290 lines
11 KiB
Python
290 lines
11 KiB
Python
from __future__ import absolute_import, unicode_literals
|
|
|
|
from django.core.exceptions import PermissionDenied
|
|
from django.db import models
|
|
|
|
from mayan.apps.common.tests import BaseTestCase
|
|
from mayan.apps.common.tests.mixins import TestModelTestMixin
|
|
from mayan.apps.documents.models import Document, DocumentType
|
|
from mayan.apps.documents.permissions import permission_document_view
|
|
from mayan.apps.documents.tests import (
|
|
DocumentTestMixin, TEST_DOCUMENT_TYPE_2_LABEL, TEST_DOCUMENT_TYPE_LABEL
|
|
)
|
|
from mayan.apps.permissions.tests.mixins import PermissionTestMixin, RoleTestMixin
|
|
|
|
from ..classes import ModelPermission
|
|
from ..models import AccessControlList
|
|
|
|
from .mixins import ACLTestMixin
|
|
|
|
|
|
class PermissionTestCase(DocumentTestMixin, BaseTestCase):
|
|
auto_create_document_type = False
|
|
|
|
def setUp(self):
|
|
super(PermissionTestCase, self).setUp()
|
|
self.test_document_type_1 = DocumentType.objects.create(
|
|
label=TEST_DOCUMENT_TYPE_LABEL
|
|
)
|
|
|
|
self.test_document_type_2 = DocumentType.objects.create(
|
|
label=TEST_DOCUMENT_TYPE_2_LABEL
|
|
)
|
|
|
|
self.test_document_1 = self.upload_document(
|
|
document_type=self.test_document_type_1
|
|
)
|
|
self.test_document_2 = self.upload_document(
|
|
document_type=self.test_document_type_1
|
|
)
|
|
self.test_document_3 = self.upload_document(
|
|
document_type=self.test_document_type_2
|
|
)
|
|
|
|
def test_check_access_without_permissions(self):
|
|
with self.assertRaises(PermissionDenied):
|
|
AccessControlList.objects.check_access(
|
|
obj=self.test_document_1, permission=permission_document_view,
|
|
user=self._test_case_user
|
|
)
|
|
|
|
def test_filtering_without_permissions(self):
|
|
self.assertEqual(
|
|
AccessControlList.objects.restrict_queryset(
|
|
permission=permission_document_view,
|
|
queryset=Document.objects.all(), user=self._test_case_user,
|
|
).count(), 0
|
|
)
|
|
|
|
def test_check_access_with_acl(self):
|
|
acl = AccessControlList.objects.create(
|
|
content_object=self.test_document_1, role=self._test_case_role
|
|
)
|
|
acl.permissions.add(permission_document_view.stored_permission)
|
|
|
|
try:
|
|
AccessControlList.objects.check_access(
|
|
obj=self.test_document_1, permission=permission_document_view,
|
|
user=self._test_case_user
|
|
)
|
|
except PermissionDenied:
|
|
self.fail('PermissionDenied exception was not expected.')
|
|
|
|
def test_filtering_with_permissions(self):
|
|
acl = AccessControlList.objects.create(
|
|
content_object=self.test_document_1, role=self._test_case_role
|
|
)
|
|
acl.permissions.add(permission_document_view.stored_permission)
|
|
|
|
self.assertQuerysetEqual(
|
|
AccessControlList.objects.restrict_queryset(
|
|
permission=permission_document_view,
|
|
queryset=Document.objects.all(), user=self._test_case_user
|
|
), (repr(self.test_document_1),)
|
|
)
|
|
|
|
def test_check_access_with_inherited_acl(self):
|
|
acl = AccessControlList.objects.create(
|
|
content_object=self.test_document_type_1, role=self._test_case_role
|
|
)
|
|
acl.permissions.add(permission_document_view.stored_permission)
|
|
|
|
try:
|
|
AccessControlList.objects.check_access(
|
|
obj=self.test_document_1, permission=permission_document_view,
|
|
user=self._test_case_user
|
|
)
|
|
except PermissionDenied:
|
|
self.fail('PermissionDenied exception was not expected.')
|
|
|
|
def test_check_access_with_inherited_acl_and_direct_acl(self):
|
|
test_acl_1 = AccessControlList.objects.create(
|
|
content_object=self.test_document_type_1, role=self._test_case_role
|
|
)
|
|
test_acl_1.permissions.add(permission_document_view.stored_permission)
|
|
|
|
test_acl_2 = AccessControlList.objects.create(
|
|
content_object=self.test_document_3, role=self._test_case_role
|
|
)
|
|
test_acl_2.permissions.add(permission_document_view.stored_permission)
|
|
|
|
try:
|
|
AccessControlList.objects.check_access(
|
|
obj=self.test_document_3, permission=permission_document_view,
|
|
user=self._test_case_user
|
|
)
|
|
except PermissionDenied:
|
|
self.fail('PermissionDenied exception was not expected.')
|
|
|
|
def test_filtering_with_inherited_permissions(self):
|
|
acl = AccessControlList.objects.create(
|
|
content_object=self.test_document_type_1, role=self._test_case_role
|
|
)
|
|
acl.permissions.add(permission_document_view.stored_permission)
|
|
|
|
result = AccessControlList.objects.restrict_queryset(
|
|
permission=permission_document_view, queryset=Document.objects.all(),
|
|
user=self._test_case_user
|
|
)
|
|
|
|
# Since document_1 and document_2 are of document_type_1
|
|
# they are the only ones that should be returned
|
|
self.assertTrue(self.test_document_1 in result)
|
|
self.assertTrue(self.test_document_2 in result)
|
|
self.assertTrue(self.test_document_3 not in result)
|
|
|
|
def test_filtering_with_inherited_permissions_and_local_acl(self):
|
|
self._test_case_role.permissions.add(
|
|
permission_document_view.stored_permission
|
|
)
|
|
|
|
acl = AccessControlList.objects.create(
|
|
content_object=self.test_document_type_1, role=self._test_case_role
|
|
)
|
|
acl.permissions.add(permission_document_view.stored_permission)
|
|
|
|
acl = AccessControlList.objects.create(
|
|
content_object=self.test_document_3, role=self._test_case_role
|
|
)
|
|
acl.permissions.add(permission_document_view.stored_permission)
|
|
|
|
result = AccessControlList.objects.restrict_queryset(
|
|
permission=permission_document_view, queryset=Document.objects.all(),
|
|
user=self._test_case_user,
|
|
)
|
|
self.assertTrue(self.test_document_1 in result)
|
|
self.assertTrue(self.test_document_2 in result)
|
|
self.assertTrue(self.test_document_3 in result)
|
|
|
|
|
|
class InheritedPermissionTestCase(TestModelTestMixin, PermissionTestMixin, RoleTestMixin, ACLTestMixin, BaseTestCase):
|
|
def test_retrieve_inherited_role_permission_not_model_applicable(self):
|
|
self._create_test_model()
|
|
self.test_object = self.TestModel.objects.create()
|
|
self._create_test_acl()
|
|
self._create_test_permission()
|
|
|
|
self.test_role.grant(permission=self.test_permission)
|
|
|
|
queryset = AccessControlList.objects.get_inherited_permissions(
|
|
obj=self.test_object, role=self.test_role
|
|
)
|
|
self.assertTrue(self.test_permission.stored_permission not in queryset)
|
|
|
|
def test_retrieve_inherited_role_permission_model_applicable(self):
|
|
self._create_test_model()
|
|
self.test_object = self.TestModel.objects.create()
|
|
self._create_test_acl()
|
|
self._create_test_permission()
|
|
|
|
ModelPermission.register(
|
|
model=self.test_object._meta.model, permissions=(
|
|
self.test_permission,
|
|
)
|
|
)
|
|
self.test_role.grant(permission=self.test_permission)
|
|
|
|
queryset = AccessControlList.objects.get_inherited_permissions(
|
|
obj=self.test_object, role=self.test_role
|
|
)
|
|
self.assertTrue(self.test_permission.stored_permission in queryset)
|
|
|
|
def test_retrieve_inherited_related_parent_child_permission(self):
|
|
self._create_test_permission()
|
|
|
|
self._create_test_model(model_name='TestModelParent')
|
|
self._create_test_model(
|
|
fields={
|
|
'parent': models.ForeignKey(
|
|
on_delete=models.CASCADE, related_name='children',
|
|
to='TestModelParent',
|
|
)
|
|
}, model_name='TestModelChild'
|
|
)
|
|
|
|
ModelPermission.register(
|
|
model=self.TestModelParent, permissions=(
|
|
self.test_permission,
|
|
)
|
|
)
|
|
ModelPermission.register(
|
|
model=self.TestModelChild, permissions=(
|
|
self.test_permission,
|
|
)
|
|
)
|
|
ModelPermission.register_inheritance(
|
|
model=self.TestModelChild, related='parent',
|
|
)
|
|
|
|
parent = self.TestModelParent.objects.create()
|
|
child = self.TestModelChild.objects.create(parent=parent)
|
|
|
|
AccessControlList.objects.grant(
|
|
obj=parent, permission=self.test_permission, role=self.test_role
|
|
)
|
|
|
|
queryset = AccessControlList.objects.get_inherited_permissions(
|
|
obj=child, role=self.test_role
|
|
)
|
|
|
|
self.assertTrue(self.test_permission.stored_permission in queryset)
|
|
|
|
def test_retrieve_inherited_related_grandparent_parent_child_permission(self):
|
|
self._create_test_permission()
|
|
|
|
self._create_test_model(model_name='TestModelGrandParent')
|
|
self._create_test_model(
|
|
fields={
|
|
'parent': models.ForeignKey(
|
|
on_delete=models.CASCADE, related_name='children',
|
|
to='TestModelGrandParent',
|
|
)
|
|
}, model_name='TestModelParent'
|
|
)
|
|
self._create_test_model(
|
|
fields={
|
|
'parent': models.ForeignKey(
|
|
on_delete=models.CASCADE, related_name='children',
|
|
to='TestModelParent',
|
|
)
|
|
}, model_name='TestModelChild'
|
|
)
|
|
|
|
ModelPermission.register(
|
|
model=self.TestModelGrandParent, permissions=(
|
|
self.test_permission,
|
|
)
|
|
)
|
|
ModelPermission.register(
|
|
model=self.TestModelParent, permissions=(
|
|
self.test_permission,
|
|
)
|
|
)
|
|
ModelPermission.register(
|
|
model=self.TestModelChild, permissions=(
|
|
self.test_permission,
|
|
)
|
|
)
|
|
|
|
ModelPermission.register_inheritance(
|
|
model=self.TestModelChild, related='parent',
|
|
)
|
|
ModelPermission.register_inheritance(
|
|
model=self.TestModelParent, related='parent',
|
|
)
|
|
|
|
grandparent = self.TestModelGrandParent.objects.create()
|
|
parent = self.TestModelParent.objects.create(parent=grandparent)
|
|
child = self.TestModelChild.objects.create(parent=parent)
|
|
|
|
AccessControlList.objects.grant(
|
|
obj=grandparent, permission=self.test_permission,
|
|
role=self.test_role
|
|
)
|
|
|
|
queryset = AccessControlList.objects.get_inherited_permissions(
|
|
obj=child, role=self.test_role
|
|
)
|
|
|
|
self.assertTrue(self.test_permission.stored_permission in queryset)
|