Bitstream getBitstreamIfAuthorized(Context context, @PathVariable UUID uuid, HttpServletResponse response) throws SQLException, IOException {
+        Bitstream bit = bitstreamService.find(context, uuid);
+        if (bit == null) {
+            response.sendError(HttpServletResponse.SC_NOT_FOUND);
+        } else {
+            try {
+                authorizeService.authorizeAction(context, bit, Constants.READ);
+            } catch (AuthorizeException e) {
+                response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
+                bit = null;
+            }
+        }
+
+        return bit;
+    }
+
     private InputStream getInputStream(Context context, Bitstream bit) {
 		try {
 			return bitstreamService.retrieve(context, bit);

dspace-spring-rest/src/test/java/org/dspace/app/rest/BitstreamContentRestControllerIT.java

@@ -14,21 +14,25 @@ import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
 
+import java.io.IOException;
 import java.io.InputStream;
 import java.util.UUID;
 
 import org.apache.commons.io.IOUtils;
 import org.apache.commons.lang3.CharEncoding;
 import org.apache.solr.client.solrj.SolrQuery;
+import org.apache.solr.client.solrj.SolrServerException;
 import org.apache.solr.client.solrj.response.QueryResponse;
 import org.dspace.app.rest.builder.BitstreamBuilder;
 import org.dspace.app.rest.builder.CollectionBuilder;
 import org.dspace.app.rest.builder.CommunityBuilder;
+import org.dspace.app.rest.builder.GroupBuilder;
 import org.dspace.app.rest.builder.ItemBuilder;
 import org.dspace.app.rest.test.AbstractControllerIntegrationTest;
 import org.dspace.content.Bitstream;
 import org.dspace.content.Collection;
 import org.dspace.content.Item;
+import org.dspace.eperson.Group;
 import org.dspace.solr.MockSolrServer;
 import org.junit.After;
 import org.junit.Before;
@@ -61,24 +65,24 @@ public class BitstreamContentRestControllerIT extends AbstractControllerIntegrat
 
         //** GIVEN **
         //1. A community-collection structure with one parent community and one collections.
-        parentCommunity = new CommunityBuilder().createCommunity(context)
+        parentCommunity = CommunityBuilder.createCommunity(context)
                 .withName("Parent Community")
                 .build();
 
-        Collection col1 = new CollectionBuilder().createCollection(context, parentCommunity).withName("Collection 1").build();
+        Collection col1 = CollectionBuilder.createCollection(context, parentCommunity).withName("Collection 1").build();
 
         //2. A public item with a bitstream
         String bitstreamContent = "0123456789";
 
         try(InputStream is = IOUtils.toInputStream(bitstreamContent, CharEncoding.UTF_8)) {
 
-            Item publicItem1 = new ItemBuilder().createItem(context, col1)
+            Item publicItem1 = ItemBuilder.createItem(context, col1)
                     .withTitle("Public item 1")
                     .withIssueDate("2017-10-17")
                     .withAuthor("Smith, Donald").withAuthor("Doe, John")
                     .build();
 
-            Bitstream bitstream = new BitstreamBuilder()
+            Bitstream bitstream = BitstreamBuilder
                     .createBitstream(context, publicItem1, is)
                     .withName("Test bitstream")
                     .withDescription("This is a bitstream to test range requests")
@@ -109,13 +113,7 @@ public class BitstreamContentRestControllerIT extends AbstractControllerIntegrat
                     .andExpect(status().isNotModified());
 
             //The download and head request should also be logged as a statistics record
-            mockSolrServer.getSolrServer().commit();
+            checkNumberOfStatsRecords(bitstream, 2);
-
-            SolrQuery query = new SolrQuery("id:\"" + bitstream.getID() + "\"")
-                    .setRows(0)
-                    .setStart(0);
-            QueryResponse queryResponse = mockSolrServer.getSolrServer().query(query);
-            assertEquals( 2, queryResponse.getResults().getNumFound());
         }
     }
 
@@ -125,24 +123,24 @@ public class BitstreamContentRestControllerIT extends AbstractControllerIntegrat
 
         //** GIVEN **
         //1. A community-collection structure with one parent community and one collections.
-        parentCommunity = new CommunityBuilder().createCommunity(context)
+        parentCommunity = CommunityBuilder.createCommunity(context)
                 .withName("Parent Community")
                 .build();
 
-        Collection col1 = new CollectionBuilder().createCollection(context, parentCommunity).withName("Collection 1").build();
+        Collection col1 = CollectionBuilder.createCollection(context, parentCommunity).withName("Collection 1").build();
 
         //2. A public item with a bitstream
         String bitstreamContent = "0123456789";
 
         try(InputStream is = IOUtils.toInputStream(bitstreamContent, CharEncoding.UTF_8)) {
 
-            Item publicItem1 = new ItemBuilder().createItem(context, col1)
+            Item publicItem1 = ItemBuilder.createItem(context, col1)
                     .withTitle("Public item 1")
                     .withIssueDate("2017-10-17")
                     .withAuthor("Smith, Donald").withAuthor("Doe, John")
                     .build();
 
-            Bitstream bitstream = new BitstreamBuilder()
+            Bitstream bitstream = BitstreamBuilder
                     .createBitstream(context, publicItem1, is)
                     .withName("Test bitstream")
                     .withDescription("This is a bitstream to test range requests")
@@ -192,13 +190,7 @@ public class BitstreamContentRestControllerIT extends AbstractControllerIntegrat
                     .andExpect(content().bytes("456789".getBytes()));
 
             //Check that NO statistics record was logged for the Range requests
-            mockSolrServer.getSolrServer().commit();
+            checkNumberOfStatsRecords(bitstream, 0);
-
-            SolrQuery query = new SolrQuery("id:\"" + bitstream.getID() + "\"")
-                    .setRows(0)
-                    .setStart(0);
-            QueryResponse queryResponse = mockSolrServer.getSolrServer().query(query);
-            assertEquals(0, queryResponse.getResults().getNumFound());
         }
     }
 
@@ -208,4 +200,111 @@ public class BitstreamContentRestControllerIT extends AbstractControllerIntegrat
                 .andExpect(status().isNotFound());
     }
 
+    @Test
+    public void testEmbargoedBitstream() throws Exception {
+        context.turnOffAuthorisationSystem();
+
+        //** GIVEN **
+        //1. A community-collection structure with one parent community and one collections.
+        parentCommunity = CommunityBuilder.createCommunity(context)
+                .withName("Parent Community")
+                .build();
+
+        Collection col1 = CollectionBuilder.createCollection(context, parentCommunity).withName("Collection 1").build();
+
+        //2. A public item with an embargoed bitstream
+        String bitstreamContent = "Embargoed!";
+
+        try(InputStream is = IOUtils.toInputStream(bitstreamContent, CharEncoding.UTF_8)) {
+
+            Item publicItem1 = ItemBuilder.createItem(context, col1)
+                    .withTitle("Public item 1")
+                    .withIssueDate("2017-10-17")
+                    .withAuthor("Smith, Donald").withAuthor("Doe, John")
+                    .build();
+
+            Bitstream bitstream = BitstreamBuilder
+                    .createBitstream(context, publicItem1, is)
+                    .withName("Test Embargoed Bitstream")
+                    .withDescription("This bitstream is embargoed")
+                    .withMimeType("text/plain")
+                    .withEmbargoPeriod("6 months")
+                    .build();
+
+            //** WHEN **
+            //We download the bitstream
+            getClient().perform(get("/api/core/bitstreams/" + bitstream.getID() + "/content"))
+
+                    //** THEN **
+                    .andExpect(status().isUnauthorized())
+                    //The response should not contain any content.
+                    .andExpect(content().bytes(new byte[0]));
+
+            //An unauthorized request should not log statistics
+            checkNumberOfStatsRecords(bitstream, 0);
+        }
+    }
+
+    @Test
+    public void testPrivateBitstream() throws Exception {
+        context.turnOffAuthorisationSystem();
+
+        //** GIVEN **
+        //1. A community-collection structure with one parent community and one collections.
+        parentCommunity = CommunityBuilder.createCommunity(context)
+                .withName("Parent Community")
+                .build();
+
+        Collection col1 = CollectionBuilder.createCollection(context, parentCommunity).withName("Collection 1").build();
+
+        //2. A public item with a private bitstream
+        Item publicItem1 = ItemBuilder.createItem(context, col1)
+                .withTitle("Public item 1")
+                .withIssueDate("2017-10-17")
+                .withAuthor("Smith, Donald").withAuthor("Doe, John")
+                .build();
+
+        Group internalGroup = GroupBuilder.createGroup(context)
+                .withName("Internal Group")
+                .build();
+
+        String bitstreamContent = "Private!";
+        try(InputStream is = IOUtils.toInputStream(bitstreamContent, CharEncoding.UTF_8)) {
+
+            Bitstream bitstream = BitstreamBuilder
+                    .createBitstream(context, publicItem1, is)
+                    .withName("Test Embargoed Bitstream")
+                    .withDescription("This bitstream is embargoed")
+                    .withMimeType("text/plain")
+                    .withReaderGroup(internalGroup)
+                    .build();
+
+            //** WHEN **
+            //We download the bitstream
+            getClient().perform(get("/api/core/bitstreams/" + bitstream.getID() + "/content"))
+
+                    //** THEN **
+                    .andExpect(status().isUnauthorized())
+                    //The response should not contain any content.
+                    .andExpect(content().bytes(new byte[0]));
+
+            //An unauthorized request should not log statistics
+            checkNumberOfStatsRecords(bitstream, 0);
+
+        } finally {
+            //** CLEANUP **
+            GroupBuilder.cleaner().delete(internalGroup);
+        }
+    }
+
+    private void checkNumberOfStatsRecords(Bitstream bitstream, int expectedNumberOfStatsRecords) throws SolrServerException, IOException {
+        mockSolrServer.getSolrServer().commit();
+
+        SolrQuery query = new SolrQuery("id:\"" + bitstream.getID() + "\"")
+                .setRows(0)
+                .setStart(0);
+        QueryResponse queryResponse = mockSolrServer.getSolrServer().query(query);
+        assertEquals(expectedNumberOfStatsRecords, queryResponse.getResults().getNumFound());
+    }
+
 }

dspace-spring-rest/src/test/java/org/dspace/app/rest/BrowsesResourceControllerIT.java

@@ -129,31 +129,31 @@ public class BrowsesResourceControllerIT extends AbstractControllerIntegrationTe
 
         //** GIVEN **
         //1. A community-collection structure with one parent community with sub-community and two collections.
-        parentCommunity = new CommunityBuilder().createCommunity(context)
+        parentCommunity = CommunityBuilder.createCommunity(context)
                 .withName("Parent Community")
                 .build();
-        Community child1 = new CommunityBuilder().createSubCommunity(context, parentCommunity)
+        Community child1 = CommunityBuilder.createSubCommunity(context, parentCommunity)
                 .withName("Sub Community")
                 .build();
-        Collection col1 = new CollectionBuilder().createCollection(context, child1).withName("Collection 1").build();
+        Collection col1 = CollectionBuilder.createCollection(context, child1).withName("Collection 1").build();
-        Collection col2 = new CollectionBuilder().createCollection(context, child1).withName("Collection 2").build();
+        Collection col2 = CollectionBuilder.createCollection(context, child1).withName("Collection 2").build();
 
         //2. Three public items that are readable by Anonymous with different subjects
-        Item publicItem1 = new ItemBuilder().createItem(context, col1)
+        Item publicItem1 = ItemBuilder.createItem(context, col1)
                 .withTitle("Public item 1")
                 .withIssueDate("2017-10-17")
                 .withAuthor("Smith, Donald").withAuthor("Doe, John")
                 .withSubject("ExtraEntry")
                 .build();
 
-        Item publicItem2 = new ItemBuilder().createItem(context, col2)
+        Item publicItem2 = ItemBuilder.createItem(context, col2)
                 .withTitle("Public item 2")
                 .withIssueDate("2016-02-13")
                 .withAuthor("Smith, Maria").withAuthor("Doe, Jane")
                 .withSubject("TestingForMore").withSubject("ExtraEntry")
                 .build();
 
-        Item publicItem3 = new ItemBuilder().createItem(context, col2)
+        Item publicItem3 = ItemBuilder.createItem(context, col2)
                 .withTitle("Public item 2")
                 .withIssueDate("2016-02-13")
                 .withAuthor("Smith, Maria").withAuthor("Doe, Jane")
@@ -208,32 +208,32 @@ public class BrowsesResourceControllerIT extends AbstractControllerIntegrationTe
 
         //** GIVEN **
         //1. A community-collection structure with one parent community with sub-community and two collections.
-        parentCommunity = new CommunityBuilder().createCommunity(context)
+        parentCommunity = CommunityBuilder.createCommunity(context)
                 .withName("Parent Community")
                 .build();
-        Community child1 = new CommunityBuilder().createSubCommunity(context, parentCommunity)
+        Community child1 = CommunityBuilder.createSubCommunity(context, parentCommunity)
                 .withName("Sub Community")
                 .build();
-        Collection col1 = new CollectionBuilder().createCollection(context, child1).withName("Collection 1").build();
+        Collection col1 = CollectionBuilder.createCollection(context, child1).withName("Collection 1").build();
-        Collection col2 = new CollectionBuilder().createCollection(context, child1).withName("Collection 2").build();
+        Collection col2 = CollectionBuilder.createCollection(context, child1).withName("Collection 2").build();
 
         //2. Two public items with the same subject and another public item that contains that same subject, but also another one
         //   All of the items are readable by an Anonymous user
-        Item publicItem1 = new ItemBuilder().createItem(context, col1)
+        Item publicItem1 = ItemBuilder.createItem(context, col1)
                 .withTitle("zPublic item more")
                 .withIssueDate("2017-10-17")
                 .withAuthor("Smith, Donald").withAuthor("Doe, John")
                 .withSubject("ExtraEntry").withSubject("AnotherTest")
                 .build();
 
-        Item publicItem2 = new ItemBuilder().createItem(context, col2)
+        Item publicItem2 = ItemBuilder.createItem(context, col2)
                 .withTitle("Public item 2")
                 .withIssueDate("2016-02-13")
                 .withAuthor("Smith, Maria").withAuthor("Doe, Jane")
                 .withSubject("AnotherTest")
                 .build();
 
-        Item publicItem3 = new ItemBuilder().createItem(context, col2)
+        Item publicItem3 = ItemBuilder.createItem(context, col2)
                 .withTitle("Public item 3")
                 .withIssueDate("2016-02-14")
                 .withAuthor("Smith, Maria").withAuthor("Doe, Jane")
@@ -282,24 +282,24 @@ public class BrowsesResourceControllerIT extends AbstractControllerIntegrationTe
 
         //** GIVEN **
         //1. A community-collection structure with one parent community with sub-community and two collections.
-        parentCommunity = new CommunityBuilder().createCommunity(context)
+        parentCommunity = CommunityBuilder.createCommunity(context)
                 .withName("Parent Community")
                 .build();
-        Community child1 = new CommunityBuilder().createSubCommunity(context, parentCommunity)
+        Community child1 = CommunityBuilder.createSubCommunity(context, parentCommunity)
                 .withName("Sub Community")
                 .build();
-        Collection col1 = new CollectionBuilder().createCollection(context, child1).withName("Collection 1").build();
+        Collection col1 = CollectionBuilder.createCollection(context, child1).withName("Collection 1").build();
-        Collection col2 = new CollectionBuilder().createCollection(context, child1).withName("Collection 2").build();
+        Collection col2 = CollectionBuilder.createCollection(context, child1).withName("Collection 2").build();
 
         //2. Two public items that are readable by Anonymous
-        Item publicItem1 = new ItemBuilder().createItem(context, col1)
+        Item publicItem1 = ItemBuilder.createItem(context, col1)
                 .withTitle("Public item 1")
                 .withIssueDate("2017-10-17")
                 .withAuthor("Smith, Donald").withAuthor("Doe, John")
                 .withSubject("Java").withSubject("Unit Testing")
                 .build();
 
-        Item publicItem2 = new ItemBuilder().createItem(context, col2)
+        Item publicItem2 = ItemBuilder.createItem(context, col2)
                 .withTitle("Public item 2")
                 .withIssueDate("2016-02-13")
                 .withAuthor("Smith, Maria").withAuthor("Doe, Jane")
@@ -307,7 +307,7 @@ public class BrowsesResourceControllerIT extends AbstractControllerIntegrationTe
                 .build();
 
         //3. An item that has been made private
-        Item privateItem = new ItemBuilder().createItem(context, col1)
+        Item privateItem = ItemBuilder.createItem(context, col1)
                 .withTitle("This is a private item")
                 .withIssueDate("2015-03-12")
                 .withAuthor("Duck, Donald")
@@ -316,7 +316,7 @@ public class BrowsesResourceControllerIT extends AbstractControllerIntegrationTe
                 .build();
 
         //4. An item with an item-level embargo
-        Item embargoedItem = new ItemBuilder().createItem(context, col2)
+        Item embargoedItem = ItemBuilder.createItem(context, col2)
                 .withTitle("An embargoed publication")
                 .withIssueDate("2017-08-10")
                 .withAuthor("Mouse, Mickey")
@@ -325,11 +325,11 @@ public class BrowsesResourceControllerIT extends AbstractControllerIntegrationTe
                 .build();
 
         //5. An item that is only readable for an internal groups
-        Group internalGroup = new GroupBuilder().createGroup(context)
+        Group internalGroup = GroupBuilder.createGroup(context)
                 .withName("Internal Group")
                 .build();
 
-        Item internalItem = new ItemBuilder().createItem(context, col2)
+        Item internalItem = ItemBuilder.createItem(context, col2)
                 .withTitle("Internal publication")
                 .withIssueDate("2016-09-19")
                 .withAuthor("Doe, John")
@@ -376,7 +376,7 @@ public class BrowsesResourceControllerIT extends AbstractControllerIntegrationTe
         ;
 
         //** CLEANUP **
-        new GroupBuilder().delete(internalGroup);
+        GroupBuilder.cleaner().delete(internalGroup);
     }
 
     @Test
@@ -385,47 +385,47 @@ public class BrowsesResourceControllerIT extends AbstractControllerIntegrationTe
 
         //** GIVEN **
         //1. A community-collection structure with one parent community with sub-community and two collections.
-        parentCommunity = new CommunityBuilder().createCommunity(context)
+        parentCommunity = CommunityBuilder.createCommunity(context)
                 .withName("Parent Community")
                 .build();
-        Community child1 = new CommunityBuilder().createSubCommunity(context, parentCommunity)
+        Community child1 = CommunityBuilder.createSubCommunity(context, parentCommunity)
                 .withName("Sub Community")
                 .build();
-        Collection col1 = new CollectionBuilder().createCollection(context, child1).withName("Collection 1").build();
+        Collection col1 = CollectionBuilder.createCollection(context, child1).withName("Collection 1").build();
-        Collection col2 = new CollectionBuilder().createCollection(context, child1).withName("Collection 2").build();
+        Collection col2 = CollectionBuilder.createCollection(context, child1).withName("Collection 2").build();
 
         //2. 7 public items that are readable by Anonymous
-        Item item1 = new ItemBuilder().createItem(context, col1)
+        Item item1 = ItemBuilder.createItem(context, col1)
                 .withTitle("Item 1")
                 .withIssueDate("2017-10-17")
                 .build();
 
-        Item item2 = new ItemBuilder().createItem(context, col2)
+        Item item2 = ItemBuilder.createItem(context, col2)
                 .withTitle("Item 2")
                 .withIssueDate("2016-02-13")
                 .build();
 
-        Item item3 = new ItemBuilder().createItem(context, col1)
+        Item item3 = ItemBuilder.createItem(context, col1)
                 .withTitle("Item 3")
                 .withIssueDate("2016-02-12")
                 .build();
 
-        Item item4 = new ItemBuilder().createItem(context, col2)
+        Item item4 = ItemBuilder.createItem(context, col2)
                 .withTitle("Item 4")
                 .withIssueDate("2016-02-11")
                 .build();
 
-        Item item5 = new ItemBuilder().createItem(context, col1)
+        Item item5 = ItemBuilder.createItem(context, col1)
                 .withTitle("Item 5")
                 .withIssueDate("2016-02-10")
                 .build();
 
-        Item item6 = new ItemBuilder().createItem(context, col2)
+        Item item6 = ItemBuilder.createItem(context, col2)
                 .withTitle("Item 6")
                 .withIssueDate("2016-01-13")
                 .build();
 
-        Item item7 = new ItemBuilder().createItem(context, col1)
+        Item item7 = ItemBuilder.createItem(context, col1)
                 .withTitle("Item 7")
                 .withIssueDate("2016-01-12")
                 .build();

dspace-spring-rest/src/test/java/org/dspace/app/rest/builder/AbstractBuilder.java

@@ -157,8 +157,10 @@ public abstract class AbstractBuilder<T extends DSpaceObject> {
         Context c = new Context();
         c.turnOffAuthorisationSystem();
         T attachedDso = c.reloadEntity(dso);
+
         if(attachedDso != null) {
             getDsoService().delete(c, attachedDso);
         }
     }
+
 }

dspace-spring-rest/src/test/java/org/dspace/app/rest/builder/BitstreamBuilder.java

@@ -19,6 +19,7 @@ import org.dspace.content.Bundle;
 import org.dspace.content.Item;
 import org.dspace.content.service.DSpaceObjectService;
 import org.dspace.core.Context;
+import org.dspace.eperson.Group;
 
 /**
  * Builder class to build bitstreams in test cases
@@ -28,9 +29,21 @@ public class BitstreamBuilder extends AbstractBuilder<Bitstream>{
     public static final String ORIGINAL = "ORIGINAL";
 
     private Bitstream bitstream;
+    private Item item;
+    private Group readerGroup;
 
-    public BitstreamBuilder createBitstream(Context context, Item item, InputStream is) throws SQLException, AuthorizeException, IOException {
+    protected BitstreamBuilder() {
+
+    }
+
+    public static BitstreamBuilder createBitstream(Context context, Item item, InputStream is) throws SQLException, AuthorizeException, IOException {
+        BitstreamBuilder builder = new BitstreamBuilder();
+        return builder.create(context, item, is);
+    }
+
+    private BitstreamBuilder create(Context context, Item item, InputStream is) throws SQLException, AuthorizeException, IOException {
         this.context = context;
+        this.item = item;
 
         Bundle originalBundle = getOriginalBundle(item);
 
@@ -78,17 +91,37 @@ public class BitstreamBuilder extends AbstractBuilder<Bitstream>{
         return targetBundle;
     }
 
-    protected DSpaceObjectService<Bitstream> getDsoService() {
+    public BitstreamBuilder withEmbargoPeriod(String embargoPeriod) {
-        return bitstreamService;
+        return setEmbargo(embargoPeriod, bitstream);
+    }
+
+    public BitstreamBuilder withReaderGroup(Group group) {
+        readerGroup = group;
+        return this;
     }
 
     public Bitstream build() {
         try {
             bitstreamService.update(context, bitstream);
+            itemService.update(context, item);
+
+            //Check if we need to make this bitstream private.
+            if(readerGroup != null) {
+                setOnlyReadPermission(bitstream, readerGroup, null);
+            }
+
+            context.dispatchEvents();
+
+            indexingService.commit();
+
         } catch (Exception e) {
             return null;
         }
 
         return bitstream;
     }
+
+    protected DSpaceObjectService<Bitstream> getDsoService() {
+        return bitstreamService;
+    }
 }

dspace-spring-rest/src/test/java/org/dspace/app/rest/builder/CollectionBuilder.java

@@ -20,7 +20,16 @@ public class CollectionBuilder extends AbstractBuilder<Collection> {
 
     private Collection collection;
 
-    public CollectionBuilder createCollection(final Context context, final Community parent) {
+    protected CollectionBuilder() {
+
+    }
+
+    public static CollectionBuilder createCollection(final Context context, final Community parent) {
+        CollectionBuilder builder = new CollectionBuilder();
+        return builder.create(context, parent);
+    }
+
+    private CollectionBuilder create(final Context context, final Community parent) {
         this.context = context;
         try {
             this.collection = collectionService.create(context, parent);

dspace-spring-rest/src/test/java/org/dspace/app/rest/builder/CommunityBuilder.java

@@ -19,11 +19,25 @@ public class CommunityBuilder extends AbstractBuilder<Community> {
 
     private Community community;
 
-    public CommunityBuilder createCommunity(final Context context) {
+    protected CommunityBuilder() {
+
+    }
+
+    public static CommunityBuilder createCommunity(final Context context) {
+        CommunityBuilder builder = new CommunityBuilder();
+        return builder.create(context);
+    }
+
+    private CommunityBuilder create(final Context context) {
         return createSubCommunity(context, null);
     }
 
-    public CommunityBuilder createSubCommunity(final Context context, final Community parent) {
+    public static CommunityBuilder createSubCommunity(final Context context, final Community parent) {
+        CommunityBuilder builder = new CommunityBuilder();
+        return builder.createSub(context, parent);
+    }
+
+    private CommunityBuilder createSub(final Context context, final Community parent) {
         this.context = context;
         try {
             community = communityService.create(parent, context);

dspace-spring-rest/src/test/java/org/dspace/app/rest/builder/GroupBuilder.java

@@ -19,6 +19,25 @@ public class GroupBuilder extends AbstractBuilder<Group> {
 
     private Group group;
 
+    protected GroupBuilder() {
+
+    }
+
+    public static GroupBuilder createGroup(final Context context) {
+        GroupBuilder builder = new GroupBuilder();
+        return builder.create(context);
+    }
+
+    private GroupBuilder create(final Context context) {
+        this.context = context;
+        try {
+            group = groupService.create(context);
+        } catch (Exception e) {
+            return handleException(e);
+        }
+        return this;
+    }
+
     @Override
     protected DSpaceObjectService<Group> getDsoService() {
         return groupService;
@@ -29,16 +48,6 @@ public class GroupBuilder extends AbstractBuilder<Group> {
         return group;
     }
 
-    public GroupBuilder createGroup(final Context context) {
-        this.context = context;
-        try {
-            group = groupService.create(context);
-        } catch (Exception e) {
-            return handleException(e);
-        }
-        return this;
-    }
-
     public GroupBuilder withName(String groupName) {
         try {
             groupService.setName(group, groupName);
@@ -65,4 +74,9 @@ public class GroupBuilder extends AbstractBuilder<Group> {
         }
         return this;
     }
+
+    public static AbstractBuilder<Group> cleaner() {
+        return new GroupBuilder();
+    }
+
 }

dspace-spring-rest/src/test/java/org/dspace/app/rest/builder/ItemBuilder.java

@@ -24,11 +24,20 @@ public class ItemBuilder extends AbstractBuilder<Item> {
     private WorkspaceItem workspaceItem;
     private Group readerGroup = null;
 
-    public ItemBuilder createItem(final Context context, final Collection col1) {
+    protected ItemBuilder() {
+
+    }
+
+    public static ItemBuilder createItem(final Context context, final Collection col) {
+        ItemBuilder builder = new ItemBuilder();
+        return builder.create(context, col);
+    }
+
+    private ItemBuilder create(final Context context, final Collection col) {
         this.context = context;
 
         try {
-            workspaceItem = workspaceItemService.create(context, col1, false);
+            workspaceItem = workspaceItemService.create(context, col, false);
         } catch (Exception e) {
             return handleException(e);
         }