/** * Yobi, Project Hosting SW * * Copyright 2012 NAVER Corp. * http://yobi.io * * @Author Hwi Ahn * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ package utils; import models.*; import models.enumeration.*; import models.resource.Resource; import org.junit.After; import org.junit.Before; import org.junit.Test; import org.junit.Assert; import play.test.Helpers; import static org.fest.assertions.Assertions.assertThat; public class AccessControlTest extends ModelTest<Role>{ @Test public void isAllowed_siteAdmin() { // Given User admin = User.findByLoginId("admin"); Project projectYobi = Project.findByOwnerAndProjectName("yobi", "projectYobi"); // When boolean canUpdate = AccessControl.isAllowed(admin, projectYobi.asResource(), Operation.UPDATE); boolean canRead = AccessControl.isAllowed(admin, projectYobi.asResource(), Operation.READ); boolean canDelete = AccessControl.isAllowed(admin, projectYobi.asResource(), Operation.DELETE); // Then assertThat(canRead).isEqualTo(true); assertThat(canUpdate).isEqualTo(true); assertThat(canDelete).isEqualTo(true); } @Test public void isAllowed_projectCreator() { // Given User yobi = User.findByLoginId("yobi"); Project projectYobi = Project.findByOwnerAndProjectName("yobi", "projectYobi"); // When boolean canUpdate = AccessControl.isAllowed(yobi, projectYobi.asResource(), Operation.UPDATE); boolean canRead = AccessControl.isAllowed(yobi, projectYobi.asResource(), Operation.READ); boolean canDelete = AccessControl.isAllowed(yobi, projectYobi.asResource(), Operation.DELETE); // Then assertThat(canRead).isEqualTo(true); assertThat(canUpdate).isEqualTo(true); assertThat(canDelete).isEqualTo(true); } @Test public void isAllowed_notAMember() { // Given User notMember = User.findByLoginId("nori"); Project projectYobi = Project.findByOwnerAndProjectName("yobi", "projectYobi"); // When boolean canUpdate = AccessControl.isAllowed(notMember, projectYobi.asResource(), Operation.UPDATE); boolean canRead = AccessControl.isAllowed(notMember, projectYobi.asResource(), Operation.READ); boolean canDelete = AccessControl.isAllowed(notMember, projectYobi.asResource(), Operation.DELETE); // Then assertThat(canRead).isEqualTo(true); assertThat(canUpdate).isEqualTo(false); assertThat(canDelete).isEqualTo(false); } // AccessControl.isAllowed throws IllegalStateException if the resource // belongs to a project but the project is missing. @Test public void isAllowed_lostProject() { // Given User author = User.findByLoginId("nori"); Project projectYobi = Project.findByOwnerAndProjectName("yobi", "projectYobi"); Issue issue = new Issue(); issue.setProject(projectYobi); issue.setTitle("hello"); issue.setBody("world"); issue.setAuthor(author); issue.state = State.OPEN; issue.save(); // When issue.project = null; // Then try { AccessControl.isAllowed(author, issue.asResource(), Operation.READ); Assert.fail(); } catch (IllegalStateException e) { } } @Test public void isResourceCreatable_to_group_member() { // Given User doortts = User.findByLoginId("doortts"); User nori = User.findByLoginId("nori"); Organization organization = createOrganization("TestOrganization"); OrganizationUser.assignRole(doortts.id, organization.id, RoleType.ORG_MEMBER.roleType()); Project protectedProject = createProject("protectedProject", ProjectScope.PROTECTED, organization); Project publicProject = createProject("publicProject", ProjectScope.PROTECTED, organization); // When & Then assertThat(AccessControl.isResourceCreatable(doortts, protectedProject.asResource(), ResourceType.ISSUE_POST)).describedAs("ISSUE_POST").isTrue(); assertThat(AccessControl.isResourceCreatable(doortts, protectedProject.asResource(), ResourceType.BOARD_POST)).describedAs("BOARD_POST").isTrue(); assertThat(AccessControl.isResourceCreatable(doortts, protectedProject.asResource(), ResourceType.COMMENT_THREAD)).describedAs("COMMENT_THREAD").isTrue(); assertThat(AccessControl.isResourceCreatable(doortts, protectedProject.asResource(), ResourceType.ATTACHMENT)).describedAs("ATTACHMENT").isTrue(); assertThat(AccessControl.isResourceCreatable(doortts, protectedProject.asResource(), ResourceType.COMMIT)).describedAs("COMMIT").isTrue(); assertThat(AccessControl.isResourceCreatable(doortts, protectedProject.asResource(), ResourceType.COMMIT_COMMENT)).describedAs("COMMIT_COMMENT").isTrue(); assertThat(AccessControl.isResourceCreatable(doortts, protectedProject.asResource(), ResourceType.MILESTONE)).describedAs("MILESTONE").isTrue(); assertThat(AccessControl.isResourceCreatable(doortts, protectedProject.asResource(), ResourceType.LABEL)).describedAs("LABEL").isTrue(); assertThat(AccessControl.isResourceCreatable(doortts, protectedProject.asResource(), ResourceType.CODE)).describedAs("CODE").isTrue(); assertThat(AccessControl.isResourceCreatable(doortts, protectedProject.asResource(), ResourceType.PULL_REQUEST)).describedAs("PULL_REQUEST").isTrue(); assertThat(AccessControl.isResourceCreatable(doortts, protectedProject.asResource(), ResourceType.ISSUE_COMMENT)).describedAs("ISSUE_COMMENT").isTrue(); assertThat(AccessControl.isResourceCreatable(doortts, protectedProject.asResource(), ResourceType.ISSUE_STATE)).describedAs("ISSUE_STATE").isTrue(); assertThat(AccessControl.isResourceCreatable(doortts, protectedProject.asResource(), ResourceType.ISSUE_ASSIGNEE)).describedAs("ISSUE_ASSIGNEE").isTrue(); assertThat(AccessControl.isResourceCreatable(doortts, publicProject.asResource(), ResourceType.ISSUE_POST)).describedAs("ISSUE_POST").isTrue(); assertThat(AccessControl.isResourceCreatable(doortts, publicProject.asResource(), ResourceType.BOARD_POST)).describedAs("BOARD_POST").isTrue(); assertThat(AccessControl.isResourceCreatable(doortts, publicProject.asResource(), ResourceType.COMMENT_THREAD)).describedAs("COMMENT_THREAD").isTrue(); assertThat(AccessControl.isResourceCreatable(doortts, publicProject.asResource(), ResourceType.ATTACHMENT)).describedAs("ATTACHMENT").isTrue(); assertThat(AccessControl.isResourceCreatable(doortts, publicProject.asResource(), ResourceType.COMMIT)).describedAs("COMMIT").isTrue(); assertThat(AccessControl.isResourceCreatable(doortts, publicProject.asResource(), ResourceType.COMMIT_COMMENT)).describedAs("COMMIT_COMMENT").isTrue(); assertThat(AccessControl.isResourceCreatable(doortts, publicProject.asResource(), ResourceType.MILESTONE)).describedAs("MILESTONE").isTrue(); assertThat(AccessControl.isResourceCreatable(doortts, publicProject.asResource(), ResourceType.LABEL)).describedAs("LABEL").isTrue(); assertThat(AccessControl.isResourceCreatable(doortts, publicProject.asResource(), ResourceType.CODE)).describedAs("CODE").isTrue(); assertThat(AccessControl.isResourceCreatable(doortts, publicProject.asResource(), ResourceType.PULL_REQUEST)).describedAs("PULL_REQUEST").isTrue(); assertThat(AccessControl.isResourceCreatable(doortts, publicProject.asResource(), ResourceType.ISSUE_COMMENT)).describedAs("ISSUE_COMMENT").isTrue(); assertThat(AccessControl.isResourceCreatable(doortts, publicProject.asResource(), ResourceType.ISSUE_STATE)).describedAs("ISSUE_STATE").isTrue(); assertThat(AccessControl.isResourceCreatable(doortts, publicProject.asResource(), ResourceType.ISSUE_ASSIGNEE)).describedAs("ISSUE_ASSIGNEE").isTrue(); // A user that is not a member of a group, is not allowed to create resource on the projects of the group. assertThat(AccessControl.isResourceCreatable(nori, protectedProject.asResource(), ResourceType.ISSUE_POST)).describedAs("ISSUE_POST").isFalse(); } @Test public void isAllowed_resource_to_group_member() { // Given User doortts = User.findByLoginId("doortts"); // a member of the organization, not admin User nori = User.findByLoginId("nori"); // not a member of the organization User laziel = User.findByLoginId("laziel"); Organization organization = createOrganization("TestOrganization"); OrganizationUser.assignRole(doortts.id, organization.id, RoleType.ORG_MEMBER.roleType()); Project protectedProject = createProject("protectedProject", ProjectScope.PROTECTED, organization); Project publicProject = createProject("publicProject", ProjectScope.PUBLIC, organization); Issue protectedIssue = createIssue(protectedProject, nori); Issue publicIssue = createIssue(publicProject, nori); // When & Then assertThat(AccessControl.isAllowed(doortts, protectedProject.asResource(), Operation.READ)).describedAs("doortts can read protected protectedProject").isTrue(); assertThat(AccessControl.isAllowed(nori, protectedProject.asResource(), Operation.READ)).describedAs("nori cann't read protected protectedProject").isFalse(); // group member is allowed assertThat(AccessControl.isAllowed(doortts, protectedIssue.asResource(), Operation.UPDATE)).describedAs("doortts can update protectedIssue").isTrue(); assertThat(AccessControl.isAllowed(doortts, protectedIssue.asResource(), Operation.DELETE)).describedAs("doortts can delete protectedIssue").isTrue(); // author is allowed assertThat(AccessControl.isAllowed(nori, protectedIssue.asResource(), Operation.UPDATE)).describedAs("nori can update protectedIssue").isTrue(); assertThat(AccessControl.isAllowed(nori, protectedIssue.asResource(), Operation.DELETE)).describedAs("nori can delete protectedIssue").isTrue(); // guest is not allowed assertThat(AccessControl.isAllowed(laziel, protectedIssue.asResource(), Operation.UPDATE)).describedAs("laziel cann't update protectedIssue").isFalse(); assertThat(AccessControl.isAllowed(laziel, protectedIssue.asResource(), Operation.DELETE)).describedAs("laziel cann't delete protectedIssue").isFalse(); // group member is allowed assertThat(AccessControl.isAllowed(doortts, publicIssue.asResource(), Operation.UPDATE)).describedAs("doortts can update publicIssue").isTrue(); assertThat(AccessControl.isAllowed(doortts, publicIssue.asResource(), Operation.DELETE)).describedAs("doortts can delete publicIssue").isTrue(); // author is allowed assertThat(AccessControl.isAllowed(nori, publicIssue.asResource(), Operation.UPDATE)).describedAs("nori can update publicIssue").isTrue(); assertThat(AccessControl.isAllowed(nori, publicIssue.asResource(), Operation.DELETE)).describedAs("nori can delete publicIssue").isTrue(); // guest is not allowed assertThat(AccessControl.isAllowed(laziel, publicIssue.asResource(), Operation.UPDATE)).describedAs("laziel cann't update publicIssue").isFalse(); assertThat(AccessControl.isAllowed(laziel, publicIssue.asResource(), Operation.DELETE)).describedAs("laziel cann't delete publicIssue").isFalse(); } private Organization createOrganization(String name) { Organization organization = new Organization(); organization.name = name; organization.save(); return organization; } private Project createProject(String name, ProjectScope projectScope, Organization organization) { Project project = new Project(); project.name = name; project.organization = organization; project.projectScope = projectScope; project.vcs = "GIT"; Project.create(project); return project; } private Issue createIssue(Project project, User author) { Issue issue = new Issue(); issue.project = project; issue.author = author; issue.authorId = author.id; issue.title = "hello"; issue.body = "world"; issue.state = State.OPEN; issue.save(); return issue; } }