CCM NG: Test for handling permissions in JPQL Queries

git-svn-id: https://svn.libreccm.org/ccm/ccm_ng@4488 8810af33-2d31-482b-a856-94f89814c4df
ccm-docs
jensp 2016-12-19 10:05:04 +00:00
parent 11c983ff50
commit 83be9cfddc
4 changed files with 654 additions and 3 deletions

View File

@ -137,8 +137,8 @@ public class ContentItemL10NManagerTest {
.addPackage(org.librecms.lifecycle.Lifecycle.class.getPackage()) .addPackage(org.librecms.lifecycle.Lifecycle.class.getPackage())
.addPackage(org.librecms.contentsection.ContentSection.class .addPackage(org.librecms.contentsection.ContentSection.class
.getPackage()) .getPackage())
.addPackage(org.librecms.contenttypes.Article.class.getPackage()). .addPackage(org.librecms.contenttypes.Article.class.getPackage())
addClass(com.arsdigita.kernel.security.SecurityConfig.class) .addClass(com.arsdigita.kernel.security.SecurityConfig.class)
.addPackage(org.libreccm.tests.categories.IntegrationTest.class .addPackage(org.libreccm.tests.categories.IntegrationTest.class
.getPackage()) .getPackage())
// .addAsLibraries(getModuleDependencies()) // .addAsLibraries(getModuleDependencies())

View File

@ -0,0 +1,271 @@
/*
* Copyright (C) 2016 LibreCCM Foundation.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
* MA 02110-1301 USA
*/
package org.librecms.contentsection;
import static org.libreccm.testutils.DependenciesHelpers.*;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.jboss.arquillian.container.test.api.Deployment;
import org.jboss.arquillian.junit.Arquillian;
import org.jboss.arquillian.junit.InSequence;
import org.jboss.arquillian.persistence.CreateSchema;
import org.jboss.arquillian.persistence.PersistenceTest;
import org.jboss.arquillian.persistence.UsingDataSet;
import org.jboss.arquillian.transaction.api.annotation.TransactionMode;
import org.jboss.arquillian.transaction.api.annotation.Transactional;
import org.jboss.shrinkwrap.api.ShrinkWrap;
import org.jboss.shrinkwrap.api.asset.EmptyAsset;
import org.jboss.shrinkwrap.api.spec.WebArchive;
import org.junit.After;
import org.junit.AfterClass;
import org.junit.Before;
import org.junit.BeforeClass;
import org.junit.Test;
import org.junit.runner.RunWith;
import org.libreccm.security.Role;
import org.libreccm.security.Shiro;
import org.libreccm.tests.categories.IntegrationTest;
import java.util.ArrayList;
import java.util.List;
import java.util.stream.Collectors;
import javax.inject.Inject;
import javax.persistence.EntityManager;
import javax.persistence.TypedQuery;
import static org.hamcrest.CoreMatchers.*;
import static org.junit.Assert.*;
/**
*
* @author <a href="mailto:jens.pelzetter@googlemail.com">Jens Pelzetter</a>
*/
@org.junit.experimental.categories.Category(IntegrationTest.class)
@RunWith(Arquillian.class)
@PersistenceTest
@Transactional(TransactionMode.COMMIT)
@CreateSchema({"create_ccm_cms_schema.sql"})
public class ContentItemPermissionTest {
private static final String QUERY = "SELECT i FROM ContentItem i "
+ "JOIN i.permissions p "
+ "WHERE p.grantee IN :roles "
+ "AND p.grantedPrivilege = 'view_draft_items' "
+ "ORDER BY i.displayName";
@Inject
private EntityManager entityManager;
@Inject
private Shiro shiro;
@Inject
private Subject subject;
@BeforeClass
public static void setUpClass() {
}
@AfterClass
public static void tearDownClass() {
}
@Before
public void setUp() {
}
@After
public void tearDown() {
}
@Deployment
public static WebArchive createDeployment() {
return ShrinkWrap
.create(WebArchive.class,
"LibreCCM-org.librecms.contentsection.ContentItemPermissionTest.war")
.addPackage(org.libreccm.auditing.CcmRevision.class.getPackage())
.addPackage(org.libreccm.categorization.Categorization.class
.getPackage())
.addPackage(org.libreccm.cdi.utils.CdiUtil.class.getPackage())
.addPackage(org.libreccm.configuration.Configuration.class
.getPackage())
.addPackage(org.libreccm.core.CcmCore.class.getPackage())
.addPackage(org.libreccm.jpa.EntityManagerProducer.class
.getPackage())
.addPackage(org.libreccm.jpa.utils.MimeTypeConverter.class
.getPackage())
.addPackage(org.libreccm.l10n.LocalizedString.class
.getPackage())
.addPackage(org.libreccm.security.Permission.class.getPackage())
.addPackage(org.libreccm.web.CcmApplication.class.getPackage())
.addPackage(org.libreccm.workflow.Workflow.class.getPackage())
.addPackage(com.arsdigita.bebop.Component.class.getPackage())
.addPackage(com.arsdigita.bebop.util.BebopConstants.class
.getPackage())
.addClass(com.arsdigita.kernel.KernelConfig.class)
.addClass(com.arsdigita.runtime.CCMResourceManager.class)
.addClass(com.arsdigita.dispatcher.RequestContext.class)
.addClass(com.arsdigita.dispatcher.AccessDeniedException.class)
.addClass(com.arsdigita.cms.dispatcher.ContentItemDispatcher.class)
.addClass(com.arsdigita.dispatcher.Dispatcher.class)
.addClass(
com.arsdigita.ui.admin.applications.AbstractAppInstanceForm.class)
.addClass(
com.arsdigita.ui.admin.applications.AbstractAppSettingsPane.class)
.addClass(
com.arsdigita.ui.admin.applications.DefaultApplicationInstanceForm.class)
.addClass(
com.arsdigita.ui.admin.applications.DefaultApplicationSettingsPane.class)
.addClass(com.arsdigita.cms.dispatcher.ItemResolver.class)
.addClass(org.libreccm.portation.Portable.class)
.addPackage(com.arsdigita.util.Lockable.class.getPackage())
.addPackage(com.arsdigita.web.BaseServlet.class.getPackage())
.addPackage(org.librecms.Cms.class.getPackage())
.addPackage(org.librecms.contentsection.Asset.class.getPackage())
.addPackage(org.librecms.contentsection.AttachmentList.class
.getPackage())
.addPackage(org.librecms.lifecycle.Lifecycle.class.getPackage())
.addPackage(org.librecms.contentsection.ContentSection.class
.getPackage())
.addPackage(org.librecms.contenttypes.Article.class.getPackage())
.addPackage(org.libreccm.tests.categories.IntegrationTest.class
.getPackage())
// .addAsLibraries(getModuleDependencies())
.addAsLibraries(getCcmCoreDependencies())
.addAsResource("test-persistence.xml",
"META-INF/persistence.xml")
.addAsResource("configs/shiro.ini", "shiro.ini")
.addAsWebInfResource("test-web.xml", "web.xml")
.addAsWebInfResource(EmptyAsset.INSTANCE, "beans.xml");
}
@Test
@InSequence(10)
public void checkInjections() {
assertThat(entityManager, is(not(nullValue())));
assertThat(shiro, is(not(nullValue())));
}
/**
* Verify that Shiro is working.
*/
@Test
@InSequence(20)
public void checkShiro() {
assertThat(shiro.getSecurityManager(), is(not(nullValue())));
assertThat(shiro.getSystemUser(), is(not(nullValue())));
}
@Test
@InSequence(100)
@UsingDataSet("datasets/org/librecms/contentsection/"
+ "ContentItemPermissionTest/data.xml")
public void accessByNoUser() {
final List<Role> roles;
if (shiro.getUser() == null) {
roles = new ArrayList<>();
} else {
roles = shiro.getUser().getRoleMemberships().stream()
.map(membership -> membership.getRole())
.collect(Collectors.toList());
}
final TypedQuery<ContentItem> query = entityManager.createQuery(
QUERY, ContentItem.class);
query.setParameter("roles", roles);
final List<ContentItem> result = query.getResultList();
assertThat(result.isEmpty(), is(true));
}
@Test
@InSequence(200)
@UsingDataSet("datasets/org/librecms/contentsection/"
+ "ContentItemPermissionTest/data.xml")
public void accessByUser1() {
final UsernamePasswordToken token = new UsernamePasswordToken(
"user1@example.org", "foo123");
token.setRememberMe(true);
subject.login(token);
final List<Role> roles = shiro.getUser().getRoleMemberships().stream()
.map(membership -> membership.getRole())
.collect(Collectors.toList());
final TypedQuery<ContentItem> query = entityManager.createQuery(
QUERY, ContentItem.class);
query.setParameter("roles", roles);
final List<ContentItem> result = query.getResultList();
assertThat(result.size(), is(2));
assertThat(result.get(0).getDisplayName(), is(equalTo("article1")));
assertThat(result.get(1).getDisplayName(), is(equalTo("news1")));
}
@Test
@InSequence(300)
@UsingDataSet("datasets/org/librecms/contentsection/"
+ "ContentItemPermissionTest/data.xml")
public void accessByUser2() {
final UsernamePasswordToken token = new UsernamePasswordToken(
"user2@example.org", "foo123");
token.setRememberMe(true);
subject.login(token);
final List<Role> roles = shiro.getUser().getRoleMemberships().stream()
.map(membership -> membership.getRole())
.collect(Collectors.toList());
final TypedQuery<ContentItem> query = entityManager.createQuery(
QUERY, ContentItem.class);
query.setParameter("roles", roles);
final List<ContentItem> result = query.getResultList();
assertThat(result.size(), is(1));
assertThat(result.get(0).getDisplayName(), is(equalTo("article2")));
}
@Test
@InSequence(400)
@UsingDataSet("datasets/org/librecms/contentsection/"
+ "ContentItemPermissionTest/data.xml")
public void accessByUser3() {
final UsernamePasswordToken token = new UsernamePasswordToken(
"user3@example.org", "foo123");
token.setRememberMe(true);
subject.login(token);
final List<Role> roles = shiro.getUser().getRoleMemberships().stream()
.map(membership -> membership.getRole())
.collect(Collectors.toList());
final TypedQuery<ContentItem> query = entityManager.createQuery(
QUERY, ContentItem.class);
query.setParameter("roles", roles);
final List<ContentItem> result = query.getResultList();
assertThat(result.size(), is(3));
assertThat(result.get(0).getDisplayName(), is(equalTo("article1")));
assertThat(result.get(1).getDisplayName(), is(equalTo("article2")));
assertThat(result.get(2).getDisplayName(), is(equalTo("article3")));
}
}

View File

@ -0,0 +1,380 @@
<?xml version="1.0" encoding="utf-8"?>
<dataset>
<ccm_core.ccm_revisions id="0"
timestamp="1451602800" />
<ccm_core.ccm_objects object_id="-1100"
display_name="info"
uuid="963bcae7-3aeb-4b62-891c-e16c4defa1f2" />
<ccm_core.ccm_objects object_id="-2100"
display_name="info_root"
uuid="82014239-9c06-486d-ae8c-4ae47f52a699" />
<ccm_core.ccm_objects object_id="-2200"
display_name="info_assets"
uuid="b163f73c-9ac2-44d7-a037-de621f5ca828" />
<ccm_core.ccm_objects object_id="-10100"
display_name="article1"
uuid="aed4b402-1180-46c6-b42d-7245f4dca248" />
<ccm_core.ccm_objects object_id="-10300"
display_name="article3"
uuid="f4b38abb-234b-4354-bc92-e36c068a1ebd" />
<ccm_core.ccm_objects object_id="-10200"
display_name="article2"
uuid="acae860f-2ffa-450d-b486-054292f0dae6" />
<ccm_core.ccm_objects object_id="-10400"
display_name="news1"
uuid="d9ea527d-c6e3-4bdd-962d-c0a1a80c6c72" />
<ccm_core.ccm_objects object_id="-20100"
display_name="org.librecms.contenttypes.Article"
uuid="2c8ec2fb-319d-4d44-9698-697c08b2b941" />
<ccm_core.ccm_objects object_id="-20200"
display_name="org.librecms.contenttypes.News"
uuid="47740f22-f89f-4ec3-90cf-d62859e53c7e" />
<ccm_core.ccm_objects_aud object_id="-10100"
rev="0"
revtype="0"
display_name="article1" />
<ccm_core.ccm_objects_aud object_id="-10200"
rev="0"
revtype="0"
display_name="article2" />
<ccm_core.ccm_objects_aud object_id="-10300"
rev="0"
revtype="0"
display_name="article3" />
<ccm_core.ccm_objects_aud object_id="-10400"
rev="0"
revtype="0"
display_name="news1" />
<ccm_core.categories object_id="-2100"
unique_id="82014239-9c06-486d-ae8c-4ae47f52a699"
name="info_root"
enabled="true"
visible="true"
abstract_category="false"
category_order="1" />
<ccm_core.categories object_id="-2200"
unique_id="b163f73c-9ac2-44d7-a037-de621f5ca828"
name="info_assets"
enabled="true"
visible="true"
abstract_category="false"
category_order="1" />
<ccm_core.category_titles object_id="-2100"
locale="en"
localized_value="info_root" />
<ccm_core.category_titles object_id="-2200"
locale="en"
localized_value="info_assets" />
<ccm_core.resources object_id="-1100"
created="2016-07-15" />
<ccm_core.resource_titles object_id="-1100"
locale="en"
localized_value="info" />
<ccm_core.applications object_id="-1100"
application_type="org.librecms.contentsection.ContentSection"
primary_url="info" />
<ccm_cms.folders object_id="-2100"
type="DOCUMENTS_FOLDER" />
<ccm_cms.folders object_id="-2200"
type="ASSETS_FOLDER" />
<ccm_cms.content_sections object_id="-1100"
label="info"
root_documents_folder_id="-2100"
root_assets_folder_id="-2200" />
<ccm_cms.folder_content_section_map folder_id="-2100"
content_section_id="-1100" />
<ccm_cms.folder_content_section_map folder_id="-2200"
content_section_id="-1100" />
<ccm_cms.content_types object_id="-20100"
content_item_class="org.librecms.contenttypes.Article"
content_section_id="-1100" />
<ccm_cms.content_types object_id="-20200"
content_item_class="org.librecms.contenttypes.News"
content_section_id="-1100" />
<ccm_cms.content_items object_id="-10100"
item_uuid="aed4b402-1180-46c6-b42d-7245f4dca248"
version="DRAFT"
content_type_id="-20100" />
<ccm_cms.content_items object_id="-10200"
item_uuid="acae860f-2ffa-450d-b486-054292f0dae6"
version="DRAFT"
content_type_id="-20100" />
<ccm_cms.content_items object_id="-10300"
item_uuid="f4b38abb-234b-4354-bc92-e36c068a1ebd"
version="DRAFT"
content_type_id="-20100" />
<ccm_cms.content_items object_id="-10400"
item_uuid="d9ea527d-c6e3-4bdd-962d-c0a1a80c6c72"
version="DRAFT"
content_type_id="-20200" />
<ccm_cms.content_items_aud object_id="-10100"
rev="0"
item_uuid="aed4b402-1180-46c6-b42d-7245f4dca248"
version="DRAFT"
content_type_id="-20100" />
<ccm_cms.content_items_aud object_id="-10200"
rev="0"
item_uuid="acae860f-2ffa-450d-b486-054292f0dae6"
version="DRAFT"
content_type_id="-20100"/>
<ccm_cms.content_items_aud object_id="-10300"
rev="0"
item_uuid="f4b38abb-234b-4354-bc92-e36c068a1ebd"
version="DRAFT"
content_type_id="-20100"/>
<ccm_cms.content_items_aud object_id="-10400"
rev="0"
item_uuid="d9ea527d-c6e3-4bdd-962d-c0a1a80c6c72"
version="DRAFT"
content_type_id="-20200"/>
<ccm_cms.content_item_names object_id="-10100"
locale="en"
localized_value="article1" />
<ccm_cms.content_item_names object_id="-10200"
locale="en"
localized_value="article2" />
<ccm_cms.content_item_names object_id="-10300"
locale="en"
localized_value="article3" />
<ccm_cms.content_item_names object_id="-10400"
locale="en"
localized_value="news1" />
<ccm_cms.content_item_names_aud rev="0"
object_id="-10100"
localized_value="article1"
locale="en"
revtype="0" />
<ccm_cms.content_item_names_aud rev="0"
object_id="-10200"
localized_value="article2"
locale="en"
revtype="0" />
<ccm_cms.content_item_names_aud rev="0"
object_id="-10300"
localized_value="article3"
locale="en"
revtype="0" />
<ccm_cms.content_item_names_aud rev="0"
object_id="-10400"
localized_value="news1"
locale="en"
revtype="0" />
<ccm_cms.content_item_titles object_id="-10100"
locale="en"
localized_value="Article 1" />
<ccm_cms.content_item_titles object_id="-10200"
locale="en"
localized_value="Article 2" />
<ccm_cms.content_item_titles object_id="-10300"
locale="en"
localized_value="Article 3" />
<ccm_cms.content_item_titles object_id="-10400"
locale="en"
localized_value="News 1" />
<ccm_cms.content_item_titles_aud rev="0"
object_id="-10100"
localized_value="Article 1"
locale="en"
revtype="0" />
<ccm_cms.content_item_titles_aud rev="0"
object_id="-10200"
localized_value="Article 2"
locale="en"
revtype="0" />
<ccm_cms.content_item_titles_aud rev="0"
object_id="-10300"
localized_value="Article 3"
locale="en"
revtype="0" />
<ccm_cms.content_item_titles_aud rev="0"
object_id="-10400"
localized_value="News 1"
locale="en"
revtype="0" />
<ccm_cms.content_type_labels object_id="-20100"
locale="en"
localized_value="Article" />
<ccm_cms.content_type_labels object_id="-20200"
locale="en"
localized_value="News" />
<ccm_cms.articles object_id="-10100" />
<ccm_cms.articles object_id="-10200" />
<ccm_cms.articles object_id="-10300" />
<ccm_cms.articles_aud object_id="-10100"
rev="0" />
<ccm_cms.articles_aud object_id="-10200"
rev="0" />
<ccm_cms.articles_aud object_id="-10300"
rev="0" />
<ccm_cms.article_texts
object_id="-10100"
locale="en"
localized_value="Quisque varius turpis et nibh rhoncus consequat. In sapien metus, fermentum quis." />
<ccm_cms.article_texts
object_id="-10200"
locale="en"
localized_value="Duis quis tincidunt elit. In pharetra justo sit amet ipsum dictum, at." />
<ccm_cms.article_texts
object_id="-10300"
locale="en"
localized_value="Etiam euismod lacus laoreet sodales ultricies. Pellentesque non elit vitae purus sagittis." />
<ccm_cms.article_texts_aud
rev="0"
object_id="-10100"
localized_value="Quisque varius turpis et nibh rhoncus consequat. In sapien metus, fermentum quis."
locale="en"
revtype="0" />
<ccm_cms.article_texts_aud
rev="0"
object_id="-10200"
localized_value="Duis quis tincidunt elit. In pharetra justo sit amet ipsum dictum, at."
locale="en"
revtype="0" />
<ccm_cms.article_texts_aud
rev="0"
object_id="-10300"
localized_value="Etiam euismod lacus laoreet sodales ultricies. Pellentesque non elit vitae purus sagittis."
locale="en"
revtype="0" />
<ccm_cms.news object_id="-10400"
news_date="2016-08-08"
homepage="false" />
<ccm_cms.news_texts
object_id="-10400"
locale="en"
localized_value="Curabitur vel sapien eu eros gravida bibendum vitae." />
<ccm_core.categorizations categorization_id="-30100"
category_id="-2100"
object_id="-10100"
category_order="1"
object_order="1"
category_index="false"
type="folder" />
<ccm_core.categorizations categorization_id="-30200"
category_id="-2100"
object_id="-10200"
category_order="1"
object_order="2"
category_index="false"
type="folder" />
<ccm_core.categorizations categorization_id="-30300"
category_id="-2100"
object_id="-10300"
category_order="1"
object_order="3"
category_index="false"
type="folder" />
<ccm_core.categorizations categorization_id="-30400"
category_id="-2100"
object_id="-10400"
category_order="1"
object_order="4"
category_index="false"
type="folder" />
<ccm_core.parties party_id="-6100"
name="user1" />
<ccm_core.parties party_id="-6200"
name="user2" />
<ccm_core.parties party_id="-6300"
name="user3" />
<ccm_core.users party_id="-6100"
password="$shiro1$SHA-512$500000$7xkDcZUN0/whJInHIvGsDw==$WhelBVmJU/cLV7lAkMOrE5B/mqCW0bUuid1WX+xBwzzAaekC5bYn9eeOFGJWhiDgmaC50ZCUmM96/iGsRoc4uA=="
email_address="user1@example.org"
bouncing="false"
verified="true"
banned="false"
password_reset_required="false" />
<ccm_core.users party_id="-6200"
password="$shiro1$SHA-512$500000$7xkDcZUN0/whJInHIvGsDw==$WhelBVmJU/cLV7lAkMOrE5B/mqCW0bUuid1WX+xBwzzAaekC5bYn9eeOFGJWhiDgmaC50ZCUmM96/iGsRoc4uA=="
email_address="user2@example.org"
bouncing="false"
verified="true"
banned="false"
password_reset_required="false" />
<ccm_core.users party_id="-6300"
password="$shiro1$SHA-512$500000$7xkDcZUN0/whJInHIvGsDw==$WhelBVmJU/cLV7lAkMOrE5B/mqCW0bUuid1WX+xBwzzAaekC5bYn9eeOFGJWhiDgmaC50ZCUmM96/iGsRoc4uA=="
email_address="user3@example.org"
bouncing="false"
verified="true"
banned="false"
password_reset_required="false" />
<ccm_core.ccm_roles role_id="-3100"
name="role1" />
<ccm_core.ccm_roles role_id="-3200"
name="role2" />
<ccm_core.ccm_roles role_id="-3300"
name="role3" />
<ccm_core.role_memberships membership_id="-7100"
role_id="-3100"
member_id="-6100" />
<ccm_core.role_memberships membership_id="-7200"
role_id="-3200"
member_id="-6200" />
<ccm_core.role_memberships membership_id="-7300"
role_id="-3300"
member_id="-6300" />
<ccm_core.permissions permission_id="-4100"
granted_privilege="view_draft_items"
object_id="-10100"
grantee_id="-3100"
creation_date="2016-07-15"/>
<ccm_core.permissions permission_id="-4200"
granted_privilege="view_draft_items"
object_id="-10400"
grantee_id="-3100"
creation_date="2016-07-15"/>
<ccm_core.permissions permission_id="-4300"
granted_privilege="view_draft_items"
object_id="-10200"
grantee_id="-3200"
creation_date="2016-07-15"/>
<ccm_core.permissions permission_id="-4400"
granted_privilege="view_draft_items"
object_id="-10100"
grantee_id="-3300"
creation_date="2016-07-15"/>
<ccm_core.permissions permission_id="-4500"
granted_privilege="view_draft_items"
object_id="-10200"
grantee_id="-3300"
creation_date="2016-07-15"/>
<ccm_core.permissions permission_id="-4600"
granted_privilege="view_draft_items"
object_id="-10300"
grantee_id="-3300"
creation_date="2016-07-15"/>
</dataset>

View File

@ -43,7 +43,7 @@ import javax.validation.executable.ExecutableValidator;
* @author <a href="mailto:jens.pelzetter@googlemail.com">Jens Pelzetter</a> * @author <a href="mailto:jens.pelzetter@googlemail.com">Jens Pelzetter</a>
*/ */
@Configuration @Configuration
public final class WebConfig { public class WebConfig {
private static final Logger LOGGER = LogManager.getLogger(WebConfig.class); private static final Logger LOGGER = LogManager.getLogger(WebConfig.class);