View source
<?php
namespace Drupal\Tests\user\Unit;
use Drupal\Core\Access\AccessResult;
use Drupal\Core\Cache\Context\CacheContextsManager;
use Drupal\Core\DependencyInjection\Container;
use Drupal\Tests\UnitTestCase;
use Drupal\user\UserAccessControlHandler;
class UserAccessControlHandlerTest extends UnitTestCase {
protected $accessControlHandler;
protected $viewer;
protected $emailViewer;
protected $owner;
protected $admin;
protected $items;
protected function setUp() : void {
parent::setUp();
$cache_contexts_manager = $this
->prophesize(CacheContextsManager::class);
$cache_contexts_manager
->assertValidTokens()
->willReturn(TRUE);
$cache_contexts_manager
->reveal();
$container = new Container();
$container
->set('cache_contexts_manager', $cache_contexts_manager);
\Drupal::setContainer($container);
$this->viewer = $this
->createMock('\\Drupal\\Core\\Session\\AccountInterface');
$this->viewer
->expects($this
->any())
->method('hasPermission')
->will($this
->returnValue(FALSE));
$this->viewer
->expects($this
->any())
->method('id')
->will($this
->returnValue(1));
$this->owner = $this
->createMock('\\Drupal\\Core\\Session\\AccountInterface');
$this->owner
->expects($this
->any())
->method('hasPermission')
->willReturnMap([
[
'administer users',
FALSE,
],
[
'change own username',
TRUE,
],
]);
$this->owner
->expects($this
->any())
->method('id')
->will($this
->returnValue(2));
$this->admin = $this
->createMock('\\Drupal\\Core\\Session\\AccountInterface');
$this->admin
->expects($this
->any())
->method('hasPermission')
->will($this
->returnValue(TRUE));
$this->emailViewer = $this
->createMock('\\Drupal\\Core\\Session\\AccountInterface');
$this->emailViewer
->expects($this
->any())
->method('hasPermission')
->willReturnMap([
[
'view user email addresses',
TRUE,
],
]);
$this->emailViewer
->expects($this
->any())
->method('id')
->will($this
->returnValue(3));
$entity_type = $this
->createMock('Drupal\\Core\\Entity\\EntityTypeInterface');
$this->accessControlHandler = new UserAccessControlHandler($entity_type);
$module_handler = $this
->createMock('Drupal\\Core\\Extension\\ModuleHandlerInterface');
$this->accessControlHandler
->setModuleHandler($module_handler);
$this->items = $this
->getMockBuilder('Drupal\\Core\\Field\\FieldItemList')
->disableOriginalConstructor()
->getMock();
$this->items
->expects($this
->any())
->method('defaultAccess')
->will($this
->returnValue(AccessResult::allowed()));
}
public function assertFieldAccess(string $field, string $viewer, string $target, bool $view, bool $edit) : void {
$field_definition = $this
->createMock('Drupal\\Core\\Field\\FieldDefinitionInterface');
$field_definition
->expects($this
->any())
->method('getName')
->will($this
->returnValue($field));
$this->items
->expects($this
->any())
->method('getEntity')
->will($this
->returnValue($this->{$target}));
foreach ([
'view' => $view,
'edit' => $edit,
] as $operation => $result) {
$result_text = !isset($result) ? 'null' : ($result ? 'true' : 'false');
$message = "User '{$field}' field access returns '{$result_text}' with operation '{$operation}' for '{$viewer}' accessing '{$target}'";
$this
->assertSame($result, $this->accessControlHandler
->fieldAccess($operation, $field_definition, $this->{$viewer}, $this->items), $message);
}
}
public function testUserNameAccess($viewer, $target, $view, $edit) {
$this
->assertFieldAccess('name', $viewer, $target, $view, $edit);
}
public function userNameProvider() {
$name_access = [
[
'viewer' => 'viewer',
'target' => 'viewer',
'view' => TRUE,
'edit' => FALSE,
],
[
'viewer' => 'owner',
'target' => 'viewer',
'view' => TRUE,
'edit' => FALSE,
],
[
'viewer' => 'viewer',
'target' => 'owner',
'view' => TRUE,
'edit' => FALSE,
],
[
'viewer' => 'owner',
'target' => 'owner',
'view' => TRUE,
'edit' => TRUE,
],
[
'viewer' => 'admin',
'target' => 'owner',
'view' => TRUE,
'edit' => TRUE,
],
];
return $name_access;
}
public function testHiddenUserSettings($field, $viewer, $target, $view, $edit) {
$this
->assertFieldAccess($field, $viewer, $target, $view, $edit);
}
public function hiddenUserSettingsProvider() {
$access_info = [];
$fields = [
'preferred_langcode',
'preferred_admin_langcode',
'timezone',
'mail',
];
foreach ($fields as $field) {
$access_info[] = [
'field' => $field,
'viewer' => 'viewer',
'target' => 'viewer',
'view' => TRUE,
'edit' => TRUE,
];
$access_info[] = [
'field' => $field,
'viewer' => 'viewer',
'target' => 'owner',
'view' => FALSE,
'edit' => TRUE,
];
$access_info[] = [
'field' => $field,
'viewer' => 'owner',
'target' => 'owner',
'view' => TRUE,
'edit' => TRUE,
];
$access_info[] = [
'field' => $field,
'viewer' => 'admin',
'target' => 'owner',
'view' => TRUE,
'edit' => TRUE,
];
$access_info[] = [
'field' => $field,
'viewer' => 'emailViewer',
'target' => 'owner',
'view' => $field === 'mail',
'edit' => TRUE,
];
}
return $access_info;
}
public function testAdminFieldAccess($field, $viewer, $target, $view, $edit) {
$this
->assertFieldAccess($field, $viewer, $target, $view, $edit);
}
public function adminFieldAccessProvider() {
$access_info = [];
$fields = [
'roles',
'status',
'access',
'login',
'init',
];
foreach ($fields as $field) {
$access_info[] = [
'field' => $field,
'viewer' => 'viewer',
'target' => 'viewer',
'view' => FALSE,
'edit' => FALSE,
];
$access_info[] = [
'field' => $field,
'viewer' => 'viewer',
'target' => 'owner',
'view' => FALSE,
'edit' => FALSE,
];
$access_info[] = [
'field' => $field,
'viewer' => 'admin',
'target' => 'owner',
'view' => TRUE,
'edit' => TRUE,
];
}
return $access_info;
}
public function testPasswordAccess($viewer, $target, $view, $edit) {
$this
->assertFieldAccess('pass', $viewer, $target, $view, $edit);
}
public function passwordAccessProvider() {
$pass_access = [
[
'viewer' => 'viewer',
'target' => 'viewer',
'view' => FALSE,
'edit' => TRUE,
],
[
'viewer' => 'viewer',
'target' => 'owner',
'view' => FALSE,
'edit' => TRUE,
],
[
'viewer' => 'owner',
'target' => 'viewer',
'view' => FALSE,
'edit' => TRUE,
],
[
'viewer' => 'admin',
'target' => 'owner',
'view' => FALSE,
'edit' => TRUE,
],
];
return $pass_access;
}
public function testCreatedAccess($viewer, $target, $view, $edit) {
$this
->assertFieldAccess('created', $viewer, $target, $view, $edit);
}
public function createdAccessProvider() {
$created_access = [
[
'viewer' => 'viewer',
'target' => 'viewer',
'view' => TRUE,
'edit' => FALSE,
],
[
'viewer' => 'owner',
'target' => 'viewer',
'view' => TRUE,
'edit' => FALSE,
],
[
'viewer' => 'admin',
'target' => 'owner',
'view' => TRUE,
'edit' => TRUE,
],
];
return $created_access;
}
public function testNonExistingFieldAccess($viewer, $target, $view, $edit) {
$this
->assertFieldAccess('some_non_existing_field', $viewer, $target, $view, $edit);
}
public function NonExistingFieldAccessProvider() {
$created_access = [
[
'viewer' => 'viewer',
'target' => 'viewer',
'view' => TRUE,
'edit' => TRUE,
],
[
'viewer' => 'owner',
'target' => 'viewer',
'view' => TRUE,
'edit' => TRUE,
],
[
'viewer' => 'admin',
'target' => 'owner',
'view' => TRUE,
'edit' => TRUE,
],
];
return $created_access;
}
}