package jnpf.dmsPermission;
|
|
import jnpf.dmsEntity.permission.entity.DmsFilePermissionEntity;
|
import jnpf.dmsEntity.permission.model.DmsResourcePath;
|
import jnpf.dmsEntity.permission.model.DmsSubjectSet;
|
import org.junit.jupiter.api.Test;
|
|
import java.util.Arrays;
|
import java.util.UUID;
|
|
import static org.junit.jupiter.api.Assertions.assertFalse;
|
import static org.junit.jupiter.api.Assertions.assertTrue;
|
|
class DmsPermissionMatcherTest {
|
private final DmsPermissionMatcher matcher = new DmsPermissionMatcher();
|
private final UUID root = UUID.randomUUID();
|
private final UUID child = UUID.randomUUID();
|
private final UUID document = UUID.randomUUID();
|
private final UUID version = UUID.randomUUID();
|
|
@Test
|
void approvedImmediateChildrenNeverIncludeGrandchildrenOrAffectManualPermissions() {
|
var p = new jnpf.dmsEntity.permission.entity.DmsFilePermissionEntity();
|
p.setPrincipalType("ORG"); p.setPrincipalId("parent"); p.setIncludeChildOrgs(false);
|
p.setResourceType("FILE_VERSION"); p.setActionCode("READ");
|
p.setSourceType("WORKFLOW"); p.setGrantedByType("SERVICE"); p.setGrantedById("dms-approved-read");
|
p.setApprovedOrgScope("CHILDREN");
|
var subject = new jnpf.dmsEntity.permission.model.DmsSubjectSet();
|
subject.getDirectOrgIds().add("child"); subject.getImmediateParentOrgIds().add("parent");
|
subject.getAncestorOrgIds().addAll(java.util.List.of("grandparent","parent","child"));
|
var matcher = new DmsPermissionMatcher();
|
assertTrue(matcher.matchesPrincipal(p,subject));
|
p.setPrincipalId("grandparent"); assertFalse(matcher.matchesPrincipal(p,subject));
|
p.setApprovedOrgScope("DESCENDANTS"); p.setIncludeChildOrgs(true);
|
assertTrue(matcher.matchesPrincipal(p,subject));
|
p.setPrincipalId("parent"); p.setIncludeChildOrgs(false); p.setApprovedOrgScope("CHILDREN");
|
p.setSourceType("MANUAL"); assertFalse(matcher.matchesPrincipal(p,subject));
|
p.setPrincipalId("child"); assertTrue(matcher.matchesPrincipal(p,subject));
|
}
|
|
@Test
|
void folderSelfCoversDirectDocumentButNotChildFolder() {
|
DmsFilePermissionEntity permission = permission("FOLDER", root, "SELF", "USER", "u1", false);
|
DmsSubjectSet subjects = user("u1");
|
|
assertTrue(matcher.matches(permission, documentPath(root), subjects));
|
assertFalse(matcher.matches(permission, folderPath(child, root), subjects));
|
}
|
|
@Test
|
void folderSubtreeCoversDescendantVersion() {
|
DmsFilePermissionEntity permission = permission("FOLDER", root, "SUBTREE", "USER", "u1", false);
|
assertTrue(matcher.matches(permission, versionPath(child, root), user("u1")));
|
}
|
|
@Test
|
void documentSelfCoversAllItsVersions() {
|
DmsFilePermissionEntity permission = permission("DOCUMENT", document, "SELF", "USER", "u1", false);
|
assertTrue(matcher.matches(permission, versionPath(child, root), user("u1")));
|
}
|
|
@Test
|
void fileVersionDoesNotCoverAnotherVersion() {
|
DmsFilePermissionEntity permission = permission("FILE_VERSION", version, "SELF", "USER", "u1", false);
|
DmsResourcePath other = versionPath(child, root);
|
other.setActualResourceId(UUID.randomUUID());
|
assertFalse(matcher.matches(permission, other, user("u1")));
|
}
|
|
@Test
|
void childOrganizationRequiresIncludeChildOrgs() {
|
DmsSubjectSet subjects = user("u1");
|
subjects.getDirectOrgIds().add("child-org");
|
subjects.getAncestorOrgIds().addAll(Arrays.asList("child-org", "root-org"));
|
DmsFilePermissionEntity directOnly = permission("DOCUMENT", document, "SELF", "ORG", "root-org", false);
|
DmsFilePermissionEntity descendants = permission("DOCUMENT", document, "SELF", "ORG", "root-org", true);
|
|
assertFalse(matcher.matches(directOnly, documentPath(child), subjects));
|
assertTrue(matcher.matches(descendants, documentPath(child), subjects));
|
}
|
|
@Test
|
void dmsGroupUsesResolvedPermissionGroupsOnly() {
|
DmsSubjectSet subjects = user("u1");
|
subjects.getPlatformGroupIds().add("g1");
|
DmsFilePermissionEntity permission = permission("DOCUMENT", document, "SELF", "GROUP", "g1", false);
|
|
assertFalse(matcher.matches(permission, documentPath(child), subjects));
|
subjects.getPermissionGroupIds().add("g1");
|
assertTrue(matcher.matches(permission, documentPath(child), subjects));
|
}
|
|
private DmsFilePermissionEntity permission(String type, UUID resourceId, String scope,
|
String principalType, String principalId, boolean childOrgs) {
|
DmsFilePermissionEntity result = new DmsFilePermissionEntity();
|
result.setResourceType(type);
|
result.setResourceId(resourceId);
|
result.setResourceScope(scope);
|
result.setPrincipalType(principalType);
|
result.setPrincipalId(principalId);
|
result.setIncludeChildOrgs(childOrgs);
|
return result;
|
}
|
|
private DmsSubjectSet user(String id) {
|
DmsSubjectSet result = new DmsSubjectSet();
|
result.setUserId(id);
|
return result;
|
}
|
|
private DmsResourcePath folderPath(UUID actual, UUID... ancestors) {
|
DmsResourcePath result = new DmsResourcePath();
|
result.setActualResourceType("FOLDER");
|
result.setActualResourceId(actual);
|
result.setDirectFolderId(actual);
|
result.getFolderPath().add(actual);
|
result.getFolderPath().addAll(Arrays.asList(ancestors));
|
return result;
|
}
|
|
private DmsResourcePath documentPath(UUID folder) {
|
DmsResourcePath result = new DmsResourcePath();
|
result.setActualResourceType("DOCUMENT");
|
result.setActualResourceId(document);
|
result.setDocumentId(document);
|
result.setDirectFolderId(folder);
|
result.getFolderPath().add(folder);
|
return result;
|
}
|
|
private DmsResourcePath versionPath(UUID folder, UUID... ancestors) {
|
DmsResourcePath result = new DmsResourcePath();
|
result.setActualResourceType("FILE_VERSION");
|
result.setActualResourceId(version);
|
result.setDocumentId(document);
|
result.setDirectFolderId(folder);
|
result.getFolderPath().add(folder);
|
result.getFolderPath().addAll(Arrays.asList(ancestors));
|
return result;
|
}
|
}
|
