WorkspaceAccessTest.php

<?php

declare (strict_types=1);
namespace Drupal\Tests\workspaces\Kernel;

use Drupal\Core\Access\AccessResult;
use Drupal\KernelTests\KernelTestBase;
use Drupal\Tests\user\Traits\UserCreationTrait;
use Drupal\workspaces\Entity\Workspace;

/**
 * Tests access on workspaces.
 *
 * @group workspaces
 */
class WorkspaceAccessTest extends KernelTestBase {
    use UserCreationTrait;
    
    /**
     * {@inheritdoc}
     */
    protected static $modules = [
        'user',
        'system',
        'workspaces',
        'workspace_access_test',
    ];
    
    /**
     * {@inheritdoc}
     */
    protected function setUp() : void {
        parent::setUp();
        $this->installSchema('workspaces', [
            'workspace_association',
        ]);
        $this->installEntitySchema('workspace');
        $this->installEntitySchema('user');
        // User 1.
        $this->createUser();
    }
    
    /**
     * Tests cases for testWorkspaceAccess().
     *
     * @return array
     *   An array of operations and permissions to test with.
     */
    public static function operationCases() {
        return [
            [
                'create',
                'administer workspaces',
            ],
            [
                'create',
                'create workspace',
            ],
            [
                'view',
                'administer workspaces',
            ],
            [
                'view',
                'view any workspace',
            ],
            [
                'view',
                'view own workspace',
            ],
            [
                'update',
                'administer workspaces',
            ],
            [
                'update',
                'edit any workspace',
            ],
            [
                'update',
                'edit own workspace',
            ],
            [
                'delete',
                'administer workspaces',
            ],
            [
                'delete',
                'delete any workspace',
            ],
            [
                'delete',
                'delete own workspace',
            ],
        ];
    }
    
    /**
     * Verifies all workspace roles have the correct access for the operation.
     *
     * @param string $operation
     *   The operation to test with.
     * @param string $permission
     *   The permission to test with.
     *
     * @dataProvider operationCases
     */
    public function testWorkspaceAccess($operation, $permission) : void {
        $user = $this->createUser();
        $this->setCurrentUser($user);
        $workspace = Workspace::create([
            'id' => 'oak',
        ]);
        $workspace->save();
        $this->assertFalse($workspace->access($operation, $user));
        \Drupal::entityTypeManager()->getAccessControlHandler('workspace')
            ->resetCache();
        $role = $this->createRole([
            $permission,
        ]);
        $user->addRole($role);
        $this->assertTrue($workspace->access($operation, $user));
    }
    
    /**
     * Tests workspace publishing access.
     */
    public function testPublishWorkspaceAccess() : void {
        $user = $this->createUser([
            'view own workspace',
            'edit own workspace',
        ]);
        $this->setCurrentUser($user);
        $workspace = Workspace::create([
            'id' => 'stage',
        ]);
        $workspace->save();
        // Check that, by default, an admin user is allowed to publish a workspace.
        $this->assertTrue($workspace->access('publish'));
        // Simulate an external factor which decides that a workspace can not be
        // published.
        \Drupal::state()->set('workspace_access_test.result.publish', AccessResult::forbidden());
        \Drupal::entityTypeManager()->getAccessControlHandler('workspace')
            ->resetCache();
        $this->assertFalse($workspace->access('publish'));
    }
    
    /**
     * @covers \Drupal\workspaces\Plugin\EntityReferenceSelection\WorkspaceSelection::getReferenceableEntities
     */
    public function testWorkspaceSelection() : void {
        $own_permission_user = $this->createUser([
            'view own workspace',
        ]);
        $any_permission_user = $this->createUser([
            'view any workspace',
        ]);
        $admin_permission_user = $this->createUser([
            'administer workspaces',
        ]);
        // Create the following workspace hierarchy:
        // - top1 ($own_permission_user)
        // --- child1_1 ($own_permission_user)
        // --- child1_2 ($any_permission_user)
        // ----- child1_2_1 ($any_permission_user)
        // - top2 ($admin_permission_user)
        // --- child2_1 ($admin_permission_user)
        $created_time = \Drupal::time()->getCurrentTime();
        Workspace::create([
            'uid' => $own_permission_user->id(),
            'id' => 'top1',
            'label' => 'top1',
            'created' => ++$created_time,
        ])
            ->save();
        Workspace::create([
            'uid' => $own_permission_user->id(),
            'id' => 'child1_1',
            'parent' => 'top1',
            'label' => 'child1_1',
            'created' => ++$created_time,
        ])
            ->save();
        Workspace::create([
            'uid' => $any_permission_user->id(),
            'id' => 'child1_2',
            'parent' => 'top1',
            'label' => 'child1_2',
            'created' => ++$created_time,
        ])
            ->save();
        Workspace::create([
            'uid' => $any_permission_user->id(),
            'id' => 'child1_2_1',
            'parent' => 'child1_2',
            'label' => 'child1_2_1',
            'created' => ++$created_time,
        ])
            ->save();
        Workspace::create([
            'uid' => $admin_permission_user->id(),
            'id' => 'top2',
            'label' => 'top2',
            'created' => ++$created_time,
        ])
            ->save();
        Workspace::create([
            'uid' => $admin_permission_user->id(),
            'id' => 'child2_1',
            'parent' => 'top2',
            'label' => 'child2_1',
            'created' => ++$created_time,
        ])
            ->save();
        
        /** @var \Drupal\Core\Entity\EntityReferenceSelection\SelectionInterface $selection_handler */
        $selection_handler = \Drupal::service('plugin.manager.entity_reference_selection')->getInstance([
            'target_type' => 'workspace',
            'handler' => 'default',
            'sort' => [
                'field' => 'created',
                'direction' => 'asc',
            ],
        ]);
        // The $own_permission_user should only be allowed to reference 'top1' and
        // 'child1_1'.
        $this->setCurrentUser($own_permission_user);
        $expected = [
            'top1',
            'child1_1',
        ];
        $this->assertEquals($expected, array_keys($selection_handler->getReferenceableEntities()['workspace']));
        $this->assertEquals($expected, array_keys($selection_handler->getReferenceableEntities(NULL, 'CONTAINS', 3)['workspace']));
        $expected = [
            'top1',
        ];
        $this->assertEquals($expected, array_keys($selection_handler->getReferenceableEntities('top')['workspace']));
        // The $any_permission_user and $admin_permission_user should be allowed to
        // reference any workspace.
        $expected_all = [
            'top1',
            'child1_1',
            'child1_2',
            'child1_2_1',
            'top2',
            'child2_1',
        ];
        $expected_3 = [
            'top1',
            'child1_1',
            'child1_2',
        ];
        $expected_top = [
            'top1',
            'top2',
        ];
        $this->setCurrentUser($any_permission_user);
        $this->assertEquals($expected_all, array_keys($selection_handler->getReferenceableEntities()['workspace']));
        $this->assertEquals($expected_3, array_keys($selection_handler->getReferenceableEntities(NULL, 'CONTAINS', 3)['workspace']));
        $this->assertEquals($expected_top, array_keys($selection_handler->getReferenceableEntities('top')['workspace']));
        $this->setCurrentUser($admin_permission_user);
        $this->assertEquals($expected_all, array_keys($selection_handler->getReferenceableEntities()['workspace']));
        $this->assertEquals($expected_3, array_keys($selection_handler->getReferenceableEntities(NULL, 'CONTAINS', 3)['workspace']));
        $this->assertEquals($expected_top, array_keys($selection_handler->getReferenceableEntities('top')['workspace']));
    }
    
    /**
     * @covers \Drupal\workspaces\Plugin\Block\WorkspaceSwitcherBlock::blockAccess
     */
    public function testWorkspaceSwitcherBlock() : void {
        $own_permission_user = $this->createUser([
            'view own workspace',
        ]);
        $any_permission_user = $this->createUser([
            'view any workspace',
        ]);
        $admin_permission_user = $this->createUser([
            'administer workspaces',
        ]);
        $access_content_user = $this->createUser([
            'access content',
        ]);
        $no_permission_user = $this->createUser();
        
        /** @var \Drupal\Core\Block\BlockManagerInterface $block_manager */
        $block_manager = \Drupal::service('plugin.manager.block');
        
        /** @var \Drupal\Core\Block\BlockPluginInterface $switcher_block */
        $switcher_block = $block_manager->createInstance('workspace_switcher');
        $this->assertTrue($switcher_block->access($own_permission_user));
        $this->assertTrue($switcher_block->access($any_permission_user));
        $this->assertTrue($switcher_block->access($admin_permission_user));
        $this->assertFalse($switcher_block->access($access_content_user));
        $this->assertFalse($switcher_block->access($no_permission_user));
    }

}