package jnpf.flowable.util;
|
|
import jnpf.flowable.model.filepermission.FilePermissionPolicy;
|
import jnpf.flowable.model.filepermission.FilePermissionPolicy.*;
|
import jnpf.flowable.util.filepermission.FileAttachmentChanges;
|
import jnpf.flowable.util.filepermission.FilePermissionEvaluator;
|
import java.util.*;
|
|
/** 与本模块现有 Checks 一致，可使用 JDK21 编译运行，不启动数据库或流程引擎。 */
|
public class FilePermissionChecks {
|
private static int checks;
|
public static void main(String[] args) {
|
Map<Action, Boolean> upper = new EnumMap<>(Action.class);
|
for (Action action : Action.values()) upper.put(action, true);
|
Map<String, Object> deny = rule("deny", "DENY");
|
Map<String, Object> allow = rule("allow", "ALLOW");
|
List<Rule> rules = parse(Arrays.asList(allow, deny));
|
FilePermissionPolicy.validateReferences(rules, Collections.singletonMap("form", Set.of("rows-files")), Set.of("node"));
|
check(!evaluate(upper, upper, rules).actions.get(Action.DOWNLOAD), "deny overrides allow");
|
check("RULE:deny".equals(evaluate(upper, upper, rules).reasons.get(Action.DOWNLOAD)), "rule reason");
|
check(evaluate(upper, upper, rules).actions.get(Action.EDIT), "independent edit");
|
Collections.reverse(rules = new ArrayList<>(rules));
|
check(!evaluate(upper, upper, rules).actions.get(Action.DOWNLOAD), "order independent");
|
check(evaluate(upper, upper, Collections.emptyList()).actions.get(Action.DOWNLOAD), "inherit");
|
check(evaluate(upper, Collections.emptyMap(), parse(List.of(allow))).actions.get(Action.DOWNLOAD), "explicit allow");
|
check(!evaluate(Collections.emptyMap(), upper, parse(List.of(allow))).actions.get(Action.DOWNLOAD), "native upper bound");
|
check(FilePermissionEvaluator.evaluate("other", "rows-files", 8, false, upper, upper, rules).actions.get(Action.DOWNLOAD), "form isolation");
|
check(FilePermissionEvaluator.evaluate("form", "files", 8, false, upper, upper, rules).actions.get(Action.DOWNLOAD), "child field isolation");
|
FilePermissionEvaluator.Result transitioning = FilePermissionEvaluator.evaluate("form", "rows-files", 9, true, upper, upper, rules);
|
check(transitioning.version == 9 && transitioning.actions.values().stream().noneMatch(Boolean.TRUE::equals), "transition closes all actions");
|
check(FilePermissionPolicy.parse(null).isEmpty(), "old config");
|
rejects(() -> FilePermissionPolicy.parse(Map.of("version", 2, "rules", List.of())), "unknown version");
|
rejects(() -> FilePermissionPolicy.parse(Map.of("version", 1.5, "rules", List.of())), "fractional version");
|
rejects(() -> parse(List.of(deny, deny)), "duplicate id");
|
Map<String, Object> persistent = rule("persist", "DENY"); persistent.put("trigger", "ENTERED");
|
rejects(() -> parse(List.of(persistent)), "explicit return behavior required");
|
persistent.put("onReturn", "KEEP"); check(parse(List.of(persistent)).get(0).onReturn == OnReturn.KEEP, "persistent behavior");
|
rejects(() -> FilePermissionPolicy.parseActions(Map.of("DOWNLAOD", "ALLOW")), "unknown action");
|
rejects(() -> FilePermissionPolicy.parseActions(Map.of("DOWNLOAD", true)), "boolean not an effect");
|
rejects(() -> FilePermissionPolicy.validateReferences(parse(List.of(deny)), Map.of(), Set.of("node")), "removed field");
|
rejects(() -> FilePermissionPolicy.validateReferences(parse(List.of(deny)), Map.of("form", Set.of("rows-files")), Set.of()), "removed node");
|
check(FileAttachmentChanges.classify(List.of("a", "b"), List.of("b", "a")).isEmpty(), "reorder is not removal");
|
check(FileAttachmentChanges.classify(List.of(), List.of("a")).equals(Set.of(Action.ADD)), "add");
|
check(FileAttachmentChanges.classify(List.of("a"), List.of()).equals(Set.of(Action.REMOVE)), "whole child row removal");
|
check(FileAttachmentChanges.classify(List.of("a"), List.of("b")).equals(Set.of(Action.REPLACE)), "replace");
|
check(FileAttachmentChanges.classify(List.of("a"), List.of("b", "c")).equals(Set.of(Action.REPLACE, Action.ADD)), "replace and add");
|
check(FileAttachmentChanges.classify(List.of("a", "b"), List.of("c")).equals(Set.of(Action.REPLACE, Action.REMOVE)), "replace and remove");
|
rejects(() -> FileAttachmentChanges.classify(List.of("a"), List.of("b", "b")), "duplicate reference");
|
rejects(() -> FileAttachmentChanges.requireAllowed(List.of("a"), List.of("b"), Map.of(Action.EDIT, true)), "editing cannot forge replacement");
|
System.out.println("FilePermissionChecks: " + checks + " passed");
|
}
|
private static FilePermissionEvaluator.Result evaluate(Map<Action, Boolean> upper, Map<Action, Boolean> inherited, List<Rule> rules) {
|
return FilePermissionEvaluator.evaluate("form", "rows-files", 8, false, upper, inherited, rules);
|
}
|
private static List<Rule> parse(List<Map<String, Object>> rules) {
|
return FilePermissionPolicy.parse(Map.of("version", 1, "rules", rules));
|
}
|
private static Map<String, Object> rule(String id, String effect) {
|
Map<String, Object> rule = new HashMap<>();
|
rule.put("id", id); rule.put("formId", "form"); rule.put("field", "rows-files");
|
rule.put("subject", "PARTICIPANTS"); rule.put("trigger", "ACTIVE"); rule.put("triggerNodeId", "node");
|
rule.put("actions", Map.of("DOWNLOAD", effect)); return rule;
|
}
|
private static void check(boolean value, String label) {
|
if (!value) throw new AssertionError(label); checks++;
|
}
|
private static void rejects(Runnable action, String label) {
|
try { action.run(); } catch (IllegalArgumentException expected) { checks++; return; }
|
throw new AssertionError(label);
|
}
|
}
|
