From a34364bc3e14f950c6dcf11255f42c3459d6421b Mon Sep 17 00:00:00 2001
From: Avgustin Marinov <Avgustin.Marinov@bosch.com>
Date: Tue, 15 Jul 2025 13:29:20 +0300
Subject: [PATCH] Make allAuthorities unmodifiable (#2551)

Signed-off-by: Avgustin Marinov <Avgustin.Marinov@bosch.com>
---
 .../hawkbit/repository/test/util/SecurityContextSwitch.java    | 3 ++-
 .../org/eclipse/hawkbit/im/authentication/SpPermission.java    | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/hawkbit-repository/hawkbit-repository-test/src/main/java/org/eclipse/hawkbit/repository/test/util/SecurityContextSwitch.java b/hawkbit-repository/hawkbit-repository-test/src/main/java/org/eclipse/hawkbit/repository/test/util/SecurityContextSwitch.java
index 9173c021a..c72848bc4 100644
--- a/hawkbit-repository/hawkbit-repository-test/src/main/java/org/eclipse/hawkbit/repository/test/util/SecurityContextSwitch.java
+++ b/hawkbit-repository/hawkbit-repository-test/src/main/java/org/eclipse/hawkbit/repository/test/util/SecurityContextSwitch.java
@@ -12,6 +12,7 @@ package org.eclipse.hawkbit.repository.test.util;
 import java.io.Serial;
 import java.io.Serializable;
 import java.lang.annotation.Annotation;
+import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
 import java.util.Objects;
@@ -164,7 +165,7 @@ public class SecurityContextSwitch {
         }
 
         private String[] getAllAuthorities(final String[] additionalAuthorities, final String[] notInclude) {
-            final List<String> permissions = SpPermission.getAllAuthorities();
+            final List<String> permissions = new ArrayList<>(SpPermission.getAllAuthorities()); // list is unmodifiable
             if (notInclude != null) {
                 permissions.removeAll(Arrays.asList(notInclude));
             }
diff --git a/hawkbit-security-core/src/main/java/org/eclipse/hawkbit/im/authentication/SpPermission.java b/hawkbit-security-core/src/main/java/org/eclipse/hawkbit/im/authentication/SpPermission.java
index 5f8840a6c..0d7064efc 100644
--- a/hawkbit-security-core/src/main/java/org/eclipse/hawkbit/im/authentication/SpPermission.java
+++ b/hawkbit-security-core/src/main/java/org/eclipse/hawkbit/im/authentication/SpPermission.java
@@ -12,6 +12,7 @@ package org.eclipse.hawkbit.im.authentication;
 import java.lang.reflect.Field;
 import java.lang.reflect.Modifier;
 import java.util.ArrayList;
+import java.util.Collections;
 import java.util.List;
 
 import lombok.AccessLevel;
@@ -168,7 +169,7 @@ public final class SpPermission {
                 }
             }
         }
-        return allPermissions;
+        return Collections.unmodifiableList(allPermissions);
     });
     /**
      * Return all permission.