package jnpf.dmsService;
|
|
import jnpf.dmsEntity.permission.entity.DmsFilePermissionEntity;
|
import jnpf.dmsEntity.storage.approval.*;
|
import jnpf.dmsIntegration.audit.DmsAuditAdapter;
|
import jnpf.dmsMapper.DmsApprovedReadAccessMapper;
|
import jnpf.dmsPermission.DmsPermissionProperties;
|
import jnpf.exception.DataException;
|
import org.junit.jupiter.api.*;
|
import org.junit.jupiter.api.extension.ExtendWith;
|
import org.mockito.*;
|
import org.mockito.junit.jupiter.MockitoExtension;
|
import java.util.*;
|
import static org.junit.jupiter.api.Assertions.*;
|
import static org.mockito.Mockito.*;
|
|
@ExtendWith(MockitoExtension.class)
|
class DmsApprovedReadAccessServiceTest {
|
@Mock DmsApprovedReadAccessMapper mapper;
|
@Mock DmsAuditAdapter audit;
|
DmsApprovedReadAccessService service;
|
DmsApprovedBatch batch;
|
@BeforeEach void setup() {
|
service = new DmsApprovedReadAccessService(mapper, audit, new DmsPermissionProperties());
|
batch = new DmsApprovedBatch(); batch.setTenantId("tenant"); batch.setId(UUID.randomUUID());
|
batch.setActivatedAt(new Date()); batch.setAuditId("audit");
|
}
|
DmsApprovedItem item(String key, String type, String scope) {
|
var item = new DmsApprovedItem(); item.setSourceKey(key); item.setChangeType(type);
|
item.setFileVersionId(UUID.randomUUID()); item.setReadAccessScope(scope); return item;
|
}
|
@Test void parsesDepartmentScopesAndRejectsMixedOrDynamicValues() {
|
for (String empty : Arrays.asList(null, "", " ", "null", " null ", "[]"))
|
assertEquals("[]", DmsApprovedDepartmentScope.normalize(empty));
|
assertEquals("[\"a--progenyOrg\",\"b--subOrg\",\"c\"]", DmsApprovedDepartmentScope.normalize(
|
"[\"b--subOrg\",\"a--org\",\"a--progenyOrg\",\"c\",\"b\"]"));
|
for (String input : List.of("{}", "[null]", "[1]", "[\"u--user\"]", "[\"p--position\"]", "[\"@department\"]", "[\"--org\"]"))
|
assertThrows(DataException.class, () -> DmsApprovedDepartmentScope.parse(input));
|
}
|
@Test void mainAndRecordReceiveIndependentReadOnlyVersionGrants() {
|
var main = item("main", "CREATE", "[\"a\"]");
|
var record = item("record", "CREATE", "[\"b--subOrg\"]");
|
when(mapper.departments("tenant", List.of("a", "b"))).thenReturn(List.of(
|
new DmsApprovedReadAccessMapper.Department("a"), new DmsApprovedReadAccessMapper.Department("b")));
|
when(mapper.insert(any())).thenAnswer(i -> i.getArgument(0));
|
service.apply(batch, List.of(main, record), List.of(main, record));
|
var captor = ArgumentCaptor.forClass(DmsFilePermissionEntity.class);
|
verify(mapper, times(2)).insert(captor.capture());
|
var grants = captor.getAllValues();
|
assertEquals(List.of(main.getFileVersionId(), record.getFileVersionId()), grants.stream().map(DmsFilePermissionEntity::getResourceId).toList());
|
assertEquals(List.of("a", "b"), grants.stream().map(DmsFilePermissionEntity::getPrincipalId).toList());
|
assertEquals(List.of("SELF", "CHILDREN"), grants.stream().map(DmsFilePermissionEntity::getApprovedOrgScope).toList());
|
for (var p : grants) {
|
assertEquals("READ",p.getActionCode()); assertEquals("ORG",p.getPrincipalType());
|
assertEquals("FILE_VERSION",p.getResourceType()); assertEquals(batch.getActivatedAt(),p.getValidFrom());
|
assertFalse(p.getIncludeChildOrgs()); assertNull(p.getMaxUseCount());
|
}
|
verify(mapper, never()).revoke(any(), any());
|
}
|
@Test void emptyScopeOnNewTargetNeverTouchesSourceVersionPermissions() {
|
for (String type : List.of("CREATE", "REVISE")) {
|
var target = item("main", type, "[]");
|
target.setBaseFileVersionId(UUID.randomUUID());
|
service.apply(batch, List.of(target), List.of(target));
|
verify(mapper).owned("tenant", target.getFileVersionId());
|
verifyNoMoreInteractions(mapper);
|
verifyNoInteractions(audit);
|
reset(mapper);
|
}
|
}
|
@Test void emptyScopeClearsOnlyApprovalGrantsOfCurrentReviewTarget() {
|
for (String scope : Arrays.asList("[]", null, "null", "", " ")) {
|
var target = item("main", "REUSE", scope);
|
target.setBaseFileVersionId(target.getFileVersionId());
|
var old = new DmsFilePermissionEntity();
|
old.setId(UUID.randomUUID()); old.setResourceId(target.getFileVersionId());
|
old.setSourceId("approved-read:previous-review");
|
when(mapper.owned("tenant", target.getFileVersionId())).thenReturn(List.of(old));
|
when(mapper.revoke("tenant", old.getId())).thenReturn(1);
|
service.apply(batch, List.of(target), List.of(target));
|
verify(mapper).revoke("tenant", old.getId());
|
verify(mapper, never()).insert(any());
|
verify(audit).permissionChange(eq("PERMISSION_GRANT"), anyString(), anyList(), anyList(), anyList());
|
reset(mapper, audit);
|
}
|
}
|
@Test void mainAndRecordApplyIndependentScopesToTheirOwnTargetVersions() {
|
var main = item("main", "REUSE", "[\"a\"]");
|
var record = item("record", "REUSE", "[]");
|
var old = new DmsFilePermissionEntity();
|
old.setId(UUID.randomUUID()); old.setSourceId("approved-read:older");
|
when(mapper.departments("tenant", List.of("a"))).thenReturn(List.of(
|
new DmsApprovedReadAccessMapper.Department("a")));
|
when(mapper.owned("tenant", main.getFileVersionId())).thenReturn(List.of(old));
|
var oldRecord = new DmsFilePermissionEntity();
|
oldRecord.setId(UUID.randomUUID()); oldRecord.setResourceId(record.getFileVersionId());
|
oldRecord.setSourceId("approved-read:previous-record-review");
|
when(mapper.owned("tenant", record.getFileVersionId())).thenReturn(List.of(oldRecord));
|
when(mapper.revoke("tenant", oldRecord.getId())).thenReturn(1);
|
when(mapper.revoke("tenant", old.getId())).thenReturn(1);
|
when(mapper.insert(any())).thenAnswer(i -> i.getArgument(0));
|
service.apply(batch, List.of(main, record), List.of(main, record));
|
verify(mapper).revoke("tenant", old.getId());
|
var captor = ArgumentCaptor.forClass(DmsFilePermissionEntity.class);
|
verify(mapper).insert(captor.capture());
|
assertEquals(main.getFileVersionId(), captor.getValue().getResourceId());
|
assertEquals("a", captor.getValue().getPrincipalId());
|
verify(mapper).revoke("tenant", oldRecord.getId());
|
}
|
@Test void invalidDepartmentFailsBeforeAnyPermissionMutation() {
|
var item=item("main","CREATE","[\"foreign\"]");
|
assertThrows(DataException.class,()->service.apply(batch,List.of(item),List.of(item)));
|
verify(mapper,never()).owned(any(),any()); verify(mapper,never()).insert(any()); verifyNoInteractions(audit);
|
}
|
@Test void snapshotMismatchAndEarlyActivationAreRejected() {
|
var item=item("main","CREATE","[]"); var changed=item("main","CREATE","[\"a\"]");
|
assertThrows(DataException.class,()->service.apply(batch,List.of(item),List.of(changed)));
|
batch.setActivatedAt(null);
|
assertThrows(DataException.class,()->service.apply(batch,List.of(item),List.of(item)));
|
verifyNoInteractions(mapper,audit);
|
}
|
@Test void duplicateActivationNeverResurrectsRevokedGrant() {
|
var item=item("main","REUSE","[\"a\"]");
|
when(mapper.departments("tenant", List.of("a"))).thenReturn(List.of(
|
new DmsApprovedReadAccessMapper.Department("a")));
|
var revoked=new DmsFilePermissionEntity();revoked.setRevokedAt(new Date());
|
revoked.setSourceId("approved-read:"+batch.getId()+":"+item.getFileVersionId());
|
when(mapper.owned("tenant",item.getFileVersionId())).thenReturn(List.of(revoked));
|
assertThrows(DataException.class,()->service.apply(batch,List.of(item),List.of(item)));
|
verify(mapper,never()).insert(any());verifyNoInteractions(audit);
|
}
|
}
|
