Skip to content
This repository was archived by the owner on Sep 10, 2021. It is now read-only.

Commit 2bb7f77

Browse files
author
Michael Grauer
committed
ENH: refs #953. created testing to fail on itemListPermissions bug.
1 parent ea02275 commit 2bb7f77

File tree

4 files changed

+138
-117
lines changed

4 files changed

+138
-117
lines changed

‎core/tests/databaseDataset/default.xml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -168,6 +168,7 @@
168168
<itempolicyuser item_id="1006" user_id="1" policy='2' />
169169
<item2folder item_id="1006" folder_id='1014' />
170170

171+
171172
<user user_id="4" firstname="community2001" lastname="Member"
172173
admin="0" email="community2001@member.com" password="35fd8ba86ba403ffcc00feac5355ad20" creation="2011-01-27 12:11:02" folder_id="1006" />
173174
<user2group group_id="3005" user_id="4" />
@@ -178,6 +179,10 @@
178179
admin="0" email="community2001@admin.com" password="35fd8ba86ba403ffcc00feac5355ad20" creation="2011-01-27 12:11:02" folder_id="1006" />
179180
<user2group group_id="3003" user_id="6" />
180181

182+
<itempolicyuser item_id="1006" user_id="4" policy='0' />
183+
<itempolicyuser item_id="1006" user_id="5" policy='1' />
184+
185+
181186
<newuserinvitation newuserinvitation_id="1001" email="dummy@dummy.com" auth_key="12345" inviter_id="4" community_id="2001" group_id="3003" date_creation="2011-01-27 12:11:02" />
182187
<pendinguser pendinguser_id="1001" email="dummy@dummy.com" auth_key="12345" password="abcdef" firstname="Dummy" lastname="Dummy" date_creation="2011-01-27 12:11:02" />
183188
</dataset>

‎modules/api/tests/controllers/ApiCallGroupMethodsTest.php‎

Lines changed: 0 additions & 104 deletions
Original file line numberDiff line numberDiff line change
@@ -27,110 +27,6 @@ public function setUp()
2727
parent::setUp();
2828
}
2929

30-
/**
31-
* helper function to test simple invalid cases:
32-
* will test all invalid users sending in all required valid params
33-
* will also test all combinations of invalid params with a valid user
34-
* for each required param
35-
* @param type $method
36-
* @param type $validUser
37-
* @param type $invalidUsers
38-
* @param type $requiredParams
39-
*/
40-
protected function exerciseInvalidCases($method, $validUser, $invalidUsers, $requiredParams)
41-
{
42-
// test all invalid users with valid params
43-
foreach($invalidUsers as $invalidUser)
44-
{
45-
$this->resetAll();
46-
if($invalidUser != null)
47-
{
48-
$this->params['token'] = $this->_loginAsUser($invalidUser);
49-
}
50-
$this->params['method'] = $method;
51-
foreach($requiredParams as $requiredParam)
52-
{
53-
$this->params[$requiredParam['name']] = $requiredParam['valid'];
54-
}
55-
$resp = $this->_callJsonApi();
56-
$this->_assertStatusFail($resp, MIDAS_INVALID_POLICY);
57-
}
58-
59-
// test valid user with all combinations of missing/invalid/valid params
60-
// will not test a case of valid user and all valid params
61-
62-
$numParams = sizeof($requiredParams);
63-
// create an int array that is initially all 0
64-
$requiredParamStates = array_fill(0, $numParams, 0);
65-
$allTwosSum = 2 * $numParams;
66-
67-
while(array_sum($requiredParamStates) < $allTwosSum)
68-
{
69-
$this->resetAll();
70-
$this->params['token'] = $this->_loginAsUser($validUser);
71-
$this->params['method'] = $method;
72-
$skipTestCase = false;
73-
foreach($requiredParams as $ind => $requiredParam)
74-
{
75-
// find the state corresponding to this param
76-
$state = $requiredParamStates[$ind];
77-
// 0s mean the param is missing (not sent)
78-
if($state == 1)
79-
{
80-
// 1s mean an invalid form of the param is sent
81-
if(!array_key_exists('invalid', $requiredParam))
82-
{
83-
// some params may not have an invalid form
84-
// skip this test case as it would repeat the case of the missing param
85-
$skipTestCase = true;
86-
break;
87-
}
88-
$this->params[$requiredParam['name']] = $requiredParam['invalid'];
89-
}
90-
elseif($state == 2)
91-
{
92-
// 2s mean a valid form of the param is sent
93-
$this->params[$requiredParam['name']] = $requiredParam['valid'];
94-
}
95-
elseif($state < 0 || $state > 2)
96-
{
97-
throw new Exception("left most param state is invalid value: ".$state);
98-
}
99-
}
100-
if(!$skipTestCase)
101-
{
102-
$resp = $this->_callJsonApi();
103-
$this->_assertStatusFail($resp, MIDAS_INVALID_PARAMETER);
104-
}
105-
106-
// now increment the parameter states
107-
// add 1 to the right most value
108-
$incrementIndex = $numParams - 1;
109-
$rightMost = $requiredParamStates[$incrementIndex];
110-
$rightMost += 1;
111-
$requiredParamStates[$incrementIndex] = $rightMost;
112-
while($rightMost == 3)
113-
{
114-
// if the right most goes to 3, set it to 0
115-
// and repeat the process one index to the left, stop moving
116-
// to the left when the last increment doesn't go to 3,
117-
// i.e. there are no more carry bits
118-
$rightMost = 0;
119-
$requiredParamStates[$incrementIndex] = $rightMost;
120-
if($incrementIndex > 0)
121-
{
122-
$incrementIndex -= 1;
123-
$rightMost = $requiredParamStates[$incrementIndex];
124-
$rightMost += 1;
125-
$requiredParamStates[$incrementIndex] = $rightMost;
126-
}
127-
else
128-
{
129-
throw new Exception("left most param state is 3");
130-
}
131-
}
132-
}
133-
}
13430

13531
/** Test adding and removing a user from a group */
13632
public function testGroupUserAddRemove()

‎modules/api/tests/controllers/ApiCallItemMethodsTest.php‎

Lines changed: 25 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1851,22 +1851,34 @@ public function testItemListPermissions()
18511851
$readItem = $itemModel->load('1004');
18521852
$writeItem = $itemModel->load('1005');
18531853
$adminItem = $itemModel->load('1006');
1854-
$nonAdmins = array($readItem, $writeItem);
18551854

18561855
$params = array('method' => 'midas.item.list.permissions',
18571856
'token' => $this->_loginAsUser($userDao));
1858-
1859-
// try to list permissions without admin, should fail
1860-
foreach($nonAdmins as $item)
1861-
{
1862-
$this->resetAll();
1863-
$params['item_id'] = $item->getItemId();
1864-
$this->params = $params;
1865-
$resp = $this->_callJsonApi();
1866-
$this->_assertStatusFail($resp, MIDAS_INVALID_POLICY);
1867-
}
1868-
1869-
// now with admin perms
1857+
$invalidItemId = -10;
1858+
1859+
// test with item the user has admin over
1860+
$requiredParams = array(
1861+
array('name' => 'item_id', 'valid' => $adminItem->getItemId(), 'invalid' => $invalidItemId));
1862+
1863+
$memberUser = $userModel->load('4');
1864+
$modUser = $userModel->load('5');
1865+
1866+
// first assert that these invalid users have the expected rights
1867+
$this->assertFalse($itemModel->policyCheck($adminItem, null, MIDAS_POLICY_READ), 'anonymous user should not have read access to admin item');
1868+
$this->assertFalse($itemModel->policyCheck($adminItem, null, MIDAS_POLICY_WRITE), 'anonymous user should not have write access to admin item');
1869+
$this->assertFalse($itemModel->policyCheck($adminItem, null, MIDAS_POLICY_ADMIN), 'anonymous user should not have admin access to admin item');
1870+
$this->assertTrue($itemModel->policyCheck($adminItem, $memberUser, MIDAS_POLICY_READ), 'member user should have read access to admin item');
1871+
$this->assertFalse($itemModel->policyCheck($adminItem, $memberUser, MIDAS_POLICY_WRITE), 'member user should not have write access to admin item');
1872+
$this->assertFalse($itemModel->policyCheck($adminItem, $memberUser, MIDAS_POLICY_ADMIN), 'member user should not have admin access to admin item');
1873+
$this->assertTrue($itemModel->policyCheck($adminItem, $modUser, MIDAS_POLICY_READ), 'moderator user should have read access to admin item');
1874+
$this->assertTrue($itemModel->policyCheck($adminItem, $modUser, MIDAS_POLICY_WRITE), 'moderator user should have write access to admin item');
1875+
$this->assertFalse($itemModel->policyCheck($adminItem, $modUser, MIDAS_POLICY_ADMIN), 'moderator user should not have admin access to admin item');
1876+
1877+
$invalidUsers = array($memberUser, $modUser, null);
1878+
$this->exerciseInvalidCases($params['method'], $userDao, $invalidUsers, $requiredParams);
1879+
1880+
// now with admin perms which are valid
1881+
$this->assertTrue($itemModel->policyCheck($adminItem, $userDao, MIDAS_POLICY_ADMIN), 'admin user should have admin access to admin item');
18701882

18711883
// first check both privacy statuses
18721884
$privacyCodes = array("Public" => MIDAS_PRIVACY_PUBLIC, "Private" => MIDAS_PRIVACY_PRIVATE);

‎modules/api/tests/controllers/ApiCallMethodsTest.php‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -314,4 +314,112 @@ protected function assertPolicyuserNonexistence($testFolders, $testItems, $user)
314314
}
315315
}
316316

317+
/**
318+
* helper function to test simple invalid cases:
319+
* will test all invalid users sending in all required valid params
320+
* will also test all combinations of invalid params with a valid user
321+
* for each required param
322+
* @param $method full name of api method
323+
* @param type $validUser userDao of a user authorized to make the api call
324+
* @param type $invalidUsers array of userDaos not authorized to call api
325+
* @param type $requiredParams array of
326+
* 'name' => name of param,
327+
* 'valid' => a valid value for the param
328+
* 'invalid' => an invalid value for the param, is optional
329+
*/
330+
protected function exerciseInvalidCases($method, $validUser, $invalidUsers, $requiredParams)
331+
{
332+
// test all invalid users with valid params
333+
foreach($invalidUsers as $invalidUser)
334+
{
335+
$this->resetAll();
336+
if($invalidUser != null)
337+
{
338+
$this->params['token'] = $this->_loginAsUser($invalidUser);
339+
}
340+
$this->params['method'] = $method;
341+
foreach($requiredParams as $requiredParam)
342+
{
343+
$this->params[$requiredParam['name']] = $requiredParam['valid'];
344+
}
345+
$resp = $this->_callJsonApi();
346+
$this->_assertStatusFail($resp, MIDAS_INVALID_POLICY);
347+
}
348+
349+
// test valid user with all combinations of missing/invalid/valid params
350+
// will not test a case of valid user and all valid params
351+
352+
$numParams = sizeof($requiredParams);
353+
// create an int array that is initially all 0
354+
$requiredParamStates = array_fill(0, $numParams, 0);
355+
$allTwosSum = 2 * $numParams;
356+
357+
while(array_sum($requiredParamStates) < $allTwosSum)
358+
{
359+
$this->resetAll();
360+
$this->params['token'] = $this->_loginAsUser($validUser);
361+
$this->params['method'] = $method;
362+
$skipTestCase = false;
363+
foreach($requiredParams as $ind => $requiredParam)
364+
{
365+
// find the state corresponding to this param
366+
$state = $requiredParamStates[$ind];
367+
// 0s mean the param is missing (not sent)
368+
if($state == 1)
369+
{
370+
// 1s mean an invalid form of the param is sent
371+
if(!array_key_exists('invalid', $requiredParam))
372+
{
373+
// some params may not have an invalid form
374+
// skip this test case as it would repeat the case of the missing param
375+
$skipTestCase = true;
376+
break;
377+
}
378+
$this->params[$requiredParam['name']] = $requiredParam['invalid'];
379+
}
380+
elseif($state == 2)
381+
{
382+
// 2s mean a valid form of the param is sent
383+
$this->params[$requiredParam['name']] = $requiredParam['valid'];
384+
}
385+
elseif($state < 0 || $state > 2)
386+
{
387+
throw new Exception("left most param state is invalid value: ".$state);
388+
}
389+
}
390+
if(!$skipTestCase)
391+
{
392+
$resp = $this->_callJsonApi();
393+
$this->_assertStatusFail($resp, MIDAS_INVALID_PARAMETER);
394+
}
395+
396+
// now increment the parameter states
397+
// add 1 to the right most value
398+
$incrementIndex = $numParams - 1;
399+
$rightMost = $requiredParamStates[$incrementIndex];
400+
$rightMost += 1;
401+
$requiredParamStates[$incrementIndex] = $rightMost;
402+
while($rightMost == 3)
403+
{
404+
// if the right most goes to 3, set it to 0
405+
// and repeat the process one index to the left, stop moving
406+
// to the left when the last increment doesn't go to 3,
407+
// i.e. there are no more carry bits
408+
$rightMost = 0;
409+
$requiredParamStates[$incrementIndex] = $rightMost;
410+
if($incrementIndex > 0)
411+
{
412+
$incrementIndex -= 1;
413+
$rightMost = $requiredParamStates[$incrementIndex];
414+
$rightMost += 1;
415+
$requiredParamStates[$incrementIndex] = $rightMost;
416+
}
417+
else
418+
{
419+
throw new Exception("left most param state is 3");
420+
}
421+
}
422+
}
423+
}
424+
317425
}

0 commit comments

Comments
 (0)