public function __construct(RoleInterface $role, ResourceInterface $resource, $action, $existingRole)
{
parent::__construct("Access for '{$role->getName()}' to '{$action}' '{$resource->getClass()}' with ID '{$resource->getId()}' is already granted by the '{$existingRole}' role.");
}
/**
* @param ResourceInterface $resource
*
* @return array|\CirclicalUser\Provider\GroupPermissionInterface[]
*/
public function getResourcePermissions(ResourceInterface $resource) : array
{
$query = $this->getRepository()->createQueryBuilder('r')->select('r')->where('r.resource_class = :resourceClass AND r.resource_id=:resourceId')->setParameter('resourceClass', $resource->getClass())->setParameter('resourceId', $resource->getId())->getQuery();
return $query->getResult();
}
/**
* Get resource-type permissions from the database
*
* @param ResourceInterface $resource
* @param UserInterface $user
*
* @return array
*/
public function getResourceUserPermission(ResourceInterface $resource, UserInterface $user)
{
$query = $this->getRepository()->createQueryBuilder('r')->select('r')->where('r.resource_class = :resourceClass AND r.resource_id=:resourceId AND r.user=:user')->setParameter('resourceClass', $resource->getClass())->setParameter('resourceId', $resource->getId())->setParameter('user', $user)->getQuery();
return $query->getOneOrNullResult();
}
function let(RoleProviderInterface $roleMapper, GroupPermissionProviderInterface $groupRules, UserPermissionProviderInterface $userRules, User $user, User $admin, GroupPermissionInterface $rule1, GroupPermissionInterface $rule2, GroupPermissionInterface $rule3, UserPermissionInterface $userRule1, UserPermissionInterface $userRule2, UserPermissionInterface $userRule3, ResourceInterface $resourceObject, GroupPermissionInterface $groupActionRule, UserMapper $userMapper, User $someObject)
{
$userRole = new Role();
$userRole->setId(1);
$userRole->setName('user');
$adminRole = new Role();
$adminRole->setId(2);
$adminRole->setName('admin');
$adminRole->setParent($userRole);
$roleMapper->getAllRoles()->willReturn([$userRole, $adminRole]);
$roleMapper->getRoleWithName(Argument::any())->willReturn(null);
$roleMapper->getRoleWithName('admin')->willReturn($adminRole);
$roleMapper->getRoleWithName('user')->willReturn($userRole);
/*
* Rule 1: Users can consume beer
*/
$rule1->getActions()->willReturn(['consume']);
$rule1->getRole()->willReturn($userRole);
$rule1->getResourceClass()->willReturn('string');
$rule1->getResourceId()->willReturn('beer');
$rule1->can(Argument::type('string'))->willReturn(false);
$rule1->can('consume')->willReturn(true);
/*
* Rule 2: Admins can pour beer
*/
$rule2->getActions()->willReturn(['pour']);
$rule2->getRole()->willReturn($adminRole);
$rule2->getResourceClass()->willReturn('string');
$rule2->getResourceId()->willReturn('beer');
$rule2->can(Argument::type('string'))->willReturn(false);
$rule2->can('pour')->willReturn(true);
/*
* Rule 3: Guests can look beer
*/
$rule3->getActions()->willReturn(['look']);
$rule3->getRole()->willReturn(null);
$rule3->getResourceClass()->willReturn('string');
$rule3->getResourceId()->willReturn('beer');
$rule3->can(Argument::type('string'))->willReturn(false);
$rule3->can('look')->willReturn(true);
/*
* Rule 4: Admin user can choose beer
*/
$userRule1->getActions()->willReturn(['buy']);
$userRule1->getResourceClass()->willReturn('string');
$userRule1->getResourceId()->willReturn('beer');
$userRule1->getUser()->willReturn($admin);
$userRule1->can(Argument::type('string'))->willReturn(false);
$userRule1->can('buy')->willReturn(true);
$userRule2->getActions()->willReturn(['buy']);
$userRule2->getResourceClass()->willReturn('string');
$userRule2->getResourceId()->willReturn('beer');
$userRule2->getUser()->willReturn($user);
$userRule2->can(Argument::type('string'))->willReturn(false);
$userRule2->can('buy')->willReturn(true);
$userRule3->getActions()->willReturn(['bar']);
$userRule3->getResourceClass()->willReturn('ResourceObject');
$userRule3->getResourceId()->willReturn('1234');
$userRule3->getUser()->willReturn($user);
$userRule3->addAction('foo')->willReturn(null);
$userRule3->can(Argument::type('string'))->willReturn(false);
$userRule3->can('bar')->willReturn(true);
$resourceObject->getClass()->willReturn("ResourceObject");
$resourceObject->getId()->willReturn("1234");
$groupActionRule->getResourceClass()->willReturn("ResourceObject");
$groupActionRule->getResourceId()->willReturn("1234");
$groupActionRule->getRole()->willReturn($userRole);
$groupActionRule->getActions()->willReturn(['bar']);
$groupActionRule->can(Argument::type('string'))->willReturn(false);
$groupActionRule->can('bar')->willReturn(true);
$userRules->getUserPermission(Argument::type('string'), Argument::any())->willReturn(null);
$userRules->getUserPermission('beer', $admin)->willReturn($userRule1);
$userRules->create($user, 'string', 'beer', ['buy'])->willReturn($userRule2);
$userRules->save($userRule2)->willReturn(null);
$userRules->getResourceUserPermission($resourceObject, $user)->willReturn($userRule3);
$userRules->update(Argument::any())->willReturn(null);
// to test a case, where a user implementation returns complete garbage
$userRules->getUserPermission('badresult', $user)->willReturn($someObject);
$groupRules->getPermissions('beer')->willReturn([$rule1, $rule2, $rule3]);
$groupRules->getResourcePermissions($resourceObject)->willReturn([$groupActionRule]);
$groupRules->getResourcePermissionsByClass('ResourceObject')->willReturn([$groupActionRule]);
$config = ['Foo' => ['controllers' => ['Foo\\Controller\\ThisController' => ['default' => ['user'], 'actions' => ['index' => ['user'], 'userList' => ['admin']]], 'Foo\\Controller\\AdminController' => ['default' => ['admin'], 'actions' => ['oddity' => ['user'], 'superodd' => []]], 'Foo\\Controller\\FreeForAll' => ['default' => [], 'actions' => ['get-name' => ['user']]], 'Foo\\Controller\\IndexController' => ['default' => ['user'], 'actions' => ['home' => [], 'login' => []]]]]];
$this->beConstructedWith($config, $roleMapper, $groupRules, $userRules, $userMapper);
$user->getId()->willReturn(100);
$user->getRoles()->willReturn([$userRole]);
$user->addRole(Argument::any())->willReturn(null);
$admin->getId()->willReturn(101);
$admin->getRoles()->willReturn([$adminRole]);
}
