package jnpf.dmsService;
|
|
import jnpf.dmsEntity.permission.entity.DmsFilePermissionEntity;
|
import jnpf.dmsEntity.permission.entity.DmsPermissionResourceEntity;
|
import jnpf.dmsIntegration.audit.DmsAuditAdapter;
|
import jnpf.dmsMapper.DmsFilePermissionMapper;
|
import jnpf.dmsMapper.DmsPermissionResourceMapper;
|
import jnpf.dmsPermission.DmsCurrentIdentity;
|
import jnpf.dmsPermission.DmsPermissionError;
|
import jnpf.dmsPermission.DmsPermissionException;
|
import jnpf.dmsPermission.DmsPermissionProperties;
|
import jnpf.dmsPermission.DmsPrincipalValidator;
|
import org.junit.jupiter.api.Test;
|
import org.mockito.ArgumentCaptor;
|
|
import java.util.Collections;
|
import java.util.Date;
|
import java.util.UUID;
|
|
import static org.junit.jupiter.api.Assertions.assertEquals;
|
import static org.junit.jupiter.api.Assertions.assertNotNull;
|
import static org.junit.jupiter.api.Assertions.assertNull;
|
import static org.junit.jupiter.api.Assertions.assertSame;
|
import static org.junit.jupiter.api.Assertions.assertThrows;
|
import static org.mockito.ArgumentMatchers.any;
|
import static org.mockito.ArgumentMatchers.eq;
|
import static org.mockito.Mockito.mock;
|
import static org.mockito.Mockito.never;
|
import static org.mockito.Mockito.verify;
|
import static org.mockito.Mockito.when;
|
|
class DmsPermissionGrantServiceTest {
|
private static final String TENANT_ID = "tenant-1";
|
private static final String CREATOR_ID = "user-1";
|
private static final UUID FOLDER_ID = UUID.fromString("018f0000-0000-7000-8000-000000000402");
|
private static final UUID PERMISSION_ID = UUID.fromString("018f0000-0000-7000-8000-000000000403");
|
private static final String SOURCE_ID = "folder-creator-create:" + FOLDER_ID;
|
private static final String GRANT_REASON = "目录创建者默认 CREATE 权限";
|
|
@Test
|
void grantsSelfCreatePermissionToFolderCreator() {
|
Fixture fixture = new Fixture();
|
when(fixture.permissionMapper.selectBySource(TENANT_ID, "SYSTEM", SOURCE_ID))
|
.thenReturn(Collections.emptyList());
|
when(fixture.permissionMapper.insertReturning(any(DmsFilePermissionEntity.class)))
|
.thenAnswer(invocation -> {
|
DmsFilePermissionEntity entity = invocation.getArgument(0);
|
entity.setId(PERMISSION_ID);
|
return entity;
|
});
|
|
DmsFilePermissionEntity result = fixture.service.ensureFolderCreatorCreatePermission(
|
TENANT_ID, FOLDER_ID, CREATOR_ID);
|
|
assertEquals(PERMISSION_ID, result.getId());
|
verify(fixture.permissionMapper).lockSource(TENANT_ID, "SYSTEM", SOURCE_ID);
|
ArgumentCaptor<DmsFilePermissionEntity> captor = ArgumentCaptor.forClass(DmsFilePermissionEntity.class);
|
verify(fixture.permissionMapper).insertReturning(captor.capture());
|
DmsFilePermissionEntity permission = captor.getValue();
|
assertEquals(TENANT_ID, permission.getTenantId());
|
assertEquals("FOLDER", permission.getResourceType());
|
assertEquals(FOLDER_ID, permission.getResourceId());
|
assertEquals("SELF", permission.getResourceScope());
|
assertEquals("USER", permission.getPrincipalType());
|
assertEquals(CREATOR_ID, permission.getPrincipalId());
|
assertEquals(Boolean.FALSE, permission.getIncludeChildOrgs());
|
assertEquals("CREATE", permission.getActionCode());
|
assertEquals("SYSTEM", permission.getSourceType());
|
assertEquals(SOURCE_ID, permission.getSourceId());
|
assertNotNull(permission.getValidFrom());
|
assertEquals(GRANT_REASON, permission.getGrantReason());
|
assertEquals("USER", permission.getGrantedByType());
|
assertEquals(CREATOR_ID, permission.getGrantedById());
|
verify(fixture.currentIdentity, never()).requirePermissionAdministrator();
|
verify(fixture.principalValidator, never()).validate(any());
|
verify(fixture.auditAdapter).permissionChange(eq("PERMISSION_GRANT"),
|
eq("授予 DMS 目录创建者默认权限"), eq(Collections.emptyList()), any(),
|
eq(Collections.emptyList()));
|
}
|
|
@Test
|
void keepsRevokedPermissionRevokedOnIdempotentRetry() {
|
Fixture fixture = new Fixture();
|
DmsFilePermissionEntity existing = matchingPermission();
|
existing.setRevokedAt(new Date());
|
when(fixture.permissionMapper.selectBySource(TENANT_ID, "SYSTEM", SOURCE_ID))
|
.thenReturn(Collections.singletonList(existing));
|
|
DmsFilePermissionEntity result = fixture.service.ensureFolderCreatorCreatePermission(
|
TENANT_ID, FOLDER_ID, CREATOR_ID);
|
|
assertSame(existing, result);
|
verify(fixture.permissionMapper, never()).insertReturning(any(DmsFilePermissionEntity.class));
|
verify(fixture.auditAdapter, never()).permissionChange(any(), any(), any(), any(), any());
|
}
|
|
@Test
|
void rejectsMismatchedPermissionUsingSameSource() {
|
Fixture fixture = new Fixture();
|
DmsFilePermissionEntity existing = matchingPermission();
|
existing.setActionCode("READ");
|
when(fixture.permissionMapper.selectBySource(TENANT_ID, "SYSTEM", SOURCE_ID))
|
.thenReturn(Collections.singletonList(existing));
|
|
DmsPermissionException exception = assertThrows(DmsPermissionException.class,
|
() -> fixture.service.ensureFolderCreatorCreatePermission(TENANT_ID, FOLDER_ID, CREATOR_ID));
|
|
assertEquals(DmsPermissionError.SOURCE_CONFLICT, exception.getError());
|
verify(fixture.permissionMapper, never()).insertReturning(any(DmsFilePermissionEntity.class));
|
}
|
|
@Test
|
void grantsSingleUseWorkflowDownloadPermissionAsService() {
|
Fixture fixture = new Fixture();
|
UUID fileVersionId = UUID.fromString("018f0000-0000-7000-8000-000000000404");
|
String sourceId = "download-request:request-1";
|
DmsPermissionResourceEntity resource = new DmsPermissionResourceEntity();
|
resource.setId(fileVersionId);
|
resource.setResourceType("FILE_VERSION");
|
when(fixture.permissionMapper.selectBySource(TENANT_ID, "WORKFLOW", sourceId))
|
.thenReturn(Collections.emptyList());
|
when(fixture.resourceMapper.selectByTenantAndIds(TENANT_ID,
|
Collections.singletonList(fileVersionId))).thenReturn(Collections.singletonList(resource));
|
when(fixture.permissionMapper.insertReturning(any(DmsFilePermissionEntity.class)))
|
.thenAnswer(invocation -> {
|
DmsFilePermissionEntity permission = invocation.getArgument(0);
|
permission.setId(PERMISSION_ID);
|
return permission;
|
});
|
|
DmsFilePermissionEntity result = fixture.service.ensureWorkflowDownloadPermissions(
|
TENANT_ID, sourceId, CREATOR_ID, Collections.singletonList(fileVersionId),
|
"jnpf-file", Collections.emptyList()).get(0);
|
|
assertEquals("FILE_VERSION", result.getResourceType());
|
assertEquals(fileVersionId, result.getResourceId());
|
assertEquals("USER", result.getPrincipalType());
|
assertEquals(CREATOR_ID, result.getPrincipalId());
|
assertEquals("DOWNLOAD", result.getActionCode());
|
assertEquals("WORKFLOW", result.getSourceType());
|
assertEquals(sourceId, result.getSourceId());
|
assertEquals(null, result.getValidTo());
|
assertEquals(Long.valueOf(1L), result.getMaxUseCount());
|
assertEquals("SERVICE", result.getGrantedByType());
|
assertEquals("jnpf-file", result.getGrantedById());
|
verify(fixture.principalValidator).validate(any());
|
verify(fixture.currentIdentity, never()).requirePermissionAdministrator();
|
|
// 审批回调重试不能恢复已消耗的下载次数。
|
result.setUsedCount(1L);
|
when(fixture.permissionMapper.selectBySource(TENANT_ID, "WORKFLOW", sourceId))
|
.thenReturn(Collections.singletonList(result));
|
DmsFilePermissionEntity replay = fixture.service.ensureWorkflowDownloadPermissions(
|
TENANT_ID, sourceId, CREATOR_ID, Collections.singletonList(fileVersionId),
|
"jnpf-file", Collections.emptyList()).get(0);
|
assertSame(result, replay);
|
assertEquals(Long.valueOf(1L), replay.getUsedCount());
|
verify(fixture.permissionMapper).insertReturning(any(DmsFilePermissionEntity.class));
|
}
|
|
@Test
|
void grantsTimeLimitedWorkflowDownloadPermissionAsService() {
|
Fixture fixture = new Fixture();
|
UUID fileVersionId = UUID.fromString("018f0000-0000-7000-8000-000000000408");
|
String sourceId = "personal-folder-download:request-1";
|
Date validTo = new Date(4102444800000L);
|
DmsPermissionResourceEntity resource = new DmsPermissionResourceEntity();
|
resource.setId(fileVersionId);
|
resource.setResourceType("FILE_VERSION");
|
when(fixture.permissionMapper.selectBySource(TENANT_ID, "WORKFLOW", sourceId))
|
.thenReturn(Collections.emptyList());
|
when(fixture.resourceMapper.selectByTenantAndIds(TENANT_ID,
|
Collections.singletonList(fileVersionId))).thenReturn(Collections.singletonList(resource));
|
when(fixture.permissionMapper.insertReturning(any(DmsFilePermissionEntity.class)))
|
.thenAnswer(invocation -> invocation.getArgument(0));
|
|
DmsFilePermissionEntity result = fixture.service.ensureWorkflowDownloadPermissions(
|
TENANT_ID, sourceId, CREATOR_ID, Collections.singletonList(fileVersionId),
|
validTo, "jnpf-flowable", Collections.emptyList()).get(0);
|
|
assertEquals("DOWNLOAD", result.getActionCode());
|
assertEquals(validTo, result.getValidTo());
|
assertEquals(Long.valueOf(1L), result.getMaxUseCount());
|
assertEquals("文件下载申请审批通过", result.getGrantReason());
|
assertEquals("SERVICE", result.getGrantedByType());
|
assertEquals("jnpf-flowable", result.getGrantedById());
|
}
|
|
@Test
|
void grantsPermanentWorkflowPrintPermissionAsService() {
|
Fixture fixture = new Fixture();
|
UUID fileVersionId = UUID.fromString("018f0000-0000-7000-8000-000000000405");
|
String sourceId = "print-request:request-1";
|
DmsPermissionResourceEntity resource = new DmsPermissionResourceEntity();
|
resource.setId(fileVersionId);
|
resource.setResourceType("FILE_VERSION");
|
when(fixture.permissionMapper.selectBySource(TENANT_ID, "WORKFLOW", sourceId))
|
.thenReturn(Collections.emptyList());
|
when(fixture.resourceMapper.selectByTenantAndIds(TENANT_ID,
|
Collections.singletonList(fileVersionId))).thenReturn(Collections.singletonList(resource));
|
when(fixture.permissionMapper.insertReturning(any(DmsFilePermissionEntity.class)))
|
.thenAnswer(invocation -> invocation.getArgument(0));
|
|
DmsFilePermissionEntity result = fixture.service.ensureWorkflowPrintPermissions(
|
TENANT_ID, sourceId, CREATOR_ID, Collections.singletonList(fileVersionId),
|
"jnpf-file", Collections.emptyList()).get(0);
|
|
assertEquals("PRINT", result.getActionCode());
|
assertEquals("WORKFLOW", result.getSourceType());
|
assertEquals(sourceId, result.getSourceId());
|
assertEquals(null, result.getValidTo());
|
assertEquals(null, result.getMaxUseCount());
|
assertEquals("SERVICE", result.getGrantedByType());
|
assertEquals("jnpf-file", result.getGrantedById());
|
}
|
|
@Test
|
void grantsTimeLimitedWorkflowPrintPermissionAsService() {
|
Fixture fixture = new Fixture();
|
UUID fileVersionId = UUID.fromString("018f0000-0000-7000-8000-000000000409");
|
String sourceId = "workflow-print-files:request-1";
|
Date validTo = new Date(4102444800000L);
|
DmsPermissionResourceEntity resource = new DmsPermissionResourceEntity();
|
resource.setId(fileVersionId);
|
resource.setResourceType("FILE_VERSION");
|
when(fixture.permissionMapper.selectBySource(TENANT_ID, "WORKFLOW", sourceId))
|
.thenReturn(Collections.emptyList());
|
when(fixture.resourceMapper.selectByTenantAndIds(TENANT_ID,
|
Collections.singletonList(fileVersionId))).thenReturn(Collections.singletonList(resource));
|
when(fixture.permissionMapper.insertReturning(any(DmsFilePermissionEntity.class)))
|
.thenAnswer(invocation -> invocation.getArgument(0));
|
|
DmsFilePermissionEntity result = fixture.service.ensureWorkflowPrintPermissions(
|
TENANT_ID, sourceId, CREATOR_ID, Collections.singletonList(fileVersionId),
|
validTo, "jnpf-flowable", Collections.emptyList()).get(0);
|
|
assertEquals("PRINT", result.getActionCode());
|
assertEquals(validTo, result.getValidTo());
|
assertEquals("文件打印申请审批通过", result.getGrantReason());
|
assertEquals("jnpf-flowable", result.getGrantedById());
|
}
|
|
@Test
|
void grantsTimeLimitedWorkflowBorrowReadPermissionAsService() {
|
Fixture fixture = new Fixture();
|
UUID fileVersionId = UUID.fromString("018f0000-0000-7000-8000-000000000406");
|
String sourceId = "personal-folder-borrow:request-1";
|
Date validTo = new Date(4102444800000L);
|
DmsPermissionResourceEntity resource = new DmsPermissionResourceEntity();
|
resource.setId(fileVersionId);
|
resource.setResourceType("FILE_VERSION");
|
when(fixture.permissionMapper.selectBySource(TENANT_ID, "WORKFLOW", sourceId))
|
.thenReturn(Collections.emptyList());
|
when(fixture.resourceMapper.selectByTenantAndIds(TENANT_ID,
|
Collections.singletonList(fileVersionId))).thenReturn(Collections.singletonList(resource));
|
when(fixture.permissionMapper.insertReturning(any(DmsFilePermissionEntity.class)))
|
.thenAnswer(invocation -> invocation.getArgument(0));
|
|
DmsFilePermissionEntity result = fixture.service.ensureWorkflowBorrowReadPermissions(
|
TENANT_ID, sourceId, CREATOR_ID, Collections.singletonList(fileVersionId),
|
validTo, "jnpf-flowable", Collections.emptyList()).get(0);
|
|
assertEquals("FILE_VERSION", result.getResourceType());
|
assertEquals(fileVersionId, result.getResourceId());
|
assertEquals("USER", result.getPrincipalType());
|
assertEquals(CREATOR_ID, result.getPrincipalId());
|
assertEquals("READ", result.getActionCode());
|
assertEquals("WORKFLOW", result.getSourceType());
|
assertEquals(validTo, result.getValidTo());
|
assertEquals("文件借阅申请审批通过", result.getGrantReason());
|
assertEquals("SERVICE", result.getGrantedByType());
|
assertEquals("jnpf-flowable", result.getGrantedById());
|
}
|
|
@Test
|
void grantsPermanentWorkflowBorrowReadPermissionWhenValidityIsNull() {
|
Fixture fixture = new Fixture();
|
UUID fileVersionId = UUID.fromString("018f0000-0000-7000-8000-000000000407");
|
String sourceId = "personal-folder-borrow:permanent-request";
|
DmsPermissionResourceEntity resource = new DmsPermissionResourceEntity();
|
resource.setId(fileVersionId);
|
resource.setResourceType("FILE_VERSION");
|
when(fixture.permissionMapper.selectBySource(TENANT_ID, "WORKFLOW", sourceId))
|
.thenReturn(Collections.emptyList());
|
when(fixture.resourceMapper.selectByTenantAndIds(TENANT_ID,
|
Collections.singletonList(fileVersionId))).thenReturn(Collections.singletonList(resource));
|
when(fixture.permissionMapper.insertReturning(any(DmsFilePermissionEntity.class)))
|
.thenAnswer(invocation -> invocation.getArgument(0));
|
|
DmsFilePermissionEntity result = fixture.service.ensureWorkflowBorrowReadPermissions(
|
TENANT_ID, sourceId, CREATOR_ID, Collections.singletonList(fileVersionId),
|
null, "jnpf-flowable", Collections.emptyList()).get(0);
|
|
assertEquals("READ", result.getActionCode());
|
assertNull(result.getValidTo());
|
assertEquals("文件借阅申请审批通过", result.getGrantReason());
|
}
|
|
private static DmsFilePermissionEntity matchingPermission() {
|
DmsFilePermissionEntity permission = new DmsFilePermissionEntity();
|
permission.setId(PERMISSION_ID);
|
permission.setTenantId(TENANT_ID);
|
permission.setResourceType("FOLDER");
|
permission.setResourceId(FOLDER_ID);
|
permission.setResourceScope("SELF");
|
permission.setPrincipalType("USER");
|
permission.setPrincipalId(CREATOR_ID);
|
permission.setIncludeChildOrgs(false);
|
permission.setActionCode("CREATE");
|
permission.setSourceType("SYSTEM");
|
permission.setSourceId(SOURCE_ID);
|
permission.setValidFrom(new Date());
|
permission.setGrantReason(GRANT_REASON);
|
permission.setGrantedByType("USER");
|
permission.setGrantedById(CREATOR_ID);
|
return permission;
|
}
|
|
private static class Fixture {
|
private final DmsCurrentIdentity currentIdentity = mock(DmsCurrentIdentity.class);
|
private final DmsPermissionProperties properties = new DmsPermissionProperties();
|
private final DmsPrincipalValidator principalValidator = mock(DmsPrincipalValidator.class);
|
private final DmsPermissionResourceMapper resourceMapper = mock(DmsPermissionResourceMapper.class);
|
private final DmsFilePermissionMapper permissionMapper = mock(DmsFilePermissionMapper.class);
|
private final DmsAuditAdapter auditAdapter = mock(DmsAuditAdapter.class);
|
private final DmsPermissionGrantService service = new DmsPermissionGrantService(
|
currentIdentity, properties, principalValidator, resourceMapper, permissionMapper, auditAdapter);
|
}
|
}
|
