diff --git a/admin/roles/classes/privacy/provider.php b/admin/roles/classes/privacy/provider.php new file mode 100644 index 0000000000000..ee8bcea104d9b --- /dev/null +++ b/admin/roles/classes/privacy/provider.php @@ -0,0 +1,382 @@ +. +/** + * Privacy Subsystem implementation for core_role. + * + * @package core_role + * @copyright 2018 Carlos Escobedo + * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later + */ +namespace core_role\privacy; +defined('MOODLE_INTERNAL') || die(); + +use \core_privacy\local\metadata\collection; +use \core_privacy\local\request\contextlist; +use \core_privacy\local\request\approved_contextlist; +use \core_privacy\local\request\transform; +use \core_privacy\local\request\writer; + +/** + * Privacy provider for core_role. + * + * @copyright 2018 Carlos Escobedo + * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later + */ +class provider implements + \core_privacy\local\metadata\provider, + \core_privacy\local\request\subsystem\provider, + \core_privacy\local\request\subsystem\plugin_provider, + \core_privacy\local\request\user_preference_provider { + + /** + * Get information about the user data stored by this plugin. + * + * @param collection $collection An object for storing metadata. + * @return collection The metadata. + */ + public static function get_metadata(collection $collection) : collection { + $rolecapabilities = [ + 'roleid' => 'privacy:metadata:role_capabilities:roleid', + 'capability' => 'privacy:metadata:role_capabilities:capability', + 'permission' => 'privacy:metadata:role_capabilities:permission', + 'timemodified' => 'privacy:metadata:role_capabilities:timemodified', + 'modifierid' => 'privacy:metadata:role_capabilities:modifierid' + ]; + $roleassignments = [ + 'roleid' => 'privacy:metadata:role_assignments:roleid', + 'userid' => 'privacy:metadata:role_assignments:userid', + 'timemodified' => 'privacy:metadata:role_assignments:timemodified', + 'modifierid' => 'privacy:metadata:role_assignments:modifierid', + 'component' => 'privacy:metadata:role_assignments:component', + 'itemid' => 'privacy:metadata:role_assignments:itemid' + ]; + $collection->add_database_table('role_capabilities', $rolecapabilities, + 'privacy:metadata:role_capabilities:tableexplanation'); + $collection->add_database_table('role_assignments', $roleassignments, + 'privacy:metadata:role_assignments:tableexplanation'); + + $collection->add_user_preference('definerole_showadvanced', + 'privacy:metadata:preference:showadvanced'); + + return $collection; + } + /** + * Export all user preferences for the plugin. + * + * @param int $userid The userid of the user whose data is to be exported. + */ + public static function export_user_preferences(int $userid) { + $showadvanced = get_user_preferences('definerole_showadvanced', null, $userid); + if ($showadvanced !== null) { + writer::export_user_preference('core_role', + 'definerole_showadvanced', + transform::yesno($showadvanced), + get_string('privacy:metadata:preference:showadvanced', 'core_role') + ); + } + } + /** + * Return all contexts for this userid. + * + * @param int $userid The user ID. + * @return contextlist The list of context IDs. + */ + public static function get_contexts_for_userid(int $userid) : contextlist { + global $DB; + + $contextlist = new contextlist(); + + // The role_capabilities table contains user data. + $contexts = [ + CONTEXT_SYSTEM, + CONTEXT_USER, + CONTEXT_COURSECAT, + CONTEXT_COURSE, + CONTEXT_MODULE, + CONTEXT_BLOCK + ]; + list($insql, $inparams) = $DB->get_in_or_equal($contexts, SQL_PARAMS_NAMED); + $sql = "SELECT ctx.id + FROM {context} ctx + JOIN {role_capabilities} rc + ON rc.contextid = ctx.id + AND ((ctx.contextlevel {$insql} AND rc.modifierid = :modifierid) + OR (ctx.contextlevel = :contextlevel AND ctx.instanceid = :userid))"; + $params = [ + 'modifierid' => $userid, + 'contextlevel' => CONTEXT_USER, + 'userid' => $userid + ]; + $params += $inparams; + + $contextlist->add_from_sql($sql, $params); + + // The role_assignments table contains user data. + $contexts = [ + CONTEXT_SYSTEM, + CONTEXT_USER, + CONTEXT_COURSECAT, + CONTEXT_COURSE, + CONTEXT_MODULE, + CONTEXT_BLOCK + ]; + list($insql, $inparams) = $DB->get_in_or_equal($contexts, SQL_PARAMS_NAMED); + $params = [ + 'userid' => $userid, + 'modifierid' => $userid + ]; + $params += $inparams; + $sql = "SELECT ctx.id + FROM {role_assignments} ra + JOIN {context} ctx + ON ctx.id = ra.contextid + AND ctx.contextlevel {$insql} + WHERE (ra.userid = :userid + OR ra.modifierid = :modifierid) + AND ra.component != 'tool_cohortroles'"; + $contextlist->add_from_sql($sql, $params); + + return $contextlist; + } + /** + * Export all user data for the specified user, in the specified contexts. + * + * @param approved_contextlist $contextlist The list of approved contexts for a user. + */ + public static function export_user_data(approved_contextlist $contextlist) { + global $DB; + + if (empty($contextlist)) { + return; + } + + $rolesnames = self::get_roles_name(); + $userid = $contextlist->get_user()->id; + $ctxfields = \context_helper::get_preload_record_columns_sql('ctx'); + list($insql, $inparams) = $DB->get_in_or_equal($contextlist->get_contextids(), SQL_PARAMS_NAMED); + + // Role Assignments export data. + $contexts = [ + CONTEXT_SYSTEM, + CONTEXT_USER, + CONTEXT_COURSECAT, + CONTEXT_COURSE, + CONTEXT_MODULE, + CONTEXT_BLOCK + ]; + list($inctxsql, $ctxparams) = $DB->get_in_or_equal($contexts, SQL_PARAMS_NAMED); + $sql = "SELECT ra.id, ra.contextid, ra.roleid, ra.userid, ra.timemodified, ra.modifierid, $ctxfields + FROM {role_assignments} ra + JOIN {context} ctx + ON ctx.id = ra.contextid + AND ctx.contextlevel {$inctxsql} + AND (ra.userid = :userid OR ra.modifierid = :modifierid) + AND ra.component != 'tool_cohortroles' + JOIN {role} r + ON r.id = ra.roleid + WHERE ctx.id {$insql}"; + $params = ['userid' => $userid, 'modifierid' => $userid]; + $params += $inparams; + $params += $ctxparams; + $assignments = $DB->get_recordset_sql($sql, $params); + foreach ($assignments as $assignment) { + \context_helper::preload_from_record($assignment); + $alldata[$assignment->contextid][$rolesnames[$assignment->roleid]][] = (object)[ + 'timemodified' => transform::datetime($assignment->timemodified), + 'userid' => transform::user($assignment->userid), + 'modifierid' => transform::user($assignment->modifierid) + ]; + } + $assignments->close(); + if (!empty($alldata)) { + array_walk($alldata, function($roledata, $contextid) { + $context = \context::instance_by_id($contextid); + array_walk($roledata, function($data, $rolename) use ($context) { + writer::with_context($context)->export_data( + [get_string('privacy:metadata:role_assignments', 'core_role'), $rolename], + (object)$data); + }); + }); + unset($alldata); + } + + // Role Capabilities export data. + $strpermissions = self::get_permissions_name(); + $contexts = [ + CONTEXT_SYSTEM, + CONTEXT_USER, + CONTEXT_COURSECAT, + CONTEXT_COURSE, + CONTEXT_MODULE, + CONTEXT_BLOCK + ]; + list($inctxsql, $ctxparams) = $DB->get_in_or_equal($contexts, SQL_PARAMS_NAMED); + $sql = "SELECT rc.id, rc.contextid, rc.capability, rc.permission, rc.timemodified, rc.roleid, $ctxfields + FROM {context} ctx + JOIN {role_capabilities} rc + ON rc.contextid = ctx.id + AND ((ctx.contextlevel {$inctxsql} AND rc.modifierid = :modifierid) + OR (ctx.contextlevel = :contextlevel AND ctx.instanceid = :userid)) + WHERE ctx.id {$insql}"; + $params = [ + 'modifierid' => $userid, + 'contextlevel' => CONTEXT_USER, + 'userid' => $userid + ]; + $params += $inparams; + $params += $ctxparams; + $capabilities = $DB->get_recordset_sql($sql, $params); + foreach ($capabilities as $capability) { + \context_helper::preload_from_record($capability); + $alldata[$capability->contextid][$rolesnames[$capability->roleid]][] = (object)[ + 'timemodified' => transform::datetime($capability->timemodified), + 'capability' => $capability->capability, + 'permission' => $strpermissions[$capability->permission] + ]; + } + $capabilities->close(); + if (!empty($alldata)) { + array_walk($alldata, function($capdata, $contextid) { + $context = \context::instance_by_id($contextid); + array_walk($capdata, function($data, $rolename) use ($context) { + writer::with_context($context)->export_data( + [get_string('privacy:metadata:role_capabilities', 'core_role'), $rolename], + (object)$data); + }); + }); + } + } + /** + * Exports the data relating to tool_cohortroles component on role assignments by + * Assign user roles to cohort feature. + * + * @param int $userid The user ID. + */ + public static function export_user_role_to_cohort(int $userid) { + global $DB; + + $rolesnames = self::get_roles_name(); + $sql = "SELECT ra.id, ra.contextid, ra.roleid, ra.userid, ra.timemodified, ra.modifierid, r.id as roleid + FROM {role_assignments} ra + JOIN {context} ctx + ON ctx.id = ra.contextid + AND ctx.contextlevel = :contextlevel + AND ra.component = 'tool_cohortroles' + JOIN {role} r + ON r.id = ra.roleid + WHERE ctx.instanceid = :instanceid + OR ra.userid = :userid"; + $params = ['userid' => $userid, 'instanceid' => $userid, 'contextlevel' => CONTEXT_USER]; + $assignments = $DB->get_recordset_sql($sql, $params); + foreach ($assignments as $assignment) { + $alldata[$assignment->contextid][$rolesnames[$assignment->roleid]][] = (object)[ + 'timemodified' => transform::datetime($assignment->timemodified), + 'userid' => transform::user($assignment->userid), + 'modifierid' => transform::user($assignment->modifierid) + ]; + } + $assignments->close(); + if (!empty($alldata)) { + array_walk($alldata, function($roledata, $contextid) { + $context = \context::instance_by_id($contextid); + array_walk($roledata, function($data, $rolename) use ($context) { + writer::with_context($context)->export_related_data( + [get_string('privacy:metadata:role_cohortroles', 'core_role'), $rolename], 'cohortroles', + (object)$data); + }); + }); + } + } + /** + * Delete all user data for this context. + * + * @param \context $context The context to delete data for. + */ + public static function delete_data_for_all_users_in_context(\context $context) { + global $DB; + + // Don't remove data from role_capabilities. + // Because this data affects the whole Moodle, there are override capabilities. + // Don't belong to the modifier user. + + // Remove data from role_assignments. + if (empty($context)) { + return; + } + $DB->delete_records('role_assignments', ['contextid' => $context->id]); + } + /** + * Delete all user data for this user only. + * + * @param approved_contextlist $contextlist The list of approved contexts for a user. + */ + public static function delete_data_for_user(approved_contextlist $contextlist) { + global $DB; + + // Don't remove data from role_capabilities. + // Because this data affects the whole Moodle, there are override capabilities. + // Don't belong to the modifier user. + + // Remove data from role_assignments. + if (empty($contextlist->count())) { + return; + } + $userid = $contextlist->get_user()->id; + foreach ($contextlist->get_contexts() as $context) { + // Only delete the roles assignments where the user is assigned in all contexts. + $DB->delete_records('role_assignments', ['userid' => $userid, 'contextid' => $context->id]); + } + } + /** + * Delete user entries in role_assignments related to the feature + * Assign user roles to cohort feature. + * + * @param int $userid The user ID. + */ + public static function delete_user_role_to_cohort(int $userid) { + global $DB; + + // Delete entries where userid is a mentor by tool_cohortroles. + $DB->delete_records('role_assignments', ['userid' => $userid, 'component' => 'tool_cohortroles']); + } + /** + * Get all the localised roles name in a simple array. + * + * @return array Array of name of the roles by roleid. + */ + protected static function get_roles_name() { + $roles = role_fix_names(get_all_roles(), \context_system::instance(), ROLENAME_ORIGINAL); + $rolesnames = array(); + foreach ($roles as $role) { + $rolesnames[$role->id] = $role->localname; + } + return $rolesnames; + } + /** + * Get all the permissions name in a simple array. + * + * @return array Array of permissions name. + */ + protected static function get_permissions_name() { + $strpermissions = array( + CAP_INHERIT => get_string('inherit', 'role'), + CAP_ALLOW => get_string('allow', 'role'), + CAP_PREVENT => get_string('prevent', 'role'), + CAP_PROHIBIT => get_string('prohibit', 'role') + ); + return $strpermissions; + } +} \ No newline at end of file diff --git a/admin/roles/tests/privacy_test.php b/admin/roles/tests/privacy_test.php new file mode 100644 index 0000000000000..bffc9199b67e2 --- /dev/null +++ b/admin/roles/tests/privacy_test.php @@ -0,0 +1,477 @@ +. +/** + * Privacy test for core_role + * + * @package core_role + * @category test + * @copyright 2018 Carlos Escobedo + * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later + */ +defined('MOODLE_INTERNAL') || die(); +use \core_role\privacy\provider; +use \core_privacy\local\request\approved_contextlist; +use \core_privacy\local\request\writer; +use \core_privacy\tests\provider_testcase; +use \core_privacy\local\request\transform; +use \tool_cohortroles\api; + +/** + * Privacy test for core_role + * + * @copyright 2018 Carlos Escobedo + * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later + */ +class core_role_privacy_testcase extends provider_testcase { + /** + * Test to check export_user_preferences. + * returns user preferences data. + */ + public function test_export_user_preferences() { + $this->resetAfterTest(); + $this->setAdminUser(); + $user = $this->getDataGenerator()->create_user(); + $this->setUser($user); + $showadvanced = 1; + set_user_preference('definerole_showadvanced', $showadvanced); + provider::export_user_preferences($user->id); + $writer = writer::with_context(\context_system::instance()); + $prefs = $writer->get_user_preferences('core_role'); + $this->assertEquals(transform::yesno($showadvanced), transform::yesno($prefs->definerole_showadvanced->value)); + $this->assertEquals(get_string('privacy:metadata:preference:showadvanced', 'core_role'), + $prefs->definerole_showadvanced->description); + } + /** + * Check all contexts are returned if there is any user data for this user. + */ + public function test_get_contexts_for_userid() { + global $DB; + + $this->resetAfterTest(); + $this->setAdminUser(); + $user = $this->getDataGenerator()->create_user(); + $this->assertEmpty(provider::get_contexts_for_userid($user->id)); + + $user2 = $this->getDataGenerator()->create_user(); + $usercontext2 = \context_user::instance($user2->id); + $course = $this->getDataGenerator()->create_course(); + $course2 = $this->getDataGenerator()->create_course(); + $coursecat = $this->getDataGenerator()->create_category(); + $cm = $this->getDataGenerator()->create_module('chat', ['course' => $course->id]); + $cmcontext = \context_module::instance($cm->cmid); + $page = $this->getDataGenerator()->create_module('page', array('course' => $course->id)); + $cmcontext2 = \context_module::instance($page->cmid); + $coursecontext = \context_course::instance($course->id); + $coursecontext2 = \context_course::instance($course2->id); + $coursecatcontext = \context_coursecat::instance($coursecat->id); + $systemcontext = \context_system::instance(); + $block = $this->getDataGenerator()->create_block('online_users'); + $blockcontext = \context_block::instance($block->id); + + $student = $DB->get_record('role', array('shortname' => 'student'), '*', MUST_EXIST); + $manager = $DB->get_record('role', array('shortname' => 'manager'), '*', MUST_EXIST); + + // Role assignments, where the user is assigned. + role_assign($student->id, $user->id, $cmcontext2->id); + role_assign($student->id, $user->id, $coursecontext2->id); + role_assign($student->id, $user->id, $blockcontext->id); + role_assign($manager->id, $user->id, $usercontext2->id); + // Role assignments, where the user makes assignments. + $this->setUser($user); + role_assign($student->id, $user2->id, $coursecontext->id); + role_assign($manager->id, $user2->id, $coursecatcontext->id); + role_assign($manager->id, $user2->id, $systemcontext->id); + + // Role capabilities. + $this->setUser($user); + $result = assign_capability('moodle/backup:backupcourse', CAP_ALLOW, $student->id, $cmcontext->id); + + $contextlist = provider::get_contexts_for_userid($user->id)->get_contextids(); + $this->assertCount(8, $contextlist); + $this->assertTrue(in_array($cmcontext->id, $contextlist)); + } + + /** + * Test that user data is exported correctly. + */ + public function test_export_user_data() { + global $DB; + + $this->resetAfterTest(); + $this->setAdminUser(); + $user = $this->getDataGenerator()->create_user(); + $user2 = $this->getDataGenerator()->create_user(); + $usercontext2 = \context_user::instance($user2->id); + $course = $this->getDataGenerator()->create_course(); + $course2 = $this->getDataGenerator()->create_course(); + $coursecat = $this->getDataGenerator()->create_category(); + $cm = $this->getDataGenerator()->create_module('chat', ['course' => $course->id]); + $cmcontext = \context_module::instance($cm->cmid); + $page = $this->getDataGenerator()->create_module('page', array('course' => $course->id)); + $cmcontext2 = \context_module::instance($page->cmid); + $coursecontext = \context_course::instance($course->id); + $coursecontext2 = \context_course::instance($course2->id); + $coursecatcontext = \context_coursecat::instance($coursecat->id); + $systemcontext = \context_system::instance(); + $block = $this->getDataGenerator()->create_block('online_users'); + $blockcontext = \context_block::instance($block->id); + + $student = $DB->get_record('role', array('shortname' => 'student'), '*', MUST_EXIST); + $manager = $DB->get_record('role', array('shortname' => 'manager'), '*', MUST_EXIST); + $rolesnames = self::get_roles_name(); + + $subcontextstudent = [ + get_string('privacy:metadata:role_assignments', 'core_role'), + $rolesnames[$student->id] + ]; + $subcontextmanager = [ + get_string('privacy:metadata:role_assignments', 'core_role'), + $rolesnames[$manager->id] + ]; + $subcontextrc = [ + get_string('privacy:metadata:role_capabilities', 'core_role'), + $rolesnames[$student->id] + ]; + + // Test over role assignments. + // Where the user is assigned. + role_assign($student->id, $user->id, $cmcontext2->id); + role_assign($student->id, $user->id, $coursecontext2->id); + role_assign($student->id, $user->id, $blockcontext->id); + role_assign($manager->id, $user->id, $usercontext2->id); + // Where the user makes assignments. + $this->setUser($user); + role_assign($manager->id, $user2->id, $coursecatcontext->id); + role_assign($manager->id, $user2->id, $systemcontext->id); + + // Test overridable roles in module, course, category, user, system and block. + assign_capability('moodle/backup:backupactivity', CAP_ALLOW, $student->id, $cmcontext->id, true); + assign_capability('moodle/backup:backupcourse', CAP_ALLOW, $student->id, $coursecontext->id, true); + assign_capability('moodle/category:manage', CAP_ALLOW, $student->id, $coursecatcontext->id, true); + assign_capability('moodle/backup:backupcourse', CAP_ALLOW, $student->id, $systemcontext->id, true); + assign_capability('moodle/block:edit', CAP_ALLOW, $student->id, $blockcontext->id, true); + assign_capability('moodle/competency:evidencedelete', CAP_ALLOW, $student->id, $usercontext2->id, true); + + // Retrieve the user's context ids. + $contextlist = provider::get_contexts_for_userid($user->id); + $approvedcontextlist = new approved_contextlist($user, 'core_role', $contextlist->get_contextids()); + + $strpermissions = array( + CAP_INHERIT => get_string('inherit', 'role'), + CAP_ALLOW => get_string('allow', 'role'), + CAP_PREVENT => get_string('prevent', 'role'), + CAP_PROHIBIT => get_string('prohibit', 'role') + ); + // Retrieve role capabilities and role assignments. + provider::export_user_data($approvedcontextlist); + foreach ($contextlist as $context) { + $writer = writer::with_context($context); + $this->assertTrue($writer->has_any_data()); + if ($context->contextlevel == CONTEXT_MODULE) { + if ($data = $writer->get_data($subcontextstudent)) { + $this->assertEquals($user->id, reset($data)->userid); + } + if ($data = $writer->get_data($subcontextrc)) { + $this->assertEquals('moodle/backup:backupactivity', reset($data)->capability); + $this->assertEquals($strpermissions[CAP_ALLOW], reset($data)->permission); + } + } + if ($context->contextlevel == CONTEXT_COURSE) { + if ($data = $writer->get_data($subcontextstudent)) { + $this->assertEquals($user->id, reset($data)->userid); + } + if ($data = $writer->get_data($subcontextrc)) { + $this->assertEquals('moodle/backup:backupcourse', reset($data)->capability); + } + } + if ($context->contextlevel == CONTEXT_COURSECAT) { + if ($data = $writer->get_data($subcontextmanager)) { + $this->assertEquals($user->id, reset($data)->modifierid); + } + if ($data = $writer->get_data($subcontextrc)) { + $this->assertEquals('moodle/category:manage', reset($data)->capability); + } + } + if ($context->contextlevel == CONTEXT_SYSTEM) { + if ($data = $writer->get_data($subcontextmanager)) { + $this->assertEquals($user->id, reset($data)->modifierid); + } + if ($data = $writer->get_data($subcontextrc)) { + $this->assertEquals('moodle/backup:backupcourse', reset($data)->capability); + } + } + if ($context->contextlevel == CONTEXT_BLOCK) { + if ($data = $writer->get_data($subcontextstudent)) { + $this->assertEquals($user->id, reset($data)->userid); + } + if ($data = $writer->get_data($subcontextrc)) { + $this->assertEquals('moodle/block:edit', reset($data)->capability); + } + } + if ($context->contextlevel == CONTEXT_USER) { + if ($data = $writer->get_data($subcontextmanager)) { + $this->assertEquals($user->id, reset($data)->userid); + } + if ($data = $writer->get_data($subcontextrc)) { + $this->assertEquals('moodle/competency:evidencedelete', reset($data)->capability); + } + } + } + } + /** + * Test for provider::delete_data_for_all_users_in_context(). + */ + public function test_delete_data_for_all_users_in_context() { + global $DB; + + $this->resetAfterTest(); + $this->setAdminUser(); + $user = $this->getDataGenerator()->create_user(); + $user2 = $this->getDataGenerator()->create_user(); + $usercontext2 = \context_user::instance($user2->id); + $user3 = $this->getDataGenerator()->create_user(); + $course = $this->getDataGenerator()->create_course(); + $coursecontext = \context_course::instance($course->id); + $coursecat = $this->getDataGenerator()->create_category(); + $coursecatcontext = \context_coursecat::instance($coursecat->id); + $systemcontext = \context_system::instance(); + $cm = $this->getDataGenerator()->create_module('chat', ['course' => $course->id]); + $cmcontext = \context_module::instance($cm->cmid); + $student = $DB->get_record('role', array('shortname' => 'student'), '*', MUST_EXIST); + $manager = $DB->get_record('role', array('shortname' => 'manager'), '*', MUST_EXIST); + $block = $this->getDataGenerator()->create_block('online_users'); + $blockcontext = \context_block::instance($block->id); + + // Role assignments CONTEXT_COURSE. + role_assign($student->id, $user->id, $coursecontext->id); + role_assign($student->id, $user2->id, $coursecontext->id); + role_assign($student->id, $user3->id, $coursecontext->id); + $count = $DB->count_records('role_assignments', ['contextid' => $coursecontext->id]); + $this->assertEquals(3, $count); + // Role assignments CONTEXT_COURSECAT. + role_assign($student->id, $user2->id, $coursecatcontext->id); + role_assign($student->id, $user3->id, $coursecatcontext->id); + $count = $DB->count_records('role_assignments', ['contextid' => $coursecatcontext->id]); + $this->assertEquals(2, $count); + // Role assignments CONTEXT_SYSTEM. + role_assign($student->id, $user->id, $systemcontext->id); + $count = $DB->count_records('role_assignments', ['contextid' => $systemcontext->id]); + $this->assertEquals(1, $count); + // Role assignments CONTEXT_MODULE. + role_assign($student->id, $user->id, $cmcontext->id); + $count = $DB->count_records('role_assignments', ['contextid' => $cmcontext->id]); + $this->assertEquals(1, $count); + // Role assigments CONTEXT_BLOCK. + role_assign($student->id, $user->id, $blockcontext->id); + $count = $DB->count_records('role_assignments', ['contextid' => $blockcontext->id]); + $this->assertEquals(1, $count); + // Role assigments CONTEXT_USER. + role_assign($manager->id, $user->id, $usercontext2->id); + $count = $DB->count_records('role_assignments', ['contextid' => $usercontext2->id]); + $this->assertEquals(1, $count); + + // Delete data based on CONTEXT_COURSE context. + provider::delete_data_for_all_users_in_context($coursecontext); + // After deletion, the role_assignments entries for this context should have been deleted. + $count = $DB->count_records('role_assignments', ['contextid' => $coursecontext->id]); + $this->assertEquals(0, $count); + // Check it is not removing data on other contexts. + $count = $DB->count_records('role_assignments', ['contextid' => $coursecatcontext->id]); + $this->assertEquals(2, $count); + $count = $DB->count_records('role_assignments', ['contextid' => $systemcontext->id]); + $this->assertEquals(1, $count); + $count = $DB->count_records('role_assignments', ['contextid' => $cmcontext->id]); + $this->assertEquals(1, $count); + // Delete data based on CONTEXT_COURSECAT context. + provider::delete_data_for_all_users_in_context($coursecatcontext); + // After deletion, the role_assignments entries for this context should have been deleted. + $count = $DB->count_records('role_assignments', ['contextid' => $coursecatcontext->id]); + $this->assertEquals(0, $count); + // Delete data based on CONTEXT_SYSTEM context. + provider::delete_data_for_all_users_in_context($systemcontext); + // After deletion, the role_assignments entries for this context should have been deleted. + $count = $DB->count_records('role_assignments', ['contextid' => $systemcontext->id]); + $this->assertEquals(0, $count); + // Delete data based on CONTEXT_MODULE context. + provider::delete_data_for_all_users_in_context($cmcontext); + // After deletion, the role_assignments entries for this context should have been deleted. + $count = $DB->count_records('role_assignments', ['contextid' => $cmcontext->id]); + $this->assertEquals(0, $count); + // Delete data based on CONTEXT_BLOCK context. + provider::delete_data_for_all_users_in_context($usercontext2); + // After deletion, the role_assignments entries for this context should have been deleted. + $count = $DB->count_records('role_assignments', ['contextid' => $usercontext2->id]); + $this->assertEquals(0, $count); + } + /** + * Test for provider::delete_data_for_user(). + */ + public function test_delete_data_for_user() { + global $DB; + + $this->resetAfterTest(); + $this->setAdminUser(); + $user = $this->getDataGenerator()->create_user(); + $user2 = $this->getDataGenerator()->create_user(); + $usercontext2 = \context_user::instance($user2->id); + $user3 = $this->getDataGenerator()->create_user(); + $usercontext3 = \context_user::instance($user3->id); + $course = $this->getDataGenerator()->create_course(); + $course2 = $this->getDataGenerator()->create_course(); + $course3 = $this->getDataGenerator()->create_course(); + $coursecontext = \context_course::instance($course->id); + $coursecontext2 = \context_course::instance($course2->id); + $coursecontext3 = \context_course::instance($course3->id); + $coursecat = $this->getDataGenerator()->create_category(); + $coursecatcontext = \context_coursecat::instance($coursecat->id); + $systemcontext = \context_system::instance(); + $cm = $this->getDataGenerator()->create_module('chat', ['course' => $course->id]); + $cmcontext = \context_module::instance($cm->cmid); + $student = $DB->get_record('role', array('shortname' => 'student'), '*', MUST_EXIST); + $manager = $DB->get_record('role', array('shortname' => 'manager'), '*', MUST_EXIST); + $block = $this->getDataGenerator()->create_block('online_users'); + $blockcontext = \context_block::instance($block->id); + + // Role assignments, Where the user is assigned. + role_assign($student->id, $user->id, $coursecontext->id); + role_assign($student->id, $user->id, $coursecontext2->id); + role_assign($student->id, $user->id, $coursecatcontext->id); + role_assign($student->id, $user->id, $cmcontext->id); + role_assign($student->id, $user->id, $systemcontext->id); + role_assign($student->id, $user->id, $blockcontext->id); + role_assign($manager->id, $user->id, $usercontext2->id); + role_assign($manager->id, $user->id, $usercontext3->id); + $count = $DB->count_records('role_assignments', ['userid' => $user->id]); + $this->assertEquals(8, $count); + // Role assignments, where the user makes assignments. + $this->setUser($user); + role_assign($student->id, $user2->id, $coursecontext3->id); + role_assign($student->id, $user3->id, $coursecontext3->id); + $count = $DB->count_records('role_assignments', ['modifierid' => $user->id]); + $this->assertEquals(2, $count); + + $contextlist = provider::get_contexts_for_userid($user->id); + $approvedcontextlist = new approved_contextlist($user, 'core_role', $contextlist->get_contextids()); + provider::delete_data_for_user($approvedcontextlist); + // After deletion, the role_assignments assigned to the user should have been deleted. + $count = $DB->count_records('role_assignments', ['userid' => $user->id]); + $this->assertEquals(0, $count); + // After deletion, the role_assignments assigned by the user should not have been deleted. + $count = $DB->count_records('role_assignments', ['modifierid' => $user->id]); + $this->assertEquals(2, $count); + } + /** + * Export for a user with a key against a script where no instance is specified. + */ + public function test_export_user_role_to_cohort() { + global $DB; + + $this->resetAfterTest(); + $this->setAdminUser(); + // Assign user roles to cohort. + $user = $this->getDataGenerator()->create_user(); + $contextuser = \context_user::instance($user->id); + $teacher = $DB->get_record('role', array('shortname' => 'teacher'), '*', MUST_EXIST); + $cohort = $this->getDataGenerator()->create_cohort(); + $userassignover = $this->getDataGenerator()->create_user(); + $contextuserassignover = \context_user::instance($userassignover->id); + cohort_add_member($cohort->id, $userassignover->id); + $this->setAdminUser(); + $params = (object) array( + 'userid' => $user->id, + 'roleid' => $teacher->id, + 'cohortid' => $cohort->id + ); + api::create_cohort_role_assignment($params); + api::sync_all_cohort_roles(); + $rolesnames = self::get_roles_name(); + $subcontextteacher = [ + get_string('privacy:metadata:role_cohortroles', 'core_role'), + $rolesnames[$teacher->id] + ]; + // Test User is assigned role teacher to cohort. + provider::export_user_role_to_cohort($user->id); + $writer = writer::with_context($contextuserassignover); + $this->assertTrue($writer->has_any_data()); + $exported = $writer->get_related_data($subcontextteacher, 'cohortroles'); + $this->assertEquals($user->id, reset($exported)->userid); + + // Test User is member of a cohort which User2 is assigned to role to this cohort. + $user2 = $this->getDataGenerator()->create_user(); + $cohort2 = $this->getDataGenerator()->create_cohort(); + cohort_add_member($cohort2->id, $user->id); + $params = (object) array( + 'userid' => $user2->id, + 'roleid' => $teacher->id, + 'cohortid' => $cohort2->id + ); + api::create_cohort_role_assignment($params); + api::sync_all_cohort_roles(); + provider::export_user_role_to_cohort($user->id); + $writer = writer::with_context($contextuser); + $this->assertTrue($writer->has_any_data()); + $exported = $writer->get_related_data($subcontextteacher, 'cohortroles'); + $this->assertEquals($user2->id, reset($exported)->userid); + } + /** + * Test for provider::delete_user_role_to_cohort(). + */ + public function test_delete_user_role_to_cohort() { + global $DB; + + $this->resetAfterTest(); + $this->setAdminUser(); + // Assign user roles to cohort. + $user = $this->getDataGenerator()->create_user(); + $user2 = $this->getDataGenerator()->create_user(); + $user3 = $this->getDataGenerator()->create_user(); + $user4 = $this->getDataGenerator()->create_user(); + $teacher = $DB->get_record('role', array('shortname' => 'teacher'), '*', MUST_EXIST); + $cohort = $this->getDataGenerator()->create_cohort(); + cohort_add_member($cohort->id, $user2->id); + cohort_add_member($cohort->id, $user3->id); + cohort_add_member($cohort->id, $user4->id); + $this->setAdminUser(); + $params = (object) array( + 'userid' => $user->id, + 'roleid' => $teacher->id, + 'cohortid' => $cohort->id + ); + api::create_cohort_role_assignment($params); + api::sync_all_cohort_roles(); + + $count = $DB->count_records('role_assignments', ['userid' => $user->id, 'component' => 'tool_cohortroles']); + $this->assertEquals(3, $count); + + provider::delete_user_role_to_cohort($user->id); + $count = $DB->count_records('role_assignments', ['userid' => $user->id, 'component' => 'tool_cohortroles']); + $this->assertEquals(0, $count); + } + /** + * Supoort function to get all the localised roles name + * in a simple array for testing. + * + * @return array Array of name of the roles by roleid. + */ + protected static function get_roles_name() { + $roles = role_fix_names(get_all_roles(), \context_system::instance(), ROLENAME_ORIGINAL); + $rolesnames = array(); + foreach ($roles as $role) { + $rolesnames[$role->id] = $role->localname; + } + return $rolesnames; + } +} \ No newline at end of file diff --git a/lang/en/role.php b/lang/en/role.php index bfb1cf6443dee..2eb11ba98afc4 100644 --- a/lang/en/role.php +++ b/lang/en/role.php @@ -463,3 +463,20 @@ $string['whydoesusernothavecap'] = 'Why does {$a->fullname} not have capability {$a->capability} in context {$a->context}?'; $string['xroleassignments'] = '{$a}\'s role assignments'; $string['xuserswiththerole'] = 'Users with the role "{$a->role}"'; +$string['privacy:metadata:preference:showadvanced'] = 'Handle the toggle advanced mode button.'; +$string['privacy:metadata:role_assignments'] = 'Role assignments'; +$string['privacy:metadata:role_assignments:component'] = 'Plugin responsible for role assignment, empty when manually assigned.'; +$string['privacy:metadata:role_assignments:itemid'] = 'The Id of enrolment/auth instance responsible for this role assignment.'; +$string['privacy:metadata:role_assignments:modifierid'] = 'The Id of the user who created or modified the role assignment.'; +$string['privacy:metadata:role_assignments:roleid'] = 'The Id of the role.'; +$string['privacy:metadata:role_assignments:tableexplanation'] = 'This table stores the assigned roles in each context.'; +$string['privacy:metadata:role_assignments:timemodified'] = 'The date when the role assignment was created or modified.'; +$string['privacy:metadata:role_assignments:userid'] = 'The Id of the user.'; +$string['privacy:metadata:role_capabilities'] = 'Role capabilities'; +$string['privacy:metadata:role_capabilities:capability'] = 'The name of the capability.'; +$string['privacy:metadata:role_capabilities:modifierid'] = 'The Id of the user who created or modified the capability.'; +$string['privacy:metadata:role_capabilities:permission'] = 'The permission for a capability: inherit, allow, prevent or prohibit.'; +$string['privacy:metadata:role_capabilities:roleid'] = 'The Id of the role.'; +$string['privacy:metadata:role_capabilities:tableexplanation'] = 'This table stores the capabilities and the override capabilities for a particular role in a particular context.'; +$string['privacy:metadata:role_capabilities:timemodified'] = 'The date when the capability was created or modified.'; +$string['privacy:metadata:role_cohortroles'] = 'Roles to cohort';