class BlockContentAccessHandlerTest

class BlockContentAccessHandlerTest extends KernelTestBase {
    use UserCreationTrait;
    
    /**
     * {@inheritdoc}
     */
    protected static $modules = [
        'block',
        'block_content',
        'system',
        'user',
    ];
    
    /**
     * The BlockContent access controller to test.
     *
     * @var \Drupal\block_content\BlockContentAccessControlHandler
     */
    protected $accessControlHandler;
    
    /**
     * The BlockContent entity used for testing.
     *
     * @var \Drupal\block_content\Entity\BlockContent
     */
    protected $blockEntity;
    
    /**
     * The test role.
     *
     * @var \Drupal\user\RoleInterface
     */
    protected $role;
    
    /**
     * {@inheritdoc}
     */
    protected function setUp() : void {
        parent::setUp();
        $this->installSchema('user', [
            'users_data',
        ]);
        $this->installEntitySchema('user');
        $this->installEntitySchema('block_content');
        // Create a basic block content type.
        $block_content_type = BlockContentType::create([
            'id' => 'basic',
            'label' => 'A basic block type',
            'description' => "Provides a block type that is basic.",
        ]);
        $block_content_type->save();
        // Create a square block content type.
        $block_content_type = BlockContentType::create([
            'id' => 'square',
            'label' => 'A square block type',
            'description' => "Provides a block type that is square.",
        ]);
        $block_content_type->save();
        $this->blockEntity = BlockContent::create([
            'info' => 'The Block',
            'type' => 'square',
        ]);
        $this->blockEntity
            ->save();
        // Create user 1 test does not have all permissions.
        User::create([
            'name' => 'admin',
        ])->save();
        $this->role = Role::create([
            'id' => 'test',
            'label' => 'test role',
        ]);
        $this->role
            ->save();
        $this->accessControlHandler = new BlockContentAccessControlHandler(\Drupal::entityTypeManager()->getDefinition('block_content'), \Drupal::service('event_dispatcher'));
    }
    
    /**
     * Test block content entity access.
     *
     * @param string $operation
     *   The entity operation to test.
     * @param bool $published
     *   Whether the latest revision should be published.
     * @param bool $reusable
     *   Whether the block content should be reusable. Non-reusable blocks are
     *   typically used in Layout Builder.
     * @param array $permissions
     *   Permissions to grant to the test user.
     * @param bool $isLatest
     *   Whether the block content should be the latest revision when checking
     *   access. If FALSE, multiple revisions will be created, and an older
     *   revision will be loaded before checking access.
     * @param string|null $parent_access
     *   Whether the test user has access to the parent entity, valid values are
     *   class names of classes implementing AccessResultInterface. Set to NULL to
     *   assert parent will not be called.
     * @param string $expected_access
     *   The expected access for the user and block content. Valid values are
     *   class names of classes implementing AccessResultInterface
     * @param string|null $expected_access_message
     *   The expected access message.
     *
     * @covers ::checkAccess
     *
     * @dataProvider providerTestAccess
     *
     * @phpstan-param class-string<\Drupal\Core\Access\AccessResultInterface>|null $parent_access
     * @phpstan-param class-string<\Drupal\Core\Access\AccessResultInterface> $expected_access
     */
    public function testAccess(string $operation, bool $published, bool $reusable, array $permissions, bool $isLatest, ?string $parent_access, string $expected_access, ?string $expected_access_message = NULL) : void {
        
        /** @var \Drupal\Core\Entity\RevisionableStorageInterface $entityStorage */
        $entityStorage = \Drupal::entityTypeManager()->getStorage('block_content');
        $loadRevisionId = NULL;
        if (!$isLatest) {
            // Save a historical revision, then setup for a new revision to be saved.
            $this->blockEntity
                ->save();
            $loadRevisionId = $this->blockEntity
                ->getRevisionId();
            $this->blockEntity = $entityStorage->createRevision($this->blockEntity);
        }
        $published ? $this->blockEntity
            ->setPublished() : $this->blockEntity
            ->setUnpublished();
        $reusable ? $this->blockEntity
            ->setReusable() : $this->blockEntity
            ->setNonReusable();
        $user = User::create([
            'name' => 'Someone',
            'mail' => 'hi@example.com',
        ]);
        if ($permissions) {
            foreach ($permissions as $permission) {
                $this->role
                    ->grantPermission($permission);
            }
            $this->role
                ->save();
        }
        $user->addRole($this->role
            ->id())
            ->save();
        if ($parent_access !== NULL) {
            $parent_entity = $this->prophesize(AccessibleInterface::class);
            $expected_parent_result = new $parent_access();
            $parent_entity->access($operation, $user, TRUE)
                ->willReturn($expected_parent_result)
                ->shouldBeCalled();
            $this->blockEntity
                ->setAccessDependency($parent_entity->reveal());
        }
        $this->blockEntity
            ->save();
        // Reload a previous revision.
        if ($loadRevisionId !== NULL) {
            $this->blockEntity = $entityStorage->loadRevision($loadRevisionId);
        }
        $result = $this->accessControlHandler
            ->access($this->blockEntity, $operation, $user, TRUE);
        $this->assertInstanceOf($expected_access, $result);
        if ($expected_access_message !== NULL) {
            $this->assertInstanceOf(AccessResultReasonInterface::class, $result);
            $this->assertEquals($expected_access_message, $result->getReason());
        }
    }
    
    /**
     * Data provider for testAccess().
     */
    public static function providerTestAccess() : array {
        $cases = [
            'view:published:reusable' => [
                'view',
                TRUE,
                TRUE,
                [],
                TRUE,
                NULL,
                AccessResultAllowed::class,
            ],
            'view:unpublished:reusable' => [
                'view',
                FALSE,
                TRUE,
                [],
                TRUE,
                NULL,
                AccessResultNeutral::class,
            ],
            'view:unpublished:reusable:admin' => [
                'view',
                FALSE,
                TRUE,
                [
                    'access block library',
                ],
                TRUE,
                NULL,
                AccessResultAllowed::class,
            ],
            'view:unpublished:reusable:per-block-editor:basic' => [
                'view',
                FALSE,
                TRUE,
                [
                    'edit any basic block content',
                ],
                TRUE,
                NULL,
                AccessResultNeutral::class,
            ],
            'view:unpublished:reusable:per-block-editor:square' => [
                'view',
                FALSE,
                TRUE,
                [
                    'access block library',
                    'edit any basic block content',
                ],
                TRUE,
                NULL,
                AccessResultAllowed::class,
            ],
            'view:published:reusable:admin' => [
                'view',
                TRUE,
                TRUE,
                [
                    'access block library',
                ],
                TRUE,
                NULL,
                AccessResultAllowed::class,
            ],
            'view:published:reusable:per-block-editor:basic' => [
                'view',
                TRUE,
                TRUE,
                [
                    'access block library',
                    'edit any basic block content',
                ],
                TRUE,
                NULL,
                AccessResultAllowed::class,
            ],
            'view:published:reusable:per-block-editor:square' => [
                'view',
                TRUE,
                TRUE,
                [
                    'access block library',
                    'edit any square block content',
                ],
                TRUE,
                NULL,
                AccessResultAllowed::class,
            ],
            'view:published:non_reusable' => [
                'view',
                TRUE,
                FALSE,
                [],
                TRUE,
                NULL,
                AccessResultForbidden::class,
            ],
            'view:published:non_reusable:parent_allowed' => [
                'view',
                TRUE,
                FALSE,
                [],
                TRUE,
                AccessResultAllowed::class,
                AccessResultAllowed::class,
            ],
            'view:published:non_reusable:parent_neutral' => [
                'view',
                TRUE,
                FALSE,
                [],
                TRUE,
                AccessResultNeutral::class,
                AccessResultNeutral::class,
            ],
            'view:published:non_reusable:parent_forbidden' => [
                'view',
                TRUE,
                FALSE,
                [],
                TRUE,
                AccessResultForbidden::class,
                AccessResultForbidden::class,
            ],
        ];
        foreach ([
            'update',
            'delete',
        ] as $operation) {
            $label = $operation === 'update' ? 'edit' : 'delete';
            $cases += [
                $operation . ':published:reusable' => [
                    $operation,
                    TRUE,
                    TRUE,
                    [],
                    TRUE,
                    NULL,
                    AccessResultNeutral::class,
                ],
                $operation . ':unpublished:reusable' => [
                    $operation,
                    FALSE,
                    TRUE,
                    [],
                    TRUE,
                    NULL,
                    AccessResultNeutral::class,
                ],
                $operation . ':unpublished:reusable:admin' => [
                    $operation,
                    FALSE,
                    TRUE,
                    [
                        $label . ' any square block content',
                    ],
                    TRUE,
                    NULL,
                    AccessResultAllowed::class,
                ],
                $operation . ':published:reusable:admin' => [
                    $operation,
                    TRUE,
                    TRUE,
                    [
                        $label . ' any square block content',
                    ],
                    TRUE,
                    NULL,
                    AccessResultAllowed::class,
                ],
                $operation . ':published:non_reusable' => [
                    $operation,
                    TRUE,
                    FALSE,
                    [],
                    TRUE,
                    NULL,
                    AccessResultForbidden::class,
                ],
                $operation . ':published:non_reusable:parent_allowed' => [
                    $operation,
                    TRUE,
                    FALSE,
                    [],
                    TRUE,
                    AccessResultAllowed::class,
                    AccessResultNeutral::class,
                ],
                $operation . ':published:non_reusable:parent_neutral' => [
                    $operation,
                    TRUE,
                    FALSE,
                    [],
                    TRUE,
                    AccessResultNeutral::class,
                    AccessResultNeutral::class,
                ],
                $operation . ':published:non_reusable:parent_forbidden' => [
                    $operation,
                    TRUE,
                    FALSE,
                    [],
                    TRUE,
                    AccessResultForbidden::class,
                    AccessResultForbidden::class,
                ],
                $operation . ':unpublished:reusable:per-block-editor:basic' => [
                    $operation,
                    FALSE,
                    TRUE,
                    [
                        'edit any basic block content',
                    ],
                    TRUE,
                    NULL,
                    AccessResultNeutral::class,
                ],
                $operation . ':published:reusable:per-block-editor:basic' => [
                    $operation,
                    TRUE,
                    TRUE,
                    [
                        'edit any basic block content',
                    ],
                    TRUE,
                    NULL,
                    AccessResultNeutral::class,
                ],
            ];
        }
        $cases += [
            'update:unpublished:reusable:per-block-editor:square' => [
                'update',
                FALSE,
                TRUE,
                [
                    'edit any square block content',
                ],
                TRUE,
                NULL,
                AccessResultAllowed::class,
            ],
            'update:published:reusable:per-block-editor:square' => [
                'update',
                TRUE,
                TRUE,
                [
                    'edit any square block content',
                ],
                TRUE,
                NULL,
                AccessResultAllowed::class,
            ],
        ];
        $cases += [
            'delete:unpublished:reusable:per-block-editor:square' => [
                'delete',
                FALSE,
                TRUE,
                [
                    'edit any square block content',
                ],
                TRUE,
                NULL,
                AccessResultNeutral::class,
            ],
            'delete:published:reusable:per-block-editor:square' => [
                'delete',
                TRUE,
                TRUE,
                [
                    'edit any square block content',
                ],
                TRUE,
                NULL,
                AccessResultNeutral::class,
            ],
        ];
        // View all revisions:
        $cases['view all revisions:none'] = [
            'view all revisions',
            TRUE,
            TRUE,
            [],
            TRUE,
            NULL,
            AccessResultNeutral::class,
        ];
        $cases['view all revisions:view any bundle history'] = [
            'view all revisions',
            TRUE,
            TRUE,
            [
                'view any square block content history',
            ],
            TRUE,
            NULL,
            AccessResultAllowed::class,
        ];
        $cases['view all revisions:administer block content'] = [
            'view all revisions',
            TRUE,
            TRUE,
            [
                'administer block content',
            ],
            TRUE,
            NULL,
            AccessResultAllowed::class,
        ];
        // Revert revisions:
        $cases['revert:none:latest'] = [
            'revert',
            TRUE,
            TRUE,
            [],
            TRUE,
            NULL,
            AccessResultForbidden::class,
        ];
        $cases['revert:none:historical'] = [
            'revert',
            TRUE,
            TRUE,
            [],
            FALSE,
            NULL,
            AccessResultNeutral::class,
        ];
        $cases['revert:revert bundle:historical'] = [
            'revert',
            TRUE,
            TRUE,
            [
                'revert any square block content revisions',
            ],
            FALSE,
            NULL,
            AccessResultAllowed::class,
        ];
        $cases['revert:administer block content:latest'] = [
            'revert',
            TRUE,
            TRUE,
            [
                'administer block content',
            ],
            TRUE,
            NULL,
            AccessResultForbidden::class,
        ];
        $cases['revert:administer block content:historical'] = [
            'revert',
            TRUE,
            TRUE,
            [
                'administer block content',
            ],
            FALSE,
            NULL,
            AccessResultAllowed::class,
        ];
        $cases['revert:revert bundle:historical:non reusable'] = [
            'revert',
            TRUE,
            FALSE,
            [
                'revert any square block content revisions',
            ],
            FALSE,
            NULL,
            AccessResultForbidden::class,
            'Block content must be reusable to use `revert` operation',
        ];
        // Delete revisions:
        $cases['delete revision:none:latest'] = [
            'delete revision',
            TRUE,
            TRUE,
            [],
            TRUE,
            NULL,
            AccessResultForbidden::class,
        ];
        $cases['delete revision:none:historical'] = [
            'delete revision',
            TRUE,
            TRUE,
            [],
            FALSE,
            NULL,
            AccessResultNeutral::class,
        ];
        $cases['delete revision:administer block content:latest'] = [
            'delete revision',
            TRUE,
            TRUE,
            [
                'administer block content',
            ],
            TRUE,
            NULL,
            AccessResultForbidden::class,
        ];
        $cases['delete revision:administer block content:historical'] = [
            'delete revision',
            TRUE,
            TRUE,
            [
                'administer block content',
            ],
            FALSE,
            NULL,
            AccessResultAllowed::class,
        ];
        $cases['delete revision:delete bundle:latest'] = [
            'delete revision',
            TRUE,
            TRUE,
            [
                'administer block content',
            ],
            TRUE,
            NULL,
            AccessResultForbidden::class,
        ];
        $cases['delete revision:delete bundle:historical'] = [
            'delete revision',
            TRUE,
            TRUE,
            [
                'delete any square block content revisions',
            ],
            FALSE,
            NULL,
            AccessResultAllowed::class,
        ];
        $cases['delete revision:delete bundle:historical:non reusable'] = [
            'delete revision',
            TRUE,
            FALSE,
            [
                'delete any square block content revisions',
            ],
            FALSE,
            NULL,
            AccessResultForbidden::class,
            'Block content must be reusable to use `delete revision` operation',
        ];
        return $cases;
    }
    
    /**
     * Tests revision log access.
     */
    public function testRevisionLogAccess() : void {
        $admin = $this->createUser([
            'administer block content',
            'access content',
        ]);
        $editor = $this->createUser([
            'access content',
            'access block library',
            'view any square block content history',
        ]);
        $viewer = $this->createUser([
            'access content',
        ]);
        $this->assertTrue($this->blockEntity
            ->get('revision_log')
            ->access('view', $admin));
        $this->assertTrue($this->blockEntity
            ->get('revision_log')
            ->access('view', $editor));
        $this->assertFalse($this->blockEntity
            ->get('revision_log')
            ->access('view', $viewer));
    }

}