class MediaAccessTest in Drupal 10

Basic access tests for Media.

@group media

Hierarchy

• class \Drupal\Tests\BrowserTestBase extends \PHPUnit\Framework\TestCase uses \Drupal\Tests\PhpUnitCompatibilityTrait, \Symfony\Bridge\PhpUnit\ExpectDeprecationTrait, FunctionalTestSetupTrait, TestSetupTrait, BlockCreationTrait, ConfigTestTrait, ExtensionListTestTrait, ContentTypeCreationTrait, NodeCreationTrait, RandomGeneratorTrait, TestRequirementsTrait, PhpUnitWarnings, UiHelperTrait, UserCreationTrait, XdebugRequestTrait
  • class \Drupal\Tests\media\Functional\MediaFunctionalTestBase uses MediaFunctionalTestTrait, MediaTypeCreationTrait
    • class \Drupal\Tests\media\Functional\MediaAccessTest uses AssertPageCacheContextsAndTagsTrait

File

core/modules/media/tests/src/Functional/MediaAccessTest.php, line 17

Namespace

Drupal\Tests\media\Functional

class MediaAccessTest extends MediaFunctionalTestBase {
  use AssertPageCacheContextsAndTagsTrait;

  /**
   * {@inheritdoc}
   */
  protected static $modules = [
    'block',
    'media_test_source',
  ];

  /**
   * {@inheritdoc}
   */
  protected $defaultTheme = 'stark';

  /**
   * {@inheritdoc}
   */
  protected function setUp() : void {
    parent::setUp();

    // This is needed to provide the user cache context for a below assertion.
    $this
      ->drupalPlaceBlock('local_tasks_block');
  }

  /**
   * Tests some access control functionality.
   */
  public function testMediaAccess() {
    $assert_session = $this
      ->assertSession();
    $media_type = $this
      ->createMediaType('test');
    \Drupal::configFactory()
      ->getEditable('media.settings')
      ->set('standalone_url', TRUE)
      ->save(TRUE);
    $this->container
      ->get('router.builder')
      ->rebuild();

    // Create media.
    $media = Media::create([
      'bundle' => $media_type
        ->id(),
      'name' => 'Unnamed',
    ]);
    $media
      ->save();
    $user_media = Media::create([
      'bundle' => $media_type
        ->id(),
      'name' => 'Unnamed',
      'uid' => $this->nonAdminUser
        ->id(),
    ]);
    $user_media
      ->save();

    // We are logged in as admin, so test 'administer media' permission.
    $this
      ->drupalGet('media/add/' . $media_type
      ->id());
    $this
      ->assertCacheContext('user.permissions');
    $assert_session
      ->statusCodeEquals(200);
    $this
      ->drupalGet('media/' . $user_media
      ->id());
    $this
      ->assertCacheContext('user.permissions');
    $assert_session
      ->statusCodeEquals(200);
    $this
      ->drupalGet('media/' . $user_media
      ->id() . '/edit');
    $this
      ->assertCacheContext('user.permissions');
    $assert_session
      ->statusCodeEquals(200);
    $this
      ->drupalGet('media/' . $user_media
      ->id() . '/delete');
    $this
      ->assertCacheContext('user.permissions');
    $assert_session
      ->statusCodeEquals(200);
    $this
      ->drupalLogin($this->nonAdminUser);

    /** @var \Drupal\user\RoleInterface $role */
    $role = Role::load(RoleInterface::AUTHENTICATED_ID);
    user_role_revoke_permissions($role
      ->id(), [
      'view media',
    ]);

    // Test 'create BUNDLE media' permission.
    $this
      ->drupalGet('media/add/' . $media_type
      ->id());
    $this
      ->assertCacheContext('user.permissions');
    $assert_session
      ->statusCodeEquals(403);
    $permissions = [
      'create ' . $media_type
        ->id() . ' media',
    ];
    $this
      ->grantPermissions($role, $permissions);
    $this
      ->drupalGet('media/add/' . $media_type
      ->id());
    $this
      ->assertCacheContext('user.permissions');
    $assert_session
      ->statusCodeEquals(200);
    user_role_revoke_permissions($role
      ->id(), $permissions);
    $role = Role::load(RoleInterface::AUTHENTICATED_ID);

    // Verify the author can not view the unpublished media item without
    // 'view own unpublished media' permission.
    $this
      ->grantPermissions($role, [
      'view media',
    ]);
    $this
      ->drupalGet('media/' . $user_media
      ->id());
    $this
      ->assertNoCacheContext('user');
    $this
      ->assertCacheContext('user.permissions');
    $assert_session
      ->statusCodeEquals(200);
    $user_media
      ->setUnpublished()
      ->save();
    $this
      ->drupalGet('media/' . $user_media
      ->id());
    $this
      ->assertCacheContext('user.permissions');
    $assert_session
      ->statusCodeEquals(403);
    $access_result = $user_media
      ->access('view', NULL, TRUE);
    $this
      ->assertSame("The user must be the owner and the 'view own unpublished media' permission is required when the media item is unpublished.", $access_result
      ->getReason());
    $this
      ->grantPermissions($role, [
      'view own unpublished media',
    ]);
    $this
      ->drupalGet('media/' . $user_media
      ->id());
    $this
      ->assertCacheContext('user');
    $assert_session
      ->statusCodeEquals(200);

    // Test 'create media' permission.
    $this
      ->drupalGet('media/add/' . $media_type
      ->id());
    $this
      ->assertCacheContext('user.permissions');
    $assert_session
      ->statusCodeEquals(403);
    $permissions = [
      'create media',
    ];
    $this
      ->grantPermissions($role, $permissions);
    $this
      ->drupalGet('media/add/' . $media_type
      ->id());
    $this
      ->assertCacheContext('user.permissions');
    $assert_session
      ->statusCodeEquals(200);
    user_role_revoke_permissions($role
      ->id(), $permissions);
    $role = Role::load(RoleInterface::AUTHENTICATED_ID);

    // Test 'edit own BUNDLE media' and 'delete own BUNDLE media' permissions.
    $this
      ->drupalGet('media/' . $user_media
      ->id() . '/edit');
    $this
      ->assertCacheContext('user.permissions');
    $assert_session
      ->statusCodeEquals(403);
    $this
      ->drupalGet('media/' . $user_media
      ->id() . '/delete');
    $this
      ->assertCacheContext('user.permissions');
    $assert_session
      ->statusCodeEquals(403);
    $permissions = [
      'edit own ' . $user_media
        ->bundle() . ' media',
      'delete own ' . $user_media
        ->bundle() . ' media',
    ];
    $this
      ->grantPermissions($role, $permissions);
    $this
      ->drupalGet('media/' . $user_media
      ->id() . '/edit');
    $this
      ->assertCacheContext('user');
    $assert_session
      ->statusCodeEquals(200);
    $this
      ->drupalGet('media/' . $user_media
      ->id() . '/delete');
    $this
      ->assertCacheContext('user');
    $assert_session
      ->statusCodeEquals(200);
    user_role_revoke_permissions($role
      ->id(), $permissions);
    $role = Role::load(RoleInterface::AUTHENTICATED_ID);

    // Test 'edit any BUNDLE media' and 'delete any BUNDLE media' permissions.
    $this
      ->drupalGet('media/' . $media
      ->id() . '/edit');
    $this
      ->assertCacheContext('user.permissions');
    $assert_session
      ->statusCodeEquals(403);
    $this
      ->drupalGet('media/' . $media
      ->id() . '/delete');
    $this
      ->assertCacheContext('user.permissions');
    $assert_session
      ->statusCodeEquals(403);
    $permissions = [
      'edit any ' . $media
        ->bundle() . ' media',
      'delete any ' . $media
        ->bundle() . ' media',
    ];
    $this
      ->grantPermissions($role, $permissions);
    $this
      ->drupalGet('media/' . $media
      ->id() . '/edit');
    $this
      ->assertCacheContext('user.permissions');
    $assert_session
      ->statusCodeEquals(200);
    $this
      ->drupalGet('media/' . $media
      ->id() . '/delete');
    $this
      ->assertCacheContext('user.permissions');
    $assert_session
      ->statusCodeEquals(200);

    // Test the 'access media overview' permission.
    $this
      ->grantPermissions($role, [
      'access content overview',
    ]);
    $this
      ->drupalGet('admin/content');
    $assert_session
      ->linkByHrefNotExists('/admin/content/media');
    $this
      ->assertCacheContext('user');

    // Create a new role, which implicitly checks if the permission exists.
    $mediaOverviewRole = $this
      ->createRole([
      'access content overview',
      'access media overview',
    ]);
    $this->nonAdminUser
      ->addRole($mediaOverviewRole);
    $this->nonAdminUser
      ->save();
    $this
      ->drupalGet('admin/content');
    $assert_session
      ->linkByHrefExists('/admin/content/media');
    $this
      ->clickLink('Media');
    $this
      ->assertCacheContext('user');
    $assert_session
      ->statusCodeEquals(200);
    $assert_session
      ->elementExists('css', '.views-element-container');

    // First row of the View contains media created by admin user.
    $assert_session
      ->elementTextEquals('xpath', '//div[@class="views-element-container"]//tbody/tr[1]/td[contains(@class, "views-field-uid")]/a', $this->adminUser
      ->getDisplayName());
    $assert_session
      ->elementTextEquals('xpath', "//div[@class='views-element-container']//tbody/tr[1]/td[contains(@class, 'views-field-name')]/a[contains(@href, '/media/{$media->id()}')]", 'Unnamed');

    // Second row of the View contains media created by non-admin user.
    $assert_session
      ->elementTextEquals('xpath', '//div[@class="views-element-container"]//tbody/tr[2]/td[contains(@class, "views-field-uid")]/a', $this->nonAdminUser
      ->getDisplayName());
    $assert_session
      ->elementTextEquals('xpath', "//div[@class='views-element-container']//tbody/tr[2]/td[contains(@class, 'views-field-name')]/a[contains(@href, '/media/{$user_media->id()}')]", 'Unnamed');
  }

  /**
   * Tests view access control on the canonical page.
   */
  public function testCanonicalMediaAccess() {
    $media_type = $this
      ->createMediaType('test');
    $assert_session = $this
      ->assertSession();
    \Drupal::configFactory()
      ->getEditable('media.settings')
      ->set('standalone_url', TRUE)
      ->save(TRUE);
    $this->container
      ->get('router.builder')
      ->rebuild();

    // Create media.
    $media = Media::create([
      'bundle' => $media_type
        ->id(),
      'name' => 'Unnamed',
    ]);
    $media
      ->save();
    $user_media = Media::create([
      'bundle' => $media_type
        ->id(),
      'name' => 'Unnamed',
      'uid' => $this->nonAdminUser
        ->id(),
    ]);
    $user_media
      ->save();
    $this
      ->drupalLogin($this->nonAdminUser);

    /** @var \Drupal\user\RoleInterface $role */
    $role = Role::load(RoleInterface::AUTHENTICATED_ID);
    user_role_revoke_permissions($role
      ->id(), [
      'view media',
    ]);
    $this
      ->drupalGet('media/' . $media
      ->id());
    $this
      ->assertCacheContext('user.permissions');
    $assert_session
      ->statusCodeEquals(403);
    $access_result = $media
      ->access('view', NULL, TRUE);
    $this
      ->assertSame("The 'view media' permission is required when the media item is published.", $access_result
      ->getReason());
    $this
      ->grantPermissions($role, [
      'view media',
    ]);
    $this
      ->drupalGet('media/' . $media
      ->id());
    $this
      ->assertCacheContext('user.permissions');
    $assert_session
      ->statusCodeEquals(200);
  }

  /**
   * Tests unpublished media access.
   */
  public function testUnpublishedMediaUserAccess() {
    \Drupal::configFactory()
      ->getEditable('media.settings')
      ->set('standalone_url', TRUE)
      ->save(TRUE);
    $this->container
      ->get('router.builder')
      ->rebuild();
    $assert_session = $this
      ->assertSession();
    $media_type = $this
      ->createMediaType('test');
    $permissions = [
      'view media',
      'view own unpublished media',
    ];
    $user_one = $this
      ->drupalCreateUser($permissions);
    $user_two = $this
      ->drupalCreateUser($permissions);

    // Create media as user one.
    $user_media = Media::create([
      'bundle' => $media_type
        ->id(),
      'name' => 'Unnamed',
      'uid' => $user_one
        ->id(),
    ]);
    $user_media
      ->setUnpublished()
      ->save();

    // Make sure user two can't access unpublished media.
    $this
      ->drupalLogin($user_two);
    $this
      ->drupalGet('media/' . $user_media
      ->id());
    $assert_session
      ->statusCodeEquals(403);
    $this
      ->assertCacheContext('user');
    $this
      ->drupalLogout();

    // Make sure user one can access own unpublished media.
    $this
      ->drupalLogin($user_one);
    $this
      ->drupalGet('media/' . $user_media
      ->id());
    $assert_session
      ->statusCodeEquals(200);
    $this
      ->assertCacheContext('user');
  }

  /**
   * Tests media access of anonymous user.
   */
  public function testMediaAnonymousUserAccess() {
    \Drupal::configFactory()
      ->getEditable('media.settings')
      ->set('standalone_url', TRUE)
      ->save(TRUE);
    $this->container
      ->get('router.builder')
      ->rebuild();
    $assert_session = $this
      ->assertSession();
    $media_type = $this
      ->createMediaType('test');

    // Create media as anonymous user.
    $user_media = Media::create([
      'bundle' => $media_type
        ->id(),
      'name' => 'Unnamed',
      'uid' => 0,
    ]);
    $user_media
      ->save();
    $role = Role::load(RoleInterface::ANONYMOUS_ID);
    $this
      ->grantPermissions($role, [
      'view media',
      'view own unpublished media',
    ]);
    $this
      ->drupalLogout();

    // Make sure anonymous users can access published media.
    $user_media
      ->setPublished()
      ->save();
    $this
      ->drupalGet('media/' . $user_media
      ->id());
    $assert_session
      ->statusCodeEquals(200);

    // Make sure anonymous users can not access unpublished media
    // even though role has 'view own unpublished media' permission.
    $user_media
      ->setUnpublished()
      ->save();
    $this
      ->drupalGet('media/' . $user_media
      ->id());
    $assert_session
      ->statusCodeEquals(403);
    $this
      ->assertCacheContext('user');
  }

  /**
   * Tests access for embedded medias.
   */
  public function testReferencedRendering() {
    \Drupal::configFactory()
      ->getEditable('media.settings')
      ->set('standalone_url', TRUE)
      ->save(TRUE);
    $this->container
      ->get('router.builder')
      ->rebuild();

    // Create a media type and an entity reference to itself.
    $media_type = $this
      ->createMediaType('test');
    FieldStorageConfig::create([
      'field_name' => 'field_reference',
      'entity_type' => 'media',
      'type' => 'entity_reference',
      'settings' => [
        'target_type' => 'media',
      ],
    ])
      ->save();
    FieldConfig::create([
      'field_name' => 'field_reference',
      'entity_type' => 'media',
      'bundle' => $media_type
        ->id(),
    ])
      ->save();
    $author = $this
      ->drupalCreateUser([
      'view media',
      'view own unpublished media',
    ]);
    $other_user = $this
      ->drupalCreateUser([
      'view media',
      'view own unpublished media',
    ]);
    $view_user = $this
      ->drupalCreateUser([
      'view media',
    ]);
    $child_title = 'Child media';
    $media_child = Media::create([
      'name' => $child_title,
      'bundle' => $media_type
        ->id(),
      'uid' => $author
        ->id(),
    ]);
    $media_child
      ->setUnpublished()
      ->save();
    $media_parent = Media::create([
      'name' => 'Parent media',
      'bundle' => $media_type
        ->id(),
      'field_reference' => $media_child
        ->id(),
    ]);
    $media_parent
      ->save();
    \Drupal::service('entity_display.repository')
      ->getViewDisplay('media', $media_type
      ->id(), 'full')
      ->set('content', [])
      ->setComponent('title', [
      'type' => 'string',
    ])
      ->setComponent('field_reference', [
      'type' => 'entity_reference_label',
    ])
      ->save();
    $assert_session = $this
      ->assertSession();

    // The author of the child media items should have access to both the parent
    // and child.
    $this
      ->drupalLogin($author);
    $this
      ->drupalGet($media_parent
      ->toUrl());
    $this
      ->assertCacheContext('user');
    $assert_session
      ->pageTextContains($child_title);

    // Other users with the 'view own unpublished media' permission should not
    // be able to see the unpublished child media item. The 'user' cache context
    // should be added in this case.
    $this
      ->drupalLogin($other_user);
    $this
      ->drupalGet($media_parent
      ->toUrl());
    $this
      ->assertCacheContext('user');
    $assert_session
      ->pageTextNotContains($child_title);

    // User with just the 'view media' permission should not be able to see the
    // child media item. The 'user' cache context should not be added in this
    // case.
    $this
      ->drupalLogin($view_user);
    $this
      ->drupalGet($media_parent
      ->toUrl());
    $this
      ->assertNoCacheContext('user');
    $assert_session
      ->pageTextNotContains($child_title);
  }

}