jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Re-usable ACL checks on teams (#5925)

Browse Source
This commit is contained in:
Kevin Papst
2026-04-26 17:06:59 +02:00
committed by GitHub
parent 7a559a09e6
commit 20c7b03bd9
14 changed files with 1393 additions and 149 deletions
Download Patch File Download Diff File Expand all files Collapse all files

49
tests/Voter/CustomerVoterTest.php
View File

@@ -16,6 +16,7 @@ use App\Voter\CustomerVoter;
use PHPUnit\Framework\Attributes\CoversClass;
use Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken;
use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
use Symfony\Component\Security\Core\User\InMemoryUser;
#[CoversClass(CustomerVoter::class)]
class CustomerVoterTest extends AbstractVoterTestCase
@@ -163,4 +164,52 @@ class CustomerVoterTest extends AbstractVoterTestCase
$this->assertVote($user, $customer, 'access', VoterInterface::ACCESS_DENIED);
}
public function testAccessGrantedForCanSeeAllDataDespiteRestrictiveTeams(): void
{
$customer = new Customer('foo');
$customer->addTeam(new Team('locked'));
$user = new User();
$user->initCanSeeAllData(true);
$this->assertVote($user, $customer, 'access', VoterInterface::ACCESS_GRANTED);
}
public function testAccessGrantedWhenUserMatchesOneOfMultipleCustomerTeams(): void
{
$sharedTeam = new Team('shared');
$foreignTeam = new Team('foreign');
$customer = new Customer('foo');
$customer->addTeam($foreignTeam);
$customer->addTeam($sharedTeam);
$user = new User();
$sharedTeam->addUser($user);
$this->assertVote($user, $customer, 'access', VoterInterface::ACCESS_GRANTED);
}
public function testAccessDeniedWhenUserOnlyInUnrelatedTeams(): void
{
$customer = new Customer('foo');
$customer->addTeam(new Team('customerTeam'));
$user = new User();
$unrelated = new Team('unrelated');
$unrelated->addUser($user);
$unrelated->addTeamlead($user);
$this->assertVote($user, $customer, 'access', VoterInterface::ACCESS_DENIED);
}
public function testAccessDeniedForNonUserToken(): void
{
$customer = new Customer('foo');
$token = new UsernamePasswordToken(new InMemoryUser('anon', null), 'bar', []);
$sut = $this->getVoter(CustomerVoter::class);
self::assertEquals(VoterInterface::ACCESS_DENIED, $sut->vote($token, $customer, ['access']));
}
}