AS1024/Kanboard-Prod
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Added application and project roles validation for API procedure calls

Browse Source
This commit is contained in:
Frederic Guillot
2016-06-26 10:25:13 -04:00
parent 922e0fb6de
commit 4a230d331e
79 changed files with 1772 additions and 761 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
tests/integration/ActionTest.php → tests/integration/ActionProcedureTest.php
View File

@@ -1,8 +1,8 @@
<?php
require_once __DIR__.'/BaseIntegrationTest.php';
require_once __DIR__.'/BaseProcedureTest.php';
class ActionTest extends BaseIntegrationTest
class ActionProcedureTest extends BaseProcedureTest
{
protected $projectName = 'My project to test actions';

4
tests/integration/AppTest.php → tests/integration/AppProcedureTest.php
View File

@@ -1,8 +1,8 @@
<?php
require_once __DIR__.'/BaseIntegrationTest.php';
require_once __DIR__.'/BaseProcedureTest.php';
class AppTest extends BaseIntegrationTest
class AppProcedureTest extends BaseProcedureTest
{
public function testGetTimezone()
{

2
tests/integration/BaseIntegrationTest.php → tests/integration/BaseProcedureTest.php
View File

@@ -2,7 +2,7 @@
require_once __DIR__.'/../../vendor/autoload.php';
abstract class BaseIntegrationTest extends PHPUnit_Framework_TestCase
abstract class BaseProcedureTest extends PHPUnit_Framework_TestCase
{
protected $app = null;
protected $admin = null;

4
tests/integration/BoardTest.php → tests/integration/BoardProcedureTest.php
View File

@@ -1,8 +1,8 @@
<?php
require_once __DIR__.'/BaseIntegrationTest.php';
require_once __DIR__.'/BaseProcedureTest.php';
class BoardTest extends BaseIntegrationTest
class BoardProcedureTest extends BaseProcedureTest
{
protected $projectName = 'My project to test board';

4
tests/integration/CategoryTest.php → tests/integration/CategoryProcedureTest.php
View File

@@ -1,8 +1,8 @@
<?php
require_once __DIR__.'/BaseIntegrationTest.php';
require_once __DIR__.'/BaseProcedureTest.php';
class CategoryTest extends BaseIntegrationTest
class CategoryProcedureTest extends BaseProcedureTest
{
protected $projectName = 'My project to test categories';
private $categoryId = 0;

4
tests/integration/ColumnTest.php → tests/integration/ColumnProcedureTest.php
View File

@@ -1,8 +1,8 @@
<?php
require_once __DIR__.'/BaseIntegrationTest.php';
require_once __DIR__.'/BaseProcedureTest.php';
class ColumnTest extends BaseIntegrationTest
class ColumnProcedureTest extends BaseProcedureTest
{
protected $projectName = 'My project to test columns';
private $columns = array();

4
tests/integration/CommentTest.php → tests/integration/CommentProcedureTest.php
View File

@@ -1,8 +1,8 @@
<?php
require_once __DIR__.'/BaseIntegrationTest.php';
require_once __DIR__.'/BaseProcedureTest.php';
class CommentTest extends BaseIntegrationTest
class CommentProcedureTest extends BaseProcedureTest
{
protected $projectName = 'My project to test comments';
private $commentId = 0;

4
tests/integration/GroupMemberTest.php → tests/integration/GroupMemberProcedureTest.php
View File

@@ -1,8 +1,8 @@
<?php
require_once __DIR__.'/BaseIntegrationTest.php';
require_once __DIR__.'/BaseProcedureTest.php';
class GroupMemberTest extends BaseIntegrationTest
class GroupMemberProcedureTest extends BaseProcedureTest
{
protected $username = 'user-group-member';
protected $groupName1 = 'My group member A';

4
tests/integration/GroupTest.php → tests/integration/GroupProcedureTest.php
View File

@@ -1,8 +1,8 @@
<?php
require_once __DIR__.'/BaseIntegrationTest.php';
require_once __DIR__.'/BaseProcedureTest.php';
class GroupTest extends BaseIntegrationTest
class GroupProcedureTest extends BaseProcedureTest
{
public function testAll()
{

4
tests/integration/LinkTest.php → tests/integration/LinkProcedureTest.php
View File

@@ -1,8 +1,8 @@
<?php
require_once __DIR__.'/BaseIntegrationTest.php';
require_once __DIR__.'/BaseProcedureTest.php';
class LinkTest extends BaseIntegrationTest
class LinkProcedureTest extends BaseProcedureTest
{
public function testGetAllLinks()
{

9
tests/integration/MeTest.php → tests/integration/MeProcedureTest.php
View File

@@ -1,8 +1,8 @@
<?php
require_once __DIR__.'/BaseIntegrationTest.php';
require_once __DIR__.'/BaseProcedureTest.php';
class MeTest extends BaseIntegrationTest
class MeProcedureTest extends BaseProcedureTest
{
protected $projectName = 'My private project';
@@ -41,11 +41,6 @@ class MeTest extends BaseIntegrationTest
{
$projects = $this->user->getMyProjects();
$this->assertNotEmpty($projects);
$this->assertCount(1, $projects);
$this->assertEquals($this->projectName, $projects[0]['name']);
$this->assertNotEmpty($projects[0]['url']['calendar']);
$this->assertNotEmpty($projects[0]['url']['board']);
$this->assertNotEmpty($projects[0]['url']['list']);
}
public function assertCreateTask()

4
tests/integration/OverdueTaskTest.php → tests/integration/OverdueTaskProcedureTest.php
View File

@@ -1,8 +1,8 @@
<?php
require_once __DIR__.'/BaseIntegrationTest.php';
require_once __DIR__.'/BaseProcedureTest.php';
class OverdueTaskTest extends BaseIntegrationTest
class OverdueTaskProcedureTest extends BaseProcedureTest
{
protected $projectName = 'My project to test overdue tasks';

306
tests/integration/ProcedureAuthorizationTest.php Normal file
View File

@@ -0,0 +1,306 @@
<?php
require_once __DIR__.'/BaseProcedureTest.php';
class ProcedureAuthorizationTest extends BaseProcedureTest
{
public function testApiCredentialDoNotHaveAccessToUserCredentialProcedure()
{
$this->setExpectedException('JsonRPC\Exception\AccessDeniedException');
$this->app->getMe();
}
public function testUserCredentialDoNotHaveAccessToAdminProcedures()
{
$this->setExpectedException('JsonRPC\Exception\AccessDeniedException');
$this->user->getUser(1);
}
public function testManagerCredentialDoNotHaveAccessToAdminProcedures()
{
$this->setExpectedException('JsonRPC\Exception\AccessDeniedException');
$this->user->getAllProjects();
}
public function testUserCredentialDoNotHaveAccessToManagerProcedures()
{
$this->setExpectedException('JsonRPC\Exception\AccessDeniedException');
$this->user->createProject('Team project creation are only for app managers');
}
public function testAppManagerCanCreateTeamProject()
{
$this->assertNotFalse($this->manager->createProject('Team project created by app manager'));
}
public function testAdminManagerCanCreateTeamProject()
{
$projectId = $this->admin->createProject('Team project created by admin');
$this->assertNotFalse($projectId);
$this->setExpectedException('JsonRPC\Exception\AccessDeniedException');
$this->assertNotNull($this->manager->getProjectById($projectId));
}
public function testProjectManagerCanUpdateHisProject()
{
$projectId = $this->manager->createProject(array(
'name' => 'Team project can be updated',
'owner_id' => $this->managerUserId,
));
$this->assertNotFalse($projectId);
$this->assertEquals('project-manager', $this->app->getProjectUserRole($projectId, $this->managerUserId));
$this->assertNotNull($this->manager->getProjectById($projectId));
$this->assertTrue($this->manager->updateProject($projectId, 'My team project have been updated'));
}
public function testProjectAuthorizationForbidden()
{
$projectId = $this->manager->createProject('A team project without members');
$this->assertNotFalse($projectId);
$this->setExpectedException('JsonRPC\Exception\AccessDeniedException');
$this->user->getProjectById($projectId);
}
public function testProjectAuthorizationGranted()
{
$projectId = $this->manager->createProject(array(
'name' => 'A team project with members',
'owner_id' => $this->managerUserId,
));
$this->assertNotFalse($projectId);
$this->assertTrue($this->manager->addProjectUser($projectId, $this->userUserId));
$this->assertNotNull($this->user->getProjectById($projectId));
}
public function testActionAuthorizationForbidden()
{
$projectId = $this->manager->createProject(array(
'name' => 'Test Project',
'owner_id' => $this->managerUserId,
));
$this->assertNotFalse($projectId);
$actionId = $this->manager->createAction($projectId, 'task.move.column', '\Kanboard\Action\TaskCloseColumn', array('column_id' => 1));
$this->assertNotFalse($actionId);
$this->setExpectedException('JsonRPC\Exception\AccessDeniedException');
$this->user->removeAction($projectId);
}
public function testActionAuthorizationForbiddenBecauseNotProjectManager()
{
$projectId = $this->manager->createProject(array(
'name' => 'Test Project',
'owner_id' => $this->managerUserId,
));
$this->assertNotFalse($projectId);
$actionId = $this->manager->createAction($projectId, 'task.move.column', '\Kanboard\Action\TaskCloseColumn', array('column_id' => 1));
$this->assertNotFalse($actionId);
$this->assertTrue($this->manager->addProjectUser($projectId, $this->userUserId, 'project-member'));
$this->setExpectedException('JsonRPC\Exception\AccessDeniedException');
$this->user->removeAction($actionId);
}
public function testActionAuthorizationGranted()
{
$projectId = $this->manager->createProject(array(
'name' => 'Test Project',
'owner_id' => $this->managerUserId,
));
$this->assertNotFalse($projectId);
$actionId = $this->manager->createAction($projectId, 'task.move.column', '\Kanboard\Action\TaskCloseColumn', array('column_id' => 1));
$this->assertNotFalse($actionId);
$this->assertTrue($this->manager->addProjectUser($projectId, $this->userUserId, 'project-manager'));
$this->assertTrue($this->user->removeAction($actionId));
}
public function testCategoryAuthorizationForbidden()
{
$projectId = $this->manager->createProject(array(
'name' => 'Test Project',
'owner_id' => $this->managerUserId,
));
$this->assertNotFalse($projectId);
$categoryId = $this->manager->createCategory($projectId, 'Test');
$this->assertNotFalse($categoryId);
$this->setExpectedException('JsonRPC\Exception\AccessDeniedException');
$this->user->removeCategory($categoryId);
}
public function testCategoryAuthorizationForbiddenBecauseNotProjectManager()
{
$projectId = $this->manager->createProject(array(
'name' => 'Test Project',
'owner_id' => $this->managerUserId,
));
$this->assertNotFalse($projectId);
$categoryId = $this->manager->createCategory($projectId, 'Test');
$this->assertNotFalse($categoryId);
$this->assertTrue($this->manager->addProjectUser($projectId, $this->userUserId, 'project-member'));
$this->setExpectedException('JsonRPC\Exception\AccessDeniedException');
$this->user->removeCategory($categoryId);
}
public function testCategoryAuthorizationGranted()
{
$projectId = $this->manager->createProject(array(
'name' => 'Test Project',
'owner_id' => $this->managerUserId,
));
$this->assertNotFalse($projectId);
$categoryId = $this->manager->createCategory($projectId, 'Test');
$this->assertNotFalse($categoryId);
$this->assertTrue($this->manager->addProjectUser($projectId, $this->userUserId, 'project-manager'));
$this->assertTrue($this->user->removeCategory($categoryId));
}
public function testColumnAuthorizationForbidden()
{
$projectId = $this->manager->createProject(array(
'name' => 'Test Project',
'owner_id' => $this->managerUserId,
));
$this->assertNotFalse($projectId);
$columnId = $this->manager->addColumn($projectId, 'Test');
$this->assertNotFalse($columnId);
$this->setExpectedException('JsonRPC\Exception\AccessDeniedException');
$this->user->removeColumn($columnId);
}
public function testColumnAuthorizationForbiddenBecauseNotProjectManager()
{
$projectId = $this->manager->createProject(array(
'name' => 'Test Project',
'owner_id' => $this->managerUserId,
));
$this->assertNotFalse($projectId);
$columnId = $this->manager->addColumn($projectId, 'Test');
$this->assertNotFalse($columnId);
$this->assertTrue($this->manager->addProjectUser($projectId, $this->userUserId, 'project-member'));
$this->setExpectedException('JsonRPC\Exception\AccessDeniedException');
$this->user->removeColumn($columnId);
}
public function testColumnAuthorizationGranted()
{
$projectId = $this->manager->createProject(array(
'name' => 'Test Project',
'owner_id' => $this->managerUserId,
));
$this->assertNotFalse($projectId);
$columnId = $this->manager->addColumn($projectId, 'Test');
$this->assertNotFalse($columnId);
$this->assertTrue($this->manager->addProjectUser($projectId, $this->userUserId, 'project-manager'));
$this->assertTrue($this->user->removeColumn($columnId));
}
public function testCommentAuthorizationForbidden()
{
$projectId = $this->manager->createProject(array(
'name' => 'Test Project',
'owner_id' => $this->managerUserId,
));
$this->assertNotFalse($projectId);
$this->assertTrue($this->manager->addProjectUser($projectId, $this->userUserId, 'project-viewer'));
$taskId = $this->manager->createTask('My Task', $projectId);
$this->assertNotFalse($taskId);
$commentId = $this->manager->createComment($taskId, $this->userUserId, 'My comment');
$this->assertNotFalse($commentId);
$this->setExpectedException('JsonRPC\Exception\AccessDeniedException');
$this->user->updateComment($commentId, 'something else');
}
public function testCommentAuthorizationGranted()
{
$projectId = $this->manager->createProject(array(
'name' => 'Test Project',
'owner_id' => $this->managerUserId,
));
$this->assertNotFalse($projectId);
$this->assertTrue($this->manager->addProjectUser($projectId, $this->userUserId, 'project-member'));
$taskId = $this->user->createTask('My Task', $projectId);
$this->assertNotFalse($taskId);
$commentId = $this->user->createComment($taskId, $this->userUserId, 'My comment');
$this->assertNotFalse($commentId);
$this->assertTrue($this->user->updateComment($commentId, 'something else'));
}
public function testSubtaskAuthorizationForbidden()
{
$projectId = $this->manager->createProject(array(
'name' => 'Test Project',
'owner_id' => $this->managerUserId,
));
$this->assertNotFalse($projectId);
$this->assertTrue($this->manager->addProjectUser($projectId, $this->userUserId, 'project-viewer'));
$taskId = $this->manager->createTask('My Task', $projectId);
$this->assertNotFalse($taskId);
$subtaskId = $this->manager->createSubtask($taskId, 'My subtask');
$this->assertNotFalse($subtaskId);
$this->setExpectedException('JsonRPC\Exception\AccessDeniedException');
$this->user->removeSubtask($subtaskId);
}
public function testSubtaskAuthorizationGranted()
{
$projectId = $this->manager->createProject(array(
'name' => 'Test Project',
'owner_id' => $this->managerUserId,
));
$this->assertNotFalse($projectId);
$this->assertTrue($this->manager->addProjectUser($projectId, $this->userUserId, 'project-member'));
$taskId = $this->user->createTask('My Task', $projectId);
$this->assertNotFalse($taskId);
$subtaskId = $this->manager->createSubtask($taskId, 'My subtask');
$this->assertNotFalse($subtaskId);
$this->assertTrue($this->user->removeSubtask($subtaskId));
}
}

4
tests/integration/ProjectPermissionTest.php → tests/integration/ProjectPermissionProcedureTest.php
View File

@@ -1,8 +1,8 @@
<?php
require_once __DIR__.'/BaseIntegrationTest.php';
require_once __DIR__.'/BaseProcedureTest.php';
class ProjectPermissionTest extends BaseIntegrationTest
class ProjectPermissionProcedureTest extends BaseProcedureTest
{
protected $projectName = 'Project with permission';
protected $username = 'user-project-permission';

4
tests/integration/ProjectTest.php → tests/integration/ProjectProcedureTest.php
View File

@@ -1,8 +1,8 @@
<?php
require_once __DIR__.'/BaseIntegrationTest.php';
require_once __DIR__.'/BaseProcedureTest.php';
class ProjectTest extends BaseIntegrationTest
class ProjectProcedureTest extends BaseProcedureTest
{
protected $projectName = 'My team project';

4
tests/integration/SubtaskTest.php → tests/integration/SubtaskProcedureTest.php
View File

@@ -1,8 +1,8 @@
<?php
require_once __DIR__.'/BaseIntegrationTest.php';
require_once __DIR__.'/BaseProcedureTest.php';
class SubtaskTest extends BaseIntegrationTest
class SubtaskProcedureTest extends BaseProcedureTest
{
protected $projectName = 'My project to test subtasks';
private $subtaskId = 0;

4
tests/integration/SwimlaneTest.php → tests/integration/SwimlaneProcedureTest.php
View File

@@ -1,8 +1,8 @@
<?php
require_once __DIR__.'/BaseIntegrationTest.php';
require_once __DIR__.'/BaseProcedureTest.php';
class SwimlaneTest extends BaseIntegrationTest
class SwimlaneProcedureTest extends BaseProcedureTest
{
protected $projectName = 'My project to test swimlanes';
private $swimlaneId = 0;

4
tests/integration/TaskFileTest.php → tests/integration/TaskFileProcedureTest.php
View File

@@ -1,8 +1,8 @@
<?php
require_once __DIR__.'/BaseIntegrationTest.php';
require_once __DIR__.'/BaseProcedureTest.php';
class TaskFileTest extends BaseIntegrationTest
class TaskFileProcedureTest extends BaseProcedureTest
{
protected $projectName = 'My project to test task files';
protected $fileId;

4
tests/integration/TaskLinkTest.php → tests/integration/TaskLinkProcedureTest.php
View File

@@ -1,8 +1,8 @@
<?php
require_once __DIR__.'/BaseIntegrationTest.php';
require_once __DIR__.'/BaseProcedureTest.php';
class TaskLinkTest extends BaseIntegrationTest
class TaskLinkProcedureTest extends BaseProcedureTest
{
protected $projectName = 'My project to test task links';
protected $taskLinkId;

4
tests/integration/TaskTest.php → tests/integration/TaskProcedureTest.php
View File

@@ -1,8 +1,8 @@
<?php
require_once __DIR__.'/BaseIntegrationTest.php';
require_once __DIR__.'/BaseProcedureTest.php';
class TaskTest extends BaseIntegrationTest
class TaskProcedureTest extends BaseProcedureTest
{
protected $projectName = 'My project to test tasks';

4
tests/integration/UserTest.php → tests/integration/UserProcedureTest.php
View File

@@ -1,8 +1,8 @@
<?php
require_once __DIR__.'/BaseIntegrationTest.php';
require_once __DIR__.'/BaseProcedureTest.php';
class UserTest extends BaseIntegrationTest
class UserProcedureTest extends BaseProcedureTest
{
public function testAll()
{