4b444a75cc
This change allows filtering a queryset by multiple permission following a logic operator to define the relationship. Example: In order to access an instance of MetadataTypeDocumentType the document type view and metadata type view permissions are required. The computation for this access control can now be coded using .restrict_queryset_by_accesses. Custom permission checking in the view is no longer required. Signed-off-by: Roberto Rosario <Roberto.Rosario@mayan-edms.com>
402 lines
15 KiB
Python
402 lines
15 KiB
Python
from __future__ import absolute_import, unicode_literals
|
|
|
|
from django.core.exceptions import PermissionDenied
|
|
from django.db import models
|
|
|
|
from mayan.apps.common.tests import BaseTestCase
|
|
from mayan.apps.documents.models import Document, DocumentType
|
|
from mayan.apps.documents.permissions import permission_document_view
|
|
from mayan.apps.documents.tests import (
|
|
DocumentTestMixin, TEST_DOCUMENT_TYPE_2_LABEL, TEST_DOCUMENT_TYPE_LABEL
|
|
)
|
|
|
|
from ..classes import ModelPermission
|
|
from ..models import AccessControlList
|
|
|
|
from .mixins import ACLTestMixin
|
|
|
|
|
|
class PermissionTestCase(DocumentTestMixin, BaseTestCase):
|
|
auto_create_document_type = False
|
|
|
|
def setUp(self):
|
|
super(PermissionTestCase, self).setUp()
|
|
self.test_document_type_1 = DocumentType.objects.create(
|
|
label=TEST_DOCUMENT_TYPE_LABEL
|
|
)
|
|
|
|
self.test_document_type_2 = DocumentType.objects.create(
|
|
label=TEST_DOCUMENT_TYPE_2_LABEL
|
|
)
|
|
|
|
self.test_document_1 = self.upload_document(
|
|
document_type=self.test_document_type_1
|
|
)
|
|
self.test_document_2 = self.upload_document(
|
|
document_type=self.test_document_type_1
|
|
)
|
|
self.test_document_3 = self.upload_document(
|
|
document_type=self.test_document_type_2
|
|
)
|
|
|
|
def test_check_access_without_permissions(self):
|
|
with self.assertRaises(PermissionDenied):
|
|
AccessControlList.objects.check_access(
|
|
obj=self.test_document_1, permission=permission_document_view,
|
|
user=self._test_case_user
|
|
)
|
|
|
|
def test_filtering_without_permissions(self):
|
|
self.assertEqual(
|
|
AccessControlList.objects.restrict_queryset(
|
|
permission=permission_document_view,
|
|
queryset=Document.objects.all(), user=self._test_case_user,
|
|
).count(), 0
|
|
)
|
|
|
|
def test_check_access_with_acl(self):
|
|
acl = AccessControlList.objects.create(
|
|
content_object=self.test_document_1, role=self._test_case_role
|
|
)
|
|
acl.permissions.add(permission_document_view.stored_permission)
|
|
|
|
try:
|
|
AccessControlList.objects.check_access(
|
|
obj=self.test_document_1, permission=permission_document_view,
|
|
user=self._test_case_user
|
|
)
|
|
except PermissionDenied:
|
|
self.fail('PermissionDenied exception was not expected.')
|
|
|
|
def test_filtering_with_permissions(self):
|
|
acl = AccessControlList.objects.create(
|
|
content_object=self.test_document_1, role=self._test_case_role
|
|
)
|
|
acl.permissions.add(permission_document_view.stored_permission)
|
|
|
|
self.assertQuerysetEqual(
|
|
AccessControlList.objects.restrict_queryset(
|
|
permission=permission_document_view,
|
|
queryset=Document.objects.all(), user=self._test_case_user
|
|
), (repr(self.test_document_1),)
|
|
)
|
|
|
|
def test_check_access_with_inherited_acl(self):
|
|
acl = AccessControlList.objects.create(
|
|
content_object=self.test_document_type_1, role=self._test_case_role
|
|
)
|
|
acl.permissions.add(permission_document_view.stored_permission)
|
|
|
|
try:
|
|
AccessControlList.objects.check_access(
|
|
obj=self.test_document_1, permission=permission_document_view,
|
|
user=self._test_case_user
|
|
)
|
|
except PermissionDenied:
|
|
self.fail('PermissionDenied exception was not expected.')
|
|
|
|
def test_check_access_with_inherited_acl_and_direct_acl(self):
|
|
test_acl_1 = AccessControlList.objects.create(
|
|
content_object=self.test_document_type_1, role=self._test_case_role
|
|
)
|
|
test_acl_1.permissions.add(permission_document_view.stored_permission)
|
|
|
|
test_acl_2 = AccessControlList.objects.create(
|
|
content_object=self.test_document_3, role=self._test_case_role
|
|
)
|
|
test_acl_2.permissions.add(permission_document_view.stored_permission)
|
|
|
|
try:
|
|
AccessControlList.objects.check_access(
|
|
obj=self.test_document_3, permission=permission_document_view,
|
|
user=self._test_case_user
|
|
)
|
|
except PermissionDenied:
|
|
self.fail('PermissionDenied exception was not expected.')
|
|
|
|
def test_filtering_with_inherited_permissions(self):
|
|
acl = AccessControlList.objects.create(
|
|
content_object=self.test_document_type_1, role=self._test_case_role
|
|
)
|
|
acl.permissions.add(permission_document_view.stored_permission)
|
|
|
|
result = AccessControlList.objects.restrict_queryset(
|
|
permission=permission_document_view, queryset=Document.objects.all(),
|
|
user=self._test_case_user
|
|
)
|
|
|
|
# Since document_1 and document_2 are of document_type_1
|
|
# they are the only ones that should be returned
|
|
self.assertTrue(self.test_document_1 in result)
|
|
self.assertTrue(self.test_document_2 in result)
|
|
self.assertTrue(self.test_document_3 not in result)
|
|
|
|
def test_filtering_with_inherited_permissions_and_local_acl(self):
|
|
self._test_case_role.permissions.add(
|
|
permission_document_view.stored_permission
|
|
)
|
|
|
|
acl = AccessControlList.objects.create(
|
|
content_object=self.test_document_type_1, role=self._test_case_role
|
|
)
|
|
acl.permissions.add(permission_document_view.stored_permission)
|
|
|
|
acl = AccessControlList.objects.create(
|
|
content_object=self.test_document_3, role=self._test_case_role
|
|
)
|
|
acl.permissions.add(permission_document_view.stored_permission)
|
|
|
|
result = AccessControlList.objects.restrict_queryset(
|
|
permission=permission_document_view, queryset=Document.objects.all(),
|
|
user=self._test_case_user,
|
|
)
|
|
self.assertTrue(self.test_document_1 in result)
|
|
self.assertTrue(self.test_document_2 in result)
|
|
self.assertTrue(self.test_document_3 in result)
|
|
|
|
|
|
class InheritedPermissionTestCase(ACLTestMixin, BaseTestCase):
|
|
def test_retrieve_inherited_role_permission_not_model_applicable(self):
|
|
self._create_test_model()
|
|
self.test_object = self.TestModel.objects.create()
|
|
self._create_test_acl()
|
|
self._create_test_permission()
|
|
|
|
self.test_role.grant(permission=self.test_permission)
|
|
|
|
queryset = AccessControlList.objects.get_inherited_permissions(
|
|
obj=self.test_object, role=self.test_role
|
|
)
|
|
self.assertTrue(self.test_permission.stored_permission not in queryset)
|
|
|
|
def test_retrieve_inherited_role_permission_model_applicable(self):
|
|
self._create_test_model()
|
|
self.test_object = self.TestModel.objects.create()
|
|
self._create_test_acl()
|
|
self._create_test_permission()
|
|
|
|
ModelPermission.register(
|
|
model=self.test_object._meta.model, permissions=(
|
|
self.test_permission,
|
|
)
|
|
)
|
|
self.test_role.grant(permission=self.test_permission)
|
|
|
|
queryset = AccessControlList.objects.get_inherited_permissions(
|
|
obj=self.test_object, role=self.test_role
|
|
)
|
|
self.assertTrue(self.test_permission.stored_permission in queryset)
|
|
|
|
def test_retrieve_inherited_related_parent_child_permission(self):
|
|
self._create_test_permission()
|
|
|
|
self._create_test_model(model_name='TestModelParent')
|
|
self._create_test_model(
|
|
fields={
|
|
'parent': models.ForeignKey(
|
|
on_delete=models.CASCADE, related_name='children',
|
|
to='TestModelParent',
|
|
)
|
|
}, model_name='TestModelChild'
|
|
)
|
|
|
|
ModelPermission.register(
|
|
model=self.TestModelParent, permissions=(
|
|
self.test_permission,
|
|
)
|
|
)
|
|
ModelPermission.register(
|
|
model=self.TestModelChild, permissions=(
|
|
self.test_permission,
|
|
)
|
|
)
|
|
ModelPermission.register_inheritance(
|
|
model=self.TestModelChild, related='parent',
|
|
)
|
|
|
|
parent = self.TestModelParent.objects.create()
|
|
child = self.TestModelChild.objects.create(parent=parent)
|
|
|
|
AccessControlList.objects.grant(
|
|
obj=parent, permission=self.test_permission, role=self.test_role
|
|
)
|
|
|
|
queryset = AccessControlList.objects.get_inherited_permissions(
|
|
obj=child, role=self.test_role
|
|
)
|
|
|
|
self.assertTrue(self.test_permission.stored_permission in queryset)
|
|
|
|
def test_retrieve_inherited_related_grandparent_parent_child_permission(self):
|
|
self._create_test_permission()
|
|
|
|
self._create_test_model(model_name='TestModelGrandParent')
|
|
self._create_test_model(
|
|
fields={
|
|
'parent': models.ForeignKey(
|
|
on_delete=models.CASCADE, related_name='children',
|
|
to='TestModelGrandParent',
|
|
)
|
|
}, model_name='TestModelParent'
|
|
)
|
|
self._create_test_model(
|
|
fields={
|
|
'parent': models.ForeignKey(
|
|
on_delete=models.CASCADE, related_name='children',
|
|
to='TestModelParent',
|
|
)
|
|
}, model_name='TestModelChild'
|
|
)
|
|
|
|
ModelPermission.register(
|
|
model=self.TestModelGrandParent, permissions=(
|
|
self.test_permission,
|
|
)
|
|
)
|
|
ModelPermission.register(
|
|
model=self.TestModelParent, permissions=(
|
|
self.test_permission,
|
|
)
|
|
)
|
|
ModelPermission.register(
|
|
model=self.TestModelChild, permissions=(
|
|
self.test_permission,
|
|
)
|
|
)
|
|
|
|
ModelPermission.register_inheritance(
|
|
model=self.TestModelChild, related='parent',
|
|
)
|
|
ModelPermission.register_inheritance(
|
|
model=self.TestModelParent, related='parent',
|
|
)
|
|
|
|
grandparent = self.TestModelGrandParent.objects.create()
|
|
parent = self.TestModelParent.objects.create(parent=grandparent)
|
|
child = self.TestModelChild.objects.create(parent=parent)
|
|
|
|
AccessControlList.objects.grant(
|
|
obj=grandparent, permission=self.test_permission,
|
|
role=self.test_role
|
|
)
|
|
|
|
queryset = AccessControlList.objects.get_inherited_permissions(
|
|
obj=child, role=self.test_role
|
|
)
|
|
|
|
self.assertTrue(self.test_permission.stored_permission in queryset)
|
|
|
|
|
|
class MultipleAccessTestCase(ACLTestMixin, BaseTestCase):
|
|
def setUp(self):
|
|
super(MultipleAccessTestCase, self).setUp()
|
|
self._create_test_permission()
|
|
self._create_test_permission_2()
|
|
|
|
self._create_test_model(model_name='TestModelParent1')
|
|
self._create_test_model(model_name='TestModelParent2')
|
|
self._create_test_model(
|
|
fields={
|
|
'parent_1': models.ForeignKey(
|
|
on_delete=models.CASCADE, related_name='children1',
|
|
to='TestModelParent1',
|
|
),
|
|
'parent_2': models.ForeignKey(
|
|
on_delete=models.CASCADE, related_name='children2',
|
|
to='TestModelParent2',
|
|
)
|
|
}, model_name='TestModelChild'
|
|
)
|
|
|
|
ModelPermission.register(
|
|
model=self.TestModelParent1, permissions=(
|
|
self.test_permission,
|
|
)
|
|
)
|
|
ModelPermission.register(
|
|
model=self.TestModelParent2, permissions=(
|
|
self.test_permission_2,
|
|
)
|
|
)
|
|
|
|
self.test_object_parent_1 = self.TestModelParent1.objects.create()
|
|
self.test_object_parent_2 = self.TestModelParent2.objects.create()
|
|
self.test_object_child = self.TestModelChild.objects.create(
|
|
parent_1=self.test_object_parent_1, parent_2=self.test_object_parent_2
|
|
)
|
|
|
|
ModelPermission.register_inheritance(
|
|
model=self.TestModelChild, related='parent_1'
|
|
)
|
|
ModelPermission.register_inheritance(
|
|
model=self.TestModelChild, related='parent_2'
|
|
)
|
|
|
|
def test_restrict_queryset_and_operator_first_permission(self):
|
|
self.grant_access(obj=self.test_object_parent_1, permission=self.test_permission)
|
|
|
|
queryset = AccessControlList.objects.restrict_queryset_by_accesses(
|
|
operator=AccessControlList.OPERATOR_AND,
|
|
permissions=(self.test_permission, self.test_permission_2),
|
|
queryset=self.TestModelChild.objects.all(),
|
|
user=self._test_case_user
|
|
)
|
|
self.assertTrue(self.test_object_child not in queryset)
|
|
|
|
def test_restrict_queryset_and_operator_second_permission(self):
|
|
self.grant_access(obj=self.test_object_parent_2, permission=self.test_permission_2)
|
|
|
|
queryset = AccessControlList.objects.restrict_queryset_by_accesses(
|
|
operator=AccessControlList.OPERATOR_AND,
|
|
permissions=(self.test_permission, self.test_permission_2),
|
|
queryset=self.TestModelChild.objects.all(),
|
|
user=self._test_case_user
|
|
)
|
|
self.assertTrue(self.test_object_child not in queryset)
|
|
|
|
def test_restrict_queryset_and_operator_both_permissions(self):
|
|
self.grant_access(obj=self.test_object_parent_1, permission=self.test_permission)
|
|
self.grant_access(obj=self.test_object_parent_2, permission=self.test_permission_2)
|
|
|
|
queryset = AccessControlList.objects.restrict_queryset_by_accesses(
|
|
operator=AccessControlList.OPERATOR_AND,
|
|
permissions=(self.test_permission, self.test_permission_2),
|
|
queryset=self.TestModelChild.objects.all(),
|
|
user=self._test_case_user
|
|
)
|
|
self.assertTrue(self.test_object_child in queryset)
|
|
|
|
def test_restrict_queryset_or_operator_first_permission(self):
|
|
self.grant_access(obj=self.test_object_parent_1, permission=self.test_permission)
|
|
|
|
queryset = AccessControlList.objects.restrict_queryset_by_accesses(
|
|
operator=AccessControlList.OPERATOR_OR,
|
|
permissions=(self.test_permission, self.test_permission_2),
|
|
queryset=self.TestModelChild.objects.all(),
|
|
user=self._test_case_user
|
|
)
|
|
self.assertTrue(self.test_object_child in queryset)
|
|
|
|
def test_restrict_queryset_or_operator_second_permission(self):
|
|
self.grant_access(obj=self.test_object_parent_2, permission=self.test_permission_2)
|
|
|
|
queryset = AccessControlList.objects.restrict_queryset_by_accesses(
|
|
operator=AccessControlList.OPERATOR_OR,
|
|
permissions=(self.test_permission, self.test_permission_2),
|
|
queryset=self.TestModelChild.objects.all(),
|
|
user=self._test_case_user
|
|
)
|
|
self.assertTrue(self.test_object_child in queryset)
|
|
|
|
def test_restrict_queryset_or_operator_both_permissions(self):
|
|
self.grant_access(obj=self.test_object_parent_1, permission=self.test_permission)
|
|
self.grant_access(obj=self.test_object_parent_2, permission=self.test_permission_2)
|
|
|
|
queryset = AccessControlList.objects.restrict_queryset_by_accesses(
|
|
operator=AccessControlList.OPERATOR_OR,
|
|
permissions=(self.test_permission, self.test_permission_2),
|
|
queryset=self.TestModelChild.objects.all(),
|
|
user=self._test_case_user
|
|
)
|
|
self.assertTrue(self.test_object_child in queryset)
|