package jnpf.dmsMapper;
|
|
import jnpf.dmsDatabase.DmsUuidTypeHandler;
|
import jnpf.dmsEntity.permission.entity.DmsFilePermissionEntity;
|
import jnpf.dmsEntity.storage.approval.DmsApprovedItem;
|
import jnpf.dmsPermission.DmsPermissionMatcher;
|
import jnpf.dmsEntity.permission.model.DmsSubjectSet;
|
import org.apache.ibatis.builder.xml.XMLMapperBuilder;
|
import org.apache.ibatis.datasource.unpooled.UnpooledDataSource;
|
import org.apache.ibatis.mapping.Environment;
|
import org.apache.ibatis.session.*;
|
import org.apache.ibatis.transaction.jdbc.JdbcTransactionFactory;
|
import org.junit.jupiter.api.Test;
|
import org.junit.jupiter.api.condition.EnabledIfEnvironmentVariable;
|
import java.io.StringReader;
|
import java.nio.charset.StandardCharsets;
|
import java.sql.SQLException;
|
import java.util.*;
|
import static org.junit.jupiter.api.Assertions.*;
|
|
/** Real mapper/JDBC against connection-local tables. Never modifies customer rows or persistent DDL. */
|
@EnabledIfEnvironmentVariable(named="DMS_READ_TEST_URL",matches=".+")
|
class DmsApprovedReadAccessPostgresTest {
|
@Test void persistsSnapshotsReplacesOnlyOwnedReadAndRollsBackFailedReplacement() throws Exception {
|
var ds=new UnpooledDataSource("org.postgresql.Driver",System.getenv("DMS_READ_TEST_URL"),
|
System.getenv("DMS_READ_TEST_USER"),System.getenv("DMS_READ_TEST_PASSWORD"));
|
var config=new Configuration(new Environment("read-test",new JdbcTransactionFactory(),ds));
|
config.setDefaultStatementTimeout(15);
|
for (String name:List.of("DmsApprovedReadAccessMapper","DmsFilePermissionMapper","DmsApprovedBatchMapper")) {
|
String path="mapper/"+name+".xml";
|
try(var input=getClass().getResourceAsStream("/"+path)) {
|
String xml=new String(Objects.requireNonNull(input).readAllBytes(),StandardCharsets.UTF_8)
|
.replace("public.dms_file_permissions","pg_temp.read_permissions")
|
.replace("public.dms_approved_file_items","pg_temp.read_items")
|
.replace("public.base_organize","pg_temp.read_departments");
|
new XMLMapperBuilder(new StringReader(xml),config,path,config.getSqlFragments()).parse();
|
}
|
}
|
try(var session=new SqlSessionFactoryBuilder().build(config).openSession(false)) {
|
try {
|
var connection=session.getConnection();
|
try(var sql=connection.createStatement()) {
|
sql.execute("CREATE TEMP TABLE read_permissions (LIKE public.dms_file_permissions INCLUDING DEFAULTS INCLUDING CONSTRAINTS INCLUDING INDEXES) ON COMMIT DROP");
|
sql.execute("ALTER TABLE pg_temp.read_permissions ADD COLUMN IF NOT EXISTS approved_org_scope TEXT");
|
sql.execute("CREATE TRIGGER permission_guard BEFORE UPDATE ON pg_temp.read_permissions FOR EACH ROW EXECUTE FUNCTION public.dms_permission_guard_permission_update()");
|
sql.execute("CREATE TEMP TABLE read_items (LIKE public.dms_approved_file_items INCLUDING DEFAULTS INCLUDING CONSTRAINTS INCLUDING INDEXES) ON COMMIT DROP");
|
sql.execute("ALTER TABLE pg_temp.read_items ADD COLUMN IF NOT EXISTS read_access_scope JSONB NOT NULL DEFAULT '[]'::jsonb");
|
sql.execute("CREATE TEMP TABLE read_departments (f_id text, f_tenant_id text, f_delete_mark integer, f_enabled_mark integer) ON COMMIT DROP");
|
sql.execute("INSERT INTO pg_temp.read_departments VALUES ('dept','tenant',NULL,1),('disabled','tenant',NULL,0),('foreign','other',NULL,1)");
|
}
|
var mapper=session.getMapper(DmsApprovedReadAccessMapper.class);
|
var permissions=session.getMapper(DmsFilePermissionMapper.class);
|
assertEquals(List.of(new DmsApprovedReadAccessMapper.Department("dept")),mapper.departments("tenant",List.of("dept","disabled","foreign")));
|
var item=new DmsApprovedItem();item.setBatchId(UUID.randomUUID());item.setTenantId("tenant");
|
item.setSourceKey("audit:main");item.setChangeType("CREATE");item.setDocumentId(UUID.randomUUID());item.setFileVersionId(UUID.randomUUID());
|
item.setReadAccessScope("[\"dept--subOrg\"]");
|
var receipts=session.getMapper(DmsApprovedBatchMapper.class);receipts.insertItem(item);
|
assertEquals(item.getReadAccessScope(),receipts.item("tenant","audit:main").getReadAccessScope());
|
// SQL interfaces return top-level arrays as text, while nested organizeSelect values stay arrays.
|
try (var sql=connection.createStatement(); var result=sql.executeQuery(
|
"SELECT read_access_scope::text AS scope, jsonb_build_array(jsonb_build_object('chayue_shouquan_fanwei_id',read_access_scope))::text AS rows FROM pg_temp.read_items WHERE source_key='audit:main'")) {
|
assertTrue(result.next()); assertInstanceOf(String.class,result.getObject("scope"));
|
assertInstanceOf(String.class,result.getObject("rows"));
|
var json=new com.fasterxml.jackson.databind.ObjectMapper();
|
assertTrue(json.readTree((String)result.getObject("scope")).isArray());
|
assertEquals("dept--subOrg",json.readTree((String)result.getObject("rows"))
|
.get(0).get("chayue_shouquan_fanwei_id").get(0).textValue());
|
}
|
item.setSourceKey("audit:legacy");item.setReadAccessScope(null);receipts.insertItem(item);
|
assertEquals("[]",receipts.item("tenant","audit:legacy").getReadAccessScope());
|
item.setSourceKey("audit:clear");item.setReadAccessScope("[]");receipts.insertItem(item);
|
assertEquals("[]",receipts.item("tenant","audit:clear").getReadAccessScope());
|
var grant=new DmsFilePermissionEntity();grant.setTenantId("tenant");grant.setResourceId(item.getFileVersionId());
|
grant.setPrincipalId("dept");grant.setIncludeChildOrgs(false);grant.setApprovedOrgScope("CHILDREN");
|
grant.setSourceId("approved-read:"+item.getBatchId()+":"+item.getFileVersionId());
|
grant.setValidFrom(new Date(System.currentTimeMillis()-1000));grant.setGrantReason("read test");
|
var saved=mapper.insert(grant);
|
assertNotNull(saved.getId());assertEquals("CHILDREN",saved.getApprovedOrgScope());
|
assertEquals("CHILDREN",permissions.selectByTenantAndId("tenant",saved.getId()).getApprovedOrgScope());
|
assertEquals("CHILDREN",permissions.selectByTenantAndIdForUpdate("tenant",saved.getId()).getApprovedOrgScope());
|
assertNull(permissions.selectByTenantAndId("other",saved.getId()));
|
var candidates=permissions.selectCandidates("tenant",List.of("READ"),List.of(item.getFileVersionId()));
|
assertEquals(1,candidates.size());
|
var subjects=new DmsSubjectSet();subjects.getImmediateParentOrgIds().add("dept");
|
assertTrue(new DmsPermissionMatcher().matchesPrincipal(candidates.getFirst(),subjects));
|
assertTrue(permissions.selectCandidates("tenant",List.of("DOWNLOAD"),List.of(item.getFileVersionId())).isEmpty());
|
// Unrelated manual permission on this exact version survives replacement.
|
try(var sql=connection.createStatement()) {
|
sql.execute("INSERT INTO pg_temp.read_permissions(id,tenant_id,resource_type,resource_id,resource_scope,principal_type,principal_id,include_child_orgs,action_code,source_type,source_id,valid_from,granted_by_type,granted_by_id) VALUES (uuidv7(),'tenant','FILE_VERSION','"+item.getFileVersionId()+"','SELF','ORG','dept',false,'READ','MANUAL','manual-test',CURRENT_TIMESTAMP,'USER','admin')");
|
}
|
assertEquals(1,mapper.owned("tenant",item.getFileVersionId()).size());
|
var savepoint=connection.setSavepoint();
|
assertEquals(1,mapper.revoke("tenant",saved.getId()));
|
grant.setSourceId("approved-read:replacement");grant.setPrincipalId(" ");
|
assertThrows(Exception.class,()->mapper.insert(grant));
|
connection.rollback(savepoint);session.clearCache();
|
assertNull(mapper.owned("tenant",item.getFileVersionId()).getFirst().getRevokedAt());
|
assertEquals(1,mapper.revoke("tenant",saved.getId()));
|
assertEquals(0,mapper.revoke("tenant",saved.getId()));
|
assertEquals(1,permissions.selectCandidates("tenant",List.of("READ"),List.of(item.getFileVersionId())).size());
|
assertNotNull(mapper.owned("tenant",item.getFileVersionId()).getFirst().getRevokedAt());
|
} finally { session.rollback(true); }
|
}
|
}
|
}
|
