1: 2: 3: 4: 5: 6: 7: 8: 9: 10: 11: 12: 13: 14: 15: 16: 17: 18: 19: 20: 21: 22: 23: 24: 25: 26: 27: 28: 29: 30: 31: 32: 33: 34: 35: 36: 37: 38: 39: 40: 41: 42: 43: 44: 45: 46: 47: 48: 49: 50: 51: 52: 53: 54: 55: 56: 57: 58: 59: 60: 61: 62: 63: 64: 65: 66: 67: 68: 69: 70: 71: 72: 73: 74: 75: 76: 77: 78: 79: 80: 81: 82: 83: 84: 85: 86: 87: 88: 89: 90: 91: 92: 93: 94: 95: 96: 97: 98: 99: 100: 101: 102: 103: 104: 105: 106: 107: 108: 109: 110: 111: 112: 113: 114: 115: 116: 117: 118: 119: 120: 121: 122: 123: 124: 125: 126: 127: 128: 129: 130: 131: 132: 133: 134: 135: 136: 137: 138: 139: 140: 141: 142: 143: 144: 145: 146: 147: 148: 149: 150: 151: 152: 153: 154: 155: 156: 157: 158: 159: 160: 161: 162: 163: 164: 165: 166: 167: 168: 169: 170: 171: 172: 173: 174: 175: 176: 177: 178: 179: 180: 181: 182: 183: 184: 185: 186: 187: 188: 189: 190: 191: 192: 193: 194: 195: 196: 197: 198: 199: 200: 201: 202: 203: 204: 205: 206: 207: 208: 209: 210: 211: 212: 213: 214: 215: 216: 217: 218: 219: 220: 221: 222: 223: 224: 225: 226: 227: 228: 229: 230: 231: 232: 233: 234: 235: 236: 237: 238: 239: 240: 241: 242: 243: 244: 245: 246: 247: 248: 249: 250: 251: 252: 253: 254: 255: 256:
<?php
namespace Nethgui\Test\Unit\Nethgui\Authorization;
class PolicyRuleTest extends \PHPUnit_Framework_TestCase
{
protected $object;
private $rules = array();
protected function setUp()
{
foreach (array(
0 => '{ "Id": 1$INDEX, "Effect": "DENY", "Subject": "*", "Action": "*", "Resource": "*", "Description": "Desc$INDEX", "Final": true }',
1 => '{ "Id": 1$INDEX, "Effect": "ALLOW", "Subject": "admin", "Action": "*", "Resource": "*", "Description": "Desc$INDEX" }',
2 => '{ "Id": 1$INDEX, "Effect": "ALLOW", "Subject": "*", "Action": "QUERY OR NOT MUTATE", "Resource": "Resource1\\\\* AND (NOT Res4 OR Res5)", "Description": "Desc$INDEX" }',
3 => '{ "Id": 1$INDEX, "Effect": "ALLOW", "Subject": "*", "Action": ["QUERY", "NOT MUTATE"], "Resource": "Resource2\\\\* AND NOT Res4", "Description": "Desc$INDEX" }',
4 => '{ "Id": 1$INDEX, "Effect": "DENY", "Subject": "dude OR (a AND b) OR .authenticated", "Resource": "*", "Description": "Desc$INDEX" }',
5 => '{ "Id": 1$INDEX, "Effect": "DENY", "Subject": false, "Resource": "*", "Description": "Desc$INDEX" }',
6 => '{ "Id": 1$INDEX, "Effect": "DENY", "Subject": "*", "Action": "*", "Resource": "a AND ", "Description": "Desc$INDEX" }',
7 => '{ "Id": 1$INDEX, "Effect": "DENY", "Subject": "*", "Action": "*", "Resource": "a AND ( b", "Description": "Desc$INDEX" }',
8 => '{ "Id": 1$INDEX, "Effect": "ALLOW", "Subject": "admin OR .authenticated OR .username IS admin OR .groups HAS Users", "Action": "*", "Resource": "*", "Description": "Desc$INDEX" }',
9 => '{ "Id": 1$INDEX, "Effect": "ALLOW", "Subject": "NOT .authenticated OR .noattribute", "Action": "*", "Resource": "*", "Description": "Desc$INDEX" }',
10 => '{ "Id": 1$INDEX, "Effect": "ALLOW", "Subject": "*", "Action": [], "Resource": "*", "Description": "Desc$INDEX" }',
11 => '{ "Id": 1$INDEX, "Effect": "ALLOW", "Subject": ".authenticated ", "Action": "*", "Resource": "*", "Description": "Desc$INDEX", "Final": true }',
12 => '{ "Id": 1$INDEX, "Effect": "ALLOW", "Subject": "*", "Action": "*", "Resource": ".nullattribute IS 16", "Description": "Desc$INDEX" }',
13 => '{ "Id": 1$INDEX, "Effect": "ALLOW", "Subject": ".groups HAS Managers", "Action": "*", "Resource": "*", "Description": "Desc$INDEX" }',
14 => '{ "Id": 1$INDEX, "Effect": "DENY", "Subject": ".groups HAS Guests", "Action": "*", "Resource": "*", "Description": "Desc$INDEX" }',
15 => '{ "Id": 1$INDEX, "Effect": "DENY", "Subject": "notarray HAS ACT", "Action": "*", "Resource": "*", "Description": "Desc$INDEX" }',
16 => '{ "Id": 1$INDEX, "Effect": "DENY", "Subject": ".authenticated IS TRUE OR NOT .authenticated IS FALSE ", "Action": "*", "Resource": "*", "Description": "Desc$INDEX" }',
) as $index => $rule) {
$this->rules[$index] = strtr($rule, array('$INDEX' => $index));
}
}
private function getRule($index)
{
return \Nethgui\Authorization\PolicyRule::createFromObject(json_decode($this->rules[$index]));
}
public function testIsFinal()
{
$this->assertTrue($this->getRule(0)->isFinal());
$this->assertFalse($this->getRule(1)->isFinal());
}
public function testGetDescription()
{
$this->assertRegExp('/^Desc0/', $this->getRule(0)->getDescription());
$this->assertRegExp('/^Desc1/', $this->getRule(1)->getDescription());
$this->assertRegExp('/^Desc2/', $this->getRule(2)->getDescription());
}
public function testGetIdentifier()
{
$this->assertEquals(10, $this->getRule(0)->getIdentifier());
$this->assertEquals(11, $this->getRule(1)->getIdentifier());
$this->assertEquals(12, $this->getRule(2)->getIdentifier());
}
public function testIsAllow()
{
$this->assertTrue($this->getRule(1)->isAllow());
$this->assertFalse($this->getRule(0)->isAllow());
}
private function getSubject($username = FALSE, $groups = array())
{
return \Nethgui\Test\Tool\MockFactory::getAuthenticationSubject($this, $username, $groups);
}
private function getAttributesProvider($provider)
{
if ($provider instanceof \Nethgui\Authorization\AuthorizationAttributesProviderInterface) {
return $provider;
}
return new \Nethgui\Authorization\StringAttributesProvider($provider);
}
private function getRequest($subject, $resource, $action)
{
if ($subject === 'Manager') {
$osubject = $this->getSubject($subject, array('Managers'));
} elseif ($subject === 'Guest') {
$osubject = $this->getSubject($subject, array('Guests'));
} else {
$osubject = $this->getSubject($subject, array('Users'));
}
return array(
'subject' => $osubject,
'resource' => $this->getAttributesProvider($resource),
'action' => $this->getAttributesProvider($action),
);
}
public function testIsApplicableTo1()
{
$this->assertTrue($this->getRule(0)->isApplicableTo($this->getRequest('dude', 'ResourceX', 'PLAY')));
$this->assertTrue($this->getRule(0)->isApplicableTo($this->getRequest(FALSE, 'ResourceX', 'PLAY')));
$this->assertTrue($this->getRule(4)->isApplicableTo($this->getRequest('dude', new ResourceX(), 'PLAY')));
$this->assertFalse($this->getRule(1)->isApplicableTo($this->getRequest('dude', new ResourceY(), 'PLAY')));
$this->assertTrue($this->getRule(8)->isApplicableTo($this->getRequest('dude', new ResourceY(), 'PLAY')));
$this->assertFalse($this->getRule(9)->isApplicableTo($this->getRequest('dude', new ResourceY(), 'PLAY')));
$this->assertFalse($this->getRule(10)->isApplicableTo($this->getRequest('dude', get_class(new ResourceY()), 'PLAY')));
$this->assertTrue($this->getRule(11)->isApplicableTo($this->getRequest('User', 'R', 'A')));
$this->assertFalse($this->getRule(12)->isApplicableTo($this->getRequest('User', 'R', 'A')));
$this->assertTrue($this->getRule(13)->isApplicableTo($this->getRequest('Manager', 'R', 'A')));
$this->assertFalse($this->getRule(13)->isApplicableTo($this->getRequest('Dude', 'R', 'A')));
$this->assertFalse($this->getRule(14)->isApplicableTo($this->getRequest('Manager', 'R', 'A')));
$this->assertTrue($this->getRule(14)->isApplicableTo($this->getRequest('Guest', 'R', 'A')));
$this->assertFalse($this->getRule(15)->isApplicableTo($this->getRequest('Guest', 'R', 'A')));
$this->assertTrue($this->getRule(16)->isApplicableTo($this->getRequest('dude', 'R', 'A')));
}
public function testIsApplicableTo2()
{
$this->getRule(5);
}
public function testIsApplicableTo3()
{
$this->getRule(6);
}
public function testIsApplicableTo4()
{
$this->getRule(7);
}
public function testCompare1()
{
$r0 = $this->getRule(0);
$r1 = $this->getRule(1);
$r2 = $this->getRule(2);
$r3 = $this->getRule(3);
$this->assertLessThan(0, $r0->compare($r1));
$this->assertGreaterThan(0, $r1->compare($r0));
$this->assertGreaterThan(0, $r1->compare($r2));
$this->assertLessThan(0, $r2->compare($r1));
$this->assertEquals(0, $r2->compare($r3));
$this->assertEquals(0, $r3->compare($r2));
}
public function testCompare2()
{
$r1 = $this->getRule(1);
$r8 = $this->getRule(8);
$this->assertLessThan(0, $r8->compare($r1), print_r(array($r1, $r8), 1));
$this->assertGreaterThan(0, $r1->compare($r8));
}
public function testCompare3()
{
$r1 = $this->getRule(1);
$r9 = $this->getRule(9);
$this->assertLessThan(0, $r9->compare($r1));
$this->assertGreaterThan(0, $r1->compare($r9));
}
public function objectProvider()
{
$tests = array();
foreach ($this->rules as $index => $test) {
$tests[] = array(json_decode($test));
}
return $tests;
}
}
class ResourceX
{
public function __toString()
{
return "Xsource1";
}
}
class ResourceY
{
}