Updated security expressions #148 (#166)

* replace has_role() with is_granted()
* added basic integration test classes for main controller
* added basic integration test classes for admin controller

src/Controller/ActivityController.php

@@ -18,8 +18,7 @@ use App\Repository\ActivityRepository;
 /**
  * Controller used to manage activity contents in the public part of the site.
  *
- * @Route("/activity")
+ * @Security("is_granted('ROLE_USER')")
- * @Security("has_role('ROLE_USER')")
  */
 class ActivityController extends Controller
 {

src/Controller/Admin/ActivityController.php

@@ -25,7 +25,7 @@ use App\Repository\Query\ActivityQuery;
  * Controller used to manage activities in the admin part of the site.
  *
  * @Route("/admin/activity")
- * @Security("has_role('ROLE_ADMIN')")
+ * @Security("is_granted('ROLE_ADMIN')")
  * @Security("is_granted('IS_AUTHENTICATED_FULLY')")
  */
 class ActivityController extends AbstractController

src/Controller/Admin/CustomerController.php

@@ -24,7 +24,7 @@ use App\Repository\Query\CustomerQuery;
  * Controller used to manage activities in the admin part of the site.
  *
  * @Route("/admin/customer")
- * @Security("has_role('ROLE_ADMIN')")
+ * @Security("is_granted('ROLE_ADMIN')")
  * @Security("is_granted('IS_AUTHENTICATED_FULLY')")
  */
 class CustomerController extends AbstractController

src/Controller/Admin/ProjectController.php

@@ -26,7 +26,7 @@ use App\Repository\Query\ProjectQuery;
  * Controller used to manage projects in the admin part of the site.
  *
  * @Route("/admin/project")
- * @Security("has_role('ROLE_ADMIN')")
+ * @Security("is_granted('ROLE_ADMIN')")
  * @Security("is_granted('IS_AUTHENTICATED_FULLY')")
  */
 class ProjectController extends AbstractController

src/Controller/Admin/TimesheetController.php

@@ -25,7 +25,7 @@ use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security;
  * Controller used for manage timesheet entries in the admin part of the site.
  *
  * @Route("/team/timesheet")
- * @Security("has_role('ROLE_TEAMLEAD')")
+ * @Security("is_granted('ROLE_TEAMLEAD')")
  * @Security("is_granted('IS_AUTHENTICATED_FULLY')")
  */
 class TimesheetController extends AbstractController

src/Controller/Admin/UserController.php

@@ -24,7 +24,7 @@ use Symfony\Component\HttpFoundation\Request;
  * Controller used to manage users in the admin part of the site.
  *
  * @Route("/admin/user")
- * @Security("has_role('ROLE_SUPER_ADMIN')")
+ * @Security("is_granted('ROLE_SUPER_ADMIN')")
  * @Security("is_granted('IS_AUTHENTICATED_FULLY')")
  */
 class UserController extends AbstractController

src/Controller/DashboardController.php

@@ -24,7 +24,7 @@ use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security;
  * Dashboard controller for the admin area.
  *
  * @Route("/dashboard")
- * @Security("has_role('ROLE_USER')")
+ * @Security("is_granted('ROLE_USER')")
  */
 class DashboardController extends Controller
 {

src/Controller/HelpController.php

@@ -19,7 +19,7 @@ use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security;
  * This controller can render the markdown documentation from /var/docs/
  *
  * @Route("/help")
- * @Security("has_role('ROLE_USER')")
+ * @Security("is_granted('ROLE_USER')")
  */
 class HelpController extends Controller
 {

src/Controller/InvoiceController.php

@@ -27,7 +27,7 @@ use Symfony\Component\HttpFoundation\Request;
  * Controller used to manage invoices.
  *
  * @Route("/invoice")
- * @Security("has_role('ROLE_TEAMLEAD')")
+ * @Security("is_granted('ROLE_TEAMLEAD')")
  */
 class InvoiceController extends AbstractController
 {

src/Controller/ProfileController.php

@@ -27,7 +27,7 @@ use Symfony\Component\HttpFoundation\Request;
  * User profile controller
  *
  * @Route("/profile")
- * @Security("has_role('ROLE_USER')")
+ * @Security("is_granted('ROLE_USER')")
  */
 class ProfileController extends AbstractController
 {

src/Controller/SidebarController.php

@@ -15,7 +15,7 @@ use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security;
 /**
  * Sidebar controller
  *
- * @Security("has_role('ROLE_USER')")
+ * @Security("is_granted('ROLE_USER')")
  */
 class SidebarController extends AbstractController
 {

src/Controller/TimesheetController.php

@@ -25,7 +25,7 @@ use Symfony\Component\HttpFoundation\Request;
  * Controller used to manage timesheet contents in the public part of the site.
  *
  * @Route("/timesheet")
- * @Security("has_role('ROLE_USER')")
+ * @Security("is_granted('ROLE_USER')")
  */
 class TimesheetController extends AbstractController
 {

tests/Controller/ActivityControllerTest.php

@@ -0,0 +1,23 @@
+<?php
+
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Tests\Controller;
+
+/**
+ * @coversDefaultClass \App\Controller\ActivityController
+ * @group integration
+ */
+class ActivityControllerTest extends ControllerBaseTest
+{
+
+    public function testIsSecure()
+    {
+        $this->markTestSkipped('no public route available');
+    }
+}

tests/Controller/Admin/ActivityControllerTest.php

@@ -0,0 +1,34 @@
+<?php
+
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Tests\Controller\Admin;
+
+use App\Entity\User;
+use App\Tests\Controller\ControllerBaseTest;
+
+/**
+ * @coversDefaultClass \App\Controller\Admin\ActivityController
+ * @group integration
+ */
+class ActivityControllerTest extends ControllerBaseTest
+{
+
+    public function testIsSecure()
+    {
+        $this->assertUrlIsSecured('/admin/activity/');
+        $this->assertUrlIsSecuredForRole(User::ROLE_TEAMLEAD, '/admin/activity/');
+    }
+
+    public function testIndexAction()
+    {
+        $client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
+        $this->assertAccessIsGranted($client, '/admin/activity/');
+        $this->assertHasDataTable($client);
+    }
+}

tests/Controller/Admin/CustomerControllerTest.php

@@ -0,0 +1,34 @@
+<?php
+
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Tests\Controller\Admin;
+
+use App\Entity\User;
+use App\Tests\Controller\ControllerBaseTest;
+
+/**
+ * @coversDefaultClass \App\Controller\Admin\CustomerController
+ * @group integration
+ */
+class CustomerControllerTest extends ControllerBaseTest
+{
+
+    public function testIsSecure()
+    {
+        $this->assertUrlIsSecured('/admin/customer/');
+        $this->assertUrlIsSecuredForRole(User::ROLE_TEAMLEAD, '/admin/customer/');
+    }
+
+    public function testIndexAction()
+    {
+        $client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
+        $this->assertAccessIsGranted($client, '/admin/customer/');
+        $this->assertHasDataTable($client);
+    }
+}

tests/Controller/Admin/ProjectControllerTest.php

@@ -0,0 +1,34 @@
+<?php
+
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Tests\Controller\Admin;
+
+use App\Entity\User;
+use App\Tests\Controller\ControllerBaseTest;
+
+/**
+ * @coversDefaultClass \App\Controller\Admin\ProjectController
+ * @group integration
+ */
+class ProjectControllerTest extends ControllerBaseTest
+{
+
+    public function testIsSecure()
+    {
+        $this->assertUrlIsSecured('/admin/project/');
+        $this->assertUrlIsSecuredForRole(User::ROLE_TEAMLEAD, '/admin/project/');
+    }
+
+    public function testIndexAction()
+    {
+        $client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
+        $this->assertAccessIsGranted($client, '/admin/project/');
+        $this->assertHasDataTable($client);
+    }
+}

tests/Controller/Admin/TimesheetControllerTest.php

@@ -0,0 +1,34 @@
+<?php
+
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Tests\Controller\Admin;
+
+use App\Entity\User;
+use App\Tests\Controller\ControllerBaseTest;
+
+/**
+ * @coversDefaultClass \App\Controller\Admin\TimesheetController
+ * @group integration
+ */
+class TimesheetControllerTest extends ControllerBaseTest
+{
+
+    public function testIsSecure()
+    {
+        $this->assertUrlIsSecured('/team/timesheet/');
+        $this->assertUrlIsSecuredForRole(User::ROLE_USER, '/team/timesheet/');
+    }
+
+    public function testIndexAction()
+    {
+        $client = $this->getClientForAuthenticatedUser(User::ROLE_TEAMLEAD);
+        $this->assertAccessIsGranted($client, '/team/timesheet/');
+        $this->assertHasDataTable($client);
+    }
+}

tests/Controller/Admin/UserControllerTest.php

@@ -0,0 +1,34 @@
+<?php
+
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Tests\Controller\Admin;
+
+use App\Entity\User;
+use App\Tests\Controller\ControllerBaseTest;
+
+/**
+ * @coversDefaultClass \App\Controller\Admin\UserController
+ * @group integration
+ */
+class UserControllerTest extends ControllerBaseTest
+{
+
+    public function testIsSecure()
+    {
+        $this->assertUrlIsSecured('/admin/user/');
+        $this->assertUrlIsSecuredForRole(User::ROLE_ADMIN, '/admin/user/');
+    }
+
+    public function testIndexAction()
+    {
+        $client = $this->getClientForAuthenticatedUser(User::ROLE_SUPER_ADMIN);
+        $this->assertAccessIsGranted($client, '/admin/user/');
+        $this->assertHasDataTable($client);
+    }
+}

tests/Controller/ControllerBaseTest.php

@@ -10,6 +10,7 @@
 namespace App\Tests\Controller;
 
 use App\DataFixtures\AppFixtures;
+use App\Entity\User;
 use Symfony\Bundle\FrameworkBundle\Client;
 use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;
 
@@ -22,14 +23,44 @@ abstract class ControllerBaseTest extends WebTestCase
     const DEFAULT_LANGUAGE = 'en';
 
     /**
+     * @param string $role
      * @return Client
      */
-    protected function getClientForAuthenticatedUser()
+    protected function getClientForAuthenticatedUser(string $role = User::ROLE_USER)
     {
+        switch($role) {
+            case User::ROLE_SUPER_ADMIN:
+                $client = self::createClient([], [
+                    'PHP_AUTH_USER' => AppFixtures::USERNAME_SUPER_ADMIN,
+                    'PHP_AUTH_PW' => AppFixtures::DEFAULT_PASSWORD,
+                ]);
+                break;
+
+            case User::ROLE_ADMIN:
+                $client = self::createClient([], [
+                    'PHP_AUTH_USER' => AppFixtures::USERNAME_ADMIN,
+                    'PHP_AUTH_PW' => AppFixtures::DEFAULT_PASSWORD,
+                ]);
+                break;
+
+            case User::ROLE_TEAMLEAD:
+                $client = self::createClient([], [
+                    'PHP_AUTH_USER' => AppFixtures::USERNAME_TEAMLEAD,
+                    'PHP_AUTH_PW' => AppFixtures::DEFAULT_PASSWORD,
+                ]);
+                break;
+
+            case User::ROLE_USER:
                 $client = self::createClient([], [
                     'PHP_AUTH_USER' => AppFixtures::USERNAME_USER,
                     'PHP_AUTH_PW' => AppFixtures::DEFAULT_PASSWORD,
                 ]);
+                break;
+
+            default:
+                $client = null;
+                break;
+        }
 
         return $client;
     }
@@ -46,23 +77,64 @@ abstract class ControllerBaseTest extends WebTestCase
     }
 
     /**
+     * @param Client $client
      * @param string $url
      * @param string $method
      */
-    protected function assertUrlIsSecured(string $url, $method = 'GET')
+    protected function assertRequestIsSecured(Client $client, string $url, $method = 'GET')
     {
-        $client = self::createClient();
         $client->request($method, '/' . self::DEFAULT_LANGUAGE . $url);
 
-        $this->assertTrue($client->getResponse()->isRedirect());
+        $this->assertTrue(
+            $client->getResponse()->isRedirect(),
+            sprintf('The secure URL %s is not protected.', $url . $client->getResponse()->getContent())
+        );
 
         $this->assertEquals(
             'http://localhost/' . self::DEFAULT_LANGUAGE . '/login',
             $client->getResponse()->getTargetUrl(),
-            sprintf('The %s secure URL redirects to the login form.', $url)
+            sprintf('The secure URL %s does not redirect to the login form.', $url)
         );
     }
 
+    /**
+     * @param string $url
+     * @param string $method
+     * @param Client|null $client
+     */
+    protected function assertUrlIsSecured(string $url, $method = 'GET')
+    {
+        $client = self::createClient();
+        $this->assertRequestIsSecured($client, $url, $method);
+    }
+
+    /**
+     * @param string $role
+     * @param string $url
+     * @param string $method
+     */
+    protected function assertUrlIsSecuredForRole(string $role, string $url, string $method = 'GET')
+    {
+        $client = $this->getClientForAuthenticatedUser($role);
+        $client->request($method, '/' . self::DEFAULT_LANGUAGE . $url);
+        $this->assertFalse(
+            $client->getResponse()->isSuccessful(),
+            sprintf('The secure URL %s is not protected for role %s', $url, $role)
+        );
+        $this->assertContains('Symfony\Component\Security\Core\Exception\AccessDeniedException', $client->getResponse()->getContent());
+    }
+
+    /**
+     * @param Client $client
+     * @param string $url
+     */
+    protected function assertAccessIsGranted(Client $client, $url)
+    {
+        $this->request($client, $url);
+        $this->assertTrue($client->getResponse()->isSuccessful());
+        // TODO improve this test?
+    }
+
     /**
      * @param Client $client
      */
@@ -71,4 +143,21 @@ abstract class ControllerBaseTest extends WebTestCase
         $this->assertFalse($client->getResponse()->isSuccessful());
         $this->assertEquals(404, $client->getResponse()->getStatusCode());
     }
+
+    /**
+     * @param Client $client
+     * @param string $classname
+     */
+    protected function assertMainContentClass(Client $client, $classname)
+    {
+        $this->assertContains('<section class="content '.$classname.'">', $client->getResponse()->getContent());
+    }
+
+    /**
+     * @param Client $client
+     */
+    protected function assertHasDataTable(Client $client)
+    {
+        $this->assertContains('<table class="table table-striped table-hover dataTable" role="grid">', $client->getResponse()->getContent());
+    }
 }

tests/Controller/DashboardControllerTest.php

@@ -0,0 +1,31 @@
+<?php
+
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Tests\Controller;
+
+/**
+ * @coversDefaultClass \App\Controller\DashboardController
+ * @group integration
+ */
+class DashboardControllerTest extends ControllerBaseTest
+{
+
+    public function testIsSecure()
+    {
+        $this->assertUrlIsSecured('/dashboard/');
+    }
+
+    public function testIndexAction()
+    {
+        $client = $this->getClientForAuthenticatedUser();
+        $this->request($client, '/dashboard/');
+        $this->assertTrue($client->getResponse()->isSuccessful());
+        $this->assertMainContentClass($client, 'dashboard');
+    }
+}

tests/Controller/InvoiceControllerTest.php

@@ -0,0 +1,35 @@
+<?php
+
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Tests\Controller;
+
+use App\Entity\User;
+
+/**
+ * @coversDefaultClass \App\Controller\InvoiceController
+ * @group integration
+ */
+class InvoiceControllerTest extends ControllerBaseTest
+{
+
+    public function testIsSecure()
+    {
+        $this->assertUrlIsSecured('/invoice/');
+        $this->assertUrlIsSecuredForRole(User::ROLE_USER, '/invoice/');
+    }
+
+    public function testIndexAction()
+    {
+        $this->markTestSkipped('create invoice template before this test case');
+        $client = $this->getClientForAuthenticatedUser(User::ROLE_TEAMLEAD);
+        $this->request($client, '/invoice/');
+        $this->assertTrue($client->getResponse()->isSuccessful());
+        $this->assertMainContentClass($client, 'dashboard');
+    }
+}

tests/Controller/ProfileControllerTest.php

@@ -0,0 +1,40 @@
+<?php
+
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Tests\Controller;
+
+use App\DataFixtures\AppFixtures;
+use App\Entity\User;
+
+/**
+ * @coversDefaultClass \App\Controller\InvoiceController
+ * @group integration
+ */
+class ProfileControllerTest extends ControllerBaseTest
+{
+
+    public function testIsSecure()
+    {
+        $this->assertUrlIsSecured('/profile/' . AppFixtures::USERNAME_USER);
+    }
+
+    public function testIndexAction()
+    {
+        $client = $this->getClientForAuthenticatedUser();
+        $this->request($client, '/profile/' . AppFixtures::USERNAME_USER);
+        $this->assertTrue($client->getResponse()->isSuccessful());
+    }
+
+    public function testIndexActionWithDifferentUsername()
+    {
+        $client = $this->getClientForAuthenticatedUser();
+        $this->request($client, '/profile/' . AppFixtures::USERNAME_TEAMLEAD);
+        $this->assertFalse($client->getResponse()->isSuccessful());
+    }
+}

tests/Controller/SidebarControllerTest.php

@@ -0,0 +1,23 @@
+<?php
+
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Tests\Controller;
+
+/**
+ * @coversDefaultClass \App\Controller\SidebarController
+ * @group integration
+ */
+class SidebarControllerTest extends ControllerBaseTest
+{
+
+    public function testIsSecure()
+    {
+        $this->markTestSkipped('no public route available');
+    }
+}

tests/Controller/TimesheetControllerTest.php

@@ -0,0 +1,33 @@
+<?php
+
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Tests\Controller;
+
+use App\DataFixtures\AppFixtures;
+use App\Entity\User;
+
+/**
+ * @coversDefaultClass \App\Controller\TimesheetController
+ * @group integration
+ */
+class TimesheetControllerTest extends ControllerBaseTest
+{
+
+    public function testIsSecure()
+    {
+        $this->assertUrlIsSecured('/timesheet/');
+    }
+
+    public function testIndexAction()
+    {
+        $client = $this->getClientForAuthenticatedUser();
+        $this->request($client, '/timesheet/');
+        $this->assertTrue($client->getResponse()->isSuccessful());
+    }
+}