package jnpf.flowable.util;
|
|
import com.baomidou.mybatisplus.core.MybatisConfiguration;
|
import com.fasterxml.jackson.databind.ObjectMapper;
|
import jnpf.flowable.entity.TaskEntity;
|
import jnpf.flowable.mapper.FilePermissionSnapshotMapper;
|
import jnpf.flowable.mapper.TaskMapper;
|
import jnpf.flowable.model.filepermission.FilePermissionPolicy;
|
import jnpf.flowable.model.templatenode.nodejson.NodeModel;
|
import jnpf.flowable.util.filepermission.FilePermissionPolicyCompiler;
|
import jnpf.flowable.util.filepermission.FilePermissionSnapshot;
|
import jnpf.util.JsonUtil;
|
import org.apache.ibatis.builder.xml.XMLMapperBuilder;
|
import org.apache.ibatis.mapping.MappedStatement;
|
|
import java.io.InputStream;
|
import java.util.*;
|
import java.util.concurrent.atomic.AtomicInteger;
|
|
/** 无数据库写入：验证真实序列化、原生 MyBatis INSERT/UPDATE 及快照隔离契约。 */
|
public final class FilePermissionSnapshotChecks {
|
private static int checks;
|
|
public static void main(String[] args) throws Exception {
|
checkLegacyAndInstances();
|
checkFieldCompilation();
|
checkSupportedConfiguration();
|
checkCorruptSnapshot();
|
checkNativePersistence();
|
System.out.println("FilePermissionSnapshotChecks: " + checks + " checks passed");
|
}
|
|
private static void checkLegacyAndInstances() {
|
AtomicInteger loads = new AtomicInteger();
|
Map<String, Object> empty = FilePermissionPolicyCompiler.compile(nodes(), id -> {
|
loads.incrementAndGet();
|
return form();
|
});
|
require(loads.get() == 0, "legacy nodes must not load forms");
|
require(FilePermissionSnapshot.create("tenant", "old", "v1", empty) == null, "unconfigured new task must stay legacy");
|
require(FilePermissionSnapshot.read(null, "tenant", "old") == null, "old task must remain legacy");
|
|
Map<String, NodeModel> nodes = nodes();
|
Map<String, Object> actions = new LinkedHashMap<>();
|
actions.put("DOWNLOAD", "DENY");
|
nodes.get("review").setFormOperates(Collections.singletonList(field("rows-files", actions)));
|
Map<String, Object> policy = FilePermissionPolicyCompiler.compile(nodes, id -> form());
|
String a = FilePermissionSnapshot.create("tenant", "a", "v1", policy);
|
actions.put("DOWNLOAD", "ALLOW");
|
String b = FilePermissionSnapshot.create("tenant", "b", "v2", FilePermissionPolicyCompiler.compile(nodes, id -> form()));
|
require(effect(a, "a") == FilePermissionPolicy.Effect.DENY, "later template edits must not affect existing snapshot");
|
require(effect(b, "b") == FilePermissionPolicy.Effect.ALLOW, "new task must use its own configuration");
|
require(FilePermissionSnapshot.read(null, "tenant", "old") == null, "new configuration must not enroll old tasks");
|
reject(() -> FilePermissionSnapshot.read(a, "tenant", "b"), "another task cannot borrow a snapshot");
|
reject(() -> FilePermissionSnapshot.read(a, "other-tenant", "a"), "tenant must match");
|
require("v1".equals(FilePermissionSnapshot.read(a, "tenant", "a").getSourceFlowId()), "source version must be fixed");
|
String derived = FilePermissionSnapshot.read(a, "tenant", "a").forDerivedTask("derived");
|
require(effect(derived, "derived") == FilePermissionPolicy.Effect.DENY, "derived task must retain source configuration");
|
require(FilePermissionSnapshot.read(derived, "tenant", "derived").getActiveReleaseRules().isEmpty(), "derived task starts a new release-rule round");
|
reject(() -> FilePermissionSnapshot.read(derived, "tenant", "a"), "derived snapshot has independent identity");
|
require(effect(a, "a") == FilePermissionPolicy.Effect.DENY, "derivation cannot mutate source");
|
}
|
|
private static void checkFieldCompilation() {
|
Map<String, NodeModel> nodes = nodes();
|
nodes.get("review").setFormOperates(Collections.singletonList(field("rows-files", Collections.singletonMap("EDIT", "DENY"))));
|
List<FilePermissionPolicy.Rule> parsed = FilePermissionPolicy.parse(FilePermissionPolicyCompiler.compile(nodes, id -> form()));
|
require(parsed.size() == 1 && "form".equals(parsed.get(0).formId), "approval node inherits start form");
|
require("rows-files".equals(parsed.get(0).field), "child field retains native identity");
|
require(parsed.get(0).subject == FilePermissionPolicy.Subject.CURRENT_HANDLERS, "node field permissions target current handlers");
|
nodes.get("start").setFormOperates(Collections.singletonList(field("files", Collections.singletonMap("ADD", "DENY"))));
|
parsed = FilePermissionPolicy.parse(FilePermissionPolicyCompiler.compile(nodes, id -> form()));
|
require(parsed.stream().anyMatch(r -> r.subject == FilePermissionPolicy.Subject.CREATOR), "start field permissions target creator");
|
|
nodes.get("review").setFormOperates(Collections.singletonList(field("missing", Collections.singletonMap("VIEW", "DENY"))));
|
reject(() -> FilePermissionPolicyCompiler.compile(nodes, id -> form()), "missing fields must fail");
|
nodes.get("review").setFormOperates(Collections.singletonList(field("title", Collections.singletonMap("VIEW", "DENY"))));
|
reject(() -> FilePermissionPolicyCompiler.compile(nodes, id -> form()), "text fields cannot pretend to be attachments");
|
nodes.get("review").setFormOperates(Collections.singletonList(field("files", null)));
|
reject(() -> FilePermissionPolicyCompiler.compile(nodes, id -> form()), "null actions must not downgrade");
|
nodes.get("review").setFormOperates(Collections.emptyList());
|
nodes.get("review").setFilePermissionPolicy(policy("rule", "other-form", "review"));
|
reject(() -> FilePermissionPolicyCompiler.compile(nodes, id -> form()), "cross-flow form is invalid");
|
nodes.get("review").setFilePermissionPolicy(policy("rule", "form", "removed"));
|
reject(() -> FilePermissionPolicyCompiler.compile(nodes, id -> form()), "deleted trigger node is invalid");
|
nodes.get("review").setFilePermissionPolicy(policy("rule", "form", "review"));
|
nodes.get("start").setFilePermissionPolicy(policy("rule", "form", "review"));
|
reject(() -> FilePermissionPolicyCompiler.compile(nodes, id -> form()), "duplicate rule IDs across nodes are invalid");
|
}
|
|
private static void checkSupportedConfiguration() {
|
for (Integer type : Arrays.asList(0, 1, 2, 3, null)) {
|
Map<String, Object> empty = FilePermissionPolicyCompiler.compile(nodes(), id -> {
|
throw new AssertionError("unconfigured flow must not load forms");
|
}, type);
|
require(FilePermissionPolicy.parse(empty).isEmpty(), "unconfigured flow type must retain original behavior");
|
}
|
Map<String, NodeModel> nodes = nodes();
|
Map<String, Object> policy = policy("rule", "form", "review");
|
nodes.get("start").setFilePermissionPolicy(policy);
|
for (int type : Arrays.asList(0, 1)) {
|
require(FilePermissionPolicy.parse(FilePermissionPolicyCompiler.compile(nodes, id -> form(), type)).size() == 1,
|
"supported flow must accept KEEP rules");
|
}
|
for (Integer type : Arrays.asList(2, 3, null, 99)) {
|
reject(() -> FilePermissionPolicyCompiler.compile(nodes, id -> form(), type), "unsupported configured flow must fail before publication");
|
}
|
@SuppressWarnings("unchecked")
|
Map<String, Object> rule = ((List<Map<String, Object>>) policy.get("rules")).get(0);
|
rule.put("onReturn", "RELEASE");
|
Map<String, Object> releasePolicy = FilePermissionPolicyCompiler.compile(nodes, id -> form(), 0);
|
require(FilePermissionPolicy.parse(releasePolicy).get(0).onReturn == FilePermissionPolicy.OnReturn.RELEASE,
|
"supported flow accepts return release");
|
String releaseJson = FilePermissionSnapshot.create("tenant", "release", "v1", releasePolicy);
|
FilePermissionSnapshot release = FilePermissionSnapshot.read(releaseJson, "tenant", "release");
|
require(release.getActiveReleaseRules().isEmpty(), "release rule starts inactive");
|
release = FilePermissionSnapshot.read(release.withEnteredNodes(Collections.singleton("review")), "tenant", "release");
|
require(release.getActiveReleaseRules().contains("rule"), "entering trigger activates release rule");
|
release = FilePermissionSnapshot.read(release.withReturnedPastNodes(Collections.singleton("later")), "tenant", "release");
|
require(release.getActiveReleaseRules().contains("rule"), "return after trigger keeps release rule active");
|
release = FilePermissionSnapshot.read(release.withReturnedPastNodes(Collections.singleton("review")), "tenant", "release");
|
require(release.getActiveReleaseRules().isEmpty(), "invalidating trigger releases rule");
|
release = FilePermissionSnapshot.read(release.withEnteredNodes(Collections.singleton("review")), "tenant", "release");
|
require(release.getActiveReleaseRules().contains("rule"), "re-entering trigger reactivates release rule");
|
rule.put("onReturn", "KEEP");
|
NodeModel condition = new NodeModel(); condition.setType("condition"); condition.setFormId("condition-form");
|
nodes.put("condition", condition);
|
rule.put("triggerNodeId", "condition");
|
reject(() -> FilePermissionPolicyCompiler.compile(nodes, id -> form(), 0), "nonparticipant trigger node must fail");
|
rule.put("triggerNodeId", "review");
|
rule.put("subject", "NODE_PARTICIPANTS"); rule.put("subjectNodeId", "condition");
|
reject(() -> FilePermissionPolicyCompiler.compile(nodes, id -> form(), 0), "nonparticipant subject node must fail");
|
rule.put("subjectNodeId", "review"); rule.put("formId", "condition-form");
|
reject(() -> FilePermissionPolicyCompiler.compile(nodes, id -> form(), 0), "unbound form on nonparticipant node must fail");
|
}
|
|
private static void checkCorruptSnapshot() {
|
reject(() -> FilePermissionSnapshot.read("", "tenant", "a"), "empty string is not legacy");
|
reject(() -> FilePermissionSnapshot.read("null", "tenant", "a"), "JSON null is not legacy");
|
reject(() -> FilePermissionSnapshot.read("{}", "tenant", "a"), "missing version must fail");
|
String valid = FilePermissionSnapshot.create("tenant", "a", "v1", policy("rule", "form", "review"));
|
reject(() -> FilePermissionSnapshot.read(valid + " {}", "tenant", "a"), "trailing tokens must fail");
|
reject(() -> FilePermissionSnapshot.read(valid.replace("\"version\":1", "\"version\":2"), "tenant", "a"), "unknown versions must fail");
|
reject(() -> FilePermissionSnapshot.read(valid.replace("\"taskId\":\"a\"", "\"taskId\":\"b\",\"taskId\":\"a\""), "tenant", "a"), "duplicate properties must fail");
|
reject(() -> FilePermissionSnapshot.read(valid.replace("\"activeReleaseRules\":[]", "\"activeReleaseRules\":[\"unknown\"]"), "tenant", "a"),
|
"unknown active release rule must fail");
|
reject(() -> FilePermissionSnapshot.read("{\"version\":1,\"tenantId\":\"tenant\",\"taskId\":\"a\",\"sourceFlowId\":\"v1\",\"policy\":{\"version\":1,\"rules\":[]}}", "tenant", "a"), "empty controlled snapshot must fail");
|
}
|
|
private static void checkNativePersistence() throws Exception {
|
TaskEntity task = new TaskEntity();
|
task.setId("a");
|
task.setFullName("task");
|
task.setFilePermissionSnapshot("server-snapshot");
|
ObjectMapper json = new ObjectMapper();
|
require(!json.writeValueAsString(task).contains("server-snapshot"), "snapshot must not leak through native JSON");
|
require(json.readValue("{\"id\":\"a\",\"filePermissionSnapshot\":\"forged\"}", TaskEntity.class).getFilePermissionSnapshot() == null,
|
"client JSON cannot set snapshot");
|
require(!JsonUtil.getObjectToString(task).contains("server-snapshot"), "platform serialization must omit snapshot");
|
require(JsonUtil.getJsonToBean("{\"id\":\"a\",\"filePermissionSnapshot\":\"forged\"}", TaskEntity.class).getFilePermissionSnapshot() == null,
|
"platform JSON cannot restore or inject a snapshot");
|
|
MybatisConfiguration configuration = new MybatisConfiguration();
|
configuration.addMapper(TaskMapper.class);
|
String prefix = TaskMapper.class.getName() + ".";
|
String insert = configuration.getMappedStatement(prefix + "insert").getBoundSql(task).getSql().toLowerCase(Locale.ROOT);
|
require(insert.contains("f_file_permission_snapshot"), "snapshot must share the native task INSERT");
|
Map<String, Object> parameters = new HashMap<>();
|
parameters.put("et", task);
|
String update = configuration.getMappedStatement(prefix + "updateById").getBoundSql(parameters).getSql().toLowerCase(Locale.ROOT);
|
require(!update.contains("f_file_permission_snapshot"), "ordinary updates cannot rewrite snapshot");
|
String select = configuration.getMappedStatement(prefix + "selectById").getBoundSql("a").getSql().toLowerCase(Locale.ROOT);
|
require(!select.contains("f_file_permission_snapshot"), "ordinary task reads remain unchanged");
|
task.setFilePermissionSnapshot(null);
|
insert = configuration.getMappedStatement(prefix + "insert").getBoundSql(task).getSql().toLowerCase(Locale.ROOT);
|
require(!insert.contains("f_file_permission_snapshot"), "legacy task INSERT must omit new column");
|
|
String resource = "mapper/FilePermissionSnapshotMapper.xml";
|
try (InputStream stream = FilePermissionSnapshotChecks.class.getClassLoader().getResourceAsStream(resource)) {
|
require(stream != null, "mapper XML must be packaged");
|
new XMLMapperBuilder(stream, configuration, resource, configuration.getSqlFragments()).parse();
|
}
|
MappedStatement statement = configuration.getMappedStatement(FilePermissionSnapshotMapper.class.getName() + ".find");
|
String sql = statement.getBoundSql(Collections.singletonMap("taskId", "a")).getSql().replaceAll("\\s+", " ");
|
require(sql.contains("f_id = ?") && !sql.contains("f_delete_mark IS NULL"), "lookup must distinguish deleted tasks from never-created tasks");
|
require(statement.getResultMaps().get(0).getResultMappings().size() == 3, "snapshot and deletion state need explicit mappings");
|
}
|
|
private static Map<String, NodeModel> nodes() {
|
Map<String, NodeModel> nodes = new LinkedHashMap<>();
|
NodeModel start = new NodeModel(); start.setType("start"); start.setFormId("form");
|
NodeModel review = new NodeModel(); review.setType("approver");
|
nodes.put("start", start); nodes.put("review", review);
|
return nodes;
|
}
|
|
private static Map<String, Object> field(String id, Object actions) {
|
Map<String, Object> field = new LinkedHashMap<>();
|
field.put("id", id); field.put("jnpfKey", "uploadFile"); field.put("filePermissions", actions);
|
return field;
|
}
|
|
private static Map<String, Object> form() {
|
Map<String, Object> childConfig = new HashMap<>();
|
childConfig.put("jnpfKey", "table");
|
childConfig.put("children", Collections.singletonList(component("files", "uploadFile")));
|
Map<String, Object> table = new HashMap<>();
|
table.put("__vModel__", "rows"); table.put("__config__", childConfig);
|
return Collections.singletonMap("fields", Arrays.asList(component("files", "uploadFile"), component("title", "input"), table));
|
}
|
|
private static Map<String, Object> component(String id, String type) {
|
Map<String, Object> field = new HashMap<>();
|
field.put("__vModel__", id); field.put("__config__", Collections.singletonMap("jnpfKey", type));
|
return field;
|
}
|
|
private static Map<String, Object> policy(String id, String formId, String nodeId) {
|
Map<String, Object> rule = new LinkedHashMap<>();
|
rule.put("id", id); rule.put("formId", formId); rule.put("field", "files");
|
rule.put("subject", "PARTICIPANTS"); rule.put("trigger", "ENTERED");
|
rule.put("triggerNodeId", nodeId); rule.put("onReturn", "KEEP");
|
rule.put("actions", Collections.singletonMap("DOWNLOAD", "DENY"));
|
Map<String, Object> policy = new LinkedHashMap<>();
|
policy.put("version", 1); policy.put("rules", Collections.singletonList(rule));
|
return policy;
|
}
|
|
private static FilePermissionPolicy.Effect effect(String snapshot, String taskId) {
|
return FilePermissionSnapshot.read(snapshot, "tenant", taskId).getRules().get(0).actions.get(FilePermissionPolicy.Action.DOWNLOAD);
|
}
|
|
private static void reject(Runnable action, String message) {
|
try { action.run(); } catch (IllegalArgumentException expected) { checks++; return; }
|
throw new AssertionError(message);
|
}
|
|
private static void require(boolean condition, String message) {
|
if (!condition) throw new AssertionError(message);
|
checks++;
|
}
|
}
|
