1
|
|
|
<?php |
2
|
|
|
|
3
|
|
|
namespace src\Kami\ApiCoreBundle\Security; |
4
|
|
|
|
5
|
|
|
use Doctrine\Common\Annotations\AnnotationReader; |
6
|
|
|
use Doctrine\Common\Annotations\Reader; |
7
|
|
|
use JMS\Serializer\Metadata\PropertyMetadata; |
8
|
|
|
use Kami\ApiCoreBundle\Annotation\Access; |
9
|
|
|
use Kami\ApiCoreBundle\Annotation\AnonymousAccess; |
10
|
|
|
use Kami\ApiCoreBundle\Annotation\AnonymousCreate; |
11
|
|
|
use Kami\ApiCoreBundle\Annotation\AnonymousDelete; |
12
|
|
|
use Kami\ApiCoreBundle\Annotation\AnonymousUpdate; |
13
|
|
|
use Kami\ApiCoreBundle\Annotation\CanBeCreatedBy; |
14
|
|
|
use Kami\ApiCoreBundle\Annotation\CanBeDeletedBy; |
15
|
|
|
use Kami\ApiCoreBundle\Annotation\CanBeUpdatedBy; |
16
|
|
|
use Kami\ApiCoreBundle\Security\AccessManager; |
17
|
|
|
use Symfony\Bundle\FrameworkBundle\Test\WebTestCase; |
18
|
|
|
use Symfony\Component\Security\Core\Authentication\Token\AnonymousToken; |
19
|
|
|
use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorage; |
20
|
|
|
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface; |
21
|
|
|
use Symfony\Component\Security\Core\User\UserInterface; |
22
|
|
|
|
23
|
|
|
class AccessManagerTest extends WebTestCase |
24
|
|
|
{ |
25
|
|
|
// can be constructed with necessary params |
26
|
|
|
|
27
|
|
|
public function testCanBeConstructedWithNecessaryParams() |
28
|
|
|
{ |
29
|
|
|
$userMock = $this->mock(UserInterface::class, 'getRoles', ['ROLE_USER', 'ROLE_ADMIN']); |
30
|
|
|
$tokenMock = $this->mock(AnonymousToken::class, 'getUser', $userMock); |
31
|
|
|
$tokenStorageMock = $this->mock(TokenStorage::class, 'getToken', $tokenMock); |
32
|
|
|
|
33
|
|
|
$accessManager = new AccessManager( |
34
|
|
|
$tokenStorageMock, $this->mock(AnnotationReader::class) |
35
|
|
|
); |
36
|
|
|
$this->assertInstanceOf(AccessManager::class, $accessManager); |
37
|
|
|
} |
38
|
|
|
|
39
|
|
|
// canAccessResource |
40
|
|
|
|
41
|
|
|
public function testCanAccessResourceAnonymousAccess() |
42
|
|
|
{ |
43
|
|
|
$tokenMock = $this->mock(AnonymousToken::class); |
44
|
|
|
|
45
|
|
|
$tokenStorageMock = $this->mock(TokenStorage::class, 'getToken', $tokenMock); |
46
|
|
|
|
47
|
|
|
$reflection = $this->mock(\ReflectionClass::class); |
48
|
|
|
|
49
|
|
|
$annReader = $this->mock(AnnotationReader::class, 'getClassAnnotation', [new AnonymousAccess()]); |
50
|
|
|
|
51
|
|
|
$accessManager = new AccessManager($tokenStorageMock, $annReader); |
52
|
|
|
$this->assertTrue($accessManager->canAccessResource($reflection)); |
53
|
|
|
} |
54
|
|
|
public function testCanAccessResourceWithUserInterfaceCurrentRole() |
55
|
|
|
{ |
56
|
|
|
$userMock = $this->mock(UserInterface::class, 'getRoles', ['ROLE_USER', 'ROLE_ADMIN']); |
57
|
|
|
$tokenMock = $this->mock(AnonymousToken::class, 'getUser', $userMock); |
58
|
|
|
$tokenStorageMock = $this->mock(TokenStorage::class, 'getToken', $tokenMock); |
59
|
|
|
$reflection = $this->mock(\ReflectionClass::class); |
60
|
|
|
|
61
|
|
|
$access = new Access(); |
62
|
|
|
$access->roles = ['ROLE_USER']; |
63
|
|
|
$annReader = $this->createMock(AnnotationReader::class); |
64
|
|
|
$annReader->expects($this->at(0)) |
65
|
|
|
->method('getClassAnnotation') |
66
|
|
|
->willReturn(null); |
67
|
|
|
$annReader->expects($this->at(1)) |
68
|
|
|
->method('getClassAnnotation') |
69
|
|
|
->willReturn($access); |
70
|
|
|
|
71
|
|
|
$accessManager = new AccessManager($tokenStorageMock, $annReader); |
72
|
|
|
$this->assertTrue($accessManager->canAccessResource($reflection)); |
73
|
|
|
} |
74
|
|
|
public function testCanAccessResourceWithUserInterfaceNotCurrentRole() |
75
|
|
|
{ |
76
|
|
|
$userMock = $this->mock(UserInterface::class, 'getRoles', ['ROLE_USER']); |
77
|
|
|
$tokenMock = $this->mock(AnonymousToken::class, 'getUser', $userMock); |
78
|
|
|
$tokenStorageMock = $this->mock(TokenStorage::class, 'getToken', $tokenMock); |
79
|
|
|
$reflection = $this->mock(\ReflectionClass::class); |
80
|
|
|
|
81
|
|
|
$access = new Access(); |
82
|
|
|
$access->roles = ['ROLE_ADMIN']; |
83
|
|
|
|
84
|
|
|
$annReader = $this->createMock(AnnotationReader::class); |
85
|
|
|
$annReader->expects($this->at(0)) |
86
|
|
|
->method('getClassAnnotation') |
87
|
|
|
->willReturn(null); |
88
|
|
|
$annReader->expects($this->at(1)) |
89
|
|
|
->method('getClassAnnotation') |
90
|
|
|
->willReturn($access); |
91
|
|
|
|
92
|
|
|
$accessManager = new AccessManager($tokenStorageMock, $annReader); |
93
|
|
|
$this->assertFalse($accessManager->canAccessResource($reflection)); |
94
|
|
|
} |
95
|
|
|
public function testCanAccessResourceWithoutUserInterface() |
96
|
|
|
{ |
97
|
|
|
$token = $this->mock(AnonymousToken::class, 'getUser', null); |
98
|
|
|
$tokenStorage = $this->mock(TokenStorage::class, 'getToken', $token); |
99
|
|
|
$reflection = $this->mock(\ReflectionClass::class); |
100
|
|
|
|
101
|
|
|
$access = new Access(); |
102
|
|
|
$access->roles = ['ROLE_ADMIN']; |
103
|
|
|
$reader = $this->createMock(AnnotationReader::class); |
104
|
|
|
$reader->expects($this->at(0)) |
105
|
|
|
->method('getClassAnnotation') |
106
|
|
|
->willReturn(null); |
107
|
|
|
$reader->expects($this->at(1)) |
108
|
|
|
->method('getClassAnnotation') |
109
|
|
|
->willReturn($access); |
110
|
|
|
|
111
|
|
|
$accessManager = new AccessManager($tokenStorage, $reader); |
112
|
|
|
$this->assertFalse($accessManager->canAccessResource($reflection)); |
113
|
|
|
} |
114
|
|
|
public function testCanAccessResourceNotCurrentAccess() |
115
|
|
|
{ |
116
|
|
|
$userMock = $this->mock(UserInterface::class, 'getRoles', ['ROLE_USER']); |
117
|
|
|
$tokenMock = $this->mock(AnonymousToken::class, 'getUser', $userMock); |
118
|
|
|
$tokenStorageMock = $this->mock(TokenStorage::class, 'getToken', $tokenMock); |
119
|
|
|
|
120
|
|
|
$reflection = $this->mock(\ReflectionClass::class); |
121
|
|
|
|
122
|
|
|
$access = new Access(); |
123
|
|
|
$access->roles = ['ROLE_ADMIN']; |
124
|
|
|
$annReader = $this->createMock(AnnotationReader::class); |
125
|
|
|
$annReader->expects($this->at(0)) |
126
|
|
|
->method('getClassAnnotation') |
127
|
|
|
->willReturn(null); |
128
|
|
|
$annReader->expects($this->at(1)) |
129
|
|
|
->method('getClassAnnotation') |
130
|
|
|
->willReturn($access); |
131
|
|
|
|
132
|
|
|
$accessManager = new AccessManager($tokenStorageMock, $annReader); |
133
|
|
|
$this->assertFalse($accessManager->canAccessResource($reflection)); |
134
|
|
|
} |
135
|
|
|
|
136
|
|
|
|
137
|
|
|
// canCreateResource |
138
|
|
|
|
139
|
|
|
public function testCanCreateResourceAnonymous() |
140
|
|
|
{ |
141
|
|
|
$userMock = $this->mock(UserInterface::class, 'getRoles', ['ROLE_USER']); |
142
|
|
|
$tokenMock = $this->mock(AnonymousToken::class, 'getUser', $userMock); |
143
|
|
|
$tokenStorageMock = $this->mock(TokenStorage::class, 'getToken', $tokenMock); |
144
|
|
|
|
145
|
|
|
$reflection = $this->mock(\ReflectionClass::class); |
146
|
|
|
$annReader = $this->mock(Reader::class, 'getClassAnnotation', [new AnonymousCreate()], $reflection); |
147
|
|
|
|
148
|
|
|
$accessManager = new AccessManager($tokenStorageMock, $annReader); |
149
|
|
|
$this->assertTrue($accessManager->canCreateResource($reflection)); |
150
|
|
|
} |
151
|
|
|
public function testCanCreateResourceWithUserInterfaceCurrentRole() |
152
|
|
|
{ |
153
|
|
|
$userMock = $this->mock(UserInterface::class, 'getRoles', ['ROLE_USER']); |
154
|
|
|
$tokenMock = $this->mock(AnonymousToken::class, 'getUser', $userMock); |
155
|
|
|
$tokenStorageMock = $this->mock(TokenStorage::class, 'getToken', $tokenMock); |
156
|
|
|
|
157
|
|
|
$reflection = $this->mock(\ReflectionClass::class); |
158
|
|
|
|
159
|
|
|
$access = new CanBeCreatedBy(); |
160
|
|
|
$access->roles = ['ROLE_USER', 'ROLE_ADMIN']; |
161
|
|
|
$annReader = $this->createMock(AnnotationReader::class); |
162
|
|
|
$annReader->expects($this->at(0)) |
163
|
|
|
->method('getClassAnnotation') |
164
|
|
|
->willReturn(null); |
165
|
|
|
$annReader->expects($this->at(1)) |
166
|
|
|
->method('getClassAnnotation') |
167
|
|
|
->willReturn($access); |
168
|
|
|
|
169
|
|
|
$accessManager = new AccessManager($tokenStorageMock, $annReader); |
170
|
|
|
$this->assertTrue($accessManager->canCreateResource($reflection)); |
171
|
|
|
} |
172
|
|
|
public function testCanCreateResourceWithUserInterfaceNotCurrentRole() |
173
|
|
|
{ |
174
|
|
|
$userMock = $this->mock(UserInterface::class, 'getRoles', ['ROLE_USER']); |
175
|
|
|
$tokenMock = $this->mock(AnonymousToken::class, 'getUser', $userMock); |
176
|
|
|
$tokenStorageMock = $this->mock(TokenStorage::class, 'getToken', $tokenMock); |
177
|
|
|
|
178
|
|
|
$reflection = $this->mock(\ReflectionClass::class); |
179
|
|
|
|
180
|
|
|
$access = new CanBeCreatedBy(); |
181
|
|
|
$access->roles = ['ROLE_ADMIN']; |
182
|
|
|
$annReader = $this->createMock(AnnotationReader::class); |
183
|
|
|
$annReader->expects($this->at(0)) |
184
|
|
|
->method('getClassAnnotation') |
185
|
|
|
->willReturn(null); |
186
|
|
|
$annReader->expects($this->at(1)) |
187
|
|
|
->method('getClassAnnotation') |
188
|
|
|
->willReturn($access); |
189
|
|
|
|
190
|
|
|
$accessManager = new AccessManager($tokenStorageMock, $annReader); |
191
|
|
|
$this->assertFalse($accessManager->canCreateResource($reflection)); |
192
|
|
|
} |
193
|
|
|
public function testCanCreateResourceWithoutUserInterface() |
194
|
|
|
{ |
195
|
|
|
$tokenMock = $this->mock(AnonymousToken::class, 'getUser', null); |
196
|
|
|
|
197
|
|
|
$tokenStorageMock = $this->mock(TokenStorage::class, 'getToken', $tokenMock); |
198
|
|
|
|
199
|
|
|
$reflection = $this->mock(\ReflectionClass::class); |
200
|
|
|
|
201
|
|
|
$access = new CanBeCreatedBy(); |
202
|
|
|
$access->roles = ['ROLE_ADMIN']; |
203
|
|
|
$annReader = $this->createMock(AnnotationReader::class); |
204
|
|
|
$annReader->expects($this->at(0)) |
205
|
|
|
->method('getClassAnnotation') |
206
|
|
|
->willReturn(null); |
207
|
|
|
$annReader->expects($this->at(1)) |
208
|
|
|
->method('getClassAnnotation') |
209
|
|
|
->willReturn($access); |
210
|
|
|
|
211
|
|
|
$accessManager = new AccessManager($tokenStorageMock, $annReader); |
212
|
|
|
$this->assertFalse($accessManager->canCreateResource($reflection)); |
213
|
|
|
} |
214
|
|
|
public function testCanCreateResourceNotCurrentAccess() |
215
|
|
|
{ |
216
|
|
|
$userMock = $this->mock(UserInterface::class, 'getRoles', ['ROLE_USER']); |
217
|
|
|
$tokenMock = $this->mock(AnonymousToken::class, 'getUser', $userMock); |
218
|
|
|
$tokenStorageMock = $this->mock(TokenStorage::class, 'getToken', $tokenMock); |
219
|
|
|
$reflection = $this->mock(\ReflectionClass::class); |
220
|
|
|
|
221
|
|
|
$annReader = $this->mock(AnnotationReader::class, 'getClassAnnotation'); |
222
|
|
|
|
223
|
|
|
$accessManager = new AccessManager($tokenStorageMock, $annReader); |
224
|
|
|
$this->assertFalse($accessManager->canCreateResource($reflection)); |
225
|
|
|
} |
226
|
|
|
|
227
|
|
|
// canCreateProperty |
228
|
|
|
|
229
|
|
|
public function testCanCreatePropertyAnonymous() |
230
|
|
|
{ |
231
|
|
|
$userMock = $this->mock(UserInterface::class, 'getRoles', ['ROLE_USER']); |
232
|
|
|
$tokenMock = $this->mock(AnonymousToken::class, 'getUser', $userMock); |
233
|
|
|
$tokenStorageMock = $this->mock(TokenStorage::class, 'getToken', $tokenMock); |
234
|
|
|
|
235
|
|
|
$reflection = $this->mock(\ReflectionProperty::class); |
236
|
|
|
|
237
|
|
|
$annReader = $this->mock(Reader::class, 'getPropertyAnnotation', [new AnonymousCreate()]); |
238
|
|
|
|
239
|
|
|
$accessManager = new AccessManager($tokenStorageMock, $annReader); |
240
|
|
|
$this->assertTrue($accessManager->canCreateProperty($reflection)); |
241
|
|
|
} |
242
|
|
|
public function testCanCreatePropertyWithUserInterfaceCurrentRole() |
243
|
|
|
{ |
244
|
|
|
$userMock = $this->mock(UserInterface::class, 'getRoles', ['ROLE_ADMIN']); |
245
|
|
|
$tokenMock = $this->mock(TokenInterface::class, 'getUser', $userMock); |
246
|
|
|
$tokenStorageMock = $this->mock(TokenStorage::class, 'getToken', $tokenMock); |
247
|
|
|
|
248
|
|
|
$reflection = $this->mock(\ReflectionProperty::class); |
249
|
|
|
|
250
|
|
|
$access = new CanBeCreatedBy(); |
251
|
|
|
$access->roles = ['ROLE_USER', 'ROLE_ADMIN']; |
252
|
|
|
$annReader = $this->createMock(AnnotationReader::class); |
253
|
|
|
$annReader->expects($this->at(0)) |
254
|
|
|
->method('getPropertyAnnotation') |
255
|
|
|
->willReturn(null); |
256
|
|
|
$annReader->expects($this->at(1)) |
257
|
|
|
->method('getPropertyAnnotation') |
258
|
|
|
->willReturn($access); |
259
|
|
|
|
260
|
|
|
$accessManager = new AccessManager($tokenStorageMock, $annReader); |
261
|
|
|
$this->assertTrue($accessManager->canCreateProperty($reflection)); |
262
|
|
|
} |
263
|
|
|
public function testCanCreatePropertyWithUserInterfaceNotCurrentRole() |
264
|
|
|
{ |
265
|
|
|
$userMock = $this->mock(UserInterface::class, 'getRoles', ['ROLE_ADMIN']); |
266
|
|
|
$tokenMock = $this->mock(TokenInterface::class, 'getUser', $userMock); |
267
|
|
|
$tokenStorageMock = $this->mock(TokenStorage::class, 'getToken', $tokenMock); |
268
|
|
|
|
269
|
|
|
$reflection = $this->mock(\ReflectionProperty::class); |
270
|
|
|
|
271
|
|
|
$access = new CanBeCreatedBy(); |
272
|
|
|
$access->roles = ['ROLE_USER']; |
273
|
|
|
$annReader = $this->createMock(AnnotationReader::class); |
274
|
|
|
$annReader->expects($this->at(0)) |
275
|
|
|
->method('getPropertyAnnotation') |
276
|
|
|
->willReturn(null); |
277
|
|
|
$annReader->expects($this->at(1)) |
278
|
|
|
->method('getPropertyAnnotation') |
279
|
|
|
->willReturn($access); |
280
|
|
|
|
281
|
|
|
$accessManager = new AccessManager($tokenStorageMock, $annReader); |
282
|
|
|
$this->assertFalse($accessManager->canCreateProperty($reflection)); |
283
|
|
|
} |
284
|
|
|
public function testCanCreatePropertyNotCurrentAccess() |
285
|
|
|
{ |
286
|
|
|
$userMock = $this->mock(UserInterface::class, 'getRoles', ['ROLE_ADMIN']); |
287
|
|
|
$tokenMock = $this->mock(TokenInterface::class, 'getUser', $userMock); |
288
|
|
|
$tokenStorageMock = $this->mock(TokenStorage::class, 'getToken', $tokenMock); |
289
|
|
|
|
290
|
|
|
$reflection = $this->mock(\ReflectionProperty::class); |
291
|
|
|
|
292
|
|
|
$annReader = $this->mock(AnnotationReader::class, 'getPropertyAnnotation', null); |
293
|
|
|
|
294
|
|
|
$accessManager = new AccessManager($tokenStorageMock, $annReader); |
295
|
|
|
$this->assertFalse($accessManager->canCreateProperty($reflection)); |
296
|
|
|
} |
297
|
|
|
public function testCanCreatePropertyWithoutUserInterface() |
298
|
|
|
{ |
299
|
|
|
$tokenMock = $this->mock(AnonymousToken::class, 'getUser', null); |
300
|
|
|
$tokenStorageMock = $this->mock(TokenStorage::class, 'getToken', $tokenMock); |
301
|
|
|
$reflection = $this->mock(\ReflectionProperty::class); |
302
|
|
|
$annReader = $this->mock(AnnotationReader::class, 'getPropertyAnnotation', null); |
303
|
|
|
|
304
|
|
|
$accessManager = new AccessManager($tokenStorageMock, $annReader); |
305
|
|
|
$this->assertFalse($accessManager->canCreateProperty($reflection)); |
306
|
|
|
} |
307
|
|
|
|
308
|
|
|
|
309
|
|
|
// canUpdateResource |
310
|
|
|
|
311
|
|
|
public function testCanUpdateResourceAnonymous() |
312
|
|
|
{ |
313
|
|
|
$tokenMock = $this->mock(TokenInterface::class, 'getUser', null); |
314
|
|
|
$tokenStorageMock = $this->mock(TokenStorage::class, 'getToken', $tokenMock); |
315
|
|
|
|
316
|
|
|
$reflectionMock = $this->mock(\ReflectionClass::class); |
317
|
|
|
|
318
|
|
|
$annReader = $this->mock(Reader::class, 'getClassAnnotation', true); |
319
|
|
|
|
320
|
|
|
$accessManager = new AccessManager($tokenStorageMock, $annReader); |
321
|
|
|
$this->assertTrue($accessManager->canUpdateResource($reflectionMock)); |
322
|
|
|
} |
323
|
|
|
public function testCanUpdateResourceWithUserInterfaceCurrentRole() |
324
|
|
|
{ |
325
|
|
|
$userMock = $this->mock(UserInterface::class, 'getRoles', ['ROLE_USER']); |
326
|
|
|
$tokenMock = $this->mock(AnonymousToken::class, 'getUser', $userMock); |
327
|
|
|
$tokenStorageMock = $this->mock(TokenStorage::class, 'getToken', $tokenMock); |
328
|
|
|
|
329
|
|
|
$reflectionPropertyMock = $this->mock(\ReflectionClass::class); |
330
|
|
|
|
331
|
|
|
$access = new CanBeUpdatedBy(); |
332
|
|
|
$access->roles = ['ROLE_USER']; |
333
|
|
|
$annReader = $this->createMock(AnnotationReader::class); |
334
|
|
|
$annReader->expects($this->at(0)) |
335
|
|
|
->method('getClassAnnotation') |
336
|
|
|
->willReturn(null); |
337
|
|
|
$annReader->expects($this->at(1)) |
338
|
|
|
->method('getClassAnnotation') |
339
|
|
|
->willReturn($access); |
340
|
|
|
|
341
|
|
|
$accessManager = new AccessManager($tokenStorageMock, $annReader); |
342
|
|
|
$this->assertTrue($accessManager->canUpdateResource($reflectionPropertyMock)); |
343
|
|
|
} |
344
|
|
|
public function testCanUpdateResourceWithUserInterfaceNotCurrentRole() |
345
|
|
|
{ |
346
|
|
|
$userMock = $this->mock(UserInterface::class, 'getRoles', ['ROLE_USER']); |
347
|
|
|
$tokenMock = $this->mock(AnonymousToken::class, 'getUser', $userMock); |
348
|
|
|
$tokenStorageMock = $this->mock(TokenStorage::class, 'getToken', $tokenMock); |
349
|
|
|
|
350
|
|
|
$reflectionPropertyMock = $this->mock(\ReflectionClass::class); |
351
|
|
|
|
352
|
|
|
$access = new CanBeUpdatedBy(); |
353
|
|
|
$access->roles = ['ROLE_ADMIN']; |
354
|
|
|
$annReader = $this->createMock(AnnotationReader::class); |
355
|
|
|
$annReader->expects($this->at(0)) |
356
|
|
|
->method('getClassAnnotation') |
357
|
|
|
->willReturn(null); |
358
|
|
|
$annReader->expects($this->at(1)) |
359
|
|
|
->method('getClassAnnotation') |
360
|
|
|
->willReturn($access); |
361
|
|
|
|
362
|
|
|
$accessManager = new AccessManager($tokenStorageMock, $annReader); |
363
|
|
|
$this->assertFalse($accessManager->canUpdateResource($reflectionPropertyMock)); |
364
|
|
|
} |
365
|
|
|
public function testCanUpdateResourceWithoutUserInterface() |
366
|
|
|
{ |
367
|
|
|
$tokenMock = $this->mock(AnonymousToken::class, 'getUser', null); |
368
|
|
|
$tokenStorageMock = $this->mock(TokenStorage::class, 'getToken', $tokenMock); |
369
|
|
|
$reflectionPropertyMock = $this->mock(\ReflectionClass::class); |
370
|
|
|
|
371
|
|
|
$annReader = $this->mock(AnnotationReader::class, 'getClassAnnotation', null); |
372
|
|
|
|
373
|
|
|
$accessManager = new AccessManager($tokenStorageMock, $annReader); |
374
|
|
|
$this->assertFalse($accessManager->canUpdateResource($reflectionPropertyMock)); |
375
|
|
|
} |
376
|
|
|
public function testCanUpdateResourceNotCurrentAccess() |
377
|
|
|
{ |
378
|
|
|
$tokenMock = $this->mock(AnonymousToken::class, 'getUser', null); |
379
|
|
|
$tokenStorageMock = $this->mock(TokenStorage::class, 'getToken', $tokenMock); |
380
|
|
|
|
381
|
|
|
$reflectionPropertyMock = $this->mock(\ReflectionClass::class); |
382
|
|
|
|
383
|
|
|
$annReader = $this->mock(AnnotationReader::class, 'getClassAnnotation', null); |
384
|
|
|
|
385
|
|
|
$accessManager = new AccessManager($tokenStorageMock, $annReader); |
386
|
|
|
$this->assertFalse($accessManager->canUpdateResource($reflectionPropertyMock)); |
387
|
|
|
} |
388
|
|
|
|
389
|
|
|
// canUpdateProperty |
390
|
|
|
|
391
|
|
|
public function testCanUpdatePropertyAnonymous() |
392
|
|
|
{ |
393
|
|
|
$tokenMock = $this->mock(AnonymousToken::class, 'getUser', null); |
394
|
|
|
$tokenStorageMock = $this->mock(TokenStorage::class, 'getToken', $tokenMock); |
395
|
|
|
|
396
|
|
|
$reflectionPropertyMock = $this->mock(\ReflectionProperty::class); |
397
|
|
|
|
398
|
|
|
$annReader = $this->mock(Reader::class, 'getPropertyAnnotation', [new AnonymousUpdate()]); |
399
|
|
|
|
400
|
|
|
$accessManager = new AccessManager($tokenStorageMock, $annReader); |
401
|
|
|
$this->assertTrue($accessManager->canUpdateProperty($reflectionPropertyMock)); |
402
|
|
|
} |
403
|
|
|
public function testCanUpdatePropertyWithUserInterfaceCurrentRole() |
404
|
|
|
{ |
405
|
|
|
$userMock = $this->mock(UserInterface::class, 'getRoles', ['ROLE_USER']); |
406
|
|
|
$tokenMock = $this->mock(AnonymousToken::class, 'getUser', $userMock); |
407
|
|
|
$tokenStorageMock = $this->mock(TokenStorage::class, 'getToken', $tokenMock); |
408
|
|
|
|
409
|
|
|
$reflectionPropertyMock = $this->mock(\ReflectionProperty::class); |
410
|
|
|
|
411
|
|
|
$access = new CanBeUpdatedBy(); |
412
|
|
|
$access->roles = ['ROLE_USER']; |
413
|
|
|
$annReader = $this->createMock(AnnotationReader::class); |
414
|
|
|
$annReader->expects($this->at(0)) |
415
|
|
|
->method('getPropertyAnnotation') |
416
|
|
|
->willReturn(null); |
417
|
|
|
$annReader->expects($this->at(1)) |
418
|
|
|
->method('getPropertyAnnotation') |
419
|
|
|
->willReturn($access); |
420
|
|
|
|
421
|
|
|
$accessManager = new AccessManager($tokenStorageMock, $annReader); |
422
|
|
|
$this->assertTrue($accessManager->canUpdateProperty($reflectionPropertyMock)); |
423
|
|
|
} |
424
|
|
|
public function testCanUpdatePropertyWithUserInterfaceNotCurrentRole() |
425
|
|
|
{ |
426
|
|
|
$userMock = $this->mock(UserInterface::class, 'getRoles', ['ROLE_USER']); |
427
|
|
|
$tokenMock = $this->mock(AnonymousToken::class, 'getUser', $userMock); |
428
|
|
|
$tokenStorageMock = $this->mock(TokenStorage::class, 'getToken', $tokenMock); |
429
|
|
|
|
430
|
|
|
$reflectionPropertyMock = $this->mock(\ReflectionProperty::class); |
431
|
|
|
|
432
|
|
|
$access = new CanBeUpdatedBy(); |
433
|
|
|
$access->roles = ['ROLE_ADMIN']; |
434
|
|
|
$annReader = $this->createMock(AnnotationReader::class); |
435
|
|
|
$annReader->expects($this->at(0)) |
436
|
|
|
->method('getPropertyAnnotation') |
437
|
|
|
->willReturn(null); |
438
|
|
|
$annReader->expects($this->at(1)) |
439
|
|
|
->method('getPropertyAnnotation') |
440
|
|
|
->willReturn($access); |
441
|
|
|
|
442
|
|
|
$accessManager = new AccessManager($tokenStorageMock, $annReader); |
443
|
|
|
$this->assertFalse($accessManager->canUpdateProperty($reflectionPropertyMock)); |
444
|
|
|
} |
445
|
|
|
public function testCanUpdatePropertyWithoutUserInterface() |
446
|
|
|
{ |
447
|
|
|
$tokenMock = $this->mock(AnonymousToken::class, 'getUser', null); |
448
|
|
|
$tokenStorageMock = $this->mock(TokenStorage::class, 'getToken', $tokenMock); |
449
|
|
|
$reflectionPropertyMock = $this->mock(\ReflectionProperty::class); |
450
|
|
|
|
451
|
|
|
$annReader = $this->mock(AnnotationReader::class, 'getPropertyAnnotation', null); |
452
|
|
|
|
453
|
|
|
$accessManager = new AccessManager($tokenStorageMock, $annReader); |
454
|
|
|
$this->assertFalse($accessManager->canUpdateProperty($reflectionPropertyMock)); |
455
|
|
|
} |
456
|
|
|
public function testCanUpdatePropertyNotCurrentAccess() |
457
|
|
|
{ |
458
|
|
|
$userMock = $this->mock(UserInterface::class, 'getRoles', ['ROLE_USER']); |
459
|
|
|
$tokenMock = $this->mock(AnonymousToken::class, 'getUser', $userMock); |
460
|
|
|
$tokenStorageMock = $this->mock(TokenStorage::class, 'getToken', $tokenMock); |
461
|
|
|
$reflectionPropertyMock = $this->mock(\ReflectionProperty::class); |
462
|
|
|
|
463
|
|
|
$annReader = $this->mock(AnnotationReader::class, 'getPropertyAnnotation', null); |
464
|
|
|
|
465
|
|
|
$accessManager = new AccessManager($tokenStorageMock, $annReader); |
466
|
|
|
$this->assertFalse($accessManager->canUpdateProperty($reflectionPropertyMock)); |
467
|
|
|
} |
468
|
|
|
|
469
|
|
|
// canDeleteResource |
470
|
|
|
|
471
|
|
|
public function testCanDeleteResourceAnonymous() |
472
|
|
|
{ |
473
|
|
|
$userMock = $this->mock(UserInterface::class, 'getRoles', ['ROLE_USER']); |
474
|
|
|
$tokenMock = $this->mock(AnonymousToken::class, 'getUser', $userMock); |
475
|
|
|
$tokenStorageMock = $this->mock(TokenStorage::class, 'getToken', $tokenMock); |
476
|
|
|
|
477
|
|
|
$reflection = $this->mock(\ReflectionClass::class); |
478
|
|
|
|
479
|
|
|
$annReader = $this->mock(AnnotationReader::class, 'getClassAnnotation', new AnonymousDelete()); |
480
|
|
|
|
481
|
|
|
$accessManager = new AccessManager($tokenStorageMock, $annReader); |
482
|
|
|
$this->assertTrue($accessManager->canDeleteResource($reflection)); |
483
|
|
|
} |
484
|
|
|
|
485
|
|
|
public function testCanDeleteResourceWithUserInterfaceCurrentRole() |
486
|
|
|
{ |
487
|
|
|
$userMock = $this->mock(UserInterface::class, 'getRoles', ['ROLE_ADMIN']); |
488
|
|
|
$tokenMock = $this->mock(TokenInterface::class, 'getUser', $userMock); |
489
|
|
|
$tokenStorageMock = $this->mock(TokenStorage::class, 'getToken', $tokenMock); |
490
|
|
|
|
491
|
|
|
$reflection = $this->mock(\ReflectionClass::class); |
492
|
|
|
|
493
|
|
|
$access = new CanBeDeletedBy(); |
494
|
|
|
$access->roles = ['ROLE_ADMIN']; |
495
|
|
|
|
496
|
|
|
$annReader = $this->createMock(AnnotationReader::class); |
497
|
|
|
$annReader->expects($this->at(0)) |
498
|
|
|
->method('getClassAnnotation') |
499
|
|
|
->willReturn(null); |
500
|
|
|
$annReader->expects($this->at(1)) |
501
|
|
|
->method('getClassAnnotation') |
502
|
|
|
->willReturn($access); |
503
|
|
|
|
504
|
|
|
$accessManager = new AccessManager($tokenStorageMock, $annReader); |
505
|
|
|
$this->assertTrue($accessManager->canDeleteResource($reflection)); |
506
|
|
|
} |
507
|
|
|
|
508
|
|
|
public function testCanDeleteResourceWithUserInterfaceNotCurrentRole() |
509
|
|
|
{ |
510
|
|
|
$userMock = $this->mock(UserInterface::class, 'getRoles', ['ROLE_ADMIN']); |
511
|
|
|
$tokenMock = $this->mock(TokenInterface::class, 'getUser', $userMock); |
512
|
|
|
$tokenStorageMock = $this->mock(TokenStorage::class, 'getToken', $tokenMock); |
513
|
|
|
|
514
|
|
|
$reflection = $this->mock(\ReflectionClass::class); |
515
|
|
|
|
516
|
|
|
$access = new CanBeDeletedBy(); |
517
|
|
|
$access->roles = ['ROLE_USER']; |
518
|
|
|
$annReader = $this->createMock(AnnotationReader::class); |
519
|
|
|
$annReader->expects($this->at(0)) |
520
|
|
|
->method('getClassAnnotation') |
521
|
|
|
->willReturn(null); |
522
|
|
|
$annReader->expects($this->at(1)) |
523
|
|
|
->method('getClassAnnotation') |
524
|
|
|
->willReturn($access); |
525
|
|
|
|
526
|
|
|
$accessManager = new AccessManager($tokenStorageMock, $annReader); |
527
|
|
|
$this->assertFalse($accessManager->canDeleteResource($reflection)); |
528
|
|
|
} |
529
|
|
|
|
530
|
|
|
public function testCanDeleteResourceNotCurrentAccess() |
531
|
|
|
{ |
532
|
|
|
$userMock = $this->mock(UserInterface::class, 'getRoles', ['ROLE_ADMIN']); |
533
|
|
|
$tokenMock = $this->mock(TokenInterface::class, 'getUser', $userMock); |
534
|
|
|
$tokenStorageMock = $this->mock(TokenStorage::class, 'getToken', $tokenMock); |
535
|
|
|
|
536
|
|
|
$reflectionPropertyMock = $this->mock(\ReflectionClass::class); |
537
|
|
|
$annReader = $this->mock(AnnotationReader::class, 'getClassAnnotation', null); |
538
|
|
|
|
539
|
|
|
$accessManager = new AccessManager($tokenStorageMock, $annReader); |
540
|
|
|
$this->assertFalse($accessManager->canDeleteResource($reflectionPropertyMock)); |
541
|
|
|
} |
542
|
|
|
|
543
|
|
|
public function testCanDeleteResourceWithoutUserInterface() |
544
|
|
|
{ |
545
|
|
|
$tokenMock = $this->mock(AnonymousToken::class, 'getUser', null); |
546
|
|
|
$tokenStorageMock = $this->mock(TokenStorage::class, 'getToken', $tokenMock); |
547
|
|
|
|
548
|
|
|
$reflection = $this->mock(\ReflectionClass::class); |
549
|
|
|
|
550
|
|
|
$annReader = $this->mock(AnnotationReader::class, 'getClassAnnotation', null); |
551
|
|
|
|
552
|
|
|
$accessManager = new AccessManager($tokenStorageMock, $annReader); |
553
|
|
|
$this->assertFalse($accessManager->canDeleteResource($reflection)); |
554
|
|
|
} |
555
|
|
|
|
556
|
|
|
private function mock($class, $expectedMethod = null, $willReturn = null, $methodParameter = null) |
557
|
|
|
{ |
558
|
|
|
$mock = $this->createMock($class); |
559
|
|
|
|
560
|
|
|
if ($expectedMethod) { |
561
|
|
|
if ($methodParameter) { |
562
|
|
|
$mock->expects($this->any()) |
563
|
|
|
->method($expectedMethod) |
564
|
|
|
->with($methodParameter) |
565
|
|
|
->willReturn($willReturn); |
566
|
|
|
} else { |
567
|
|
|
$mock->expects($this->any()) |
568
|
|
|
->method($expectedMethod) |
569
|
|
|
->willReturn($willReturn); |
570
|
|
|
} |
571
|
|
|
} |
572
|
|
|
return $mock; |
573
|
|
|
} |
574
|
|
|
|
575
|
|
|
} |