jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

lock exported timesheets (#798)

Browse Source
This commit is contained in:
Kevin Papst
2019-05-22 22:28:29 +02:00
committed by GitHub
parent 871b2e52c7
commit fea3495098
22 changed files with 387 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files

76
tests/API/TimesheetControllerTest.php
View File

@@ -427,6 +427,8 @@ class TimesheetControllerTest extends APIControllerBaseTest
$this->assertApiCallValidationError($response, ['end', 'activity']);
}
// TODO: TEST PATCH FOR EXPORTED TIMESHEET FOR USER WITHOUT PERMISSION IS REJECTED
public function testDeleteAction()
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_USER);
@@ -478,6 +480,36 @@ class TimesheetControllerTest extends APIControllerBaseTest
$this->assertEquals('You are not allowed to delete this timesheet', $json['message']);
}
public function testDeleteActionForExportedRecordIsNotAllowed()
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_USER);
$em = $client->getContainer()->get('doctrine.orm.entity_manager');
/** @var Timesheet $timesheet */
$timesheet = $em->getRepository(Timesheet::class)->find(1);
$timesheet->setExported(true);
$em->persist($timesheet);
$em->flush($timesheet);
$this->request($client, '/api/timesheets/1', 'DELETE');
$this->assertApiResponseAccessDenied($client->getResponse(), 'You are not allowed to delete this timesheet');
}
public function testDeleteActionForExportedRecordIsAllowedForAdmin()
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$em = $client->getContainer()->get('doctrine.orm.entity_manager');
/** @var Timesheet $timesheet */
$timesheet = $em->getRepository(Timesheet::class)->find(1);
$timesheet->setExported(true);
$em->persist($timesheet);
$em->flush($timesheet);
$this->request($client, '/api/timesheets/1', 'DELETE');
$this->assertTrue($client->getResponse()->isSuccessful());
}
public function testGetRecentCollectionWithSubresources()
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_TEAMLEAD);
@@ -731,6 +763,50 @@ class TimesheetControllerTest extends APIControllerBaseTest
$this->assertApiResponseAccessDenied($client->getResponse(), 'You are not allowed to re-start this timesheet');
}
public function testRestartThrowsNotFound()
{
$this->assertEntityNotFound(User::ROLE_USER, '/api/timesheets/42/restart', 'PATCH');
}
public function testExportAction()
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$em = $client->getContainer()->get('doctrine.orm.entity_manager');
/** @var Timesheet $timesheet */
$timesheet = $em->getRepository(Timesheet::class)->find(1);
$this->assertEquals(false, $timesheet->isExported());
$this->request($client, '/api/timesheets/1/export', 'PATCH');
$this->assertTrue($client->getResponse()->isSuccessful());
$this->assertDefaultStructure(json_decode($client->getResponse()->getContent(), true), true);
$em = $client->getContainer()->get('doctrine.orm.entity_manager');
/** @var Timesheet $timesheet */
$timesheet = $em->getRepository(Timesheet::class)->find(1);
$this->assertEquals(true, $timesheet->isExported());
$this->request($client, '/api/timesheets/1/export', 'PATCH');
$this->assertTrue($client->getResponse()->isSuccessful());
$em = $client->getContainer()->get('doctrine.orm.entity_manager');
$timesheet = $em->getRepository(Timesheet::class)->find(1);
$this->assertEquals(false, $timesheet->isExported());
}
public function testExportNotAllowedForUser()
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_USER);
$this->request($client, '/api/timesheets/1/export', 'PATCH');
$this->assertApiResponseAccessDenied($client->getResponse(), 'Access denied.');
}
public function testExportThrowsNotFound()
{
$this->assertEntityNotFound(User::ROLE_ADMIN, '/api/timesheets/42/export', 'PATCH');
}
protected function assertDefaultStructure(array $result, $full = true)
{
$expectedKeys = [

77
tests/Doctrine/SqliteSessionInitSubscriberTest.php Normal file
View File

@@ -0,0 +1,77 @@
<?php
/*
* This file is part of the Kimai time-tracking app.
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace App\Tests\EventSubscriber;
use App\Doctrine\SqliteSessionInitSubscriber;
use Doctrine\DBAL\Connection;
use Doctrine\DBAL\Event\ConnectionEventArgs;
use Doctrine\DBAL\Events;
use Doctrine\DBAL\Platforms\MySqlPlatform;
use Doctrine\DBAL\Platforms\SqlitePlatform;
use PHPUnit\Framework\TestCase;
/**
* @covers \App\Doctrine\SqliteSessionInitSubscriber
*/
class SqliteSessionInitSubscriberTest extends TestCase
{
public function testGetSubscribedEvents()
{
$sut = new SqliteSessionInitSubscriber();
$events = $sut->getSubscribedEvents();
$this->assertTrue(in_array(Events::postConnect, $events));
}
public function testPostConnectWithSqlite()
{
$sut = new SqliteSessionInitSubscriber();
$platformMock = $this->getMockBuilder(SqlitePlatform::class)
->setMethods(['getName'])
->disableOriginalConstructor()
->getMock();
$platformMock->expects($this->once())->method('getName')->willReturn('sqlite');
$connectionMock = $this->getMockBuilder(Connection::class)
->setMethods(['getDatabasePlatform', 'getConnection', 'executeUpdate'])
->disableOriginalConstructor()
->getMock();
$connectionMock->expects($this->once())->method('getDatabasePlatform')->willReturn($platformMock);
$connectionMock->expects($this->once())->method('executeUpdate')->with('PRAGMA foreign_keys = ON;', [], []);
$args = new ConnectionEventArgs($connectionMock);
$sut->postConnect($args);
}
public function testPostConnectWithMysql()
{
$sut = new SqliteSessionInitSubscriber();
$platformMock = $this->getMockBuilder(MySqlPlatform::class)
->setMethods(['getName'])
->disableOriginalConstructor()
->getMock();
$platformMock->expects($this->once())->method('getName')->willReturn('mysql');
$connectionMock = $this->getMockBuilder(Connection::class)
->setMethods(['getDatabasePlatform', 'getConnection', 'executeUpdate'])
->disableOriginalConstructor()
->getMock();
$connectionMock->expects($this->once())->method('getDatabasePlatform')->willReturn($platformMock);
$connectionMock->expects($this->never())->method('executeUpdate')->with('PRAGMA foreign_keys = ON;', [], []);
$args = new ConnectionEventArgs($connectionMock);
$sut->postConnect($args);
}
}

4
tests/Voter/AbstractVoterTest.php
View File

@@ -79,8 +79,8 @@ abstract class AbstractVoterTest extends TestCase
$roleUser = [];
$roleTeamlead = ['view_rate_own_timesheet', 'view_rate_other_timesheet', 'hourly-rate_own_profile'];
$roleAdmin = ['hourly-rate_own_profile'];
$roleSuperAdmin = ['hourly-rate_own_profile', 'hourly-rate_other_profile', 'delete_own_profile', 'roles_own_profile'];
$roleAdmin = ['hourly-rate_own_profile', 'edit_exported_timesheet'];
$roleSuperAdmin = ['hourly-rate_own_profile', 'hourly-rate_other_profile', 'delete_own_profile', 'roles_own_profile', 'system_information', 'system_actions', 'system_configuration', 'plugins', 'edit_exported_timesheet'];
$permissions = [
'ROLE_USER' => array_merge($timesheet, $profile, $roleUser),

61
tests/Voter/TimesheetVoterTest.php
View File

@@ -23,10 +23,7 @@ use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
*/
class TimesheetVoterTest extends AbstractVoterTest
{
/**
* @dataProvider getTestData
*/
public function testVote(User $user, $subject, $attribute, $result)
protected function assertVote(User $user, $subject, $attribute, $result)
{
$token = new UsernamePasswordToken($user, 'foo', 'bar', $user->getRoles());
$sut = $this->getVoter(TimesheetVoter::class, $user);
@@ -34,6 +31,14 @@ class TimesheetVoterTest extends AbstractVoterTest
$this->assertEquals($result, $sut->vote($token, $subject, [$attribute]));
}
/**
* @dataProvider getTestData
*/
public function testVote(User $user, $subject, $attribute, $result)
{
$this->assertVote($user, $subject, $attribute, $result);
}
public function getTestData()
{
$user0 = $this->getUser(0, null);
@@ -46,6 +51,10 @@ class TimesheetVoterTest extends AbstractVoterTest
$timesheet2 = $this->getTimesheet($user2);
$timesheet3 = $this->getTimesheet($user3);
$timesheet4 = $this->getTimesheet($user4);
$timesheet5 = $this->getTimesheet($user2);
$timesheet5->setExported(true);
$timesheet6 = $this->getTimesheet($user1);
$timesheet6->getActivity()->setVisible(false);
$result = VoterInterface::ACCESS_GRANTED;
$times = [
@@ -78,6 +87,50 @@ class TimesheetVoterTest extends AbstractVoterTest
}
}
public function testSpecialCases()
{
$user1 = $this->getUser(1, User::ROLE_USER);
$user2 = $this->getUser(2, User::ROLE_TEAMLEAD);
$user3 = $this->getUser(3, User::ROLE_ADMIN);
$user4 = $this->getUser(4, User::ROLE_SUPER_ADMIN);
// unknown attribute
$timesheet = $this->getTimesheet($user3);
$this->assertVote($user3, $timesheet, 'edit2', VoterInterface::ACCESS_ABSTAIN);
$timesheet = $this->getTimesheet($user2);
$timesheet->setExported(true);
// edit exported timesheet disallowed for teamleads
$this->assertVote($user2, $timesheet, 'edit', VoterInterface::ACCESS_DENIED);
$this->assertVote($user2, $timesheet, 'delete', VoterInterface::ACCESS_DENIED);
// but allowed for admins
$this->assertVote($user4, $timesheet, 'edit', VoterInterface::ACCESS_GRANTED);
$this->assertVote($user4, $timesheet, 'delete', VoterInterface::ACCESS_GRANTED);
// hidden activities might not be started
$timesheet = $this->getTimesheet($user1);
$timesheet->getActivity()->setVisible(false);
$this->assertVote($user2, $timesheet, 'start', VoterInterface::ACCESS_DENIED);
// hidden projects might not be started
$timesheet = $this->getTimesheet($user1);
$timesheet->getProject()->setVisible(false);
$this->assertVote($user2, $timesheet, 'start', VoterInterface::ACCESS_DENIED);
// hidden customers might not be started
$timesheet = $this->getTimesheet($user1);
$timesheet->getProject()->getCustomer()->setVisible(false);
$this->assertVote($user2, $timesheet, 'start', VoterInterface::ACCESS_DENIED);
// cannot start timesheet without activity
$timesheet = new Timesheet();
$timesheet->setUser($user2)->setProject(new Project());
$this->assertVote($user2, $timesheet, 'start', VoterInterface::ACCESS_DENIED);
// cannot start timesheet without project
$timesheet = new Timesheet();
$timesheet->setUser($user2)->setActivity(new Activity());
$this->assertVote($user2, $timesheet, 'start', VoterInterface::ACCESS_DENIED);
}
protected function getTimesheet($user)
{
$timesheet = new Timesheet();