From 6e6d0cac3fa077b8a7afde77cd6f9920cf656cb9 Mon Sep 17 00:00:00 2001 From: Andrei Forascu Date: Wed, 26 Jul 2017 12:16:48 +0300 Subject: [PATCH] REPO-2670 - REST API: Retrieve Node (alfresco-access) Audit Entries - add sanity TAS-level test: - added TAS test to cover the scenario where a non-admin user with access to a node can access the audit entries for that node using nodes/{nodeId}/audit-entries --- e2e-test/java/org/alfresco/rest/RestTest.java | 5 ++- .../org/alfresco/rest/audit/AuditTest.java | 25 ++++++++----- .../rest/audit/GetAuditCoreTests.java | 35 +++++++++++++++---- 3 files changed, 48 insertions(+), 17 deletions(-) diff --git a/e2e-test/java/org/alfresco/rest/RestTest.java b/e2e-test/java/org/alfresco/rest/RestTest.java index 789d7cca1..c65cd7710 100644 --- a/e2e-test/java/org/alfresco/rest/RestTest.java +++ b/e2e-test/java/org/alfresco/rest/RestTest.java @@ -65,13 +65,16 @@ public abstract class RestTest extends AbstractTestNGSpringContextTests protected WorkflowService workflow; protected SiteModel testSite; - + + protected SiteModel privateTestSite; + @BeforeSuite(alwaysRun = true) public void checkServerHealth() throws Exception { super.springTestContextPrepareTestInstance(); serverHealth.assertServerIsOnline(); testSite = dataSite.createPublicRandomSite(); + privateTestSite = dataSite.createPrivateRandomSite(); } @BeforeMethod(alwaysRun=true) diff --git a/e2e-test/java/org/alfresco/rest/audit/AuditTest.java b/e2e-test/java/org/alfresco/rest/audit/AuditTest.java index 084bedc94..a64f4147f 100644 --- a/e2e-test/java/org/alfresco/rest/audit/AuditTest.java +++ b/e2e-test/java/org/alfresco/rest/audit/AuditTest.java @@ -2,6 +2,7 @@ package org.alfresco.rest.audit; import static org.hamcrest.Matchers.is; +import org.alfresco.dataprep.CMISUtil.DocumentType; import org.alfresco.rest.RestTest; import org.alfresco.rest.core.RestRequest; import org.alfresco.rest.core.RestResponse; @@ -12,7 +13,10 @@ import org.alfresco.rest.model.RestAuditEntryModel; import org.alfresco.rest.model.RestAuditEntryModelsCollection; import org.alfresco.rest.model.RestNodeBodyModel; import org.alfresco.rest.model.RestNodeModel; +import org.alfresco.utility.constants.UserRole; import org.alfresco.utility.model.ContentModel; +import org.alfresco.utility.model.FileModel; +import org.alfresco.utility.model.SiteModel; import org.alfresco.utility.model.UserModel; import org.alfresco.utility.network.JmxBuilder; import org.springframework.beans.factory.annotation.Autowired; @@ -32,21 +36,26 @@ public abstract class AuditTest extends RestTest @Autowired protected JmxBuilder jmxBuilder; - protected UserModel userModel,adminUser; + protected UserModel userModel, userModel1, adminUser; protected RestAuditAppModelsCollection restAuditCollection; protected RestAuditAppModel restAuditAppModel; protected RestAuditEntryModel restAuditEntryModel; protected RestAuditEntryModelsCollection restAuditEntryCollection; protected RestAuditAppModel syncRestAuditAppModel; protected RestAuditAppModel taggingRestAuditAppModel; - protected RestNodeModel node; + protected RestNodeModel node; + protected FileModel file; @BeforeClass(alwaysRun = true) public void dataPreparation() throws Exception { - //Using two users, because audit API is designed for users with admin rights. + //Audit API is designed for users with admin rights (except /nodes/{nodeId}/audit-entries) + //Create users and add userModel as SiteCollaborator on private site userModel = dataUser.createRandomTestUser(); + userModel1 = dataUser.createRandomTestUser(); adminUser = dataUser.getAdminUser(); + dataUser.addUserToSite(userModel, privateTestSite, UserRole.SiteCollaborator); + userModel.setUserRole(UserRole.SiteCollaborator); //Enable alfresco-access audit application. jmxBuilder.getJmxClient().writeProperty("Alfresco:Type=Configuration,Category=Audit,id1=default", "audit.alfresco-access.enabled", Boolean.TRUE.toString()); @@ -72,12 +81,10 @@ public abstract class AuditTest extends RestTest restAuditAppModel = restAuditCollection.getEntries().get(i++).onModel(); } while (!restAuditAppModel.getName().equals("alfresco-access")); - //Create new node. - RestNodeBodyModel nodeBody = new RestNodeBodyModel(); - nodeBody.setName("MyFile"); - nodeBody.setNodeType("cm:content"); - node = restClient.withParams("autoRename=true").withCoreAPI().usingNode(ContentModel.my()).createNode(nodeBody); - restClient.assertStatusCodeIs(HttpStatus.CREATED); + //Create new file + file = dataContent.usingUser(adminUser).usingSite(privateTestSite).createContent(DocumentType.TEXT_PLAIN); + node = restClient.authenticateUser(adminUser).withCoreAPI().usingNode(file).usingParams("include=isLocked").getNode(); + restClient.assertStatusCodeIs(HttpStatus.OK); } protected RestAuditAppModel getSyncRestAuditAppModel(UserModel userModel) throws Exception diff --git a/e2e-test/java/org/alfresco/rest/audit/GetAuditCoreTests.java b/e2e-test/java/org/alfresco/rest/audit/GetAuditCoreTests.java index 7d0608fd0..12683aacb 100644 --- a/e2e-test/java/org/alfresco/rest/audit/GetAuditCoreTests.java +++ b/e2e-test/java/org/alfresco/rest/audit/GetAuditCoreTests.java @@ -7,8 +7,6 @@ import static org.testng.Assert.assertTrue; import java.util.ArrayList; -import org.alfresco.utility.model.FileModel; -import org.alfresco.utility.model.FileType; import org.alfresco.utility.model.TestGroup; import org.alfresco.utility.testrail.ExecutionType; import org.alfresco.utility.testrail.annotation.TestRail; @@ -294,18 +292,18 @@ public class GetAuditCoreTests extends AuditTest String createdAt1, createdAt2; int expectedNumberOfItems; - // Get the node id and construct a fileModel to be used when adding comments + // Get the node id String nodeId = node.getId(); - FileModel fileModel = new FileModel("testFile", FileType.TEXT_PLAIN); - fileModel.setNodeRef(nodeId); // Add comments for a node (to create audit entries) - restClient.authenticateUser(adminUser).withCoreAPI().usingNode(fileModel).addComment("This is the first comment"); - restClient.authenticateUser(adminUser).withCoreAPI().usingNode(fileModel).addComment("This is the second comment"); + restClient.authenticateUser(adminUser).withCoreAPI().usingNode(file).addComment("This is the first comment"); + restClient.authenticateUser(adminUser).withCoreAPI().usingNode(file).addComment("This is the second comment"); + restClient.assertStatusCodeIs(HttpStatus.CREATED); // Get maxium two audit entries for the node using 'maxItems' param on /nodes/{nodeId}/audit-entries restAuditEntryCollection = restClient.authenticateUser(adminUser).withParams("maxItems=2").withCoreAPI().usingAudit().listAuditEntriesForNode(nodeId); restClient.assertStatusCodeIs(HttpStatus.OK); + restAuditEntryCollection.assertThat().entriesListIsNotEmpty(); if (restAuditEntryCollection.getPagination().getCount() == 2) { @@ -332,4 +330,27 @@ public class GetAuditCoreTests extends AuditTest } } + @Test(groups = { TestGroup.REST_API, TestGroup.AUDIT, TestGroup.CORE }) + @TestRail(section = { TestGroup.REST_API, + TestGroup.AUDIT }, executionType = ExecutionType.SANITY, description = "Verify if user with permissions can get a list of audit entries for node and status code is 200") + public void getAuditEntriesForNodeUsingUserWithPermissions() throws Exception + { + // Get the node id + String nodeId = node.getId(); + + // Add comments for a node using user with permissions (to create audit entries and check if user can view/edit the node) + restClient.authenticateUser(userModel).withCoreAPI().usingNode(file).addComment("This is a comment"); + restClient.assertStatusCodeIs(HttpStatus.CREATED); + + // Get audit entries for the node using a user with permissions and /nodes/{nodeId}/audit-entries + restAuditEntryCollection = restClient.authenticateUser(userModel).withCoreAPI().usingAudit().listAuditEntriesForNode(nodeId); + restClient.assertStatusCodeIs(HttpStatus.OK); + restAuditEntryCollection.assertThat().entriesListIsNotEmpty(); + + // Check that a user that doesn't have access to node, doesn't have access to audit entries for node + restClient.authenticateUser(userModel1).withCoreAPI().usingNode(file).getNode(); + restClient.assertStatusCodeIs(HttpStatus.FORBIDDEN); + restClient.authenticateUser(userModel1).withCoreAPI().usingAudit().listAuditEntriesForNode(nodeId); + restClient.assertStatusCodeIs(HttpStatus.FORBIDDEN); + } }