class AccessTest

class AccessTest extends KernelTestBase {
  
  /**
   * Modules to enable.
   *
   * @var array
   */
  protected static $modules = [
    'file',
    'system',
    'user',
  ];
  
  /**
   * An authenticated user.
   *
   * @var \Drupal\user\UserInterface
   */
  protected $user1;
  
  /**
   * An authenticated user.
   *
   * @var \Drupal\user\UserInterface
   */
  protected $user2;
  
  /**
   * The file object used in the test.
   *
   * @var \Drupal\file\FileInterface
   */
  protected $file;
  
  /**
   * {@inheritdoc}
   */
  protected function setUp() : void {
    parent::setUp();
    $this->installEntitySchema('file');
    $this->installEntitySchema('user');
    $this->installSchema('file', [
      'file_usage',
    ]);
    $this->installSchema('system', 'sequences');
    $this->user1 = User::create([
      'name' => 'user1',
      'status' => 1,
    ]);
    $this->user1
      ->save();
    $this->user2 = User::create([
      'name' => 'user2',
      'status' => 1,
    ]);
    $this->user2
      ->save();
    $this->file = File::create([
      'uid' => $this->user1
        ->id(),
      'filename' => 'druplicon.txt',
      'filemime' => 'text/plain',
    ]);
  }
  
  /**
   * Tests that only the file owner can delete or update a file.
   */
  public function testOnlyOwnerCanDeleteUpdateFile() {
    \Drupal::currentUser()->setAccount($this->user2);
    $this->assertFalse($this->file
      ->access('delete'));
    $this->assertFalse($this->file
      ->access('update'));
    \Drupal::currentUser()->setAccount($this->user1);
    $this->assertTrue($this->file
      ->access('delete'));
    $this->assertTrue($this->file
      ->access('update'));
  }
  
  /**
   * Tests file entity field access.
   *
   * @see \Drupal\file\FileAccessControlHandler::checkFieldAccess()
   */
  public function testCheckFieldAccess() {
    \Drupal::currentUser()->setAccount($this->user1);
    /** @var \Drupal\file\FileInterface $file */
    $file = File::create([
      'uri' => 'public://test.png',
    ]);
    // While creating a file entity access will be allowed for create-only
    // fields.
    $this->assertTrue($file->get('uri')
      ->access('edit'));
    $this->assertTrue($file->get('filemime')
      ->access('edit'));
    $this->assertTrue($file->get('filesize')
      ->access('edit'));
    // Access to the status field is denied whilst creating a file entity.
    $this->assertFalse($file->get('status')
      ->access('edit'));
    $file->save();
    // After saving the entity is no longer new and, therefore, access to
    // create-only fields and the status field will be denied.
    $this->assertFalse($file->get('uri')
      ->access('edit'));
    $this->assertFalse($file->get('filemime')
      ->access('edit'));
    $this->assertFalse($file->get('filesize')
      ->access('edit'));
    $this->assertFalse($file->get('status')
      ->access('edit'));
  }
  
  /**
   * Tests create access checks.
   */
  public function testCreateAccess() {
    // Anonymous users can create a file by default.
    $this->assertFalse($this->file
      ->access('create'));
    // Authenticated users can create a file by default.
    \Drupal::currentUser()->setAccount($this->user1);
    $this->assertFalse($this->file
      ->access('create'));
  }
  
  /**
   * Tests cacheability metadata.
   */
  public function testFileCacheability() {
    $file = File::create([
      'filename' => 'green-scarf',
      'uri' => 'private://green-scarf',
      'filemime' => 'text/plain',
    ]);
    $file->setPermanent();
    $file->save();
    \Drupal::service('session')->set('anonymous_allowed_file_ids', [
      $file->id() => $file->id(),
    ]);
    $account = User::getAnonymousUser();
    $file->setOwnerId($account->id())
      ->save();
    $this->assertSame([
      'session',
      'user',
    ], $file->access('view', $account, TRUE)
      ->getCacheContexts());
    $this->assertSame([
      'session',
      'user',
    ], $file->access('download', $account, TRUE)
      ->getCacheContexts());
    $account = $this->user1;
    $file->setOwnerId($account->id())
      ->save();
    $this->assertSame([
      'user',
    ], $file->access('view', $account, TRUE)
      ->getCacheContexts());
    $this->assertSame([
      'user',
    ], $file->access('download', $account, TRUE)
      ->getCacheContexts());
  }

}