package jnpf.dmsPermission;
|
|
import jnpf.base.UserInfo;
|
import jnpf.dmsEntity.permission.entity.DmsFilePermissionEntity;
|
import jnpf.dmsEntity.permission.entity.DmsPermissionUsageEntity;
|
import jnpf.dmsEntity.permission.enums.DmsPermissionAction;
|
import jnpf.dmsEntity.permission.enums.DmsResourceType;
|
import jnpf.dmsEntity.permission.form.PermissionDecisionForm;
|
import jnpf.dmsEntity.permission.model.DmsResourcePath;
|
import jnpf.dmsEntity.permission.model.DmsSubjectSet;
|
import jnpf.dmsEntity.permission.vo.DmsPermissionDecisionVO;
|
import jnpf.dmsMapper.DmsFilePermissionMapper;
|
import jnpf.dmsMapper.DmsPermissionUsageMapper;
|
import jnpf.dmsService.DmsPermissionDecisionService;
|
import org.junit.jupiter.api.BeforeEach;
|
import org.junit.jupiter.api.Test;
|
|
import java.util.Date;
|
import java.util.UUID;
|
|
import static org.junit.jupiter.api.Assertions.assertEquals;
|
import static org.junit.jupiter.api.Assertions.assertThrows;
|
import static org.mockito.ArgumentMatchers.any;
|
import static org.mockito.Mockito.mock;
|
import static org.mockito.Mockito.never;
|
import static org.mockito.Mockito.verify;
|
import static org.mockito.Mockito.when;
|
|
class DmsPermissionGuardTest {
|
private final DmsCurrentIdentity currentIdentity = mock(DmsCurrentIdentity.class);
|
private final DmsPermissionDecisionService decisionService = mock(DmsPermissionDecisionService.class);
|
private final DmsFilePermissionMapper permissionMapper = mock(DmsFilePermissionMapper.class);
|
private final DmsPermissionUsageMapper usageMapper = mock(DmsPermissionUsageMapper.class);
|
private final DmsResourceResolver resourceResolver = mock(DmsResourceResolver.class);
|
private final DmsSubjectResolver subjectResolver = mock(DmsSubjectResolver.class);
|
private final DmsPermissionGroupMembershipResolver groupResolver = mock(DmsPermissionGroupMembershipResolver.class);
|
private final DmsPermissionMatcher matcher = mock(DmsPermissionMatcher.class);
|
private final DmsAccessExclusionResolver exclusionResolver = mock(DmsAccessExclusionResolver.class);
|
private final DmsPermissionGuard guard = new DmsPermissionGuard(currentIdentity, decisionService,
|
permissionMapper, usageMapper, resourceResolver, subjectResolver, groupResolver, matcher,
|
exclusionResolver);
|
private final UUID permissionId = UUID.randomUUID();
|
private final UUID resourceId = UUID.randomUUID();
|
private final UserInfo user = new UserInfo();
|
|
@BeforeEach
|
void setUp() {
|
user.setTenantId("tenant-1");
|
user.setUserId("user-1");
|
when(currentIdentity.requireUser()).thenReturn(user);
|
when(currentIdentity.tenantId(user)).thenReturn("tenant-1");
|
when(subjectResolver.resolve(user)).thenReturn(mock(DmsSubjectSet.class));
|
when(resourceResolver.resolve(any(), any(), any())).thenReturn(mock(DmsResourcePath.class));
|
when(exclusionResolver.isExcluded(any(), any(), any())).thenReturn(false);
|
when(matcher.matches(any(), any(), any())).thenReturn(true);
|
DmsPermissionDecisionVO decision = new DmsPermissionDecisionVO();
|
decision.setAllowed(true);
|
decision.setMatchedPermissionId(permissionId);
|
when(decisionService.evaluate(any(PermissionDecisionForm.class))).thenReturn(decision);
|
}
|
|
@Test
|
void rejectsPermissionRevokedWhileWaitingForLock() {
|
DmsFilePermissionEntity permission = activePermission();
|
permission.setRevokedAt(new Date());
|
when(permissionMapper.selectByTenantAndIdForUpdate("tenant-1", permissionId)).thenReturn(permission);
|
DmsPermissionOperation<String> operation = mockOperation();
|
|
DmsPermissionException error = assertThrows(DmsPermissionException.class,
|
() -> guard.execute(context(), operation));
|
|
assertEquals(DmsPermissionError.PERMISSION_DENIED, error.getError());
|
verify(operation, never()).execute();
|
}
|
|
@Test
|
void rejectsPermissionExhaustedWhileWaitingForLock() {
|
DmsFilePermissionEntity permission = activePermission();
|
permission.setMaxUseCount(1L);
|
permission.setUsedCount(1L);
|
when(permissionMapper.selectByTenantAndIdForUpdate("tenant-1", permissionId)).thenReturn(permission);
|
DmsPermissionOperation<String> operation = mockOperation();
|
|
DmsPermissionException error = assertThrows(DmsPermissionException.class,
|
() -> guard.execute(context(), operation));
|
|
assertEquals(DmsPermissionError.PERMISSION_EXHAUSTED, error.getError());
|
verify(operation, never()).execute();
|
}
|
|
@Test
|
void recordsLimitedUseAfterBusinessOperationSucceeds() {
|
DmsFilePermissionEntity permission = activePermission();
|
permission.setMaxUseCount(2L);
|
when(permissionMapper.selectByTenantAndIdForUpdate("tenant-1", permissionId)).thenReturn(permission);
|
DmsPermissionOperation<String> operation = mockOperation();
|
when(operation.execute()).thenReturn("created");
|
DmsPermissionExecutionContext context = context();
|
|
String result = guard.execute(context, operation);
|
|
assertEquals("created", result);
|
org.mockito.ArgumentCaptor<DmsPermissionUsageEntity> captor =
|
org.mockito.ArgumentCaptor.forClass(DmsPermissionUsageEntity.class);
|
verify(usageMapper).insert(captor.capture());
|
DmsPermissionUsageEntity usage = captor.getValue();
|
assertEquals(permissionId, usage.getPermissionId());
|
assertEquals(resourceId, usage.getActualResourceId());
|
assertEquals(context.getOperationId(), usage.getOperationId());
|
assertEquals("READ", usage.getActionCode());
|
}
|
|
@Test
|
void downloadTicketSessionCannotOutlivePermission() {
|
DmsFilePermissionEntity permission = activePermission();
|
permission.setActionCode("DOWNLOAD");
|
permission.setMaxUseCount(1L);
|
Date deadline = new Date(System.currentTimeMillis() + 60_000);
|
permission.setValidTo(deadline);
|
when(permissionMapper.selectByTenantAndIdForUpdate("tenant-1", permissionId)).thenReturn(permission);
|
DmsPermissionOperation<String> operation = mockOperation();
|
when(operation.execute()).thenReturn("ticket");
|
DmsPermissionExecutionContext context = context(DmsPermissionAction.DOWNLOAD);
|
context.setSessionExpiresAt(new Date(System.currentTimeMillis() + 300_000));
|
guard.execute(context, operation);
|
assertEquals(deadline, context.getSessionExpiresAt());
|
org.mockito.ArgumentCaptor<DmsPermissionUsageEntity> usage =
|
org.mockito.ArgumentCaptor.forClass(DmsPermissionUsageEntity.class);
|
verify(usageMapper).insert(usage.capture());
|
assertEquals(deadline, usage.getValue().getSessionExpiresAt());
|
}
|
|
@Test
|
void unlimitedPermissionDoesNotCreateUsageRecord() {
|
DmsFilePermissionEntity permission = activePermission();
|
when(permissionMapper.selectByTenantAndIdForUpdate("tenant-1", permissionId)).thenReturn(permission);
|
DmsPermissionOperation<String> operation = mockOperation();
|
when(operation.execute()).thenReturn("previewed");
|
|
String result = guard.execute(context(), operation);
|
|
assertEquals("previewed", result);
|
verify(usageMapper, never()).insert(any(DmsPermissionUsageEntity.class));
|
}
|
|
@Test
|
void missingReadPermissionIsNotTreatedAsUnlimitedPermission() {
|
DmsPermissionDecisionVO denied = new DmsPermissionDecisionVO();
|
denied.setAllowed(false);
|
when(decisionService.evaluate(any(PermissionDecisionForm.class))).thenReturn(denied);
|
DmsPermissionOperation<String> operation = mockOperation();
|
|
DmsPermissionException error = assertThrows(DmsPermissionException.class,
|
() -> guard.execute(context(), operation));
|
|
assertEquals(DmsPermissionError.PERMISSION_DENIED, error.getError());
|
verify(operation, never()).execute();
|
verify(usageMapper, never()).insert(any(DmsPermissionUsageEntity.class));
|
}
|
|
@Test
|
void replaysPriorUseWithoutExecutingBusinessOperationAgain() {
|
DmsPermissionExecutionContext context = context();
|
DmsPermissionUsageEntity prior = new DmsPermissionUsageEntity();
|
prior.setPermissionId(permissionId);
|
prior.setUserId("user-1");
|
prior.setActualResourceType("DOCUMENT");
|
prior.setActualResourceId(resourceId);
|
prior.setActionCode("READ");
|
prior.setOperationId(context.getOperationId());
|
when(usageMapper.selectByOperation("tenant-1", "user-1", context.getOperationId())).thenReturn(prior);
|
when(permissionMapper.selectByTenantAndId("tenant-1", permissionId)).thenReturn(activePermission());
|
DmsPermissionOperation<String> operation = mockOperation();
|
when(operation.replay()).thenReturn("replayed");
|
|
String result = guard.execute(context, operation);
|
|
assertEquals("replayed", result);
|
verify(operation, never()).execute();
|
verify(operation).replay();
|
verify(usageMapper, never()).insert(any(DmsPermissionUsageEntity.class));
|
}
|
|
@Test
|
void rejectsReadExcludedLimitedPermissionWithoutUsingPermission() {
|
DmsFilePermissionEntity permission = activePermission();
|
permission.setMaxUseCount(2L);
|
when(permissionMapper.selectByTenantAndIdForUpdate("tenant-1", permissionId)).thenReturn(permission);
|
when(exclusionResolver.isExcluded(any(), any(), any())).thenReturn(true);
|
DmsPermissionOperation<String> operation = mockOperation();
|
|
DmsPermissionException error = assertThrows(DmsPermissionException.class,
|
() -> guard.execute(context(), operation));
|
|
assertEquals(DmsPermissionError.PERMISSION_DENIED, error.getError());
|
verify(operation, never()).execute();
|
verify(usageMapper, never()).insert(any(DmsPermissionUsageEntity.class));
|
}
|
|
@Test
|
void rejectsPrintWhenReadAccessIsExcluded() {
|
DmsFilePermissionEntity permission = activePermission();
|
permission.setActionCode("PRINT");
|
when(permissionMapper.selectByTenantAndIdForUpdate("tenant-1", permissionId)).thenReturn(permission);
|
when(exclusionResolver.isExcluded(any(), any(), any())).thenReturn(true);
|
DmsPermissionOperation<String> operation = mockOperation();
|
|
DmsPermissionException error = assertThrows(DmsPermissionException.class,
|
() -> guard.execute(context(DmsPermissionAction.PRINT), operation));
|
|
assertEquals(DmsPermissionError.PERMISSION_DENIED, error.getError());
|
verify(operation, never()).execute();
|
verify(usageMapper, never()).insert(any(DmsPermissionUsageEntity.class));
|
}
|
|
@Test
|
void rejectsIdempotentReplayAfterReadExclusionIsAdded() {
|
DmsPermissionExecutionContext context = context();
|
DmsPermissionUsageEntity prior = new DmsPermissionUsageEntity();
|
prior.setPermissionId(permissionId);
|
prior.setUserId("user-1");
|
prior.setActualResourceType("DOCUMENT");
|
prior.setActualResourceId(resourceId);
|
prior.setActionCode("READ");
|
prior.setOperationId(context.getOperationId());
|
when(usageMapper.selectByOperation("tenant-1", "user-1", context.getOperationId())).thenReturn(prior);
|
when(exclusionResolver.isExcluded(any(), any(), any())).thenReturn(true);
|
DmsPermissionOperation<String> operation = mockOperation();
|
|
DmsPermissionException error = assertThrows(DmsPermissionException.class,
|
() -> guard.execute(context, operation));
|
|
assertEquals(DmsPermissionError.PERMISSION_DENIED, error.getError());
|
verify(operation, never()).replay();
|
verify(permissionMapper, never()).selectByTenantAndId(any(), any());
|
}
|
|
@SuppressWarnings("unchecked")
|
private DmsPermissionOperation<String> mockOperation() {
|
return mock(DmsPermissionOperation.class);
|
}
|
|
private DmsPermissionExecutionContext context() {
|
return context(DmsPermissionAction.READ);
|
}
|
|
private DmsPermissionExecutionContext context(DmsPermissionAction action) {
|
DmsPermissionExecutionContext context = new DmsPermissionExecutionContext();
|
context.setResourceType(DmsResourceType.DOCUMENT);
|
context.setResourceId(resourceId);
|
context.setActionCode(action);
|
context.setOperationId(UUID.randomUUID());
|
return context;
|
}
|
|
private DmsFilePermissionEntity activePermission() {
|
DmsFilePermissionEntity permission = new DmsFilePermissionEntity();
|
permission.setId(permissionId);
|
permission.setTenantId("tenant-1");
|
permission.setActionCode("READ");
|
permission.setValidFrom(new Date(System.currentTimeMillis() - 60_000));
|
permission.setUsedCount(0L);
|
return permission;
|
}
|
}
|
