1:   2:   3:   4:   5:   6:   7:   8:   9:  10:  11:  12:  13:  14:  15:  16:  17:  18:  19:  20:  21:  22:  23:  24:  25:  26:  27:  28:  29:  30:  31:  32:  33:  34:  35:  36:  37:  38:  39:  40:  41:  42:  43:  44:  45:  46:  47:  48:  49:  50:  51:  52:  53:  54:  55:  56:  57:  58:  59:  60:  61:  62:  63:  64:  65:  66:  67:  68:  69:  70:  71:  72:  73:  74:  75:  76:  77:  78:  79:  80:  81:  82:  83:  84:  85:  86:  87:  88:  89:  90:  91:  92:  93:  94:  95:  96:  97:  98:  99: 100: 101: 102: 103: 104: 105: 106: 107: 108: 109: 110: 111: 112: 113: 114: 115: 116: 117: 118: 119: 120: 121: 122: 123: 124: 125: 126: 127: 128: 129: 130: 131: 132: 133: 134: 135: 136: 137: 138: 139: 140: 141: 142: 143: 144: 145: 146: 147: 148: 149: 150: 151: 152: 153: 154: 155: 156: 157: 158: 159: 160: 161: 162: 163: 164: 165: 166: 167: 168: 169: 170: 171: 172: 173: 174: 175: 176: 177: 178: 179: 180: 181: 182: 183: 184: 185: 186: 187: 188: 189: 190: 191: 192: 193: 194: 195: 196: 197: 198: 199: 200: 201: 202: 203: 204: 205: 206: 207: 208: 209: 210: 211: 212: 213: 214: 215: 216: 217: 218: 219: 220: 221: 222: 223: 224: 225: 226: 227: 228: 229: 230: 231: 232: 233: 234: 235: 236: 237: 238: 239: 240: 241: 242: 243: 244: 245: 246: 247: 248: 249: 250: 251: 252: 253: 254: 255: 256: 

<?php
namespace Nethgui\Test\Unit\Nethgui\Authorization;

/*
 * Copyright (C) 2012 Nethesis S.r.l.
 *
 * This script is part of NethServer.
 *
 * NethServer is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * NethServer is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with NethServer. If not, see <http://www.gnu.org/licenses/>.
 */

/**
 * PolicyRule Unit test case
 *
 * @author Davide Principi <davide.principi@nethesis.it>
 * @since 1.0
 * @covers \Nethgui\Authorization\PolicyRule
 * @covers \Nethgui\Authorization\PolicyExpressionParser
 * @covers \Nethgui\Authorization\AbstractExpression
 * @covers \Nethgui\Authorization\AnyOfExpression
 * @covers \Nethgui\Authorization\AllOfExpression
 * @covers \Nethgui\Authorization\IsExpression
 * @covers \Nethgui\Authorization\HasExpression
 * @covers \Nethgui\Authorization\AttributeExpression
 * @covers \Nethgui\Authorization\NegationExpression
 * @covers \Nethgui\Authorization\StringMatchExpression
 * @covers \Nethgui\Authorization\BinaryExpression
 * @covers \Nethgui\Authorization\StringAttributesProvider
 * @covers \Nethgui\Authorization\Constant
 */
class PolicyRuleTest extends \PHPUnit_Framework_TestCase
{

    /**
     * @var PolicyRule
     */
    protected $object;
    private $rules = array();

    protected function setUp()
    {
        foreach (array(
        0 => '{ "Id": 1$INDEX, "Effect": "DENY", "Subject": "*", "Action": "*", "Resource": "*", "Description": "Desc$INDEX", "Final": true }',
        1 => '{ "Id": 1$INDEX, "Effect": "ALLOW", "Subject": "admin", "Action": "*", "Resource": "*", "Description": "Desc$INDEX" }',
        2 => '{ "Id": 1$INDEX, "Effect": "ALLOW", "Subject": "*", "Action": "QUERY OR NOT MUTATE", "Resource": "Resource1\\\\* AND (NOT Res4 OR Res5)", "Description": "Desc$INDEX" }',
        3 => '{ "Id": 1$INDEX, "Effect": "ALLOW", "Subject": "*", "Action": ["QUERY", "NOT MUTATE"], "Resource": "Resource2\\\\* AND NOT Res4", "Description": "Desc$INDEX" }',
        4 => '{ "Id": 1$INDEX, "Effect": "DENY", "Subject": "dude OR (a AND b) OR .authenticated", "Resource": "*", "Description": "Desc$INDEX" }',
        5 => '{ "Id": 1$INDEX, "Effect": "DENY", "Subject": false, "Resource": "*", "Description": "Desc$INDEX" }',
        6 => '{ "Id": 1$INDEX, "Effect": "DENY", "Subject": "*", "Action": "*", "Resource": "a AND ", "Description": "Desc$INDEX" }', // ERROR
        7 => '{ "Id": 1$INDEX, "Effect": "DENY", "Subject": "*", "Action": "*", "Resource": "a AND ( b", "Description": "Desc$INDEX" }', // ERROR
        8 => '{ "Id": 1$INDEX, "Effect": "ALLOW", "Subject": "admin OR .authenticated OR .username IS admin OR .groups HAS Users", "Action": "*", "Resource": "*", "Description": "Desc$INDEX" }',
        9 => '{ "Id": 1$INDEX, "Effect": "ALLOW", "Subject": "NOT .authenticated  OR .noattribute", "Action": "*", "Resource": "*", "Description": "Desc$INDEX" }',
        10 => '{ "Id": 1$INDEX, "Effect": "ALLOW", "Subject": "*", "Action": [], "Resource": "*", "Description": "Desc$INDEX" }',
        11 => '{ "Id": 1$INDEX, "Effect": "ALLOW", "Subject": ".authenticated ", "Action": "*", "Resource": "*", "Description": "Desc$INDEX", "Final": true }',
        12 => '{ "Id": 1$INDEX, "Effect": "ALLOW", "Subject": "*", "Action": "*", "Resource": ".nullattribute IS 16", "Description": "Desc$INDEX" }',
        13 => '{ "Id": 1$INDEX, "Effect": "ALLOW", "Subject": ".groups HAS Managers", "Action": "*", "Resource": "*", "Description": "Desc$INDEX" }',
        14 => '{ "Id": 1$INDEX, "Effect": "DENY", "Subject": ".groups HAS Guests", "Action": "*", "Resource": "*", "Description": "Desc$INDEX" }',
        15 => '{ "Id": 1$INDEX, "Effect": "DENY", "Subject": "notarray HAS ACT", "Action": "*", "Resource": "*", "Description": "Desc$INDEX" }',
        16 => '{ "Id": 1$INDEX, "Effect": "DENY", "Subject": ".authenticated IS TRUE OR NOT .authenticated IS FALSE ", "Action": "*", "Resource": "*", "Description": "Desc$INDEX" }',
        ) as $index => $rule) {

            $this->rules[$index] = strtr($rule, array('$INDEX' => $index));
        }
    }

    /**
     *
     * @param integer $index
     * @return \Nethgui\Authorization\PolicyRule
     */
    private function getRule($index)
    {
        return \Nethgui\Authorization\PolicyRule::createFromObject(json_decode($this->rules[$index]));
    }

    public function testIsFinal()
    {
        $this->assertTrue($this->getRule(0)->isFinal());
        $this->assertFalse($this->getRule(1)->isFinal());
    }

    public function testGetDescription()
    {
        $this->assertRegExp('/^Desc0/', $this->getRule(0)->getDescription());
        $this->assertRegExp('/^Desc1/', $this->getRule(1)->getDescription());
        $this->assertRegExp('/^Desc2/', $this->getRule(2)->getDescription());
    }

    public function testGetIdentifier()
    {
        $this->assertEquals(10, $this->getRule(0)->getIdentifier());
        $this->assertEquals(11, $this->getRule(1)->getIdentifier());
        $this->assertEquals(12, $this->getRule(2)->getIdentifier());
    }

    public function testIsAllow()
    {
        $this->assertTrue($this->getRule(1)->isAllow());
        $this->assertFalse($this->getRule(0)->isAllow());
    }

    private function getSubject($username = FALSE, $groups = array())
    {
        return \Nethgui\Test\Tool\MockFactory::getAuthenticationSubject($this, $username, $groups);
    }

    private function getAttributesProvider($provider)
    {
        if ($provider instanceof \Nethgui\Authorization\AuthorizationAttributesProviderInterface) {
            return $provider;
        }

        return new \Nethgui\Authorization\StringAttributesProvider($provider);
    }

    private function getRequest($subject, $resource, $action)
    {
        if ($subject === 'Manager') {
            $osubject = $this->getSubject($subject, array('Managers'));
        } elseif ($subject === 'Guest') {
            $osubject = $this->getSubject($subject, array('Guests'));
        } else {
            $osubject = $this->getSubject($subject, array('Users'));
        }

        return array(
            'subject' => $osubject,
            'resource' => $this->getAttributesProvider($resource),
            'action' => $this->getAttributesProvider($action),
        );
    }

    public function testIsApplicableTo1()
    {
        $this->assertTrue($this->getRule(0)->isApplicableTo($this->getRequest('dude', 'ResourceX', 'PLAY')));
        $this->assertTrue($this->getRule(0)->isApplicableTo($this->getRequest(FALSE, 'ResourceX', 'PLAY')));
        // check missing matcher
        $this->assertTrue($this->getRule(4)->isApplicableTo($this->getRequest('dude', new ResourceX(), 'PLAY')));
        // check missing matcher
        $this->assertFalse($this->getRule(1)->isApplicableTo($this->getRequest('dude', new ResourceY(), 'PLAY')));
        // check missing matcher
        $this->assertTrue($this->getRule(8)->isApplicableTo($this->getRequest('dude', new ResourceY(), 'PLAY')));
        $this->assertFalse($this->getRule(9)->isApplicableTo($this->getRequest('dude', new ResourceY(), 'PLAY')));
        $this->assertFalse($this->getRule(10)->isApplicableTo($this->getRequest('dude', get_class(new ResourceY()), 'PLAY')));

        $this->assertTrue($this->getRule(11)->isApplicableTo($this->getRequest('User', 'R', 'A')));
        $this->assertFalse($this->getRule(12)->isApplicableTo($this->getRequest('User', 'R', 'A')));

        $this->assertTrue($this->getRule(13)->isApplicableTo($this->getRequest('Manager', 'R', 'A')));
        $this->assertFalse($this->getRule(13)->isApplicableTo($this->getRequest('Dude', 'R', 'A')));

        $this->assertFalse($this->getRule(14)->isApplicableTo($this->getRequest('Manager', 'R', 'A')));
        $this->assertTrue($this->getRule(14)->isApplicableTo($this->getRequest('Guest', 'R', 'A')));

        $this->assertFalse($this->getRule(15)->isApplicableTo($this->getRequest('Guest', 'R', 'A')));
        $this->assertTrue($this->getRule(16)->isApplicableTo($this->getRequest('dude', 'R', 'A')));
    }

    /**
     * @expectedException \InvalidArgumentException
     */
    public function testIsApplicableTo2()
    {
        $this->getRule(5);
    }

    /**
     * @expectedException \UnexpectedValueException
     */
    public function testIsApplicableTo3()
    {
        // parse error
        $this->getRule(6);
    }

    /**
     * @expectedException \UnexpectedValueException
     */
    public function testIsApplicableTo4()
    {
        // parse error
        $this->getRule(7);
    }

    public function testCompare1()
    {
        $r0 = $this->getRule(0);
        $r1 = $this->getRule(1);
        $r2 = $this->getRule(2);
        $r3 = $this->getRule(3);

        $this->assertLessThan(0, $r0->compare($r1));
        $this->assertGreaterThan(0, $r1->compare($r0));

        $this->assertGreaterThan(0, $r1->compare($r2));
        $this->assertLessThan(0, $r2->compare($r1));

        $this->assertEquals(0, $r2->compare($r3));
        $this->assertEquals(0, $r3->compare($r2));
    }

    public function testCompare2()
    {
        $r1 = $this->getRule(1);
        $r8 = $this->getRule(8);
        $this->assertLessThan(0, $r8->compare($r1), print_r(array($r1, $r8), 1));
        $this->assertGreaterThan(0, $r1->compare($r8));
    }

    public function testCompare3()
    {
        $r1 = $this->getRule(1);
        $r9 = $this->getRule(9);
        $this->assertLessThan(0, $r9->compare($r1));
        $this->assertGreaterThan(0, $r1->compare($r9));
    }

    public function objectProvider()
    {
        $tests = array();

        foreach ($this->rules as $index => $test) {
            $tests[] = array(json_decode($test));
        }

        return $tests;
    }

}

class ResourceX
{

    public function __toString()
    {
        return "Xsource1";
    }

}

class ResourceY
{

}