@duftler comments + small test

gate-web/src/main/groovy/com/netflix/spinnaker/gate/security/anonymous/AnonymousConfig.groovy

@@ -54,8 +54,12 @@ class AnonymousConfig extends WebSecurityConfigurerAdapter {
 
   @Scheduled(initialDelay = 30000L, fixedDelay = 60000L)
   void updateAnonymousAccounts() {
-    def newAnonAccounts = accountsService.getAllowedAccounts([])
-    anonymousAllowedAccounts.clear()
-    anonymousAllowedAccounts.addAll(newAnonAccounts)
+    def newAnonAccounts = accountsService.getAllowedAccounts([]) ?: []
+
+    def toAdd = newAnonAccounts - anonymousAllowedAccounts
+    def toRemove = anonymousAllowedAccounts - newAnonAccounts
+
+    anonymousAllowedAccounts.removeAll(toRemove)
+    anonymousAllowedAccounts.addAll(toAdd)
   }
 }

gate-web/src/test/groovy/com/netflix/spinnaker/gate/security/anonymous/AnonymousConfigSpec.groovy

@@ -0,0 +1,49 @@
+/*
+ * Copyright 2016 Google, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License")
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.netflix.spinnaker.gate.security.anonymous
+
+import com.netflix.spinnaker.gate.services.AccountsService
+import spock.lang.Specification
+import spock.lang.Subject
+import spock.lang.Unroll
+
+class AnonymousConfigSpec extends Specification {
+
+  @Unroll
+  def "should update accounts correctly"() {
+    setup:
+      AccountsService accountsService = Mock(AccountsService) {
+        getAllowedAccounts(*_) >> newAccounts
+      }
+      @Subject AnonymousConfig config = new AnonymousConfig(anonymousAllowedAccounts: oldAccounts,
+                                                            accountsService: accountsService)
+
+
+    when:
+      config.updateAnonymousAccounts()
+
+    then:
+      config.anonymousAllowedAccounts == newAccounts
+
+    where:
+      oldAccounts || newAccounts
+      []          || ["a"]
+      ["a"]       || ["a", "b"]
+      ["a"]       || ["b"]
+      ["a"]       || []
+  }
+}