package jnpf.dmsService;
|
|
import jnpf.dmsEntity.permission.entity.DmsAccessExclusionEntity;
|
import jnpf.dmsEntity.permission.entity.DmsPermissionResourceEntity;
|
import jnpf.dmsEntity.permission.enums.DmsResourceType;
|
import jnpf.dmsEntity.permission.enums.DmsSourceType;
|
import jnpf.dmsEntity.permission.form.AccessExclusionBatchForm;
|
import jnpf.dmsEntity.permission.form.AccessExclusionItemForm;
|
import jnpf.dmsEntity.permission.form.AccessExclusionRevokeForm;
|
import jnpf.dmsEntity.permission.vo.DmsAccessExclusionVO;
|
import jnpf.dmsEntity.permission.vo.DmsCursorPageVO;
|
import jnpf.dmsIntegration.audit.DmsAuditAdapter;
|
import jnpf.dmsMapper.DmsAccessExclusionMapper;
|
import jnpf.dmsMapper.DmsPermissionResourceMapper;
|
import jnpf.dmsPermission.DmsCurrentIdentity;
|
import jnpf.dmsPermission.DmsCursorCodec;
|
import jnpf.dmsPermission.DmsPermissionError;
|
import jnpf.dmsPermission.DmsPermissionException;
|
import jnpf.dmsPermission.DmsPermissionProperties;
|
import jnpf.dmsPermission.DmsPrincipalValidator;
|
import jnpf.dmsPermission.DmsUserDisplayNameResolver;
|
import org.junit.jupiter.api.Test;
|
import org.mockito.ArgumentCaptor;
|
|
import java.util.Arrays;
|
import java.util.Collections;
|
import java.util.Date;
|
import java.util.List;
|
import java.util.UUID;
|
|
import static org.junit.jupiter.api.Assertions.assertEquals;
|
import static org.junit.jupiter.api.Assertions.assertFalse;
|
import static org.junit.jupiter.api.Assertions.assertThrows;
|
import static org.junit.jupiter.api.Assertions.assertTrue;
|
import static org.mockito.ArgumentMatchers.any;
|
import static org.mockito.ArgumentMatchers.anyCollection;
|
import static org.mockito.Mockito.mock;
|
import static org.mockito.Mockito.never;
|
import static org.mockito.Mockito.verify;
|
import static org.mockito.Mockito.when;
|
|
class DmsAccessExclusionServiceTest {
|
private static final String TENANT_ID = "tenant-1";
|
private static final String ADMIN_ID = "admin-1";
|
private static final String USER_ID = "user-1";
|
private static final String SOURCE_ID = "exclude-command-1";
|
|
@Test
|
void createsWholeExclusionSetWithOneBatchInsert() {
|
Fixture fixture = new Fixture();
|
UUID documentId = UUID.randomUUID();
|
AccessExclusionBatchForm form = form(item(DmsResourceType.DOCUMENT, documentId, "reason"));
|
DmsAccessExclusionEntity created = exclusion(DmsResourceType.DOCUMENT, documentId, "reason");
|
when(fixture.exclusionMapper.selectBySource(TENANT_ID, "MANUAL", SOURCE_ID))
|
.thenReturn(Collections.emptyList(), Collections.singletonList(created));
|
when(fixture.resourceMapper.selectByTenantAndIds(TENANT_ID, Collections.singletonList(documentId)))
|
.thenReturn(Collections.singletonList(resource(DmsResourceType.DOCUMENT, documentId)));
|
when(fixture.exclusionMapper.insertBatch(any())).thenReturn(1);
|
|
fixture.service.create(form);
|
|
ArgumentCaptor<List<DmsAccessExclusionEntity>> captor = ArgumentCaptor.forClass(List.class);
|
verify(fixture.exclusionMapper).insertBatch(captor.capture());
|
assertEquals(1, captor.getValue().size());
|
DmsAccessExclusionEntity inserted = captor.getValue().get(0);
|
assertEquals("READ", inserted.getActionCode());
|
assertEquals(USER_ID, inserted.getUserId());
|
assertEquals(ADMIN_ID, inserted.getExcludedById());
|
verify(fixture.principalValidator).validateUsers(anyCollection());
|
verify(fixture.auditAdapter).dataChange("CREATE", "创建 DMS 用户读取排除",
|
"dms_access_exclusions", created.getId().toString(), "reason", null);
|
}
|
|
@Test
|
void returnsExistingSetForExactSourceRetry() {
|
Fixture fixture = new Fixture();
|
UUID documentId = UUID.randomUUID();
|
AccessExclusionBatchForm form = form(item(DmsResourceType.DOCUMENT, documentId, "reason"));
|
when(fixture.exclusionMapper.selectBySource(TENANT_ID, "MANUAL", SOURCE_ID))
|
.thenReturn(Collections.singletonList(exclusion(DmsResourceType.DOCUMENT, documentId, "reason")));
|
|
fixture.service.create(form);
|
|
verify(fixture.exclusionMapper, never()).insertBatch(any());
|
verify(fixture.resourceMapper, never()).selectByTenantAndIds(any(), any());
|
verify(fixture.principalValidator, never()).validateUsers(anyCollection());
|
}
|
|
@Test
|
void rejectsDifferentSetUsingSameSourceWithoutWriting() {
|
Fixture fixture = new Fixture();
|
UUID documentId = UUID.randomUUID();
|
AccessExclusionBatchForm form = form(item(DmsResourceType.DOCUMENT, documentId, "new reason"));
|
when(fixture.exclusionMapper.selectBySource(TENANT_ID, "MANUAL", SOURCE_ID))
|
.thenReturn(Collections.singletonList(exclusion(DmsResourceType.DOCUMENT, documentId,
|
"old reason")));
|
|
DmsPermissionException error = assertThrows(DmsPermissionException.class,
|
() -> fixture.service.create(form));
|
|
assertEquals(DmsPermissionError.SOURCE_CONFLICT, error.getError());
|
verify(fixture.exclusionMapper, never()).insertBatch(any());
|
}
|
|
@Test
|
void rejectsFolderExclusion() {
|
Fixture fixture = new Fixture();
|
|
DmsPermissionException error = assertThrows(DmsPermissionException.class,
|
() -> fixture.service.create(form(item(DmsResourceType.FOLDER, UUID.randomUUID(), "reason"))));
|
|
assertEquals(DmsPermissionError.INVALID_REQUEST, error.getError());
|
verify(fixture.exclusionMapper, never()).lockSource(any(), any(), any());
|
}
|
|
@Test
|
void revokesWholeSetInOneUpdate() {
|
Fixture fixture = new Fixture();
|
DmsAccessExclusionEntity first = exclusion(DmsResourceType.DOCUMENT, UUID.randomUUID(), "reason");
|
DmsAccessExclusionEntity second = exclusion(DmsResourceType.FILE_VERSION, UUID.randomUUID(), "reason");
|
List<UUID> ids = Arrays.asList(first.getId(), second.getId());
|
ids.sort(java.util.Comparator.comparing(UUID::toString));
|
when(fixture.exclusionMapper.selectByTenantAndIdsForUpdate(TENANT_ID, ids))
|
.thenReturn(Arrays.asList(first, second));
|
when(fixture.exclusionMapper.revokeBatch(TENANT_ID, ids, "USER", ADMIN_ID, "revoke"))
|
.thenReturn(2);
|
DmsAccessExclusionEntity revokedFirst = exclusion(
|
DmsResourceType.valueOf(first.getResourceType()), first.getResourceId(), "reason");
|
revokedFirst.setId(first.getId());
|
revokedFirst.setRevokedAt(new Date());
|
DmsAccessExclusionEntity revokedSecond = exclusion(
|
DmsResourceType.valueOf(second.getResourceType()), second.getResourceId(), "reason");
|
revokedSecond.setId(second.getId());
|
revokedSecond.setRevokedAt(new Date());
|
when(fixture.exclusionMapper.selectByTenantAndIds(TENANT_ID, ids))
|
.thenReturn(Arrays.asList(revokedFirst, revokedSecond));
|
AccessExclusionRevokeForm form = new AccessExclusionRevokeForm();
|
form.setExclusionIds(ids);
|
form.setReason("revoke");
|
|
fixture.service.revoke(form);
|
|
verify(fixture.exclusionMapper).revokeBatch(TENANT_ID, ids, "USER", ADMIN_ID, "revoke");
|
}
|
|
@Test
|
void rejectsSecondRevocationWithoutUpdating() {
|
Fixture fixture = new Fixture();
|
DmsAccessExclusionEntity existing = exclusion(DmsResourceType.DOCUMENT, UUID.randomUUID(), "reason");
|
existing.setRevokedAt(new Date());
|
List<UUID> ids = Collections.singletonList(existing.getId());
|
when(fixture.exclusionMapper.selectByTenantAndIdsForUpdate(TENANT_ID, ids))
|
.thenReturn(Collections.singletonList(existing));
|
AccessExclusionRevokeForm form = new AccessExclusionRevokeForm();
|
form.setExclusionIds(ids);
|
form.setReason("revoke again");
|
|
DmsPermissionException error = assertThrows(DmsPermissionException.class,
|
() -> fixture.service.revoke(form));
|
|
assertEquals(DmsPermissionError.EXCLUSION_ALREADY_REVOKED, error.getError());
|
verify(fixture.exclusionMapper, never()).revokeBatch(any(), any(), any(), any(), any());
|
}
|
|
@Test
|
void queriesExclusionsWithTenantScopedKeysetPage() {
|
Fixture fixture = new Fixture();
|
UUID resourceId = UUID.randomUUID();
|
DmsAccessExclusionEntity first = exclusion(DmsResourceType.DOCUMENT, resourceId, "first");
|
DmsAccessExclusionEntity second = exclusion(DmsResourceType.DOCUMENT, resourceId, "second");
|
when(fixture.exclusionMapper.selectPage(TENANT_ID, resourceId, USER_ID, null, null, 2))
|
.thenReturn(Arrays.asList(first, second));
|
when(fixture.userDisplayNameResolver.resolve(anyCollection()))
|
.thenReturn(Collections.singletonMap(USER_ID, "运营用户（yunying1）"));
|
|
DmsCursorPageVO<DmsAccessExclusionVO> result = fixture.service.page(
|
resourceId, " " + USER_ID + " ", null, 1);
|
|
assertEquals(1, result.getList().size());
|
assertEquals(first.getId(), result.getList().get(0).getId());
|
assertEquals("运营用户（yunying1）", result.getList().get(0).getUserName());
|
assertTrue(result.isHasMore());
|
assertFalse(result.getNextCursor() == null || result.getNextCursor().isEmpty());
|
verify(fixture.currentIdentity).requirePermissionAdministrator();
|
verify(fixture.userDisplayNameResolver).resolve(anyCollection());
|
}
|
|
private AccessExclusionBatchForm form(AccessExclusionItemForm item) {
|
AccessExclusionBatchForm result = new AccessExclusionBatchForm();
|
result.setSourceType(DmsSourceType.MANUAL);
|
result.setSourceId(SOURCE_ID);
|
result.setItems(Collections.singletonList(item));
|
return result;
|
}
|
|
private AccessExclusionItemForm item(DmsResourceType type, UUID id, String reason) {
|
AccessExclusionItemForm result = new AccessExclusionItemForm();
|
result.setResourceType(type);
|
result.setResourceId(id);
|
result.setUserId(USER_ID);
|
result.setExcludeReason(reason);
|
return result;
|
}
|
|
private DmsPermissionResourceEntity resource(DmsResourceType type, UUID id) {
|
DmsPermissionResourceEntity result = new DmsPermissionResourceEntity();
|
result.setId(id);
|
result.setResourceType(type.name());
|
return result;
|
}
|
|
private DmsAccessExclusionEntity exclusion(DmsResourceType type, UUID resourceId, String reason) {
|
DmsAccessExclusionEntity result = new DmsAccessExclusionEntity();
|
result.setId(UUID.randomUUID());
|
result.setTenantId(TENANT_ID);
|
result.setResourceType(type.name());
|
result.setResourceId(resourceId);
|
result.setUserId(USER_ID);
|
result.setActionCode("READ");
|
result.setSourceType("MANUAL");
|
result.setSourceId(SOURCE_ID);
|
result.setValidFrom(new Date(System.currentTimeMillis() - 60_000));
|
result.setExcludeReason(reason);
|
result.setExcludedByType("USER");
|
result.setExcludedById(ADMIN_ID);
|
result.setRevision(0L);
|
result.setCreatedAt(new Date());
|
result.setUpdatedAt(new Date());
|
return result;
|
}
|
|
private static class Fixture {
|
private final DmsCurrentIdentity currentIdentity = mock(DmsCurrentIdentity.class);
|
private final DmsPermissionProperties properties = new DmsPermissionProperties();
|
private final DmsPrincipalValidator principalValidator = mock(DmsPrincipalValidator.class);
|
private final DmsPermissionResourceMapper resourceMapper = mock(DmsPermissionResourceMapper.class);
|
private final DmsAccessExclusionMapper exclusionMapper = mock(DmsAccessExclusionMapper.class);
|
private final DmsCursorCodec cursorCodec = new DmsCursorCodec();
|
private final DmsAuditAdapter auditAdapter = mock(DmsAuditAdapter.class);
|
private final DmsUserDisplayNameResolver userDisplayNameResolver = mock(DmsUserDisplayNameResolver.class);
|
private final DmsAccessExclusionService service = new DmsAccessExclusionService(currentIdentity,
|
properties, principalValidator, resourceMapper, exclusionMapper, cursorCodec, auditAdapter,
|
userDisplayNameResolver);
|
|
private Fixture() {
|
when(currentIdentity.tenantId()).thenReturn(TENANT_ID);
|
when(currentIdentity.userId()).thenReturn(ADMIN_ID);
|
when(userDisplayNameResolver.resolve(anyCollection())).thenReturn(Collections.emptyMap());
|
}
|
}
|
}
|
