Skip to content

Commit e2a72d1

Browse files
ssddanbrownssddanbrown
committed
Made adjustments to fit copied work into dev branch
Ported non-compatible elements, Now all tests passing apart from some specific permission scenario tests which are probably correctly failing. Updates some tests to better avoid messing environment state.
1 parent c724bfe commit e2a72d1

File tree

8 files changed

+31
-413
lines changed

8 files changed

+31
-413
lines changed

‎dev/docs/permission-scenario-testing.md‎

Lines changed: 1 addition & 182 deletions
Original file line numberDiff line numberDiff line change
@@ -6,19 +6,16 @@ Test cases are written ability abstract, since all abilities should act the same
66

77
Tests are categorised by the most specific element involved in the scenario, where the below list is most specific to least:
88

9-
- User entity permissions.
109
- Role entity permissions.
1110
- Fallback entity permissions.
1211
- Role permissions.
1312

14-
- TODO - Test fallback in the context of the above.
15-
1613
## General Permission Logical Rules
1714

1815
The below are some general rules we follow to standardise the behaviour of permissions in the platform:
1916

2017
- Most specific permission application (as above) take priority and can deny less specific permissions.
21-
- Parent user/role entity permissions that may be inherited, are considered to essentially be applied on the item they are inherited to unless a lower level has its own permission rule for an already specific role/user.
18+
- Parent role entity permissions that may be inherited, are considered to essentially be applied on the item they are inherited to unless a lower level has its own permission rule for an already specific role.
2219
- Where both grant and deny exist at the same specificity, we side towards grant.
2320

2421
## Cases
@@ -241,181 +238,3 @@ User denied page permission.
241238
- User has Role A & B.
242239

243240
User denied page permission.
244-
245-
---
246-
247-
### Entity User Permissions
248-
249-
These are tests related to entity-level user-specific permission overrides.
250-
251-
#### test_01_explicit_allow
252-
253-
- Page permissions have inherit disabled.
254-
- User has entity allow page permission.
255-
256-
User granted page permission.
257-
258-
#### test_02_explicit_deny
259-
260-
- Page permissions have inherit disabled.
261-
- User has entity deny page permission.
262-
263-
User denied page permission.
264-
265-
#### test_10_allow_inherit
266-
267-
- Page permissions have inherit enabled.
268-
- Chapter permissions have inherit disabled.
269-
- User has entity allow chapter permission.
270-
271-
User granted page permission.
272-
273-
#### test_11_deny_inherit
274-
275-
- Page permissions have inherit enabled.
276-
- Chapter permissions have inherit disabled.
277-
- User has entity deny chapter permission.
278-
279-
User denied page permission.
280-
281-
#### test_12_allow_inherit_override
282-
283-
- Page permissions have inherit enabled.
284-
- Chapter permissions have inherit disabled.
285-
- User has entity deny chapter permission.
286-
- User has entity allow page permission.
287-
288-
User granted page permission.
289-
290-
#### test_13_deny_inherit_override
291-
292-
- Page permissions have inherit enabled.
293-
- Chapter permissions have inherit disabled.
294-
- User has entity allow chapter permission.
295-
- User has entity deny page permission.
296-
297-
User denied page permission.
298-
299-
#### test_40_entity_role_override_allow
300-
301-
- Page permissions have inherit disabled.
302-
- User has entity allow page permission.
303-
- Role A has entity deny page permission.
304-
- User has role A.
305-
306-
User granted page permission.
307-
308-
#### test_41_entity_role_override_deny
309-
310-
- Page permissions have inherit disabled.
311-
- User has entity deny page permission.
312-
- Role A has entity allow page permission.
313-
- User has role A.
314-
315-
User denied page permission.
316-
317-
#### test_42_entity_role_override_allow_via_inherit
318-
319-
- Page permissions have inherit enabled.
320-
- Chapter permissions have inherit disabled.
321-
- User has entity allow chapter permission.
322-
- Role A has entity deny page permission.
323-
- User has role A.
324-
325-
User granted page permission.
326-
327-
#### test_43_entity_role_override_deny_via_inherit
328-
329-
- Page permissions have inherit enabled.
330-
- Chapter permissions have inherit disabled.
331-
- User has entity deny chapter permission.
332-
- Role A has entity allow page permission.
333-
- User has role A.
334-
335-
User denied page permission.
336-
337-
#### test_50_role_override_allow
338-
339-
- Page permissions have inherit enabled.
340-
- Role A has no page role permission.
341-
- User has entity allow page permission.
342-
- User has Role A.
343-
344-
User granted page permission.
345-
346-
#### test_51_role_override_deny
347-
348-
- Page permissions have inherit enabled.
349-
- Role A has all-page role permission.
350-
- User has entity deny page permission.
351-
- User has Role A.
352-
353-
User denied page permission.
354-
355-
#### test_60_inherited_role_override_allow
356-
357-
- Page permissions have inherit enabled.
358-
- Role A has no page role permission.
359-
- User has entity allow chapter permission.
360-
- User has Role A.
361-
362-
User granted page permission.
363-
364-
#### test_61_inherited_role_override_deny
365-
366-
- Page permissions have inherit enabled.
367-
- Role A has view-all page role permission.
368-
- User has entity deny chapter permission.
369-
- User has Role A.
370-
371-
User denied page permission.
372-
373-
#### test_61_inherited_role_override_deny_on_own
374-
375-
- Page permissions have inherit enabled.
376-
- Role A has view-own page role permission.
377-
- User has entity deny chapter permission.
378-
- User has Role A.
379-
- User owns Page.
380-
381-
User denied page permission.
382-
383-
#### test_70_all_override_allow
384-
385-
- Page permissions have inherit enabled.
386-
- Role A has no page role permission.
387-
- Role A has entity deny page permission.
388-
- User has entity allow page permission.
389-
- User has Role A.
390-
391-
User granted page permission.
392-
393-
#### test_71_all_override_deny
394-
395-
- Page permissions have inherit enabled.
396-
- Role A has page-all role permission.
397-
- Role A has entity allow page permission.
398-
- User has entity deny page permission.
399-
- User has Role A.
400-
401-
User denied page permission.
402-
403-
#### test_80_inherited_all_override_allow
404-
405-
- Page permissions have inherit enabled.
406-
- Role A has no page role permission.
407-
- Role A has entity deny chapter permission.
408-
- User has entity allow chapter permission.
409-
- User has Role A.
410-
411-
User granted page permission.
412-
413-
#### test_81_inherited_all_override_deny
414-
415-
- Page permissions have inherit enabled.
416-
- Role A has view-all page role permission.
417-
- Role A has entity allow chapter permission.
418-
- User has entity deny chapter permission.
419-
- User has Role A.
420-
421-
User denied page permission.

‎tests/Commands/RegeneratePermissionsCommandTest.php‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33
namespace Tests\Commands;
44

55
use BookStack\Auth\Permissions\CollapsedPermission;
6+
use BookStack\Auth\Permissions\EntityPermission;
7+
use BookStack\Auth\Permissions\JointPermission;
68
use Illuminate\Support\Facades\Artisan;
79
use Illuminate\Support\Facades\DB;
810
use Tests\TestCase;
@@ -14,21 +16,25 @@ public function test_regen_permissions_command()
1416
DB::rollBack();
1517
$page = $this->entities->page();
1618
$editor = $this->users->editor();
17-
$this->permissions->addEntityPermission($page, ['view'], null, $editor);
18-
CollapsedPermission::query()->truncate();
19+
$role = $editor->roles()->first();
20+
$this->permissions->addEntityPermission($page, ['view'], $role);
21+
JointPermission::query()->truncate();
1922

20-
$this->assertDatabaseMissing('entity_permissions_collapsed', ['entity_id' => $page->id]);
23+
$this->assertDatabaseMissing('joint_permissions', ['entity_id' => $page->id]);
2124

2225
$exitCode = Artisan::call('bookstack:regenerate-permissions');
2326
$this->assertTrue($exitCode === 0, 'Command executed successfully');
2427

25-
$this->assertDatabaseHas('entity_permissions_collapsed', [
28+
$this->assertDatabaseHas('joint_permissions', [
2629
'entity_id' => $page->id,
27-
'user_id' => $editor->id,
28-
'view' => 1,
30+
'entity_type' => 'page',
31+
'role_id' => $role->id,
32+
'has_permission' => 1,
2933
]);
3034

31-
CollapsedPermission::query()->truncate();
35+
$page->permissions()->delete();
36+
$page->rebuildPermissions();
37+
3238
DB::beginTransaction();
3339
}
3440
}

‎tests/Entity/BookShelfTest.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ public function test_shelves_shows_in_header_if_have_view_permissions()
2121
$this->withHtml($resp)->assertElementContains('header', 'Shelves');
2222

2323
$viewer->roles()->delete();
24+
$this->permissions->grantUserRolePermissions($viewer, []);
2425
$resp = $this->actingAs($viewer)->get('/');
2526
$this->withHtml($resp)->assertElementNotContains('header', 'Shelves');
2627

‎tests/Helpers/PermissionsProvider.php‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ public function setEntityPermissions(Entity $entity, array $actions = [], array
8585

8686
if (!$inherit) {
8787
// Set default permissions to not allow actions so that only the provided role permissions are at play.
88-
$permissions[] = ['role_id' => null, 'user_id' => null, 'view' => false, 'create' => false, 'update' => false, 'delete' => false];
88+
$permissions[] = ['role_id' => 0, 'view' => false, 'create' => false, 'update' => false, 'delete' => false];
8989
}
9090

9191
foreach ($roles as $role) {
@@ -95,9 +95,9 @@ public function setEntityPermissions(Entity $entity, array $actions = [], array
9595
$this->addEntityPermissionEntries($entity, $permissions);
9696
}
9797

98-
public function addEntityPermission(Entity $entity, array $actionList, ?Role $role = null, ?User $user = null)
98+
public function addEntityPermission(Entity $entity, array $actionList, Role $role)
9999
{
100-
$permissionData = $this->actionListToEntityPermissionData($actionList, $role->id ?? null, $user->id ?? null);
100+
$permissionData = $this->actionListToEntityPermissionData($actionList, $role->id);
101101
$this->addEntityPermissionEntries($entity, [$permissionData]);
102102
}
103103

@@ -107,7 +107,7 @@ public function addEntityPermission(Entity $entity, array $actionList, ?Role $ro
107107
*/
108108
public function disableEntityInheritedPermissions(Entity $entity): void
109109
{
110-
$entity->permissions()->whereNull(['user_id', 'role_id'])->delete();
110+
$entity->permissions()->where('role_id', '=', 0)->delete();
111111
$fallback = $this->actionListToEntityPermissionData([]);
112112
$this->addEntityPermissionEntries($entity, [$fallback]);
113113
}
@@ -124,9 +124,9 @@ protected function addEntityPermissionEntries(Entity $entity, array $entityPermi
124124
* the format to entity permission data, where permission is granted if the action is in the
125125
* given actionList array.
126126
*/
127-
protected function actionListToEntityPermissionData(array $actionList, int $roleId = null, int $userId = null): array
127+
protected function actionListToEntityPermissionData(array $actionList, int $roleId = 0): array
128128
{
129-
$permissionData = ['role_id' => $roleId, 'user_id' => $userId];
129+
$permissionData = ['role_id' => $roleId];
130130
foreach (EntityPermission::PERMISSIONS as $possibleAction) {
131131
$permissionData[$possibleAction] = in_array($possibleAction, $actionList);
132132
}

‎tests/Permissions/EntityPermissionsTest.php‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -379,19 +379,17 @@ protected function entityRestrictionFormTest(string $model, string $title, strin
379379

380380
$this->put($modelInstance->getUrl('/permissions'), [
381381
'permissions' => [
382-
'role' => [
383-
$roleId => [
384-
$permission => 'true',
385-
],
382+
$roleId => [
383+
$permission => 'true',
386384
],
387385
],
388386
]);
389387

390388
$this->assertDatabaseHas('entity_permissions', [
391-
'entity_id' => $modelInstance->id,
392-
'entity_type' => $modelInstance->getMorphClass(),
393-
'role_id' => $roleId,
394-
$permission => true,
389+
'entity_id' => $modelInstance->id,
390+
'entity_type' => $modelInstance->getMorphClass(),
391+
'role_id' => $roleId,
392+
$permission => true,
395393
]);
396394
}
397395

0 commit comments

Comments
 (0)