diff --git a/templates/timesheet/index.html.twig b/templates/timesheet/index.html.twig
index c9d7ea10..f88e1673 100644
--- a/templates/timesheet/index.html.twig
+++ b/templates/timesheet/index.html.twig
@@ -5,7 +5,18 @@
{% block page_title %}{{ 'timesheet.title'|trans }}{% endblock %}
{% block page_subtitle %}{{ 'timesheet.subtitle'|trans }}{% endblock %}
-{% block page_actions %}{{ widgets.page_actions({'filter': '#collapseTimesheet', 'download': 'onclick:return exportTimesheet()', 'visibility': '#modal_timesheet', 'calendar': path('calendar'), 'create': path('timesheet_create')}) }}{% endblock %}
+{% block page_actions %}
+ {% set actions = {'filter': '#collapseTimesheet'} %}
+ {% if is_granted('export_own_timesheet') %}
+ {% set actions = actions|merge({'download': 'onclick:return exportTimesheet()'}) %}
+ {% endif %}
+ {% set actions = actions|merge({'visibility': '#modal_timesheet'}) %}
+ {% set actions = actions|merge({'calendar': path('calendar')}) %}
+ {% if is_granted('create_own_timesheet') %}
+ {% set actions = actions|merge({'create': path('timesheet_create')}) %}
+ {% endif %}
+ {{ widgets.page_actions(actions) }}
+{% endblock %}
{% block main_before %}
{{ toolbar.toolbar(toolbarForm, 'collapseTimesheet', showFilter) }}
@@ -23,9 +34,13 @@
{% set columns = columns|merge({'starttime': '', 'endtime': 'hidden-xs'}) %}
{% endif %}
+ {% set columns = columns|merge({'duration': ''}) %}
+
+ {% if is_granted('view_rate_own_timesheet') %}
+ {% set columns = columns|merge({'rate': 'hidden-xs'}) %}
+ {% endif %}
+
{% set columns = columns|merge({
- 'duration': '',
- 'rate': 'hidden-xs',
'customer': 'hidden-xs hidden-sm',
'project': 'hidden-xs hidden-sm',
'activity': 'hidden-xs hidden-sm',
@@ -50,13 +65,17 @@
{{ entry.end|date("H:i") }} |
{% endif %}
{{ entry.duration|duration }} |
- {{ entry.rate|money(entry.project.customer.currency) }} |
+ {% if is_granted('view_rate', entry) %}
+ {{ entry.rate|money(entry.project.customer.currency) }} |
+ {% endif %}
{% else %}
{% if not duration_only %}
‐ |
{% endif %}
{{ entry|duration }} |
- ‐ |
+ {% if is_granted('view_rate', entry) %}
+ ‐ |
+ {% endif %}
{% endif %}
{{ widgets.label_customer(entry.project.customer) }} |
@@ -64,7 +83,10 @@
{{ widgets.label_activity(entry.activity) }} |
{{ entry.description|desc2html }} |
- {% set actionButtons = {'edit': path('timesheet_edit', {'id' : entry.id, 'page': page})} %}
+ {% set actionButtons = {} %}
+ {% if is_granted('edit', entry) %}
+ {% set actionButtons = actionButtons|merge({'edit': path('timesheet_edit', {'id' : entry.id, 'page': page})}) %}
+ {% endif %}
{% if entry.end %}
{% if is_granted('start', entry) %}
@@ -76,7 +98,9 @@
{% endif %}
{% endif %}
- {% set actionButtons = actionButtons|merge({'trash': path('timesheet_delete', {'id' : entry.id, 'page': page})}) %}
+ {% if is_granted('delete', entry) %}
+ {% set actionButtons = actionButtons|merge({'trash': path('timesheet_delete', {'id' : entry.id, 'page': page})}) %}
+ {% endif %}
{{ widgets.button_group(actionButtons) }}
|
diff --git a/tests/Controller/Admin/UserControllerTest.php b/tests/Controller/Admin/UserControllerTest.php
index bb18c40a..ad1d5f65 100644
--- a/tests/Controller/Admin/UserControllerTest.php
+++ b/tests/Controller/Admin/UserControllerTest.php
@@ -51,7 +51,7 @@ class UserControllerTest extends ControllerBaseTest
$this->assertIsRedirect($client, $this->createUrl('/profile/' . urlencode($username) . '/edit'));
$client->followRedirect();
- $expectedTabs = ['#charts', '#settings', '#password', '#api-token', '#roles'];
+ $expectedTabs = ['#charts', '#settings', '#password', '#api-token', '#roles', '#preferences'];
$tabs = $client->getCrawler()->filter('div.nav-tabs-custom ul.nav-tabs li');
$this->assertEquals(count($expectedTabs), $tabs->count());
diff --git a/tests/Controller/InvoiceControllerTest.php b/tests/Controller/InvoiceControllerTest.php
index 8a585d3a..14e37794 100644
--- a/tests/Controller/InvoiceControllerTest.php
+++ b/tests/Controller/InvoiceControllerTest.php
@@ -225,7 +225,7 @@ class InvoiceControllerTest extends ControllerBaseTest
public function testDeleteTemplateAction()
{
- $client = $this->getClientForAuthenticatedUser(User::ROLE_TEAMLEAD);
+ $client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$em = $client->getContainer()->get('doctrine.orm.entity_manager');
$fixture = new InvoiceFixtures();
diff --git a/tests/Controller/ProfileControllerTest.php b/tests/Controller/ProfileControllerTest.php
index 33ebb0eb..455d0972 100644
--- a/tests/Controller/ProfileControllerTest.php
+++ b/tests/Controller/ProfileControllerTest.php
@@ -25,13 +25,24 @@ class ProfileControllerTest extends ControllerBaseTest
$this->assertUrlIsSecured('/profile/' . UserFixtures::USERNAME_USER);
}
- public function testIndexAction()
+ public function getTabTestData()
{
- $client = $this->getClientForAuthenticatedUser();
- $this->request($client, '/profile/' . UserFixtures::USERNAME_USER);
- $this->assertTrue($client->getResponse()->isSuccessful());
+ $userTabs = ['#charts', '#settings', '#password', '#api-token', '#preferences'];
- $expectedTabs = ['#charts', '#settings', '#password', '#api-token', '#preferences'];
+ return [
+ [User::ROLE_USER, UserFixtures::USERNAME_USER, ['#charts', '#settings', '#password', '#api-token', '#preferences']],
+ [User::ROLE_SUPER_ADMIN, UserFixtures::USERNAME_SUPER_ADMIN, array_merge($userTabs, ['#roles'])],
+ ];
+ }
+
+ /**
+ * @dataProvider getTabTestData
+ */
+ public function testIndexAction($role, $username, $expectedTabs)
+ {
+ $client = $this->getClientForAuthenticatedUser($role);
+ $this->request($client, '/profile/' . $username);
+ $this->assertTrue($client->getResponse()->isSuccessful());
$tabs = $client->getCrawler()->filter('div.nav-tabs-custom ul.nav-tabs li');
$this->assertEquals(count($expectedTabs), $tabs->count());
@@ -208,16 +219,31 @@ class ProfileControllerTest extends ControllerBaseTest
$this->assertEquals(['ROLE_TEAMLEAD', 'ROLE_SUPER_ADMIN', 'ROLE_USER'], $user->getRoles());
}
- public function testPreferencesAction()
+ public function getPreferencesTestData()
{
- $client = $this->getClientForAuthenticatedUser(User::ROLE_USER);
- $this->request($client, '/profile/' . UserFixtures::USERNAME_USER . '/prefs');
+ return [
+ // assert that the user doesn't have the "hourly-rate_own_profile" permission
+ [User::ROLE_USER, UserFixtures::USERNAME_USER, 82, 82, 'ar'],
+ // admins are allowed to update their own hourly rate
+ [User::ROLE_ADMIN, UserFixtures::USERNAME_ADMIN, 81, 37, 'ar'],
+ // admins are allowed to update other peoples hourly rate
+ [User::ROLE_SUPER_ADMIN, UserFixtures::USERNAME_USER, 82, 37, 'en'],
+ ];
+ }
+
+ /**
+ * @dataProvider getPreferencesTestData
+ */
+ public function testPreferencesAction($role, $username, $hourlyRateOriginal, $hourlyRate, $expectedLocale)
+ {
+ $client = $this->getClientForAuthenticatedUser($role);
+ $this->request($client, '/profile/' . $username . '/prefs');
/** @var User $user */
$em = $client->getContainer()->get('doctrine.orm.entity_manager');
- $user = $this->getUserByRole($em, User::ROLE_USER);
+ $user = $this->getUserByName($em, $username);
- $this->assertEquals(82, $user->getPreferenceValue(UserPreference::HOURLY_RATE));
+ $this->assertEquals($hourlyRateOriginal, $user->getPreferenceValue(UserPreference::HOURLY_RATE));
$this->assertEquals('green', $user->getPreferenceValue(UserPreference::SKIN));
$this->assertEquals(true, $user->getPreferenceValue('theme.fixed_layout'));
$this->assertEquals(false, $user->getPreferenceValue('theme.boxed_layout'));
@@ -242,7 +268,7 @@ class ProfileControllerTest extends ControllerBaseTest
]
]);
- $targetUrl = '/ar/profile/' . urlencode(UserFixtures::USERNAME_USER) . '/prefs';
+ $targetUrl = '/' . $expectedLocale . '/profile/' . urlencode($username) . '/prefs';
$this->assertIsRedirect($client, $targetUrl);
$client->followRedirect();
@@ -251,9 +277,9 @@ class ProfileControllerTest extends ControllerBaseTest
$this->assertHasFlashSuccess($client);
$em = $client->getContainer()->get('doctrine.orm.entity_manager');
- $user = $this->getUserByRole($em, User::ROLE_USER);
+ $user = $this->getUserByName($em, $username);
- $this->assertEquals(37, $user->getPreferenceValue(UserPreference::HOURLY_RATE));
+ $this->assertEquals($hourlyRate, $user->getPreferenceValue(UserPreference::HOURLY_RATE));
//$this->assertEquals('', $user->getPreferenceValue('America/Creston'));
$this->assertEquals('ar', $user->getPreferenceValue('language'));
$this->assertEquals('blue', $user->getPreferenceValue(UserPreference::SKIN));
diff --git a/tests/Controller/TimesheetControllerTest.php b/tests/Controller/TimesheetControllerTest.php
index b9eddfdd..5cfb321c 100644
--- a/tests/Controller/TimesheetControllerTest.php
+++ b/tests/Controller/TimesheetControllerTest.php
@@ -183,12 +183,23 @@ class TimesheetControllerTest extends ControllerBaseTest
$this->assertEquals(1, $timesheet->getProject()->getId());
}
- public function testStopAction()
+ public function testStopActionDoesNotShowRateFieldsForUser()
{
$client = $this->getClientForAuthenticatedUser();
$this->request($client, '/timesheet/create');
$this->assertTrue($client->getResponse()->isSuccessful());
+ $form = $client->getCrawler()->filter('form[name=timesheet_edit_form]')->form();
+ $this->assertFalse($form->has('hourlyRate'));
+ $this->assertFalse($form->has('fixedRate'));
+ }
+
+ public function testStopAction()
+ {
+ $client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
+ $this->request($client, '/timesheet/create');
+ $this->assertTrue($client->getResponse()->isSuccessful());
+
$form = $client->getCrawler()->filter('form[name=timesheet_edit_form]')->form();
$client->submit($form, [
'timesheet_edit_form' => [
@@ -222,7 +233,7 @@ class TimesheetControllerTest extends ControllerBaseTest
public function testCreateActionWithFromAndToValues()
{
- $client = $this->getClientForAuthenticatedUser();
+ $client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$this->request($client, '/timesheet/create?from=2018-08-02T20%3A00%3A00&to=2018-08-02T20%3A30%3A00');
$this->assertTrue($client->getResponse()->isSuccessful());
@@ -256,7 +267,7 @@ class TimesheetControllerTest extends ControllerBaseTest
public function testCreateActionWithBeginAndEndValues()
{
- $client = $this->getClientForAuthenticatedUser();
+ $client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$this->request($client, '/timesheet/create?begin=2018-08-02&end=2018-08-02');
$this->assertTrue($client->getResponse()->isSuccessful());
diff --git a/tests/KernelTestTrait.php b/tests/KernelTestTrait.php
index a2d9d679..78ae603a 100644
--- a/tests/KernelTestTrait.php
+++ b/tests/KernelTestTrait.php
@@ -34,6 +34,16 @@ trait KernelTestTrait
$executor->execute($loader->getFixtures(), true);
}
+ /**
+ * @param EntityManager $em
+ * @param string $username
+ * @return User|null
+ */
+ protected function getUserByName(EntityManager $em, string $username)
+ {
+ return $em->getRepository(User::class)->findOneBy(['username' => $username]);
+ }
+
/**
* @param EntityManager $em
* @param string $role
@@ -64,6 +74,6 @@ trait KernelTestTrait
return null;
}
- return $em->getRepository(User::class)->findOneBy(['username' => $name]);
+ return $this->getUserByName($em, $name);
}
}
diff --git a/tests/Voter/AbstractVoterTest.php b/tests/Voter/AbstractVoterTest.php
new file mode 100644
index 00000000..4b052387
--- /dev/null
+++ b/tests/Voter/AbstractVoterTest.php
@@ -0,0 +1,95 @@
+getRoles());
+ $accessManager = $this->getMockBuilder(AclDecisionManager::class)->disableOriginalConstructor()->getMock();
+ $accessManager->method('isFullyAuthenticated')->willReturn($isAuthenticated);
+ $accessManager->method('hasRole')->willReturnCallback(function ($role) use ($user) {
+ return in_array($role, $user->getRoles());
+ });
+
+ $class = new \ReflectionClass($voterClass);
+
+ return $class->newInstance($accessManager, $this->getRolePermissionManager());
+ }
+
+ /**
+ * @param $id
+ * @param $role
+ * @return User
+ */
+ protected function getUser($id, $role)
+ {
+ $roles = [];
+ if (!empty($role)) {
+ $roles[] = $role;
+ }
+
+ $user = $this->getMockBuilder(User::class)->getMock();
+ $user->method('getId')->willReturn($id);
+ $user->method('getRoles')->willReturn($roles);
+
+ return $user;
+ }
+
+ /**
+ * @param array $permissions
+ * @param bool $overwrite
+ * @return RolePermissionManager
+ */
+ protected function getRolePermissionManager(array $permissions = [], bool $overwrite = false)
+ {
+ if (!$overwrite) {
+ $activities = ['view_activity', 'edit_activity', 'delete_activity', 'create_activity'];
+ $projects = ['view_project', 'edit_project', 'delete_project', 'create_project'];
+ $customers = ['view_customer', 'edit_customer', 'delete_customer', 'create_customer'];
+ $invoice = ['view_invoice', 'create_invoice'];
+ $invoiceTemplate = ['view_invoice_template', 'create_invoice_template', 'edit_invoice_template', 'delete_invoice_template'];
+ $timesheet = ['view_own_timesheet', 'start_own_timesheet', 'stop_own_timesheet', 'create_own_timesheet', 'edit_own_timesheet', 'export_own_timesheet', 'delete_own_timesheet'];
+ $timesheetOthers = ['view_other_timesheet', 'start_other_timesheet', 'stop_other_timesheet', 'create_other_timesheet', 'edit_other_timesheet', 'delete_other_timesheet'];
+ $profile = ['view_own_profile', 'edit_own_profile', 'password_own_profile', 'preferences_own_profile', 'api-token_own_profile'];
+ $profileOther = ['view_other_profile', 'edit_other_profile', 'delete_other_profile', 'password_other_profile', 'roles_other_profile', 'preferences_other_profile', 'api-token_other_profile'];
+ $user = ['view_user', 'create_user', 'delete_user'];
+ $rate = ['view_rate_own_timesheet', 'edit_rate_own_timesheet'];
+ $rateOther = ['view_rate_other_timesheet', 'edit_rate_other_timesheet'];
+
+ $roleUser = [];
+ $roleTeamlead = ['view_rate_own_timesheet', 'view_rate_other_timesheet', 'hourly-rate_own_profile'];
+ $roleAdmin = ['hourly-rate_own_profile'];
+ $roleSuperAdmin = ['hourly-rate_own_profile', 'hourly-rate_other_profile', 'delete_own_profile', 'roles_own_profile'];
+
+ $permissions = [
+ 'ROLE_USER' => array_merge($timesheet, $profile, $roleUser),
+ 'ROLE_TEAMLEAD' => array_merge($invoice, $timesheet, $timesheetOthers, $profile, $roleTeamlead),
+ 'ROLE_ADMIN' => array_merge($activities, $projects, $customers, $invoice, $invoiceTemplate, $timesheet, $timesheetOthers, $profile, $rate, $rateOther, $roleAdmin),
+ 'ROLE_SUPER_ADMIN' => array_merge($activities, $projects, $customers, $invoice, $invoiceTemplate, $timesheet, $timesheetOthers, $profile, $profileOther, $user, $rate, $rateOther, $roleSuperAdmin),
+ ];
+ }
+
+ return new RolePermissionManager($permissions);
+ }
+}
diff --git a/tests/Voter/ActivityVoterTest.php b/tests/Voter/ActivityVoterTest.php
new file mode 100644
index 00000000..d1e493e9
--- /dev/null
+++ b/tests/Voter/ActivityVoterTest.php
@@ -0,0 +1,66 @@
+getRoles());
+ $sut = $this->getVoter(ActivityVoter::class, $user);
+
+ $this->assertEquals($result, $sut->vote($token, $subject, [$attribute]));
+ }
+
+ public function getTestData()
+ {
+ $user0 = $this->getUser(0, null);
+ $user1 = $this->getUser(1, User::ROLE_USER);
+ $user2 = $this->getUser(2, User::ROLE_TEAMLEAD);
+ $user3 = $this->getUser(3, User::ROLE_ADMIN);
+ $user4 = $this->getUser(4, User::ROLE_SUPER_ADMIN);
+
+ $result = VoterInterface::ACCESS_GRANTED;
+ foreach ([$user3, $user4] as $user) {
+ yield [$user, new Activity(), 'view', $result];
+ yield [$user, new Activity(), 'edit', $result];
+ yield [$user, new Activity(), 'delete', $result];
+ }
+
+ $result = VoterInterface::ACCESS_DENIED;
+ foreach ([$user0, $user1, $user2] as $user) {
+ yield [$user, new Activity(), 'view', $result];
+ yield [$user, new Activity(), 'edit', $result];
+ yield [$user, new Activity(), 'delete', $result];
+ }
+
+ $result = VoterInterface::ACCESS_ABSTAIN;
+ foreach ([$user0, $user1, $user2] as $user) {
+ yield [$user, new Activity(), 'view_activity', $result];
+ yield [$user, new Activity(), 'edit_activity', $result];
+ yield [$user, new Activity(), 'delete_activity', $result];
+ yield [$user, new \stdClass(), 'view', $result];
+ yield [$user, null, 'edit', $result];
+ yield [$user, $user, 'delete', $result];
+ }
+ }
+}
diff --git a/tests/Voter/CustomerVoterTest.php b/tests/Voter/CustomerVoterTest.php
new file mode 100644
index 00000000..16d846a8
--- /dev/null
+++ b/tests/Voter/CustomerVoterTest.php
@@ -0,0 +1,66 @@
+getRoles());
+ $sut = $this->getVoter(CustomerVoter::class, $user);
+
+ $this->assertEquals($result, $sut->vote($token, $subject, [$attribute]));
+ }
+
+ public function getTestData()
+ {
+ $user0 = $this->getUser(0, null);
+ $user1 = $this->getUser(1, User::ROLE_USER);
+ $user2 = $this->getUser(2, User::ROLE_TEAMLEAD);
+ $user3 = $this->getUser(3, User::ROLE_ADMIN);
+ $user4 = $this->getUser(4, User::ROLE_SUPER_ADMIN);
+
+ $result = VoterInterface::ACCESS_GRANTED;
+ foreach ([$user3, $user4] as $user) {
+ yield [$user, new Customer(), 'view', $result];
+ yield [$user, new Customer(), 'edit', $result];
+ yield [$user, new Customer(), 'delete', $result];
+ }
+
+ $result = VoterInterface::ACCESS_DENIED;
+ foreach ([$user0, $user1, $user2] as $user) {
+ yield [$user, new Customer(), 'view', $result];
+ yield [$user, new Customer(), 'edit', $result];
+ yield [$user, new Customer(), 'delete', $result];
+ }
+
+ $result = VoterInterface::ACCESS_ABSTAIN;
+ foreach ([$user0, $user1, $user2] as $user) {
+ yield [$user, new Customer(), 'view_customer', $result];
+ yield [$user, new Customer(), 'edit_customer', $result];
+ yield [$user, new Customer(), 'delete_customer', $result];
+ yield [$user, new \stdClass(), 'view', $result];
+ yield [$user, null, 'edit', $result];
+ yield [$user, $user, 'delete', $result];
+ }
+ }
+}
diff --git a/tests/Voter/InvoiceTemplateVoterTest.php b/tests/Voter/InvoiceTemplateVoterTest.php
new file mode 100644
index 00000000..35463906
--- /dev/null
+++ b/tests/Voter/InvoiceTemplateVoterTest.php
@@ -0,0 +1,66 @@
+getRoles());
+ $sut = $this->getVoter(InvoiceTemplateVoter::class, $user);
+
+ $this->assertEquals($result, $sut->vote($token, $subject, [$attribute]));
+ }
+
+ public function getTestData()
+ {
+ $user0 = $this->getUser(0, null);
+ $user1 = $this->getUser(1, User::ROLE_USER);
+ $user2 = $this->getUser(2, User::ROLE_TEAMLEAD);
+ $user3 = $this->getUser(3, User::ROLE_ADMIN);
+ $user4 = $this->getUser(4, User::ROLE_SUPER_ADMIN);
+
+ $result = VoterInterface::ACCESS_GRANTED;
+ foreach ([$user3, $user4] as $user) {
+ yield [$user, new InvoiceTemplate(), 'view', $result];
+ yield [$user, new InvoiceTemplate(), 'edit', $result];
+ yield [$user, new InvoiceTemplate(), 'delete', $result];
+ }
+
+ $result = VoterInterface::ACCESS_DENIED;
+ foreach ([$user0, $user1, $user2] as $user) {
+ yield [$user, new InvoiceTemplate(), 'view', $result];
+ yield [$user, new InvoiceTemplate(), 'edit', $result];
+ yield [$user, new InvoiceTemplate(), 'delete', $result];
+ }
+
+ $result = VoterInterface::ACCESS_ABSTAIN;
+ foreach ([$user0, $user1, $user2] as $user) {
+ yield [$user, new InvoiceTemplate(), 'view_invoice_template', $result];
+ yield [$user, new InvoiceTemplate(), 'edit_invoice_template', $result];
+ yield [$user, new InvoiceTemplate(), 'delete_invoice_template', $result];
+ yield [$user, new \stdClass(), 'view', $result];
+ yield [$user, null, 'edit', $result];
+ yield [$user, $user, 'delete', $result];
+ }
+ }
+}
diff --git a/tests/Voter/InvoiceVoterTest.php b/tests/Voter/InvoiceVoterTest.php
deleted file mode 100644
index 9c75fa8f..00000000
--- a/tests/Voter/InvoiceVoterTest.php
+++ /dev/null
@@ -1,80 +0,0 @@
-getRoles());
-
- $accessManager = $this->getMockBuilder(AclDecisionManager::class)->disableOriginalConstructor()->getMock();
- $accessManager->method('isFullyAuthenticated')->willReturn($isAuthenticated);
- $accessManager->method('hasRole')->willReturn($hasRole);
-
- $sut = new InvoiceVoter($accessManager);
-
- $this->assertEquals($result, $sut->vote($token, $subject, [$attribute]));
- }
-
- public function getTestData()
- {
- $user0 = $this->getUser(0, User::ROLE_CUSTOMER);
- $user1 = $this->getUser(1, User::ROLE_USER);
- $user2 = $this->getUser(1, User::ROLE_TEAMLEAD);
- $user3 = $this->getUser(1, User::ROLE_ADMIN);
- $user4 = $this->getUser(1, User::ROLE_SUPER_ADMIN);
-
- $users = [$user0, $user1, $user2, $user3, $user4];
- $attributes = [InvoiceVoter::VIEW, InvoiceVoter::CREATE, InvoiceVoter::EDIT, InvoiceVoter::DELETE];
- $subjects = ['invoice', 'invoice_template', new InvoiceTemplate()];
-
- foreach ($attributes as $attribute) {
- foreach ($users as $user) {
- foreach ($subjects as $subject) {
- yield [$user, false, false, $subject, $attribute, VoterInterface::ACCESS_DENIED];
- yield [$user, true, false, $subject, $attribute, VoterInterface::ACCESS_DENIED];
- yield [$user, false, true, $subject, $attribute, VoterInterface::ACCESS_DENIED];
- yield [$user, true, true, $subject, $attribute, VoterInterface::ACCESS_GRANTED];
- yield [$user, true, true, $subject, 'something', VoterInterface::ACCESS_ABSTAIN];
- }
- yield [$user, true, true, new \stdClass(), $attribute, VoterInterface::ACCESS_ABSTAIN];
- yield [$user, false, true, new \stdClass(), $attribute, VoterInterface::ACCESS_ABSTAIN];
- yield [$user, true, false, new \stdClass(), $attribute, VoterInterface::ACCESS_ABSTAIN];
- yield [$user, false, false, new \stdClass(), $attribute, VoterInterface::ACCESS_ABSTAIN];
- yield [$user, true, true, null, $attribute, VoterInterface::ACCESS_ABSTAIN];
- yield [$user, true, true, 'foo', $attribute, VoterInterface::ACCESS_ABSTAIN];
- }
- }
- }
-
- protected function getUser($id, $role)
- {
- $user = $this->getMockBuilder(User::class)->getMock();
- $user->method('getId')->willReturn($id);
- $user->method('getRoles')->willReturn([$role]);
-
- return $user;
- }
-}
diff --git a/tests/Voter/ProjectVoterTest.php b/tests/Voter/ProjectVoterTest.php
new file mode 100644
index 00000000..4f036ece
--- /dev/null
+++ b/tests/Voter/ProjectVoterTest.php
@@ -0,0 +1,67 @@
+getRoles());
+ $sut = $this->getVoter(ProjectVoter::class, $user);
+
+ $this->assertEquals($result, $sut->vote($token, $subject, [$attribute]));
+ }
+
+ public function getTestData()
+ {
+ $user0 = $this->getUser(0, null);
+ $user1 = $this->getUser(1, User::ROLE_USER);
+ $user2 = $this->getUser(2, User::ROLE_TEAMLEAD);
+ $user3 = $this->getUser(3, User::ROLE_ADMIN);
+ $user4 = $this->getUser(4, User::ROLE_SUPER_ADMIN);
+
+ $result = VoterInterface::ACCESS_GRANTED;
+ foreach ([$user3, $user4] as $user) {
+ yield [$user, new Project(), 'view', $result];
+ yield [$user, new Project(), 'edit', $result];
+ yield [$user, new Project(), 'delete', $result];
+ }
+
+ $result = VoterInterface::ACCESS_DENIED;
+ foreach ([$user0, $user1, $user2] as $user) {
+ yield [$user, new Project(), 'view', $result];
+ yield [$user, new Project(), 'edit', $result];
+ yield [$user, new Project(), 'delete', $result];
+ }
+
+ $result = VoterInterface::ACCESS_ABSTAIN;
+ foreach ([$user0, $user1, $user2] as $user) {
+ yield [$user, new Project(), 'create_project', $result];
+ yield [$user, new Project(), 'view_project', $result];
+ yield [$user, new Project(), 'edit_project', $result];
+ yield [$user, new Project(), 'delete_project', $result];
+ yield [$user, new \stdClass(), 'view', $result];
+ yield [$user, null, 'edit', $result];
+ yield [$user, $user, 'delete', $result];
+ }
+ }
+}
diff --git a/tests/Voter/RolePermissionVoterTest.php b/tests/Voter/RolePermissionVoterTest.php
new file mode 100644
index 00000000..7a841359
--- /dev/null
+++ b/tests/Voter/RolePermissionVoterTest.php
@@ -0,0 +1,133 @@
+getRoles());
+ $sut = $this->getVoter(RolePermissionVoter::class, $user);
+
+ $this->assertEquals($result, $sut->vote($token, $subject, [$attribute]));
+ }
+
+ public function getTestData()
+ {
+ $user0 = $this->getUser(0, null);
+ $user1 = $this->getUser(1, User::ROLE_USER);
+ $user2 = $this->getUser(2, User::ROLE_TEAMLEAD);
+ $user3 = $this->getUser(3, User::ROLE_ADMIN);
+ $user4 = $this->getUser(4, User::ROLE_SUPER_ADMIN);
+
+ $invoice = [
+ 'create_invoice_template' => null,
+ 'view_invoice' => null,
+ 'create_invoice' => null,
+ ];
+
+ $timesheet = [
+ 'view_own_timesheet' => null,
+ 'create_own_timesheet' => null,
+ 'export_own_timesheet' => null,
+ ];
+
+ $timesheetOther = [
+ 'view_other_timesheet' => null,
+ 'create_other_timesheet' => null,
+ ];
+
+ $others = [
+ 'create_activity' => null,
+ 'create_customer' => null,
+ 'create_project' => null,
+ ];
+
+ $users = [
+ 'create_user' => null,
+ 'view_user' => null,
+ ];
+
+ // ================== GRANTED ==================
+ $result = VoterInterface::ACCESS_GRANTED;
+
+ $entries = array_merge($timesheet);
+ foreach ([$user1, $user2, $user3, $user4] as $user) {
+ foreach ($entries as $permission => $entity) {
+ yield [$user, $entity, $permission, $result];
+ yield [$user, null, $permission, $result];
+ }
+ }
+
+ $entriesAdmin = array_merge($others, $timesheetOther, $invoice, $timesheet);
+ foreach ([$user3, $user4] as $user) {
+ foreach ($entriesAdmin as $permission => $entity) {
+ yield [$user, $entity, $permission, $result];
+ yield [$user, null, $permission, $result];
+ }
+ }
+
+ $entriesSuperAdmin = array_merge($users);
+ foreach ($entriesSuperAdmin as $permission => $entity) {
+ yield [$user4, $entity, $permission, $result];
+ yield [$user4, null, $permission, $result];
+ }
+
+ // ================== DENIED ==================
+ // this test might fail in the future due to the role permissions
+ $result = VoterInterface::ACCESS_DENIED;
+
+ foreach ([$user0, $user1, $user2] as $user) {
+ foreach ($others as $permission => $entity) {
+ yield [$user, $entity, $permission, $result];
+ }
+ }
+ foreach ([$user0, $user1] as $user) {
+ foreach ($invoice as $permission => $entity) {
+ yield [$user, $entity, $permission, $result];
+ }
+ }
+ foreach ([$user0] as $user) {
+ foreach ($timesheet as $permission => $entity) {
+ yield [$user, $entity, $permission, $result];
+ }
+ }
+ foreach ([$user0, $user1] as $user) {
+ foreach ($timesheetOther as $permission => $entity) {
+ yield [$user, $entity, $permission, $result];
+ }
+ }
+
+ // ================== ABSTAIN ==================
+ $result = VoterInterface::ACCESS_ABSTAIN;
+ foreach ([$user3, $user4] as $user) {
+ yield [$user, new Activity(), 'view', $result];
+ yield [$user, new Activity(), 'edit', $result];
+ yield [$user, new Activity(), 'delete', $result];
+ yield [$user, new Activity(), 'ROLE_USER', $result];
+ yield [$user, new Activity(), 'ROLE_ADMIN', $result];
+ yield [$user, new \stdClass(), 'view', $result];
+ yield [$user, null, 'edit', $result];
+ yield [$user, $user, 'delete', $result];
+ }
+ }
+}
diff --git a/tests/Voter/TimesheetVoterTest.php b/tests/Voter/TimesheetVoterTest.php
index c78b61c5..3274b97c 100644
--- a/tests/Voter/TimesheetVoterTest.php
+++ b/tests/Voter/TimesheetVoterTest.php
@@ -11,51 +11,69 @@ namespace App\Tests\Voter;
use App\Entity\Activity;
use App\Entity\Customer;
+use App\Entity\Project;
use App\Entity\Timesheet;
use App\Entity\User;
-use App\Security\AclDecisionManager;
use App\Voter\TimesheetVoter;
-use PHPUnit\Framework\TestCase;
use Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken;
use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
/**
* @covers \App\Voter\TimesheetVoter
*/
-class TimesheetVoterTest extends TestCase
+class TimesheetVoterTest extends AbstractVoterTest
{
/**
* @dataProvider getTestData
*/
- public function testVote($user, $roles, $allow, $subject, $attributes, $result)
+ public function testVote(User $user, $subject, $attribute, $result)
{
- $token = new UsernamePasswordToken($user, 'foo', 'bar', $roles);
+ $token = new UsernamePasswordToken($user, 'foo', 'bar', $user->getRoles());
+ $sut = $this->getVoter(TimesheetVoter::class, $user);
- $accessManager = $this->getMockBuilder(AclDecisionManager::class)->disableOriginalConstructor()->getMock();
- $accessManager->method('isFullyAuthenticated')->willReturn($allow);
- $accessManager->method('hasRole')->willReturn($allow);
-
- $sut = new TimesheetVoter($accessManager);
-
- $this->assertEquals($result, $sut->vote($token, $subject, $attributes));
+ $this->assertEquals($result, $sut->vote($token, $subject, [$attribute]));
}
public function getTestData()
{
- $user0 = $this->getUser(0, User::ROLE_CUSTOMER);
+ $user0 = $this->getUser(0, null);
$user1 = $this->getUser(1, User::ROLE_USER);
$user2 = $this->getUser(2, User::ROLE_TEAMLEAD);
+ $user3 = $this->getUser(3, User::ROLE_ADMIN);
+ $user4 = $this->getUser(4, User::ROLE_SUPER_ADMIN);
- return [
- [$user0, $user0->getRoles(), false, new Customer(), [TimesheetVoter::EDIT], VoterInterface::ACCESS_ABSTAIN],
- [$user1, $user1->getRoles(), false, $this->getTimesheet($user1), [TimesheetVoter::EDIT], VoterInterface::ACCESS_GRANTED],
- [$user1, $user1->getRoles(), false, $this->getTimesheet($user0), [TimesheetVoter::EDIT], VoterInterface::ACCESS_DENIED],
- [$user2, $user2->getRoles(), true, $this->getTimesheet($user1), [TimesheetVoter::EDIT], VoterInterface::ACCESS_GRANTED],
- ['foo', [], false, $this->getTimesheet($user1), [TimesheetVoter::EDIT], VoterInterface::ACCESS_DENIED],
- [$user2, $user2->getRoles(), true, new Activity(), [TimesheetVoter::EDIT], VoterInterface::ACCESS_ABSTAIN],
- [$user2, $user2->getRoles(), true, $this->getTimesheet($user2), [TimesheetVoter::VIEW], VoterInterface::ACCESS_GRANTED],
- [$user1, $user1->getRoles(), false, $this->getTimesheet($user2), [TimesheetVoter::VIEW], VoterInterface::ACCESS_DENIED],
+ $timesheet1 = $this->getTimesheet($user1);
+ $timesheet2 = $this->getTimesheet($user2);
+ $timesheet3 = $this->getTimesheet($user3);
+ $timesheet4 = $this->getTimesheet($user4);
+
+ $result = VoterInterface::ACCESS_GRANTED;
+ $times = [
+ [$user1, $timesheet1],
+ [$user2, $timesheet2],
+ [$user3, $timesheet3],
+ [$user4, $timesheet4],
+ [$user2, $timesheet1],
+ [$user3, $timesheet2],
+ [$user4, $timesheet3],
];
+ foreach ($times as $timeEntry) {
+ yield [$timeEntry[0], $timeEntry[1], 'start', $result];
+ yield [$timeEntry[0], $timeEntry[1], 'stop', $result];
+ yield [$timeEntry[0], $timeEntry[1], 'edit', $result];
+ yield [$timeEntry[0], $timeEntry[1], 'delete', $result];
+ }
+
+ $result = VoterInterface::ACCESS_DENIED;
+ $times = [
+ [$user1, $timesheet4],
+ ];
+ foreach ($times as $timeEntry) {
+ yield [$timeEntry[0], $timeEntry[1], 'start', $result];
+ yield [$timeEntry[0], $timeEntry[1], 'stop', $result];
+ yield [$timeEntry[0], $timeEntry[1], 'edit', $result];
+ yield [$timeEntry[0], $timeEntry[1], 'delete', $result];
+ }
}
protected function getTimesheet($user)
@@ -63,6 +81,14 @@ class TimesheetVoterTest extends TestCase
$timesheet = new Timesheet();
$timesheet->setUser($user);
+ $activity = new Activity();
+ $project = new Project();
+ $activity->setProject($project);
+ $timesheet->setProject($project);
+ $timesheet->setActivity($activity);
+ $customer = new Customer();
+ $project->setCustomer($customer);
+
return $timesheet;
}
diff --git a/tests/Voter/UserVoterTest.php b/tests/Voter/UserVoterTest.php
new file mode 100644
index 00000000..438195be
--- /dev/null
+++ b/tests/Voter/UserVoterTest.php
@@ -0,0 +1,87 @@
+getRoles());
+ $sut = $this->getVoter(UserVoter::class, $user);
+
+ $this->assertEquals($result, $sut->vote($token, $subject, [$attribute]));
+ }
+
+ public function getTestData()
+ {
+ $user0 = $this->getUser(0, null);
+ $user1 = $this->getUser(1, User::ROLE_USER);
+ $user2 = $this->getUser(2, User::ROLE_TEAMLEAD);
+ $user3 = $this->getUser(3, User::ROLE_ADMIN);
+ $user4 = $this->getUser(4, User::ROLE_SUPER_ADMIN);
+
+ $result = VoterInterface::ACCESS_GRANTED;
+ foreach ([$user1, $user2, $user3] as $user) {
+ yield [$user4, $user, 'view', $result];
+ yield [$user4, $user, 'edit', $result];
+ yield [$user4, $user, 'password', $result];
+ yield [$user4, $user, 'roles', $result];
+ yield [$user4, $user, 'preferences', $result];
+ yield [$user4, $user, 'api-token', $result];
+ }
+
+ foreach ([$user1, $user2, $user3] as $user) {
+ yield [$user4, $user, 'delete', $result];
+ }
+
+ foreach ([$user1, $user2, $user3, $user4] as $user) {
+ yield [$user, $user, 'view', $result];
+ yield [$user, $user, 'edit', $result];
+ yield [$user, $user, 'password', $result];
+ yield [$user, $user, 'preferences', $result];
+ yield [$user, $user, 'api-token', $result];
+ }
+
+ $result = VoterInterface::ACCESS_DENIED;
+ foreach ([$user0, $user1, $user2] as $user) {
+ yield [$user, $user, 'roles', $result];
+ yield [$user3, $user, 'roles', $result];
+ yield [$user, $user3, 'view', $result];
+ yield [$user, $user3, 'edit', $result];
+ yield [$user, $user3, 'delete', $result];
+ yield [$user, $user4, 'view', $result];
+ yield [$user, $user4, 'edit', $result];
+ yield [$user, $user4, 'delete', $result];
+ yield [$user, $user4, 'hourly-rate', $result];
+ }
+
+ $result = VoterInterface::ACCESS_ABSTAIN;
+ foreach ([$user0, $user1, $user2] as $user) {
+ yield [$user, new InvoiceTemplate(), 'view', $result];
+ yield [$user, new InvoiceTemplate(), 'edit', $result];
+ yield [$user, new InvoiceTemplate(), 'delete', $result];
+ yield [$user, new \stdClass(), 'view', $result];
+ yield [$user, null, 'edit', $result];
+ yield [$user, null, 'delete', $result];
+ }
+ }
+}
diff --git a/var/docs/README.md b/var/docs/README.md
index 88d965cc..0418480e 100644
--- a/var/docs/README.md
+++ b/var/docs/README.md
@@ -14,7 +14,8 @@ For the most parts Kimai usage should be self-explanatory, so we will only cover
- [Configurations](configurations.md) - intro into the global application configs
- [Calendar](calendar.md) - the Timesheet calendar view
- [Dashboard & widgets](dashboard.md) - how to configure widgets and dashboard sections
- - [Emails](emails.md) - transport configuration and handling of emails
+ - [Emails](emails.md) - transport configuration and handling of emails
+ - [Permissions](permissions.md) - flexible and configurable ROLE based permission system
- [Developer](developers.md) - docs about extending Kimai's feature set
- [API](developers_api.md) - how to use the JSON API
- [Theme settings](theme.md) - theme related settings
diff --git a/var/docs/permissions.md b/var/docs/permissions.md
new file mode 100644
index 00000000..4a5123ff
--- /dev/null
+++ b/var/docs/permissions.md
@@ -0,0 +1,115 @@
+# Permissions
+
+Kimai 2 provides a flexible permissions system, which can be adapted though your [local.yaml](configurations.md) config
+file and that is based on [user roles](users.md).
+
+## Understanding permission structure
+
+Before you learn to configure the permission system, you have to understand the three involved config types:
+
+1. `Permission sets` define a re-usable name for a list of "permission names"
+2. `Permission maps` will apply a list of "permission sets" to a "user role"
+3. `Permissions` apply a list of "permission names" to a "user role"
+
+An example and its explanation:
+
+```yaml
+ permissions:
+ sets:
+ ACTIVITY: [view_activity,create_activity]
+ TIMESHEET: [view_own_timesheet,start_own_timesheet]
+ maps:
+ ROLE_USER: [TIMESHEET]
+ ROLE_ADMIN: [TIMESHEET,ACTIVITY]
+ roles:
+ ROLE_USER: [my_profile]
+ ROLE_ADMIN: [my_profile,start_other_timesheet]
+```
+
+In `sets` we define the two `permissions sets` names "ACTIVITY" and "TIMESHEET". In `maps` we apply the `permissions set` to the
+called "TIMESHEET" to the user-role "ROLE_USER" and the two `permissions set` called "TIMESHEET" and "ACTIVITY" to the user-role "ROLE_ADMIN".
+
+At this step the role have the following permissions:
+
+- `ROLE_USER`: view_own_timesheet,start_own_timesheet
+- `ROLE_ADMIN`: view_own_timesheet,start_own_timesheet,view_activity,create_activity
+
+As last step, the list of `permission names` will be added to the list of calculated permissions.
+So we add the permission "my_profile" to the user-role "ROLE_USER" and the two permissions "my_profile" and "start_other_timesheet" to the user-role "ROLE_ADMIN".
+
+At the end the system calculated the final list of permissions:
+
+- `ROLE_USER`: view_own_timesheet,start_own_timesheet,my_profile
+- `ROLE_ADMIN`: view_own_timesheet,start_own_timesheet,view_activity,create_activity,my_profile,start_other_timesheet
+
+## Existing permissions
+
+The permission-names were chosen to be self-explanatory. In the hope that it worked, here is the full list of existing permissions:
+
+| Permission name | Set name | API use | Description |
+|---|---|---|---|
+| view_activity | ACTIVITIES | | allows access to the activity administration |
+| create_activity | ACTIVITIES | | - |
+| edit_activity | ACTIVITIES | | - |
+| delete_activity | ACTIVITIES | | - |
+| view_project | PROJECTS | | allows access to the project administration |
+| create_project | PROJECTS | | - |
+| edit_project | PROJECTS | | - |
+| delete_project | PROJECTS | | - |
+| view_customer | CUSTOMERS | | allows access to the customer administration |
+| create_customer | CUSTOMERS | | - |
+| edit_customer | CUSTOMERS | | - |
+| delete_customer | CUSTOMERS | | - |
+| view_invoice | INVOICE | | allows access to the invoice section |
+| create_invoice | INVOICE | | - |
+| view_invoice_template | INVOICE_TEMPLATE | | allows access to the invoice and invoice template section |
+| create_invoice_template | INVOICE_TEMPLATE | | - |
+| edit_invoice_template | INVOICE_TEMPLATE | | - |
+| delete_invoice_template | INVOICE_TEMPLATE | | - |
+| view_own_timesheet | TIMESHEET | X | - |
+| start_own_timesheet | TIMESHEET | | - |
+| stop_own_timesheet | TIMESHEET | | - |
+| create_own_timesheet | TIMESHEET | X | - |
+| edit_own_timesheet | TIMESHEET | | - |
+| export_own_timesheet | TIMESHEET | | - |
+| delete_own_timesheet | TIMESHEET | | - |
+| view_other_timesheet | TIMESHEET_OTHER | | allows access to the complete timesheet view |
+| start_other_timesheet | TIMESHEET_OTHER | | - |
+| stop_other_timesheet | TIMESHEET_OTHER | | - |
+| create_other_timesheet | TIMESHEET_OTHER | | - |
+| edit_other_timesheet | TIMESHEET_OTHER | | - |
+| delete_other_timesheet | TIMESHEET_OTHER | | - |
+| view_rate_own_timesheet | RATE | | - |
+| edit_rate_own_timesheet | RATE | | - |
+| view_rate_other_timesheet | RATE_OTHER | | - |
+| edit_rate_other_timesheet | RATE_OTHER | | - |
+| view_own_profile | PROFILE | | Allows access to the own profile view. Without this permission, users cannot access any of their profile settings or passwords ... |
+| edit_own_profile | PROFILE | | - |
+| delete_own_profile | PROFILE | | - |
+| password_own_profile | PROFILE | | - |
+| roles_own_profile | PROFILE | | - |
+| preferences_own_profile | PROFILE | | - |
+| api-token_own_profile | PROFILE | | - |
+| view_other_profile | PROFILE_OTHER | | - |
+| edit_other_profile | PROFILE_OTHER | | - |
+| delete_other_profile | PROFILE_OTHER | | - |
+| password_other_profile | PROFILE_OTHER | | allows to change the password for another user |
+| roles_other_profile | PROFILE_OTHER | | allows to change roles for other users |
+| preferences_other_profile | PROFILE_OTHER | | allows to change the preferences for another user |
+| api-token_other_profile | PROFILE_OTHER | | allows to set the API login token for other users |
+| hourly-rate_own_profile | - | | allows to edit the own user specific hourly rate |
+| hourly-rate_other_profile | - | | allows to edit other users specific hourly rate |
+| view_user | USER | X | allows to access the User administration and see the list of all users |
+| create_user | USER | | allows to create new users |
+| delete_user | USER | | allows to delete existing users |
+
+## Configure permissions
+
+Knowing that many companies need a different combination of allowed permissions than the default ones, you might also
+want to change the pre-configured permission.
+
+You can do that in your [local.yaml](configurations.md). Define the permissions like we did in the above mentioned example,
+you might start by copying the default permissions from `kimai.yaml`.
+
+Be aware: if you configure your own permission definition, you have to overwrite the complete
+node (`sets`, `maps` or`roles`) that you edited and define all SETS and/or ROLES.
diff --git a/var/docs/users.md b/var/docs/users.md
index 10b9adde..5b0d56c3 100644
--- a/var/docs/users.md
+++ b/var/docs/users.md
@@ -1,16 +1,20 @@
# Users
-## Roles & Permissions
+## Roles
-There are multiple pre-defined roles in Kimai, which define the ACLs. A user can only inherit one role, where the roles extend each user.
+There are multiple pre-defined roles in Kimai, which define the ACLs/permissions.
-| Role name | extends | Gives permission for |
+| Role name | extends | Description |
|---|---|---|
-| ROLE_CUSTOMER | - | Currently has no permissions, but was reserved for future functionality |
-| ROLE_USER | ROLE_CUSTOMER | Time-tracking |
-| ROLE_TEAMLEAD | ROLE_USER | All of the above, plus: editing other users timesheets |
-| ROLE_ADMIN | ROLE_TEAMLEAD | All of the above, plus: editing customers, editing projects, editing activities |
-| ROLE_SUPER_ADMIN | ROLE_ADMIN | All of the above, plus: editing users |
+| ROLE_CUSTOMER | - | Currently not used, reserved for future features |
+| ROLE_USER | ROLE_CUSTOMER | Normal user that wants to track working times |
+| ROLE_TEAMLEAD | ROLE_USER | This role manages teams of ROLE_USER (this feature is not yet implemented, but planned for the future) and has further permissions on invoices |
+| ROLE_ADMIN | ROLE_TEAMLEAD | Admins can do almost everything in Kimai, except some user specific tasks |
+| ROLE_SUPER_ADMIN | ROLE_ADMIN | Evey Super-Admin can do anything Kimai |
+
+### Permissions
+
+The permission system is configurable through a configuration file. You can find further information in the [permissions](permissions.md) chapter.
## Login