More tests on easyACL and more bugfixes !!!

Etienne Pallier
1 parent 19a31f8f
Showing 3 changed files with 110 additions and 30 deletions Show diff stats
src/Controller/AppController.php
src/Controller/MaterielsController.php
tests/TestCase/Controller/MaterielsControllerTest.php
@@ -70,18 +70,22 @@ class AppController extends Controller {
         'DEFAULT' => array (
             // 'action' => 'condition for execution' (= 'Y', 'N', or '<condition>'),
             // with <condition> like "'field name' == 'value'"
+            // !!! Used for test, DO NOT REMOVE : !!!
+            'action_CAS4_Y' => 'Y',
+            'action_CAS4_N' => 'N',
+            // YOUR RULES :
             // CRUD actions :
             //'edit' => 'N', // update
             //'delete' => 'N',
-            'autre1' => 'Y',
-            'autre2' => 'N',
-            'autre3' => 'Y',
-            'autre4' => 'N',
         ),
         // Ajoute des ACL plus spécifiques (ci-dessus) pour le profil USER qui est plus restreint
         // Les actions absentes ne sont pas surchargées (elles sont exécutées selon les conditions définies pour 'ALL')
         'USER' => array (
+            // !!! Used for test, DO NOT REMOVE : !!!
+            'action_CAS3_Y' => 'Y',
+            'action_CAS3_N' => 'N',
+            // YOUR RULES :
             // CRUD actions
             'add' => 'Y', // C
             'index' => 'Y', // R all
@@ -182,28 +186,30 @@ class AppController extends Controller {
             case 'Administration Plus': $role='ADMINPLUS'; break;
             case 'Super Administrateur': $role='SUPERADMIN'; break;
         }
-        // 1) controller specific (role) rule for action
+        if ($doDEBUG) debug("role is $role");
+        
+        // 1) SPECIFIC controller SPECIFIC (role) rule for action
         //if (isset($controller->easyACL[$role][$action])) {
         if (self::hasACLRule($controller::easyACL, $role, $action)) {
             if ($doDEBUG) debug("CAS1");
             return $this->evalSpecificRule($controller::easyACL[$role][$action], $controller, $user, $role, $action);
         }
-        // 2) AppController ($this) specific (role) rule for action
-        //if (isset($this->easyACL[$role][$action])) { 
-        if (self::hasACLRule(self::easyACL, $role, $action)) {
+        // 2) SPECIFIC controller DEFAULT rule for action
+        //if (null !== $controller::easyACL['DEFAULT'][$action]) {
+        if (self::hasACLRule($controller::easyACL, 'DEFAULT', $action)) {
             if ($doDEBUG) debug("CAS2");
-            return $this->evalSpecificRule(self::easyACL[$role][$action], $this, $user, $role, $action);
+            return $this->evalACL($controller::easyACL['DEFAULT'][$action]);
         }
-        // 3) controller general (DEFAULT) rule for action
-        //if (null !== $controller::easyACL['DEFAULT'][$action]) {
-        if (self::hasACLRule($controller::easyACL, 'DEFAULT', $action)) {
+        // 3) ALL controllers (AppController) SPECIFIC (role) rule for action
+        //if (isset($this->easyACL[$role][$action])) { 
+        if (self::hasACLRule(self::easyACL, $role, $action)) {
             if ($doDEBUG) debug("CAS3");
-            return $this->evalACL($controller::easyACL['DEFAULT'][$action]);
+            return $this->evalSpecificRule(self::easyACL[$role][$action], $this, $user, $role, $action);
         }
-        // 4) AppController general (DEFAULT) rule for action
+        // 4) ALL controllers (AppController) DEFAULT rule for action
         //if (isset($this->easyACL['DEFAULT'][$action])) {
         //if (self::hasACLRule('DEFAULT',$action)) {
         if (self::hasACLRule(self::easyACL, 'DEFAULT',$action)) {
@@ -214,12 +220,12 @@ class AppController extends Controller {
         /*
          * (RECURSIVE CALL)
-         * 5) controller previous specific (role) rule for action
+         * 5) SPECIFIC controller PREVIOUS SPECIFIC (role) rule for action
          * ex: if role is 'SUPER', use 'ADMIN' rule
          * ex: if role is 'ADMIN', use 'RESP' rule
          * ex: if role is 'RESP', use 'USER' rule
          * ex: if role is 'USER', stop recursive call
-         * Stop recursive call if role is 'USER' => no rule found, so default is authorize (Y)
+         * Stop recursive call if role is 'USER' => no rule found, so DEFAULT IS AUTHORIZE (Y) !!! => permissive ACL
          */ 
         //if ($role == 'USER') return true;
         if ($role == 'USER') {
@@ -53,6 +53,10 @@ class MaterielsController extends AppController {
 	    'DEFAULT' => array (
 	        // 'action' => 'condition for execution' (= 'Y', 'N', or '<condition>'),
 	        // with <condition> like "'field name' == 'value'"
+	        // !!! Used for test, DO NOT REMOVE : !!!
+	        'action_CAS2_Y' => 'Y',
+	        'action_CAS2_N' => 'N',
+	        // YOUR RULES :
 	        // CRUD actions :
 	        //'index' => 'Y', // read all
 	        //'view' => 'Y', // read one
@@ -60,15 +64,17 @@ class MaterielsController extends AppController {
 	        //'find' => 'Y', // create
 	        'edit' => '(status == CREATED || status == VALIDATED)', // update
 	        'delete' => '(status == CREATED)',
-	        'autre1' => 'N',
-	        'autre2' => 'Y',
-	        //'autre3' => 'N',
-	        //'autre4' => 'NN',
 	    ),
 	    // Ajoute des ACL plus spécifiques (ci-dessus) pour le profil USER qui est plus restreint
 	    // Les actions absentes ne sont pas surchargées (elles sont exécutées selon les conditions définies pour 'ALL')
 	    'USER' => array (
+	        // !!! Used for test, DO NOT REMOVE : !!!
+	        'action_CAS1_Y' => 'Y',
+	        'action_CAS1_N' => 'N',
+	        'action_CAS6_resp_Y' => 'Y',
+	        'action_CAS6_resp_N' => 'N',
+	        // YOUR RULES :
 	        'edit' => '&& (is_creator || is_user)', // is_owner = (nom_createur == CURRENT_USER_NAME)
 	       // except fields status, owner, etiquette, and admin data, VALIDATED (only some fields, cf $modifiableFields in View/Materiels/scaffold.form.ctp)
 	        'delete' => '&& is_owner',
@@ -87,6 +93,10 @@ class MaterielsController extends AppController {
 	    // Surcharge des ACL par défaut (ci-dessus) pour le profil RESPONSABLE qui est plus restreint
 	    // Les actions absentes ne sont pas surchargées (elles sont exécutées selon les conditions définies pour 'ALL')
 	    'RESPONSABLE' => array (
+	        // !!! Used for test, DO NOT REMOVE : !!!
+	        'action_CAS6_admin_Y' => 'Y',
+	        'action_CAS6_admin_N' => 'N',
+	        // YOUR RULES :
 	        'edit' => '&& is_resp', // is_owner = (nom_createur == CURRENT_USER_NAME)
 	        //'delete' => 'is_resp && (status == CREATED)', 
 	        // Valider les matos dont il est responsable : 
@@ -135,24 +135,88 @@ class MaterielsControllerTest extends General {
      * *****************************************************************************
      */
     public function testEasyACL() {
+        $matCont = new MaterielsController();
+        $appCont = new AppController();
+        /*
         $role = 'USER_from_ldap';
         $this->authAs($role);
-        $roleLong = (new AppController())->getUserRole();
-        $matCont = new MaterielsController();
-        $this->_testEasyACL('N', $matCont, $roleLong, 'autre1');
-        $this->_testEasyACL('Y', $matCont, $roleLong, 'autre2');
-        $this->_testEasyACL('Y', $matCont, $roleLong, 'autre3');
-        $this->_testEasyACL('N', $matCont, $roleLong, 'autre4');
-        $this->_testEasyACL('Y', $matCont, $roleLong, 'unknown');
-        $this->_testEasyACL('Y', $matCont, $roleLong, 'add');
-        $this->_testEasyACL('(status == CREATED || status == VALIDATED) && (is_creator || is_user)', $matCont, $roleLong, 'edit');
+        $roleLong = $appCont->getUserRole();
+        */
+
+        /*
+         * SCHOOL CASES
+         */
+        
+        $roleLong = 'Utilisateur';
+        // CAS1
+        $this->_testEasyACL($matCont, $roleLong, 'action_CAS1_Y', 'Y');
+        $this->_testEasyACL($matCont, $roleLong, 'action_CAS1_N', 'N');
+        // CAS2
+        $this->_testEasyACL($matCont, $roleLong, 'action_CAS2_Y', 'Y');
+        $this->_testEasyACL($matCont, $roleLong, 'action_CAS2_N', 'N');
+        // CAS3
+        $this->_testEasyACL($matCont, $roleLong, 'action_CAS3_Y', 'Y');
+        $this->_testEasyACL($matCont, $roleLong, 'action_CAS3_N', 'N');
+        // CAS4
+        $this->_testEasyACL($matCont, $roleLong, 'action_CAS4_Y', 'Y');
+        $this->_testEasyACL($matCont, $roleLong, 'action_CAS4_N', 'N');
+        // CAS5
+        $this->_testEasyACL($matCont, $roleLong, 'action_unknown_CAS5_Y', 'Y');
+        
+        // CAS6
+        /*
+        $role = 'RESP';
+        $this->authAs($role);
+        $roleLong = $appCont->getUserRole();
+        */
+        $roleLong = 'Responsable';
+        $this->_testEasyACL($matCont, $roleLong, 'action_CAS6_resp_Y', 'Y');
+        $this->_testEasyACL($matCont, $roleLong, 'action_CAS6_resp_N', 'N');
+        /*
+        $role = 'ADMIN';
+        $this->authAs($role);
+        $roleLong = $appCont->getUserRole();
+        */
+        $roleLong = 'Administration';
+        $this->_testEasyACL($matCont, $roleLong, 'action_CAS6_admin_Y', 'Y');
+        $this->_testEasyACL($matCont, $roleLong, 'action_CAS6_admin_N', 'N');
+        
+        /*
+         * REAL CASES
+         */
+        
+        $roleLong = 'Utilisateur';
+        // add as USER
+        $this->_testEasyACL($matCont, $roleLong, 'add', 'Y');
+        
+        // edit
+        $this->_testEasyACL($matCont, 'Utilisateur', 'edit', '(status == CREATED || status == VALIDATED) && (is_creator || is_user)');
+        $this->_testEasyACL($matCont, 'Responsable', 'edit', '(status == CREATED || status == VALIDATED) && is_resp');
+        $this->_testEasyACL($matCont, 'Administration', 'edit', '(status == CREATED || status == VALIDATED)');
+        $this->_testEasyACL($matCont, 'Administration Plus', 'edit', '(status == CREATED || status == VALIDATED)');
+        $this->_testEasyACL($matCont, 'Super Administrateur', 'edit', '(status == CREATED || status == VALIDATED)');
+        
+        // delete
+        $this->_testEasyACL($matCont, 'Utilisateur', 'delete', '(status == CREATED) && is_owner');
+        $this->_testEasyACL($matCont, 'Responsable', 'delete', '(status == CREATED)');
+        $this->_testEasyACL($matCont, 'Administration', 'delete', '(status == CREATED)');
+        $this->_testEasyACL($matCont, 'Administration Plus', 'delete', '(status == CREATED)');
+        $this->_testEasyACL($matCont, 'Super Administrateur', 'delete', '(status == CREATED)');
+        
+        // statusCreated
+        $this->_testEasyACL($matCont, 'Utilisateur', 'statusCreated', 'N');
+        $this->_testEasyACL($matCont, 'Responsable', 'statusCreated', 'N');
+        $this->_testEasyACL($matCont, 'Administration', 'statusCreated', 'Y');
+        $this->_testEasyACL($matCont, 'Administration Plus', 'statusCreated', 'Y');
+        $this->_testEasyACL($matCont, 'Super Administrateur', 'statusCreated', 'Y');
+        
         /*
         $action='autre4';
         $rule = $matCont->isAuthorizedAction($matCont, $roleLong, $action);
         $this->assertEquals('N', $rule, $roleLong.' do '.$action);
         */
     }
-    private function _testEasyACL($expectedRule, AppController $controller, $roleLong, $action) {
+    private function _testEasyACL(AppController $controller, $roleLong, $action, $expectedRule) {
         $rule = $controller->isAuthorizedAction($controller, $roleLong, $action);
         $this->assertEquals($expectedRule, $rule, $roleLong.' do '.$action);
     }