InheritedPermissionsTest::testEditPermissions() - Code Metrics - Inspection of "I have no idea where to look for these errors. And..." - sminnee/silverstripe-framework - Measure and Improve Code Quality continuously with Scrutinizer

Completed

Push — authenticator-refactor ( 16f104...61b037 )

by Simon

created 2017-05-20 08:29 UTC

InheritedPermissionsTest::testEditPermissions() B

↳ Parent: InheritedPermissionsTest

Complexity

Conditions	1
Paths	1

Size

Total Lines	37
Code Lines	18

Duplication

Lines	37
Ratio	100 %

Importance

Changes

Metric	Value
cc	1
eloc	18
nc	1
nop	0
dl	37
loc	37
rs	8.8571
c	0
b	0
f	0

<?php

namespace SilverStripe\Security\Tests;

use SilverStripe\Core\Injector\Injector;
use SilverStripe\Dev\SapphireTest;
use SilverStripe\Security\Group;
use SilverStripe\Security\InheritedPermissions;
use SilverStripe\Security\Member;
use SilverStripe\Security\PermissionChecker;
use SilverStripe\Security\Test\InheritedPermissionsTest\TestPermissionNode;
use SilverStripe\Security\Test\InheritedPermissionsTest\TestDefaultPermissionChecker;
use SilverStripe\Versioned\Versioned;

class InheritedPermissionsTest extends SapphireTest
{
    protected static $fixture_file = 'InheritedPermissionsTest.yml';

    protected static $extra_dataobjects = [
        TestPermissionNode::class,
    ];

    /**
     * @var TestDefaultPermissionChecker
     */
    protected $rootPermissions = null;

    protected function setUp()
    {
        parent::setUp();

        // Register root permissions
        $permission = InheritedPermissions::create(TestPermissionNode::class)
            ->setGlobalEditPermissions(['TEST_NODE_ACCESS'])
            ->setDefaultPermissions($this->rootPermissions = new TestDefaultPermissionChecker());
        Injector::inst()->registerService(
interface User
{
    /** @return string */
    public function getPassword();
}

class MyUser implements User
{
    public function getPassword()
    {
        // return something
    }

    public function getDisplayName()
    {
        // return some name.
    }
}

class AuthSystem
{
    public function authenticate(User $user)
    {
        $this->logger->info(sprintf('Authenticating %s.', $user->getDisplayName()));
        // do something.
    }
}
            $permission,
            PermissionChecker::class.'.testpermissions'
        );

        // Reset root permission
    }

    public function testEditPermissions()

    {
        $editor = $this->objFromFixture(Member::class, 'editor');

        $about = $this->objFromFixture(TestPermissionNode::class, 'about');
        $aboutStaff = $this->objFromFixture(TestPermissionNode::class, 'about-staff');
        $history = $this->objFromFixture(TestPermissionNode::class, 'history');
        $products = $this->objFromFixture(TestPermissionNode::class, 'products');
        $product1 = $this->objFromFixture(TestPermissionNode::class, 'products-product1');
        $product4 = $this->objFromFixture(TestPermissionNode::class, 'products-product4');

        // Test logged out users cannot edit
        Member::actAs(null, function () use ($aboutStaff) {
            $this->assertFalse($aboutStaff->canEdit());
        });

        // Can't edit a page that is locked to admins
        $this->assertFalse($about->canEdit($editor));
/**
 * @return array|string
 */
function returnsDifferentValues($x) {
    if ($x) {
        return 'foo';
    }

    return array();
}

$x = returnsDifferentValues($y);
if (is_array($x)) {
    // $x is an array.
}

        // Can edit a page that is locked to editors
        $this->assertTrue($products->canEdit($editor));
/**
 * @return array|string
 */
function returnsDifferentValues($x) {
    if ($x) {
        return 'foo';
    }

    return array();
}

$x = returnsDifferentValues($y);
if (is_array($x)) {
    // $x is an array.
}

        // Can edit a child of that page that inherits
        $this->assertTrue($product1->canEdit($editor));
/**
 * @return array|string
 */
function returnsDifferentValues($x) {
    if ($x) {
        return 'foo';
    }

    return array();
}

$x = returnsDifferentValues($y);
if (is_array($x)) {
    // $x is an array.
}

        // Can't edit a child of that page that has its permissions overridden
        $this->assertFalse($product4->canEdit($editor));
/**
 * @return array|string
 */
function returnsDifferentValues($x) {
    if ($x) {
        return 'foo';
    }

    return array();
}

$x = returnsDifferentValues($y);
if (is_array($x)) {
    // $x is an array.
}

        // Test that root node respects root permissions
        $this->assertTrue($history->canEdit($editor));
/**
 * @return array|string
 */
function returnsDifferentValues($x) {
    if ($x) {
        return 'foo';
    }

    return array();
}

$x = returnsDifferentValues($y);
if (is_array($x)) {
    // $x is an array.
}

        TestPermissionNode::getInheritedPermissions()->clearCache();
        $this->rootPermissions->setCanEdit(false);

        // With root edit false, permissions are now denied for CanEditType = Inherit
        $this->assertFalse($history->canEdit($editor));
/**
 * @return array|string
 */
function returnsDifferentValues($x) {
    if ($x) {
        return 'foo';
    }

    return array();
}

$x = returnsDifferentValues($y);
if (is_array($x)) {
    // $x is an array.
}
    }

    public function testDeletePermissions()

    {
        $editor = $this->objFromFixture(Member::class, 'editor');

        $about = $this->objFromFixture(TestPermissionNode::class, 'about');
        $aboutStaff = $this->objFromFixture(TestPermissionNode::class, 'about-staff');
        $history = $this->objFromFixture(TestPermissionNode::class, 'history');
        $products = $this->objFromFixture(TestPermissionNode::class, 'products');
        $product1 = $this->objFromFixture(TestPermissionNode::class, 'products-product1');
        $product4 = $this->objFromFixture(TestPermissionNode::class, 'products-product4');

        // Test logged out users cannot edit
        Member::actAs(null, function () use ($aboutStaff) {
            $this->assertFalse($aboutStaff->canDelete());
        });

        // Can't edit a page that is locked to admins
        $this->assertFalse($about->canDelete($editor));
/**
 * @return array|string
 */
function returnsDifferentValues($x) {
    if ($x) {
        return 'foo';
    }

    return array();
}

$x = returnsDifferentValues($y);
if (is_array($x)) {
    // $x is an array.
}

        // Can't delete a page if a child (product4) is un-deletable
        $this->assertFalse($products->canDelete($editor));
/**
 * @return array|string
 */
function returnsDifferentValues($x) {
    if ($x) {
        return 'foo';
    }

    return array();
}

$x = returnsDifferentValues($y);
if (is_array($x)) {
    // $x is an array.
}

        // Can edit a child of that page that inherits
        $this->assertTrue($product1->canDelete($editor));
/**
 * @return array|string
 */
function returnsDifferentValues($x) {
    if ($x) {
        return 'foo';
    }

    return array();
}

$x = returnsDifferentValues($y);
if (is_array($x)) {
    // $x is an array.
}

        // Can't edit a child of that page that has its permissions overridden
        $this->assertFalse($product4->canDelete($editor));
/**
 * @return array|string
 */
function returnsDifferentValues($x) {
    if ($x) {
        return 'foo';
    }

    return array();
}

$x = returnsDifferentValues($y);
if (is_array($x)) {
    // $x is an array.
}

        // Test that root node respects root permissions
        $this->assertTrue($history->canDelete($editor));
/**
 * @return array|string
 */
function returnsDifferentValues($x) {
    if ($x) {
        return 'foo';
    }

    return array();
}

$x = returnsDifferentValues($y);
if (is_array($x)) {
    // $x is an array.
}

        TestPermissionNode::getInheritedPermissions()->clearCache();
        $this->rootPermissions->setCanEdit(false);

        // With root edit false, permissions are now denied for CanEditType = Inherit
        $this->assertFalse($history->canDelete($editor));
/**
 * @return array|string
 */
function returnsDifferentValues($x) {
    if ($x) {
        return 'foo';
    }

    return array();
}

$x = returnsDifferentValues($y);
if (is_array($x)) {
    // $x is an array.
}
    }

    public function testViewPermissions()
    {
        $history = $this->objFromFixture(TestPermissionNode::class, 'history');
        $contact = $this->objFromFixture(TestPermissionNode::class, 'contact');
        $contactForm = $this->objFromFixture(TestPermissionNode::class, 'contact-form');
        $secret = $this->objFromFixture(TestPermissionNode::class, 'secret');
        $secretNested = $this->objFromFixture(TestPermissionNode::class, 'secret-nested');
        $protected = $this->objFromFixture(TestPermissionNode::class, 'protected');
        $protectedChild = $this->objFromFixture(TestPermissionNode::class, 'protected-child');
        $editor = $this->objFromFixture(Member::class, 'editor');

        // Not logged in user can only access Inherit or Anyone pages
        Member::actAs(
            null,
            function () use ($protectedChild, $secretNested, $protected, $secret, $history, $contact, $contactForm) {
                $this->assertTrue($history->canView());
                $this->assertTrue($contact->canView());
                $this->assertTrue($contactForm->canView());
                // Protected
                $this->assertFalse($secret->canView());
                $this->assertFalse($secretNested->canView());
                $this->assertFalse($protected->canView());
                $this->assertFalse($protectedChild->canView());
            }
        );

        // Editor can view pages restricted to logged in users
        $this->assertTrue($secret->canView($editor));
/**
 * @return array|string
 */
function returnsDifferentValues($x) {
    if ($x) {
        return 'foo';
    }

    return array();
}

$x = returnsDifferentValues($y);
if (is_array($x)) {
    // $x is an array.
}
        $this->assertTrue($secretNested->canView($editor));
/**
 * @return array|string
 */
function returnsDifferentValues($x) {
    if ($x) {
        return 'foo';
    }

    return array();
}

$x = returnsDifferentValues($y);
if (is_array($x)) {
    // $x is an array.
}

        // Cannot read admin-only pages
        $this->assertFalse($protected->canView($editor));
/**
 * @return array|string
 */
function returnsDifferentValues($x) {
    if ($x) {
        return 'foo';
    }

    return array();
}

$x = returnsDifferentValues($y);
if (is_array($x)) {
    // $x is an array.
}
        $this->assertFalse($protectedChild->canView($editor));
/**
 * @return array|string
 */
function returnsDifferentValues($x) {
    if ($x) {
        return 'foo';
    }

    return array();
}

$x = returnsDifferentValues($y);
if (is_array($x)) {
    // $x is an array.
}

        // Check root permissions
        $this->assertTrue($history->canView($editor));
/**
 * @return array|string
 */
function returnsDifferentValues($x) {
    if ($x) {
        return 'foo';
    }

    return array();
}

$x = returnsDifferentValues($y);
if (is_array($x)) {
    // $x is an array.
}

        TestPermissionNode::getInheritedPermissions()->clearCache();
        $this->rootPermissions->setCanView(false);

        $this->assertFalse($history->canView($editor));
/**
 * @return array|string
 */
function returnsDifferentValues($x) {
    if ($x) {
        return 'foo';
    }

    return array();
}

$x = returnsDifferentValues($y);
if (is_array($x)) {
    // $x is an array.
}
    }

    /**
     * Test that draft permissions deny unrestricted live permissions
     */
    public function testRestrictedDraftUnrestrictedLive()
    {
        Versioned::set_stage(Versioned::DRAFT);

        // Should be editable by non-admin editor
        /** @var TestPermissionNode $products */
        $products = $this->objFromFixture(TestPermissionNode::class, 'products');
        /** @var TestPermissionNode $products1 */
        $products1 = $this->objFromFixture(TestPermissionNode::class, 'products-product1');
        $editor = $this->objFromFixture(Member::class, 'editor');

        // Ensure the editor can edit
        $this->assertTrue($products->canEdit($editor));
        $this->assertTrue($products1->canEdit($editor));

        // Write current version to live
        $products->writeToStage(Versioned::LIVE);
        $products1->writeToStage(Versioned::LIVE);

        // Draft version restrict to admins
        $products->EditorGroups()->setByIDList([
            $this->idFromFixture(Group::class, 'admins')
        ]);
        $products->write();

        // Ensure editor can no longer edit
        TestPermissionNode::getInheritedPermissions()->clearCache();
        $this->assertFalse($products->canEdit($editor));
        $this->assertFalse($products1->canEdit($editor));
    }

    /**
     * Test that draft permissions permit access over live permissions
     */
    public function testUnrestrictedDraftOverridesLive()
    {
        Versioned::set_stage(Versioned::DRAFT);

        // Should be editable by non-admin editor
        /** @var TestPermissionNode $about */
        $about = $this->objFromFixture(TestPermissionNode::class, 'about');
        /** @var TestPermissionNode $aboutStaff */
        $aboutStaff = $this->objFromFixture(TestPermissionNode::class, 'about-staff');
        $editor = $this->objFromFixture(Member::class, 'editor');

        // Ensure the editor can't edit
        $this->assertFalse($about->canEdit($editor));
        $this->assertFalse($aboutStaff->canEdit($editor));

        // Write current version to live
        $about->writeToStage(Versioned::LIVE);
        $aboutStaff->writeToStage(Versioned::LIVE);

        // Unrestrict draft
        $about->CanEditType = InheritedPermissions::LOGGED_IN_USERS;
<?php

/**
 * @property int $x
 * @property int $y
 * @property string $text
 */
class MyLabel
{
    private $properties;

    private $allowedProperties = array('x', 'y', 'text');

    public function __get($name)
    {
        if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
            return $properties[$name];
        } else {
            return null;
        }
    }

    public function __set($name, $value)
    {
        if (in_array($name, $this->allowedProperties)) {
            $properties[$name] = $value;
        } else {
            throw new \LogicException("Property $name is not defined.");
        }
    }

}
        $about->write();

        // Ensure editor can no longer edit
        TestPermissionNode::getInheritedPermissions()->clearCache();
        $this->assertTrue($about->canEdit($editor));
        $this->assertTrue($aboutStaff->canEdit($editor));
    }

    /**
     * Ensure that flipping parent / child relationship on live doesn't
     * cause infinite loop
     */
    public function testMobiusHierarchy()
    {
        Versioned::set_stage(Versioned::DRAFT);

        /** @var TestPermissionNode $history */
        $history = $this->objFromFixture(TestPermissionNode::class, 'history');
        /** @var TestPermissionNode $historyGallery */
        $historyGallery = $this->objFromFixture(TestPermissionNode::class, 'history-gallery');

        // Publish current state to live
        $history->writeToStage(Versioned::LIVE);
        $historyGallery->writeToStage(Versioned::LIVE);

        // Flip relation
        $historyGallery->ParentID = 0;
<?php

/**
 * @property int $x
 * @property int $y
 * @property string $text
 */
class MyLabel
{
    private $properties;

    private $allowedProperties = array('x', 'y', 'text');

    public function __get($name)
    {
        if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
            return $properties[$name];
        } else {
            return null;
        }
    }

    public function __set($name, $value)
    {
        if (in_array($name, $this->allowedProperties)) {
            $properties[$name] = $value;
        } else {
            throw new \LogicException("Property $name is not defined.");
        }
    }

}
        $historyGallery->write();
        $history->ParentID = $historyGallery->ID;
<?php

/**
 * @property int $x
 * @property int $y
 * @property string $text
 */
class MyLabel
{
    private $properties;

    private $allowedProperties = array('x', 'y', 'text');

    public function __get($name)
    {
        if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
            return $properties[$name];
        } else {
            return null;
        }
    }

    public function __set($name, $value)
    {
        if (in_array($name, $this->allowedProperties)) {
            $properties[$name] = $value;
        } else {
            throw new \LogicException("Property $name is not defined.");
        }
    }

}
        $history->write();

        // Test viewability (not logged in users)
        Member::actAs(null, function () use ($history, $historyGallery) {
            $this->assertTrue($history->canView());
            $this->assertTrue($historyGallery->canView());
        });

        // Change permission on draft root and ensure it affects both
        $historyGallery->CanViewType = InheritedPermissions::LOGGED_IN_USERS;
<?php

/**
 * @property int $x
 * @property int $y
 * @property string $text
 */
class MyLabel
{
    private $properties;

    private $allowedProperties = array('x', 'y', 'text');

    public function __get($name)
    {
        if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
            return $properties[$name];
        } else {
            return null;
        }
    }

    public function __set($name, $value)
    {
        if (in_array($name, $this->allowedProperties)) {
            $properties[$name] = $value;
        } else {
            throw new \LogicException("Property $name is not defined.");
        }
    }

}
        $historyGallery->write();
        TestPermissionNode::getInheritedPermissions()->clearCache();

        // Test viewability (not logged in users)
        Member::actAs(null, function () use ($history, $historyGallery) {
            $this->assertFalse($historyGallery->canView());
            $this->assertFalse($history->canView());
        });
    }
}


1			<?php
2
3			namespace SilverStripe\Security\Tests;
4
5			use SilverStripe\Core\Injector\Injector;
6			use SilverStripe\Dev\SapphireTest;
7			use SilverStripe\Security\Group;
8			use SilverStripe\Security\InheritedPermissions;
9			use SilverStripe\Security\Member;
10			use SilverStripe\Security\PermissionChecker;
11			use SilverStripe\Security\Test\InheritedPermissionsTest\TestPermissionNode;
12			use SilverStripe\Security\Test\InheritedPermissionsTest\TestDefaultPermissionChecker;
13			use SilverStripe\Versioned\Versioned;
14
15			class InheritedPermissionsTest extends SapphireTest
16			{
17			protected static $fixture_file = 'InheritedPermissionsTest.yml';
18
19			protected static $extra_dataobjects = [
20			TestPermissionNode::class,
21			];
22
23			/**
24			* @var TestDefaultPermissionChecker
25			*/
26			protected $rootPermissions = null;
27
28			protected function setUp()
29			{
30			parent::setUp();
31
32			// Register root permissions
33			$permission = InheritedPermissions::create(TestPermissionNode::class)
34			->setGlobalEditPermissions(['TEST_NODE_ACCESS'])
35			->setDefaultPermissions($this->rootPermissions = new TestDefaultPermissionChecker());
36			Injector::inst()->registerService(
			0 ignored issues – show Bug introduced 2017-05-20 08:33 UTC by Report Bug Copy Issue Report It seems like you code against a concrete implementation and not the interface `Psr\Container\ContainerInterface` as the method `registerService()` does only exist in the following implementations of said interface: `SilverStripe\Core\Injector\Injector`. Let’s take a look at an example: interface User { /** @return string / public function getPassword(); } class MyUser implements User { public function getPassword() { // return something } public function getDisplayName() { // return some name. } } class AuthSystem { public function authenticate(User $user) { $this->logger->info(sprintf('Authenticating %s.', $user->getDisplayName())); // do something. } } In the above example, the authenticate() method works fine as long as you just pass instances of MyUser. However, if you now also want to pass a different implementation of User which does not have a getDisplayName() method, the code will break. Available Fixes Change the type-hint for the parameter: class AuthSystem { public function authenticate(MyUser $user) { / ... / } } Add an additional type-check: class AuthSystem { public function authenticate(User $user) { if ($user instanceof MyUser) { $this->logger->info(/* ... /); } // or alternatively if ( ! $user instanceof MyUser) { throw new \LogicException( '$user must be an instance of MyUser, ' .'other instances are not supported.' ); } } } Note:* PHP Analyzer uses reverse abstract interpretation to narrow down the types inside the if block in such a case. Add the method to the interface: interface User { /** @return string / public function getPassword(); /* @return string */ public function getDisplayName(); } Loading history...
37			$permission,
38			PermissionChecker::class.'.testpermissions'
39			);

sminnee / silverstripe-framework

Push — authenticator-refactor ( 16f104...61b037 )

InheritedPermissionsTest::testEditPermissions() B

Complexity

Size

Duplication

Importance

Available Fixes

Duplication Side-by-Side

Filter issues like