31a8f887a5
* bump version * fix formatting locale reset after embedded controller sub-requests (#5944) * fix GHSA-c6w6-57jj-62vh * fix GHSA-m492-gv72-xvxj * fix GHSA-jr9p-4h4j-6c58 * make sure to only use JS logic to call API endpoints * fixes GHSA-r8vr-m544-qh4h * make sure to only use JS logic to call API endpoints * fix GHSA-rw46-qg69-vg6h * fix GHSA-pj8j-p4g4-4vw8 - prevent kimai from rendering images via markdown * fix GHSA-pj8j-p4g4-4vw8 - use a safe network client to prevent SSRF via images * fix GHSA-xv4r-4885-gwpg * fix GHSA-pgcc-vfmc-7cw5 - move GET routes to API with POST method to prevent CSRF * fix tooltip survives page reload * updated wizard images * split wizard and password reset subscriber into two classes * relax upper php limit * added zizmor workflow scans and apply findings * user permissions <name>_other_profile now respect teams * move all linting steps to new job * updated docker image version names * use .env.local for storing APP_SECRET * improve build order and use given tag as ref for checkout, not default main branch * improved APP_SECRET handling, see entrypoint.sh * use local code for building the image for more flexibility, added dockerignore
1071 lines
37 KiB
PHP
1071 lines
37 KiB
PHP
<?php
|
|
|
|
/*
|
|
* This file is part of the Kimai time-tracking app.
|
|
*
|
|
* For the full copyright and license information, please view the LICENSE
|
|
* file that was distributed with this source code.
|
|
*/
|
|
|
|
namespace App\Tests\Security;
|
|
|
|
use App\Entity\Activity;
|
|
use App\Entity\Customer;
|
|
use App\Entity\Project;
|
|
use App\Entity\Team;
|
|
use App\Entity\Timesheet;
|
|
use App\Entity\User;
|
|
use App\Repository\RolePermissionRepository;
|
|
use App\Security\RolePermissionManager;
|
|
use App\User\PermissionService;
|
|
use PHPUnit\Framework\Attributes\CoversClass;
|
|
use PHPUnit\Framework\TestCase;
|
|
use Symfony\Component\Cache\Adapter\ArrayAdapter;
|
|
|
|
#[CoversClass(RolePermissionManager::class)]
|
|
class RolePermissionManagerTest extends TestCase
|
|
{
|
|
public function testWithEmptyRepository(): void
|
|
{
|
|
$repository = $this->getMockBuilder(RolePermissionRepository::class)->onlyMethods(['getAllAsArray'])->disableOriginalConstructor()->getMock();
|
|
$repository->method('getAllAsArray')->willReturn([]);
|
|
/** @var RolePermissionRepository $repository */
|
|
$service = new PermissionService($repository, new ArrayAdapter());
|
|
|
|
$sut = new RolePermissionManager($service, [], []);
|
|
self::assertFalse($sut->isRegisteredPermission('foo'));
|
|
self::assertEquals([], $sut->getPermissions());
|
|
self::assertFalse($sut->hasPermission('TEST_ROLE', 'foo'));
|
|
}
|
|
|
|
public function testWithRepositoryData(): void
|
|
{
|
|
$repository = $this->getMockBuilder(RolePermissionRepository::class)->onlyMethods(['getAllAsArray'])->disableOriginalConstructor()->getMock();
|
|
$repository->method('getAllAsArray')->willReturn([
|
|
['permission' => 'foo', 'role' => 'TEST_ROLE', 'allowed' => true],
|
|
['permission' => 'bar', 'role' => 'USER_ROLE', 'allowed' => true],
|
|
['permission' => 'foo', 'role' => 'USER_ROLE', 'allowed' => false],
|
|
]);
|
|
/** @var RolePermissionRepository $repository */
|
|
$service = new PermissionService($repository, new ArrayAdapter());
|
|
|
|
$sut = new RolePermissionManager($service, [], []);
|
|
|
|
// only data injected through the config will be registered as "known"
|
|
self::assertFalse($sut->isRegisteredPermission('foo'));
|
|
self::assertFalse($sut->isRegisteredPermission('bar'));
|
|
self::assertEquals([], $sut->getPermissions());
|
|
|
|
self::assertTrue($sut->hasPermission('TEST_ROLE', 'foo'));
|
|
self::assertFalse($sut->hasPermission('USER_ROLE', 'foo'));
|
|
self::assertTrue($sut->hasPermission('USER_ROLE', 'bar'));
|
|
}
|
|
|
|
public function testWithConfigData(): void
|
|
{
|
|
$repository = $this->getMockBuilder(RolePermissionRepository::class)->onlyMethods(['getAllAsArray'])->disableOriginalConstructor()->getMock();
|
|
$repository->method('getAllAsArray')->willReturn([]);
|
|
/** @var RolePermissionRepository $repository */
|
|
$service = new PermissionService($repository, new ArrayAdapter());
|
|
|
|
$sut = new RolePermissionManager($service, ['TEST_ROLE' => ['foo' => true], 'USER_ROLE' => ['bar' => true]], ['foo' => true, 'bar' => true]);
|
|
|
|
self::assertTrue($sut->isRegisteredPermission('foo'));
|
|
self::assertTrue($sut->isRegisteredPermission('bar'));
|
|
self::assertEquals(['foo', 'bar'], $sut->getPermissions());
|
|
|
|
self::assertTrue($sut->hasPermission('TEST_ROLE', 'foo'));
|
|
self::assertFalse($sut->hasPermission('TEST_ROLE', 'bar'));
|
|
self::assertFalse($sut->hasPermission('USER_ROLE', 'foo'));
|
|
self::assertTrue($sut->hasPermission('USER_ROLE', 'bar'));
|
|
}
|
|
|
|
public function testWithMixedData(): void
|
|
{
|
|
$repository = $this->getMockBuilder(RolePermissionRepository::class)->onlyMethods(['getAllAsArray'])->disableOriginalConstructor()->getMock();
|
|
$repository->method('getAllAsArray')->willReturn([
|
|
['permission' => 'foo', 'role' => 'TEST_ROLE', 'allowed' => false],
|
|
['permission' => 'bar', 'role' => 'USER_ROLE', 'allowed' => true],
|
|
['permission' => 'foo', 'role' => 'USER_ROLE', 'allowed' => false],
|
|
['permission' => 'role_permissions', 'role' => 'ROLE_SUPER_ADMIN', 'allowed' => false],
|
|
['permission' => 'view_user', 'role' => 'ROLE_SUPER_ADMIN', 'allowed' => false],
|
|
['permission' => 'create_user', 'role' => 'ROLE_SUPER_ADMIN', 'allowed' => false],
|
|
]);
|
|
/** @var RolePermissionRepository $repository */
|
|
$service = new PermissionService($repository, new ArrayAdapter());
|
|
|
|
$sut = new RolePermissionManager($service, [
|
|
'ROLE_SUPER_ADMIN' => ['role_permissions' => true, 'view_user' => true, 'create_user' => true],
|
|
'TEST_ROLE' => ['foo2' => true, 'foo' => true],
|
|
'USER_ROLE' => ['foo' => true, 'bar' => true]
|
|
], ['role_permissions' => true, 'view_user' => true, 'create_user' => true, 'foo2' => true, 'foo' => true, 'bar' => true]);
|
|
|
|
$user = new User();
|
|
$user->addRole('TEST_ROLE');
|
|
$user->addRole('FFOOOOOO');
|
|
|
|
self::assertTrue($sut->isRegisteredPermission('foo'));
|
|
self::assertTrue($sut->isRegisteredPermission('bar'));
|
|
self::assertEquals(['role_permissions', 'view_user', 'create_user', 'foo2', 'foo', 'bar'], array_values($sut->getPermissions()));
|
|
|
|
self::assertTrue($sut->hasPermission('TEST_ROLE', 'foo2'));
|
|
self::assertTrue($sut->hasRolePermission($user, 'foo2'));
|
|
self::assertFalse($sut->hasRolePermission($user, 'foo'));
|
|
self::assertFalse($sut->hasPermission('TEST_ROLE', 'foo'));
|
|
self::assertFalse($sut->hasPermission('USER_ROLE', 'foo'));
|
|
self::assertTrue($sut->hasPermission('USER_ROLE', 'bar'));
|
|
self::assertFalse($sut->hasPermission('ROLE_SUPER_ADMIN', 'create_user'));
|
|
|
|
// the next two are a special case, which might never be falsified by the database
|
|
self::assertTrue($sut->hasPermission('ROLE_SUPER_ADMIN', 'role_permissions'));
|
|
self::assertTrue($sut->hasPermission('ROLE_SUPER_ADMIN', 'view_user'));
|
|
}
|
|
|
|
public function testCheckTeamAccessCustomerAllowsUsersWithGlobalAccess(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
$customer = new Customer('Acme');
|
|
$customer->addTeam(new Team('Support'));
|
|
|
|
$user = new User();
|
|
self::assertFalse($sut->checkTeamAccessCustomer($customer, $user));
|
|
$user->initCanSeeAllData(true);
|
|
self::assertTrue($sut->checkTeamAccessCustomer($customer, $user));
|
|
}
|
|
|
|
public function testCheckTeamAccessCustomerAllowsAccessWithoutAssignedTeams(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
self::assertTrue($sut->checkTeamAccessCustomer(new Customer('Acme'), new User()));
|
|
}
|
|
|
|
public function testCheckTeamAccessCustomerRequiresMembershipForAssignedTeams(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
$customer = new Customer('Acme');
|
|
$team = new Team('Support');
|
|
$customer->addTeam($team);
|
|
|
|
$user = new User();
|
|
self::assertFalse($sut->checkTeamAccessCustomer($customer, new User()));
|
|
|
|
self::assertFalse($sut->checkTeamAccessCustomer($customer, $user));
|
|
$team->addUser($user);
|
|
self::assertTrue($sut->checkTeamAccessCustomer($customer, $user));
|
|
}
|
|
|
|
public function testCheckTeamAccessProjectDeniesAccessIfCustomerIsDenied(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
$customer = new Customer('Acme');
|
|
$customerTeam = new Team('Customer team');
|
|
$customer->addTeam($customerTeam);
|
|
|
|
$project = new Project();
|
|
$project->setCustomer($customer);
|
|
$projectTeam = new Team('Project team');
|
|
$project->addTeam($projectTeam);
|
|
|
|
$user = new User();
|
|
$projectTeam->addUser($user);
|
|
|
|
self::assertFalse($sut->checkTeamAccessProject($project, $user));
|
|
}
|
|
|
|
public function testCheckTeamAccessProjectAllowsUsersWithGlobalAccess(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
$customer = new Customer('Acme');
|
|
$customer->addTeam(new Team('Customer team'));
|
|
|
|
$project = new Project();
|
|
$project->setCustomer($customer);
|
|
$project->addTeam(new Team('Project team'));
|
|
|
|
$user = new User();
|
|
self::assertFalse($sut->checkTeamAccessProject($project, $user));
|
|
$user->initCanSeeAllData(true);
|
|
self::assertTrue($sut->checkTeamAccessProject($project, $user));
|
|
}
|
|
|
|
public function testCheckTeamAccessProjectAllowsMatchingProjectTeamAfterCustomerAccess(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
$customer = new Customer('Acme');
|
|
$customerTeam = new Team('Customer team');
|
|
$customer->addTeam($customerTeam);
|
|
|
|
$project = new Project();
|
|
$project->setCustomer($customer);
|
|
$projectTeam = new Team('Project team');
|
|
$project->addTeam($projectTeam);
|
|
|
|
$user = new User();
|
|
$customerTeam->addUser($user);
|
|
$projectTeam->addUser($user);
|
|
|
|
self::assertTrue($sut->checkTeamAccessProject($project, $user));
|
|
}
|
|
|
|
public function testCheckTeamAccessActivityDeniesAccessIfProjectIsDenied(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
$customer = new Customer('Acme');
|
|
$customerTeam = new Team('Customer team');
|
|
$customer->addTeam($customerTeam);
|
|
|
|
$project = new Project();
|
|
$project->setCustomer($customer);
|
|
$projectTeam = new Team('Project team');
|
|
$project->addTeam($projectTeam);
|
|
|
|
$activity = new Activity();
|
|
$activity->setProject($project);
|
|
$activityTeam = new Team('Activity team');
|
|
$activity->addTeam($activityTeam);
|
|
|
|
$user = new User();
|
|
$activityTeam->addUser($user);
|
|
|
|
self::assertFalse($sut->checkTeamAccessActivity($activity, $user));
|
|
}
|
|
|
|
public function testCheckTeamAccessActivityAllowsUsersWithGlobalAccess(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
$customer = new Customer('Acme');
|
|
$customer->addTeam(new Team('Customer team'));
|
|
|
|
$project = new Project();
|
|
$project->setCustomer($customer);
|
|
$project->addTeam(new Team('Project team'));
|
|
|
|
$activity = new Activity();
|
|
$activity->setProject($project);
|
|
$activity->addTeam(new Team('Activity team'));
|
|
|
|
$user = new User();
|
|
self::assertFalse($sut->checkTeamAccessActivity($activity, $user));
|
|
$user->initCanSeeAllData(true);
|
|
self::assertTrue($sut->checkTeamAccessActivity($activity, $user));
|
|
}
|
|
|
|
public function testCheckTeamAccessActivityAllowsMatchingActivityTeamAfterProjectAccess(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
$customer = new Customer('Acme');
|
|
$customerTeam = new Team('Customer team');
|
|
$customer->addTeam($customerTeam);
|
|
|
|
$project = new Project();
|
|
$project->setCustomer($customer);
|
|
$projectTeam = new Team('Project team');
|
|
$project->addTeam($projectTeam);
|
|
|
|
$activity = new Activity();
|
|
$activity->setProject($project);
|
|
$activityTeam = new Team('Activity team');
|
|
$activity->addTeam($activityTeam);
|
|
|
|
$user = new User();
|
|
$customerTeam->addUser($user);
|
|
$projectTeam->addUser($user);
|
|
$activityTeam->addUser($user);
|
|
|
|
self::assertTrue($sut->checkTeamAccessActivity($activity, $user));
|
|
}
|
|
|
|
public function testCheckTeamAccessTimesheetGrantsAccessForOwner(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$owner = new User();
|
|
$timesheet = new Timesheet();
|
|
$timesheet->setUser($owner);
|
|
|
|
self::assertTrue($sut->checkTeamAccessTimesheet($timesheet, $owner));
|
|
}
|
|
|
|
public function testCheckTeamAccessTimesheetGrantsForOwnerEvenWithBlockingTeams(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$owner = self::userWithId(42);
|
|
$customer = new Customer('Acme');
|
|
$customer->addTeam(new Team('Customer team'));
|
|
$project = new Project();
|
|
$project->setCustomer($customer);
|
|
$project->addTeam(new Team('Project team'));
|
|
$activity = new Activity();
|
|
$activity->setProject($project);
|
|
$activity->addTeam(new Team('Activity team'));
|
|
|
|
$ownerTeam = new Team('Owner team');
|
|
$ownerTeam->addUser($owner);
|
|
|
|
$timesheet = new Timesheet();
|
|
$timesheet->setUser($owner);
|
|
$timesheet->setProject($project);
|
|
$timesheet->setActivity($activity);
|
|
|
|
// Owner is not in any of the customer/project/activity teams and is only
|
|
// a member (not teamlead) of his own team — must still be granted access
|
|
self::assertTrue($sut->checkTeamAccessTimesheet($timesheet, $owner));
|
|
}
|
|
|
|
public function testCheckTeamAccessTimesheetGrantsForDifferentInstancesWithSameId(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$owner = self::userWithId(42);
|
|
$requester = self::userWithId(42);
|
|
// Make sure the requester does not pass via canSeeAllData or team membership.
|
|
self::assertNotSame($owner, $requester);
|
|
|
|
$customer = new Customer('Acme');
|
|
$customer->addTeam(new Team('Customer team'));
|
|
$project = new Project();
|
|
$project->setCustomer($customer);
|
|
$activity = new Activity();
|
|
$activity->setProject($project);
|
|
|
|
$timesheet = new Timesheet();
|
|
$timesheet->setUser($owner);
|
|
$timesheet->setProject($project);
|
|
$timesheet->setActivity($activity);
|
|
|
|
self::assertTrue($sut->checkTeamAccessTimesheet($timesheet, $requester));
|
|
}
|
|
|
|
public function testCheckTeamAccessTimesheetGrantsForCanSeeAllData(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$owner = self::userWithId(1);
|
|
$ownerTeam = new Team('Owner team');
|
|
$ownerTeam->addUser($owner);
|
|
|
|
$customer = new Customer('Acme');
|
|
$customer->addTeam(new Team('Customer team'));
|
|
$project = new Project();
|
|
$project->setCustomer($customer);
|
|
$project->addTeam(new Team('Project team'));
|
|
$activity = new Activity();
|
|
$activity->setProject($project);
|
|
$activity->addTeam(new Team('Activity team'));
|
|
|
|
$timesheet = new Timesheet();
|
|
$timesheet->setUser($owner);
|
|
$timesheet->setProject($project);
|
|
$timesheet->setActivity($activity);
|
|
|
|
$requester = self::userWithId(2);
|
|
$requester->initCanSeeAllData(true);
|
|
|
|
self::assertTrue($sut->checkTeamAccessTimesheet($timesheet, $requester));
|
|
}
|
|
|
|
public function testCheckTeamAccessTimesheetGrantsForCanSeeAllDataWithEmptyTimesheet(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$requester = self::userWithId(2);
|
|
$requester->initCanSeeAllData(true);
|
|
|
|
$timesheet = new Timesheet();
|
|
|
|
self::assertTrue($sut->checkTeamAccessTimesheet($timesheet, $requester));
|
|
}
|
|
|
|
public function testCheckTeamAccessTimesheetDeniesWhenCustomerTeamRestricts(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$owner = self::userWithId(1);
|
|
$requester = self::userWithId(2);
|
|
|
|
$customer = new Customer('Acme');
|
|
$customer->addTeam(new Team('Customer team'));
|
|
|
|
$project = new Project();
|
|
$project->setCustomer($customer);
|
|
|
|
$timesheet = new Timesheet();
|
|
$timesheet->setUser($owner);
|
|
$timesheet->setProject($project);
|
|
|
|
// Even if requester would be a teamlead of the timesheet user's team, the
|
|
// customer gate must still deny.
|
|
$ownerTeam = new Team('Owner team');
|
|
$ownerTeam->addUser($owner);
|
|
$ownerTeam->addTeamlead($requester);
|
|
|
|
self::assertFalse($sut->checkTeamAccessTimesheet($timesheet, $requester));
|
|
}
|
|
|
|
public function testCheckTeamAccessTimesheetDeniesWhenProjectTeamRestricts(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$owner = self::userWithId(1);
|
|
$requester = self::userWithId(2);
|
|
|
|
$project = new Project();
|
|
$project->setCustomer(new Customer('Acme'));
|
|
$project->addTeam(new Team('Project team'));
|
|
|
|
$timesheet = new Timesheet();
|
|
$timesheet->setUser($owner);
|
|
$timesheet->setProject($project);
|
|
|
|
self::assertFalse($sut->checkTeamAccessTimesheet($timesheet, $requester));
|
|
}
|
|
|
|
public function testCheckTeamAccessTimesheetDeniesWhenCustomerOkButProjectRestricts(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$owner = self::userWithId(1);
|
|
$requester = self::userWithId(2);
|
|
|
|
$customer = new Customer('Acme');
|
|
$customerTeam = new Team('Customer team');
|
|
$customer->addTeam($customerTeam);
|
|
$customerTeam->addUser($requester);
|
|
|
|
$project = new Project();
|
|
$project->setCustomer($customer);
|
|
$project->addTeam(new Team('Project team'));
|
|
|
|
$timesheet = new Timesheet();
|
|
$timesheet->setUser($owner);
|
|
$timesheet->setProject($project);
|
|
|
|
self::assertFalse($sut->checkTeamAccessTimesheet($timesheet, $requester));
|
|
}
|
|
|
|
public function testCheckTeamAccessTimesheetPassesProjectGateWithoutTeams(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$owner = self::userWithId(1);
|
|
$requester = self::userWithId(2);
|
|
|
|
// No customer team, no project team -> project gate is permissive.
|
|
$project = new Project();
|
|
$project->setCustomer(new Customer('Acme'));
|
|
|
|
$timesheet = new Timesheet();
|
|
$timesheet->setUser($owner);
|
|
$timesheet->setProject($project);
|
|
|
|
// Owner has no teams -> teamlead gate is permissive too.
|
|
self::assertTrue($sut->checkTeamAccessTimesheet($timesheet, $requester));
|
|
}
|
|
|
|
public function testCheckTeamAccessTimesheetDeniesWhenActivityTeamRestricts(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$owner = self::userWithId(1);
|
|
$requester = self::userWithId(2);
|
|
|
|
$project = new Project();
|
|
$project->setCustomer(new Customer('Acme'));
|
|
|
|
$activity = new Activity();
|
|
$activity->setProject($project);
|
|
$activity->addTeam(new Team('Activity team'));
|
|
|
|
$timesheet = new Timesheet();
|
|
$timesheet->setUser($owner);
|
|
$timesheet->setProject($project);
|
|
$timesheet->setActivity($activity);
|
|
|
|
self::assertFalse($sut->checkTeamAccessTimesheet($timesheet, $requester));
|
|
}
|
|
|
|
public function testCheckTeamAccessTimesheetPassesActivityGateWithoutTeams(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$owner = self::userWithId(1);
|
|
$requester = self::userWithId(2);
|
|
|
|
$project = new Project();
|
|
$project->setCustomer(new Customer('Acme'));
|
|
|
|
$activity = new Activity();
|
|
$activity->setProject($project);
|
|
|
|
$timesheet = new Timesheet();
|
|
$timesheet->setUser($owner);
|
|
$timesheet->setProject($project);
|
|
$timesheet->setActivity($activity);
|
|
|
|
self::assertTrue($sut->checkTeamAccessTimesheet($timesheet, $requester));
|
|
}
|
|
|
|
public function testCheckTeamAccessTimesheetActivityChainsThroughItsProjectAndCustomer(): void
|
|
{
|
|
// checkTeamAccessActivity walks activity -> project -> customer. Even when
|
|
// the timesheet's project gate already passed, the activity must re-pass
|
|
// its own project's customer gate.
|
|
$sut = $this->createSut();
|
|
|
|
$owner = self::userWithId(1);
|
|
$requester = self::userWithId(2);
|
|
|
|
// Timesheet's own project is unrestricted.
|
|
$timesheetProject = new Project();
|
|
$timesheetProject->setCustomer(new Customer('Acme'));
|
|
|
|
// Activity is wired to a different project whose customer locks out the requester.
|
|
$blockedCustomer = new Customer('Blocked');
|
|
$blockedCustomer->addTeam(new Team('Blocked customer team'));
|
|
$activityProject = new Project();
|
|
$activityProject->setCustomer($blockedCustomer);
|
|
|
|
$activity = new Activity();
|
|
$activity->setProject($activityProject);
|
|
|
|
$timesheet = new Timesheet();
|
|
$timesheet->setUser($owner);
|
|
$timesheet->setProject($timesheetProject);
|
|
$timesheet->setActivity($activity);
|
|
|
|
self::assertFalse($sut->checkTeamAccessTimesheet($timesheet, $requester));
|
|
}
|
|
|
|
public function testCheckTeamAccessTimesheetGrantsWhenTimesheetUserHasNoTeams(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$owner = self::userWithId(1);
|
|
$requester = self::userWithId(2);
|
|
|
|
$timesheet = new Timesheet();
|
|
$timesheet->setUser($owner);
|
|
|
|
// Owner has no team memberships -> teamlead gate returns true.
|
|
self::assertSame([], $owner->getTeams());
|
|
self::assertTrue($sut->checkTeamAccessTimesheet($timesheet, $requester));
|
|
}
|
|
|
|
public function testCheckTeamAccessTimesheetDeniesPlainMemberOfTimesheetUserTeam(): void
|
|
{
|
|
// Headline behaviour: plain team membership is NOT enough — the requester
|
|
// must be a teamlead.
|
|
$sut = $this->createSut();
|
|
|
|
$owner = self::userWithId(1);
|
|
$requester = self::userWithId(2);
|
|
|
|
$sharedTeam = new Team('Shared');
|
|
$sharedTeam->addUser($owner);
|
|
$sharedTeam->addUser($requester);
|
|
|
|
$timesheet = new Timesheet();
|
|
$timesheet->setUser($owner);
|
|
|
|
self::assertTrue($requester->isInTeam($sharedTeam));
|
|
self::assertFalse($requester->isTeamleadOf($sharedTeam));
|
|
self::assertFalse($sut->checkTeamAccessTimesheet($timesheet, $requester));
|
|
}
|
|
|
|
public function testCheckTeamAccessTimesheetGrantsTeamleadOfTimesheetUserTeam(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$owner = self::userWithId(1);
|
|
$requester = self::userWithId(2);
|
|
|
|
$sharedTeam = new Team('Shared');
|
|
$sharedTeam->addUser($owner);
|
|
$sharedTeam->addTeamlead($requester);
|
|
|
|
$timesheet = new Timesheet();
|
|
$timesheet->setUser($owner);
|
|
|
|
self::assertTrue($requester->isTeamleadOf($sharedTeam));
|
|
self::assertTrue($sut->checkTeamAccessTimesheet($timesheet, $requester));
|
|
}
|
|
|
|
public function testCheckTeamAccessTimesheetGrantsTeamleadOfOneOfMultipleTeams(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$owner = self::userWithId(1);
|
|
$requester = self::userWithId(2);
|
|
|
|
$teamA = new Team('A');
|
|
$teamB = new Team('B');
|
|
$teamA->addUser($owner);
|
|
$teamB->addUser($owner);
|
|
$teamA->addUser($requester);
|
|
$teamB->addTeamlead($requester);
|
|
|
|
$timesheet = new Timesheet();
|
|
$timesheet->setUser($owner);
|
|
|
|
self::assertTrue($sut->checkTeamAccessTimesheet($timesheet, $requester));
|
|
}
|
|
|
|
public function testCheckTeamAccessTimesheetDeniesWhenTeamleadOfNoneOfMultipleTeams(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$owner = self::userWithId(1);
|
|
$requester = self::userWithId(2);
|
|
|
|
$teamA = new Team('A');
|
|
$teamB = new Team('B');
|
|
$teamA->addUser($owner);
|
|
$teamB->addUser($owner);
|
|
$teamA->addUser($requester);
|
|
$teamB->addUser($requester);
|
|
|
|
$timesheet = new Timesheet();
|
|
$timesheet->setUser($owner);
|
|
|
|
self::assertFalse($sut->checkTeamAccessTimesheet($timesheet, $requester));
|
|
}
|
|
|
|
public function testCheckTeamAccessTimesheetDeniesWhenTeamleadOfUnrelatedTeam(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$owner = self::userWithId(1);
|
|
$requester = self::userWithId(2);
|
|
|
|
$ownerTeam = new Team('Owner team');
|
|
$ownerTeam->addUser($owner);
|
|
|
|
$unrelatedTeam = new Team('Unrelated');
|
|
$unrelatedTeam->addTeamlead($requester);
|
|
|
|
$timesheet = new Timesheet();
|
|
$timesheet->setUser($owner);
|
|
|
|
self::assertFalse($requester->isInTeam($ownerTeam));
|
|
self::assertFalse($requester->isTeamleadOf($ownerTeam));
|
|
self::assertFalse($sut->checkTeamAccessTimesheet($timesheet, $requester));
|
|
}
|
|
|
|
public function testCheckTeamAccessTimesheetGrantsWhenTimesheetUserIsNullAndNoProjectActivity(): void
|
|
{
|
|
// Documents current behaviour: an orphaned timesheet (no user) bypasses
|
|
// the teamlead gate because getTeams() ?? [] is empty.
|
|
$sut = $this->createSut();
|
|
|
|
$requester = self::userWithId(2);
|
|
$timesheet = new Timesheet();
|
|
|
|
self::assertNull($timesheet->getUser());
|
|
self::assertTrue($sut->checkTeamAccessTimesheet($timesheet, $requester));
|
|
}
|
|
|
|
public function testCheckTeamAccessTimesheetDeniesWhenTimesheetUserNullButProjectRestricts(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$requester = self::userWithId(2);
|
|
|
|
$project = new Project();
|
|
$project->setCustomer(new Customer('Acme'));
|
|
$project->addTeam(new Team('Project team'));
|
|
|
|
$timesheet = new Timesheet();
|
|
$timesheet->setProject($project);
|
|
|
|
self::assertFalse($sut->checkTeamAccessTimesheet($timesheet, $requester));
|
|
}
|
|
|
|
public function testCheckTeamAccessTimesheetGrantsWithoutProjectAndActivityWhenTeamlead(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$owner = self::userWithId(1);
|
|
$requester = self::userWithId(2);
|
|
|
|
$sharedTeam = new Team('Shared');
|
|
$sharedTeam->addUser($owner);
|
|
$sharedTeam->addTeamlead($requester);
|
|
|
|
$timesheet = new Timesheet();
|
|
$timesheet->setUser($owner);
|
|
|
|
self::assertNull($timesheet->getProject());
|
|
self::assertNull($timesheet->getActivity());
|
|
self::assertTrue($sut->checkTeamAccessTimesheet($timesheet, $requester));
|
|
}
|
|
|
|
public function testCheckTeamAccessTimesheetGrantsFullChainAsMemberAndTeamlead(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$owner = self::userWithId(1);
|
|
$requester = self::userWithId(2);
|
|
|
|
$customer = new Customer('Acme');
|
|
$customerTeam = new Team('Customer team');
|
|
$customer->addTeam($customerTeam);
|
|
$customerTeam->addUser($requester);
|
|
|
|
$project = new Project();
|
|
$project->setCustomer($customer);
|
|
$projectTeam = new Team('Project team');
|
|
$project->addTeam($projectTeam);
|
|
$projectTeam->addUser($requester);
|
|
|
|
$activity = new Activity();
|
|
$activity->setProject($project);
|
|
$activityTeam = new Team('Activity team');
|
|
$activity->addTeam($activityTeam);
|
|
$activityTeam->addUser($requester);
|
|
|
|
$ownerTeam = new Team('Owner team');
|
|
$ownerTeam->addUser($owner);
|
|
$ownerTeam->addTeamlead($requester);
|
|
|
|
$timesheet = new Timesheet();
|
|
$timesheet->setUser($owner);
|
|
$timesheet->setProject($project);
|
|
$timesheet->setActivity($activity);
|
|
|
|
self::assertTrue($sut->checkTeamAccessTimesheet($timesheet, $requester));
|
|
}
|
|
|
|
public function testCheckTeamAccessTimesheetDeniesFullChainMissingActivityTeam(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$owner = self::userWithId(1);
|
|
$requester = self::userWithId(2);
|
|
|
|
$customer = new Customer('Acme');
|
|
$customerTeam = new Team('Customer team');
|
|
$customer->addTeam($customerTeam);
|
|
$customerTeam->addUser($requester);
|
|
|
|
$project = new Project();
|
|
$project->setCustomer($customer);
|
|
$projectTeam = new Team('Project team');
|
|
$project->addTeam($projectTeam);
|
|
$projectTeam->addUser($requester);
|
|
|
|
$activity = new Activity();
|
|
$activity->setProject($project);
|
|
$activity->addTeam(new Team('Activity team')); // requester missing
|
|
|
|
$ownerTeam = new Team('Owner team');
|
|
$ownerTeam->addUser($owner);
|
|
$ownerTeam->addTeamlead($requester);
|
|
|
|
$timesheet = new Timesheet();
|
|
$timesheet->setUser($owner);
|
|
$timesheet->setProject($project);
|
|
$timesheet->setActivity($activity);
|
|
|
|
self::assertFalse($sut->checkTeamAccessTimesheet($timesheet, $requester));
|
|
}
|
|
|
|
public function testCheckTeamAccessTimesheetDeniesFullChainOnlyMemberNotTeamlead(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$owner = self::userWithId(1);
|
|
$requester = self::userWithId(2);
|
|
|
|
$customer = new Customer('Acme');
|
|
$customerTeam = new Team('Customer team');
|
|
$customer->addTeam($customerTeam);
|
|
$customerTeam->addUser($requester);
|
|
|
|
$project = new Project();
|
|
$project->setCustomer($customer);
|
|
$projectTeam = new Team('Project team');
|
|
$project->addTeam($projectTeam);
|
|
$projectTeam->addUser($requester);
|
|
|
|
$activity = new Activity();
|
|
$activity->setProject($project);
|
|
$activityTeam = new Team('Activity team');
|
|
$activity->addTeam($activityTeam);
|
|
$activityTeam->addUser($requester);
|
|
|
|
$ownerTeam = new Team('Owner team');
|
|
$ownerTeam->addUser($owner);
|
|
$ownerTeam->addUser($requester); // plain member only
|
|
|
|
$timesheet = new Timesheet();
|
|
$timesheet->setUser($owner);
|
|
$timesheet->setProject($project);
|
|
$timesheet->setActivity($activity);
|
|
|
|
self::assertFalse($sut->checkTeamAccessTimesheet($timesheet, $requester));
|
|
}
|
|
|
|
public function testCheckUserAccessGrantsAccessForSameUserId(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$subject = self::userWithId(42);
|
|
$subject->setEnabled(false);
|
|
$subject->setSystemAccount(true);
|
|
|
|
$requester = self::userWithId(42);
|
|
|
|
self::assertTrue($sut->checkUserAccess($subject, $requester));
|
|
}
|
|
|
|
public function testCheckUserAccessGrantsAccessForSuperAdmin(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$subject = self::userWithId(1);
|
|
$subject->setEnabled(true);
|
|
|
|
$requester = self::userWithId(2);
|
|
$requester->setSuperAdmin(true);
|
|
|
|
self::assertTrue($sut->checkUserAccess($subject, $requester));
|
|
}
|
|
|
|
public function testCheckUserAccessGrantsAccessForCanSeeAllData(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$subject = self::userWithId(1);
|
|
$subject->setEnabled(true);
|
|
|
|
$requester = self::userWithId(2);
|
|
$requester->initCanSeeAllData(true);
|
|
|
|
self::assertTrue($sut->checkUserAccess($subject, $requester));
|
|
}
|
|
|
|
public function testCheckUserAccessDeniesDisabledSubject(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$subject = self::userWithId(1);
|
|
$subject->setEnabled(false);
|
|
|
|
$requester = self::userWithId(2);
|
|
$requester->setRoles([User::ROLE_TEAMLEAD]);
|
|
|
|
self::assertFalse($sut->checkUserAccess($subject, $requester));
|
|
}
|
|
|
|
public function testCheckUserAccessAllowsDisabledSubjectWhenOnlyEnabledIsFalse(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$subject = self::userWithId(1);
|
|
$subject->setEnabled(false);
|
|
|
|
$requester = self::userWithId(2);
|
|
$team = new Team('Support');
|
|
$team->addUser($subject);
|
|
$team->addTeamlead($requester);
|
|
|
|
// with $onlyEnabled = true (default) the disabled flag denies access
|
|
self::assertFalse($sut->checkUserAccess($subject, $requester));
|
|
// with $onlyEnabled = false the disabled flag is ignored and the teamlead path grants access
|
|
self::assertTrue($sut->checkUserAccess($subject, $requester, false));
|
|
}
|
|
|
|
public function testCheckUserAccessOnlyEnabledFalseStillRequiresAccessPath(): void
|
|
{
|
|
// disabling the "enabled" check must not bypass the rest of the access logic:
|
|
// a requester without team relation must still be denied.
|
|
$sut = $this->createSut();
|
|
|
|
$subject = self::userWithId(1);
|
|
$subject->setEnabled(false);
|
|
(new Team('Subject team'))->addUser($subject);
|
|
|
|
$requester = self::userWithId(2);
|
|
$requester->setRoles([User::ROLE_TEAMLEAD]);
|
|
|
|
self::assertFalse($sut->checkUserAccess($subject, $requester, false));
|
|
}
|
|
|
|
public function testCheckUserAccessOnlyEnabledFalseStillBlocksSystemAccountSubject(): void
|
|
{
|
|
// the system-account guard sits below the "enabled" check, so it must still
|
|
// apply when $onlyEnabled = false.
|
|
$sut = $this->createSut();
|
|
|
|
$subject = self::userWithId(1);
|
|
$subject->setEnabled(false);
|
|
$subject->setSystemAccount(true);
|
|
|
|
$requester = self::userWithId(2);
|
|
$team = new Team('Support');
|
|
$team->addUser($subject);
|
|
$team->addTeamlead($requester);
|
|
|
|
self::assertFalse($sut->checkUserAccess($subject, $requester, false));
|
|
}
|
|
|
|
public function testCheckUserAccessOnlyEnabledFalseGrantsAdminFallbackForDisabledTeamlessUser(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$subject = self::userWithId(1);
|
|
$subject->setEnabled(false);
|
|
|
|
$requester = self::userWithId(2);
|
|
$requester->setRoles([User::ROLE_ADMIN]);
|
|
|
|
self::assertTrue($subject->isRegularUserOnly());
|
|
self::assertSame([], $subject->getTeams());
|
|
self::assertFalse($sut->checkUserAccess($subject, $requester));
|
|
self::assertTrue($sut->checkUserAccess($subject, $requester, false));
|
|
}
|
|
|
|
public function testCheckUserAccessOnlyEnabledFalseStillGrantsSuperAdmin(): void
|
|
{
|
|
// super-admin / canSeeAllData is decided before the "enabled" check,
|
|
// so the result must not change with the flag.
|
|
$sut = $this->createSut();
|
|
|
|
$subject = self::userWithId(1);
|
|
$subject->setEnabled(false);
|
|
|
|
$requester = self::userWithId(2);
|
|
$requester->setSuperAdmin(true);
|
|
|
|
self::assertTrue($sut->checkUserAccess($subject, $requester));
|
|
self::assertTrue($sut->checkUserAccess($subject, $requester, false));
|
|
}
|
|
|
|
public function testCheckUserAccessDeniesSystemAccountForNonSystemRequester(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$subject = self::userWithId(1);
|
|
$subject->setEnabled(true);
|
|
$subject->setSystemAccount(true);
|
|
|
|
$requester = self::userWithId(2);
|
|
$requester->setRoles([User::ROLE_TEAMLEAD]);
|
|
|
|
self::assertFalse($sut->checkUserAccess($subject, $requester));
|
|
}
|
|
|
|
public function testCheckUserAccessGrantsTeamleadOfUser(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$subject = self::userWithId(1);
|
|
$subject->setEnabled(true);
|
|
|
|
$requester = self::userWithId(2);
|
|
$team = new Team('Support');
|
|
$team->addUser($subject);
|
|
$team->addTeamlead($requester);
|
|
|
|
self::assertTrue($requester->isTeamleadOfUser($subject));
|
|
self::assertTrue($sut->checkUserAccess($subject, $requester));
|
|
}
|
|
|
|
public function testCheckUserAccessGrantsAdminFallbackForRegularUserWithoutTeam(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$subject = self::userWithId(1);
|
|
$subject->setEnabled(true);
|
|
|
|
$requester = self::userWithId(2);
|
|
$requester->setRoles([User::ROLE_ADMIN]);
|
|
|
|
self::assertTrue($subject->isRegularUserOnly());
|
|
self::assertSame([], $subject->getTeams());
|
|
self::assertTrue($sut->checkUserAccess($subject, $requester));
|
|
}
|
|
|
|
public function testCheckUserAccessGrantsTeamleadFallbackForRegularUserWithoutTeam(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$subject = self::userWithId(1);
|
|
$subject->setEnabled(true);
|
|
|
|
$requester = self::userWithId(2);
|
|
$requester->setRoles([User::ROLE_TEAMLEAD]);
|
|
|
|
self::assertTrue($subject->isRegularUserOnly());
|
|
self::assertSame([], $subject->getTeams());
|
|
self::assertTrue($sut->checkUserAccess($subject, $requester));
|
|
}
|
|
|
|
public function testCheckUserAccessDeniesFallbackForRegularUserWithTeam(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$subject = self::userWithId(1);
|
|
$subject->setEnabled(true);
|
|
(new Team('Support'))->addUser($subject);
|
|
|
|
$requester = self::userWithId(2);
|
|
$requester->setRoles([User::ROLE_ADMIN]);
|
|
|
|
self::assertTrue($subject->isRegularUserOnly());
|
|
self::assertNotSame([], $subject->getTeams());
|
|
self::assertFalse($sut->checkUserAccess($subject, $requester));
|
|
}
|
|
|
|
public function testCheckUserAccessDeniesFallbackForNonRegularUserWithoutTeam(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$subject = self::userWithId(1);
|
|
$subject->setEnabled(true);
|
|
$subject->addRole(User::ROLE_TEAMLEAD);
|
|
|
|
$requester = self::userWithId(2);
|
|
$requester->setRoles([User::ROLE_ADMIN]);
|
|
|
|
self::assertFalse($subject->isRegularUserOnly());
|
|
self::assertSame([], $subject->getTeams());
|
|
self::assertFalse($sut->checkUserAccess($subject, $requester));
|
|
}
|
|
|
|
public function testCheckUserAccessDeniesSystemRequesterWithoutMatchingAccessPath(): void
|
|
{
|
|
$sut = $this->createSut();
|
|
|
|
$subject = self::userWithId(1);
|
|
$subject->setEnabled(true);
|
|
$subject->setSystemAccount(true);
|
|
|
|
$requester = self::userWithId(2);
|
|
$requester->setSystemAccount(true);
|
|
|
|
self::assertFalse($sut->checkUserAccess($subject, $requester));
|
|
}
|
|
|
|
private static function userWithId(int $id): User
|
|
{
|
|
$user = new User();
|
|
$reflection = new \ReflectionClass($user);
|
|
$property = $reflection->getProperty('id');
|
|
$property->setAccessible(true);
|
|
$property->setValue($user, $id);
|
|
|
|
return $user;
|
|
}
|
|
|
|
private function createSut(): RolePermissionManager
|
|
{
|
|
$repository = $this->getMockBuilder(RolePermissionRepository::class)->onlyMethods(['getAllAsArray'])->disableOriginalConstructor()->getMock();
|
|
$repository->method('getAllAsArray')->willReturn([]);
|
|
|
|
return new RolePermissionManager(new PermissionService($repository, new ArrayAdapter()), [], []);
|
|
}
|
|
}
|