Added new unit tests. Change get***ById() to find just entities from this realm/application

model/jpa/src/main/java/org/keycloak/models/jpa/ApplicationAdapter.java

@@ -125,11 +125,13 @@ public class ApplicationAdapter implements ApplicationModel {
 
     @Override
     public boolean removeRoleById(String id) {
-        ApplicationRoleEntity role = em.find(ApplicationRoleEntity.class, id);
-        if (role == null) {
+        RoleAdapter roleAdapter = getRoleById(id);
+        if (roleAdapter == null) {
             return false;
         }
 
+        ApplicationRoleEntity role = (ApplicationRoleEntity)roleAdapter.getRole();
+
         application.getRoles().remove(role);
         application.getDefaultRoles().remove(role);
 
@@ -154,8 +156,13 @@ public class ApplicationAdapter implements ApplicationModel {
     }
 
     @Override
-    public RoleModel getRoleById(String id) {
-        return realm.getRoleById(id);
+    public RoleAdapter getRoleById(String id) {
+        RoleEntity entity = em.find(RoleEntity.class, id);
+
+        // Check if it's application role and belongs to this application
+        if (entity == null || !(entity instanceof ApplicationRoleEntity)) return null;
+        ApplicationRoleEntity appRoleEntity = (ApplicationRoleEntity)entity;
+        return (appRoleEntity.getApplication().equals(this.application)) ? new RoleAdapter(this.realm, em, appRoleEntity) : null;
     }
 
     @Override

model/jpa/src/main/java/org/keycloak/models/jpa/RealmAdapter.java

@@ -431,7 +431,11 @@ public class RealmAdapter implements RealmModel {
 
     @Override
     public UserModel getUserById(String id) {
-        return new UserAdapter(em.find(UserEntity.class, id));
+        UserEntity entity = em.find(UserEntity.class, id);
+
+        // Check if user belongs to this realm
+        if (entity == null || !this.realm.equals(entity.getRealm())) return null;
+        return new UserAdapter(entity);
     }
 
     @Override
@@ -562,6 +566,7 @@ public class RealmAdapter implements RealmModel {
         applicationData.setApplicationUser(user);
         applicationData.setName(name);
         applicationData.setEnabled(true);
+        applicationData.setRealm(realm);
         realm.getApplications().add(applicationData);
         em.persist(applicationData);
         em.flush();
@@ -606,7 +611,9 @@ public class RealmAdapter implements RealmModel {
     @Override
     public ApplicationModel getApplicationById(String id) {
         ApplicationEntity app = em.find(ApplicationEntity.class, id);
-        if (app == null) return null;
+
+        // Check if application belongs to this realm
+        if (app == null || !this.realm.equals(app.getRealm())) return null;
         return new ApplicationAdapter(this, em, app);
     }
 
@@ -783,7 +790,9 @@ public class RealmAdapter implements RealmModel {
     @Override
     public OAuthClientModel getOAuthClientById(String id) {
         OAuthClientEntity client = em.find(OAuthClientEntity.class, id);
-        if (client == null) return null;
+
+        // Check if client belongs to this realm
+        if (client == null || !this.realm.equals(client.getRealm())) return null;
         return new OAuthClientAdapter(client);
     }
 
@@ -846,7 +855,6 @@ public class RealmAdapter implements RealmModel {
     @Override
     public boolean removeRoleById(String id) {
         RoleModel role = getRoleById(id);
-        if (role == null) return false;
 
         if (role == null) {
             return false;
@@ -877,8 +885,11 @@ public class RealmAdapter implements RealmModel {
     @Override
     public RoleModel getRoleById(String id) {
         RoleEntity entity = em.find(RoleEntity.class, id);
-        if (entity == null) return null;
-        return new RoleAdapter(this, em, entity);
+
+        // Check if it's realm role and belongs to this realm
+        if (entity == null || !(entity instanceof RealmRoleEntity)) return null;
+        RealmRoleEntity realmRoleEntity = (RealmRoleEntity)entity;
+        return (realmRoleEntity.getRealm().equals(this.realm)) ? new RoleAdapter(this, em, realmRoleEntity) : null;
     }
 
     @Override
@@ -894,8 +905,8 @@ public class RealmAdapter implements RealmModel {
 
     protected TypedQuery<UserRoleMappingEntity> getUserRoleMappingEntityTypedQuery(UserAdapter user, RoleAdapter role) {
         TypedQuery<UserRoleMappingEntity> query = em.createNamedQuery("userHasRole", UserRoleMappingEntity.class);
-        query.setParameter("user", ((UserAdapter)user).getUser());
-        query.setParameter("role", ((RoleAdapter) role).getRole());
+        query.setParameter("user", user.getUser());
+        query.setParameter("role", role.getRole());
         return query;
     }
 
@@ -938,6 +949,8 @@ public class RealmAdapter implements RealmModel {
 
     @Override
     public void deleteRoleMapping(UserModel user, RoleModel role) {
+        if (user == null || role == null) return;
+
         TypedQuery<UserRoleMappingEntity> query = getUserRoleMappingEntityTypedQuery((UserAdapter) user, (RoleAdapter) role);
         List<UserRoleMappingEntity> results = query.getResultList();
         if (results.size() == 0) return;

model/jpa/src/main/java/org/keycloak/models/jpa/entities/ApplicationEntity.java

@@ -6,6 +6,7 @@ import javax.persistence.FetchType;
 import javax.persistence.GeneratedValue;
 import javax.persistence.Id;
 import javax.persistence.JoinTable;
+import javax.persistence.ManyToOne;
 import javax.persistence.OneToMany;
 import javax.persistence.OneToOne;
 import java.util.ArrayList;
@@ -40,6 +41,9 @@ public class ApplicationEntity {
     @JoinTable(name="ApplicationDefaultRoles")
     Collection<RoleEntity> defaultRoles = new ArrayList<RoleEntity>();
 
+    @ManyToOne()
+    private RealmEntity realm;
+
     public String getId() {
         return id;
     }
@@ -107,4 +111,12 @@ public class ApplicationEntity {
     public void setDefaultRoles(Collection<RoleEntity> defaultRoles) {
         this.defaultRoles = defaultRoles;
     }
+
+    public RealmEntity getRealm() {
+        return realm;
+    }
+
+    public void setRealm(RealmEntity realm) {
+        this.realm = realm;
+    }
 }

model/jpa/src/main/java/org/keycloak/models/jpa/entities/RealmEntity.java

@@ -68,7 +68,7 @@ public class RealmEntity {
     @JoinTable(name="OAuthClient_RequiredCreds")
     Collection<RequiredCredentialEntity> requiredOAuthClCredentials = new ArrayList<RequiredCredentialEntity>();
 
-    @OneToMany(cascade ={CascadeType.REMOVE}, orphanRemoval = true)
+    @OneToMany(fetch = FetchType.LAZY, cascade ={CascadeType.REMOVE}, orphanRemoval = true, mappedBy = "realm")
     Collection<ApplicationEntity> applications = new ArrayList<ApplicationEntity>();
 
     @OneToMany(fetch = FetchType.LAZY, cascade ={CascadeType.REMOVE}, orphanRemoval = true, mappedBy = "realm")