def test_update_localroles_if_user_has_changed_protection_fields( self, browser): self.login(self.dossier_manager, browser) browser.open(self.leaf_repofolder) factoriesmenu.add(u'Business Case Dossier') browser.fill({'Title': 'My Dossier'}) form = browser.find_form_by_field('Reading') form.find_widget('Reading and writing').fill(self.regular_user.getId()) browser.click_on('Save') new_dossier = browser.context RoleAssignmentManager(new_dossier).add_or_update_assignment( SharingRoleAssignment('projekt_a', ['Contributor'])) self.assert_local_roles( IProtectDossier(new_dossier).READING_AND_WRITING_ROLES, self.regular_user.getId(), new_dossier) self.assert_local_roles(['Contributor'], 'projekt_a', new_dossier) browser.open(new_dossier, view="@@edit") browser.fill({'Title': 'My new Dossier'}) form = browser.find_form_by_field('Reading') form.find_widget('Reading and writing').fill([]) form.find_widget('Reading').fill([self.regular_user.getId()]) browser.click_on('Save') self.assert_local_roles( IProtectDossier(new_dossier).READING_ROLES, self.regular_user.getId(), new_dossier) self.assert_local_roles([], 'projekt_a', new_dossier)
def test_protect_dossier_will_add_selected_reading_and_writing_users_to_localroles( self): self.login(self.dossier_manager) dossier_protector = IProtectDossier(self.dossier) dossier_protector.reading_and_writing = [self.regular_user.getId()] dossier_protector.protect() self.assert_local_roles(dossier_protector.READING_AND_WRITING_ROLES, self.regular_user.getId(), self.dossier)
def test_check_protect_dossier_consistency_returns_no_messages_if_no_inconsistency(self): self.login(self.dossier_manager) dossier_protector = IProtectDossier(self.dossier) dossier_protector.reading = [self.regular_user.getId()] dossier_protector.protect() view = getMultiAdapter((self.dossier, self.request), name="check_protect_dossier_consistency") self.assertIsNone(json.loads(view()).get('messages'))
def test_protect_dossier_will_add_selected_reading_and_writing_users_to_localroles(self): self.login(self.dossier_manager) dossier_protector = IProtectDossier(self.dossier) dossier_protector.reading_and_writing = [self.regular_user.getId()] dossier_protector.protect() self.assert_local_roles( dossier_protector.READING_AND_WRITING_ROLES, self.regular_user.getId(), self.dossier)
def test_protect_dossier_wont_exclude_current_logged_in_user(self): self.login(self.dossier_manager) dossier_protector = IProtectDossier(self.dossier) dossier_protector.reading = [self.regular_user.getId()] dossier_protector.dossier_manager = self.dossier_manager.getId() dossier_protector.protect() self.assert_local_roles( IProtectDossier(self.dossier).DOSSIER_MANAGER_ROLES, self.dossier_manager.getId(), self.dossier)
def test_check_protect_dossier_consistency_returns_error_msg_if_inconsistent(self): self.login(self.dossier_manager) dossier_protector = IProtectDossier(self.dossier) dossier_protector.reading = [self.regular_user.getId()] dossier_protector.protect() self.dossier.manage_setLocalRoles(self.regular_user.getId(), ['DossierManager']) view = getMultiAdapter((self.dossier, self.request), name="check_protect_dossier_consistency") self.assertEqual(1, len(json.loads(view()).get('messages')))
def test_check_protect_dossier_consistency_returns_no_messages_if_no_inconsistency( self): self.login(self.dossier_manager) dossier_protector = IProtectDossier(self.dossier) dossier_protector.reading = [self.regular_user.getId()] dossier_protector.protect() view = getMultiAdapter((self.dossier, self.request), name="check_protect_dossier_consistency") self.assertIsNone(json.loads(view()).get('messages'))
def test_dossier_manager_can_set_protect_dossier_fields(self, browser): self.login(self.dossier_manager, browser) browser.open(self.dossier, view="@@edit") form = browser.find_form_by_field('Reading') form.find_widget('Reading').fill('projekt_a') form.find_widget('Reading and writing').fill('projekt_b') form.find_widget('Dossier manager').fill(self.dossier_manager.getId()) browser.click_on('Save') self.assertEqual(['projekt_a'], IProtectDossier(self.dossier).reading) self.assertEqual(['projekt_b'], IProtectDossier(self.dossier).reading_and_writing)
def test_check_protect_dossier_consistency_returns_error_msg_if_inconsistent( self): self.login(self.dossier_manager) dossier_protector = IProtectDossier(self.dossier) dossier_protector.reading = [self.regular_user.getId()] dossier_protector.protect() self.dossier.manage_setLocalRoles(self.regular_user.getId(), ['DossierManager']) view = getMultiAdapter((self.dossier, self.request), name="check_protect_dossier_consistency") self.assertEqual(1, len(json.loads(view()).get('messages')))
def test_full_dossier_protection_check(self): self.login(self.dossier_manager) dossier_protector = IProtectDossier(self.dossier) dossier_protector.reading = [self.regular_user.getId(), 'projekt_a'] dossier_protector.reading_and_writing = [ self.secretariat_user.getId(), 'projekt_b' ] dossier_protector.dossier_manager = self.dossier_manager.getId() dossier_protector.protect() self.assert_local_roles(dossier_protector.READING_ROLES, self.regular_user.getId(), self.dossier) self.assert_local_roles(dossier_protector.READING_ROLES, 'projekt_a', self.dossier) self.assert_local_roles(dossier_protector.READING_AND_WRITING_ROLES, self.secretariat_user.getId(), self.dossier) self.assert_local_roles(dossier_protector.READING_AND_WRITING_ROLES, 'projekt_b', self.dossier) self.assert_local_roles(dossier_protector.DOSSIER_MANAGER_ROLES, self.dossier_manager.getId(), self.dossier)
def check_consistency(self, json_response): if IProtectDossier(self.context).check_local_role_consistency(): return json_response.warning( _(u'dossier_protection_inconsistency_warning', default="The local roles do not match with the current " "dossier protection settings. If you save this " "form, the local roles will be overridden."))
def add(self, object): super(DossierAddForm, self).add(object) # CUSTOM: Handle dossier protection after successfully adding # the dossier. To be able to set the localroles correctly, we need # the acquisition wrapped object. new_object = self.context.unrestrictedTraverse(object.getId()) if IProtectDossierMarker.providedBy(new_object): IProtectDossier(new_object).protect()
def test_check_protect_dossier_consistency_returns_no_messages_if_no_inconsistency(self): self.login(self.dossier_manager) RoleAssignmentManager(self.empty_dossier).add_or_update_assignment( SharingRoleAssignment(self.dossier_responsible.id, ['Reader'])) RoleAssignmentManager(self.empty_dossier).add_or_update_assignment( SharingRoleAssignment( self.dossier_responsible.id, ['Reader', 'Editor', 'Contributor', 'Reviewer', 'Publisher', 'DossierManager', 'Owner'])) dossier_protector = IProtectDossier(self.empty_dossier) dossier_protector.dossier_manager = self.dossier_manager.getId() dossier_protector.reading = [self.dossier_responsible.id] dossier_protector.protect() view = getMultiAdapter((self.empty_dossier, self.request), name="check_protect_dossier_consistency") self.assertIsNone(json.loads(view()).get('messages'))
def applyChanges(self, data): changes = super(DossierEditForm, self).applyChanges(data) # CUSTOM: Handle dossier protection after editing the dossier. # Only update localroles if the user changed one of the IProtectDossier # fields if changes.get(IProtectDossier): IProtectDossier(self.context).protect() return changes
def test_get_subdossiers_unrestricted_search(self): self.login(self.dossier_manager) # Protect self.subsubdossier so it cannot be seen by an 'Editor' of self.subdossier self.assertFalse(getattr(self.subsubdossier, '__ac_local_roles_block__', False)) dossier_protector = IProtectDossier(self.subsubdossier) dossier_protector.dossier_manager = self.dossier_manager.getId() dossier_protector.reading = [self.secretariat_user.getId()] dossier_protector.protect() self.assertTrue(getattr(self.subsubdossier, '__ac_local_roles_block__', False)) self.assertFalse( api.user.has_permission('View', user=self.regular_user, obj=self.subsubdossier), 'This test does not actually test what it says on the tin, if self.regular_user can see self.subsubdossier.', ) with self.login(self.regular_user): restricted_subdossiers = self.subdossier.get_subdossiers() unrestricted_subdossiers = self.subdossier.get_subdossiers(unrestricted=True) self.assertSequenceEqual([], map(self.brain_to_object, restricted_subdossiers)) self.assertSequenceEqual([self.subsubdossier], map(self.brain_to_object, unrestricted_subdossiers))
def test_edit_dossier_will_enable_dossier_protection(self, browser): self.login(self.dossier_manager, browser) browser.open(self.dossier, view="@@edit") form = browser.find_form_by_field('Reading') form.find_widget('Reading').fill(self.regular_user.getId()) form.find_widget('Dossier manager').fill(self.dossier_manager.getId()) browser.click_on('Save') self.assert_local_roles( IProtectDossier(self.dossier).READING_ROLES, self.regular_user.getId(), browser.context)
def test_full_dossier_protection_check(self): self.login(self.dossier_manager) dossier_protector = IProtectDossier(self.dossier) dossier_protector.reading = [self.regular_user.getId(), 'projekt_a'] dossier_protector.reading_and_writing = [self.secretariat_user.getId(), 'projekt_b'] dossier_protector.dossier_manager = self.dossier_manager.getId() dossier_protector.protect() self.assert_local_roles( dossier_protector.READING_ROLES, self.regular_user.getId(), self.dossier) self.assert_local_roles( dossier_protector.READING_ROLES, 'projekt_a', self.dossier) self.assert_local_roles( dossier_protector.READING_AND_WRITING_ROLES, self.secretariat_user.getId(), self.dossier) self.assert_local_roles( dossier_protector.READING_AND_WRITING_ROLES, 'projekt_b', self.dossier) self.assert_local_roles( dossier_protector.DOSSIER_MANAGER_ROLES, self.dossier_manager.getId(), self.dossier)
def test_subdossiers_the_user_cannot_view_can_also_block_deactivation( self, browser): with self.login(self.dossier_manager): # Protect self.subsubdossier so it cannot be seen by an 'Editor' of self.subdossier self.assertFalse( getattr(self.subsubdossier, '__ac_local_roles_block__', False)) dossier_protector = IProtectDossier(self.subsubdossier) dossier_protector.dossier_manager = self.dossier_manager.getId() dossier_protector.reading = [self.secretariat_user.getId()] dossier_protector.protect() self.assertTrue( getattr(self.subsubdossier, '__ac_local_roles_block__', False)) self.assertFalse( api.user.has_permission('View', user=self.regular_user, obj=self.subsubdossier), 'This test does not actually test what it says on the tin, if self.regular_user can see self.subsubdossier.', ) # Grant self.regular_user 'Editor' on self.subdossier so the action to deactivate is presented to the user RoleAssignmentManager(self.subdossier).add_or_update_assignment( SharingRoleAssignment(self.regular_user.getId(), ['Reader', 'Contributor', 'Editor'])) self.login(self.regular_user, browser) self.deactivate(self.subdossier, browser) expected_msgs = [ u"The Dossier 2016 contains a subdossier " u"which can't be deactivated by the user." ] self.assert_errors(self.subdossier, browser, expected_msgs)
def test_protect_dossier_wont_exclude_current_logged_in_user(self): self.login(self.dossier_manager) dossier_protector = IProtectDossier(self.dossier) dossier_protector.reading = [self.regular_user.getId()] dossier_protector.dossier_manager = self.dossier_manager.getId() dossier_protector.protect() self.assert_local_roles( IProtectDossier(self.dossier).DOSSIER_MANAGER_ROLES, self.dossier_manager.getId(), self.dossier)
def test_add_dossier_will_enable_dossier_protection(self, browser): self.login(self.dossier_manager, browser) browser.open(self.leaf_repofolder) factoriesmenu.add(u'Business Case Dossier') browser.fill({'Title': 'My Dossier'}) form = browser.find_form_by_field('Reading') form.find_widget('Reading').fill(self.regular_user.getId()) browser.click_on('Save') self.assert_local_roles( IProtectDossier(self.dossier).READING_ROLES, self.regular_user.getId(), browser.context)
def test_protect_dossier_will_disable_role_inheritance(self): self.login(self.dossier_manager) self.assertFalse( getattr(self.dossier, '__ac_local_roles_block__', False)) dossier_protector = IProtectDossier(self.dossier) dossier_protector.dossier_manager = self.dossier_manager.getId() dossier_protector.reading = ['kathi.barfuss'] dossier_protector.protect() self.assertTrue( getattr(self.dossier, '__ac_local_roles_block__', False)) dossier_protector.reading = [] dossier_protector.protect() self.assertFalse( getattr(self.dossier, '__ac_local_roles_block__', False))
def test_subdossiers_the_user_cannot_view_can_also_block_deactivation(self, browser): with self.login(self.dossier_manager): # Protect self.subsubdossier so it cannot be seen by an 'Editor' of self.subdossier self.assertFalse(getattr(self.subsubdossier, '__ac_local_roles_block__', False)) dossier_protector = IProtectDossier(self.subsubdossier) dossier_protector.dossier_manager = self.dossier_manager.getId() dossier_protector.reading = [self.secretariat_user.getId()] dossier_protector.protect() self.assertTrue(getattr(self.subsubdossier, '__ac_local_roles_block__', False)) self.assertFalse( api.user.has_permission('View', user=self.regular_user, obj=self.subsubdossier), 'This test does not actually test what it says on the tin, if self.regular_user can see self.subsubdossier.', ) # Grant self.regular_user 'Editor' on self.subdossier so the action to deactivate is presented to the user RoleAssignmentManager(self.subdossier).add_or_update_assignment( SharingRoleAssignment(self.regular_user.getId(), ['Reader', 'Contributor', 'Editor'])) self.login(self.regular_user, browser) self.deactivate(self.subdossier, browser) expected_msgs = [u"The Dossier 2016 contains a subdossier " u"which can't be deactivated by the user."] self.assert_errors(self.subdossier, browser, expected_msgs)
def test_protect_dossier_will_disable_role_inheritance(self): self.login(self.dossier_manager) self.assertFalse(getattr(self.dossier, '__ac_local_roles_block__', False)) dossier_protector = IProtectDossier(self.dossier) dossier_protector.dossier_manager = self.dossier_manager.getId() dossier_protector.reading = ['kathi.barfuss'] dossier_protector.protect() self.assertTrue(getattr(self.dossier, '__ac_local_roles_block__', False)) dossier_protector.reading = [] dossier_protector.protect() self.assertFalse(getattr(self.dossier, '__ac_local_roles_block__', False))
def test_user_without_field_permission_doesnt_get_added_as_dossier_manager_by_default( self, browser): """The current user must only be set as dossier_manager if they have the write permission for the dossier_manager field. Our regular_user, which doesn't have it, should not end up as dossier_manager after saving. """ self.login(self.regular_user, browser) browser.open(self.leaf_repofolder) factoriesmenu.add(u'Business Case Dossier') browser.fill({'Title': 'My Dossier'}) browser.click_on('Save') self.assertEqual(None, IProtectDossier(browser.context).dossier_manager)
def test_current_user_is_default_dossier_manager(self, browser): self.login(self.dossier_manager, browser) browser.open(self.leaf_repofolder) factoriesmenu.add(u'Business Case Dossier') field = browser.find('Dossier manager') selected_option = filter(lambda x: x.attrib.get('selected'), field.css('option'))[0] self.assertEqual(u'Fr\xfchling F\xe4ivel (faivel.fruhling)', selected_option.text) browser.fill({'Title': 'My Dossier'}) browser.click_on('Save') self.assertEqual(self.dossier_manager.getId(), IProtectDossier(browser.context).dossier_manager)
def test_reindex_object_security_on_dossier(self): self.login(self.dossier_manager) self.assertItemsEqual([ 'Administrator', 'Contributor', 'Editor', 'Manager', 'Reader', 'user:fa_users', 'user:{}'.format(self.regular_user.getId()) ], self.get_allowed_roles_and_users_for(self.dossier)) dossier_protector = IProtectDossier(self.dossier) dossier_protector.reading = [self.regular_user.getId()] dossier_protector.reading_and_writing = [] dossier_protector.dossier_manager = self.dossier_manager.getId() dossier_protector.protect() self.assertItemsEqual([ 'Administrator', 'Contributor', 'Editor', 'Manager', 'Reader', 'user:{}'.format(self.dossier_manager.getId()), 'user:{}'.format( self.regular_user.getId()) ], self.get_allowed_roles_and_users_for(self.dossier))
def test_prefilled_dossier_manager_can_be_removed(self, browser): self.login(self.dossier_manager, browser) browser.open(self.leaf_repofolder) factoriesmenu.add(u'Business Case Dossier') browser.fill({'Title': 'My Dossier'}) form = browser.find_form_by_field('Reading') # Guard assertion - make sure the widget's value has been prefilled dossier_manager_widget = form.find_widget('Dossier manager') select = dossier_manager_widget.xpath('select').first self.assertEqual('faivel.fruhling', select.value) # Reset the widget's value dossier_manager_widget.fill('') browser.click_on('Save') new_dossier = browser.context # No dossier manager should have been saved self.assertIsNone(IProtectDossier(new_dossier).dossier_manager)
def test_reindex_object_security_on_dossier(self): self.login(self.dossier_manager) self.assertItemsEqual( ['Administrator', 'Contributor', 'Editor', 'Manager', 'Reader', 'user:fa_users', 'user:{}'.format(self.regular_user.getId())], self.get_allowed_roles_and_users_for(self.dossier)) dossier_protector = IProtectDossier(self.dossier) dossier_protector.reading = [self.regular_user.getId()] dossier_protector.reading_and_writing = [] dossier_protector.dossier_manager = self.dossier_manager.getId() dossier_protector.protect() self.assertItemsEqual( ['Administrator', 'Contributor', 'Editor', 'Manager', 'Reader', 'user:{}'.format(self.dossier_manager.getId()), 'user:{}'.format(self.regular_user.getId())], self.get_allowed_roles_and_users_for(self.dossier))
def test_check_protect_dossier_consistency_returns_no_messages_if_no_inconsistency( self): self.login(self.dossier_manager) RoleAssignmentManager(self.empty_dossier).add_or_update_assignment( SharingRoleAssignment(self.dossier_responsible.id, ['Reader'])) RoleAssignmentManager(self.empty_dossier).add_or_update_assignment( SharingRoleAssignment(self.dossier_responsible.id, [ 'Reader', 'Editor', 'Contributor', 'Reviewer', 'Publisher', 'DossierManager', 'Owner' ])) dossier_protector = IProtectDossier(self.empty_dossier) dossier_protector.dossier_manager = self.dossier_manager.getId() dossier_protector.reading = [self.dossier_responsible.id] dossier_protector.protect() view = getMultiAdapter((self.empty_dossier, self.request), name="check_protect_dossier_consistency") self.assertIsNone(json.loads(view()).get('messages'))
def test_get_subdossiers_unrestricted_search(self): self.login(self.dossier_manager) # Protect self.subsubdossier so it cannot be seen by an 'Editor' of self.subdossier self.assertFalse(getattr(self.subsubdossier, '__ac_local_roles_block__', False)) dossier_protector = IProtectDossier(self.subsubdossier) dossier_protector.dossier_manager = self.dossier_manager.getId() dossier_protector.reading = [self.secretariat_user.getId()] dossier_protector.protect() self.assertTrue(getattr(self.subsubdossier, '__ac_local_roles_block__', False)) self.assertFalse( api.user.has_permission('View', user=self.regular_user, obj=self.subsubdossier), 'This test does not actually test what it says on the tin, if self.regular_user can see self.subsubdossier.', ) with self.login(self.regular_user): restricted_subdossiers = self.subdossier.get_subdossiers() unrestricted_subdossiers = self.subdossier.get_subdossiers(unrestricted=True) self.assertSequenceEqual([], map(self.brain_to_object, restricted_subdossiers)) self.assertSequenceEqual([self.subsubdossier], map(self.brain_to_object, unrestricted_subdossiers))