* Edit details Ui action now reflects user's capabilites correctly
 * Fixed up a couple of behaviours that don't execute when non-admin user (run as system user since admin may not be rm admin)
 * Transfers not appear in docLib filter correcetly
 * File UI action now reflects the user's capability correctly.
 * Renamed 'group' capabilities to 'private' as this more accurately reflects what it means.
 * Added composite capability implementation ... allows us to futher consolidate some of the edge cases and will allow us to break down further some of the existing capabilities .. this makes is much easier to see and understand exactlly what each capability is doing
 * Refactored current 'group' capabilities .. replacing with pure spring config where appropriate .. much clearer what they are doing (and fixed up where they wheren't doing exactlly the right thing)
 * Moved the remaining group capabilities impl's with the other capability impl's .. we are now down to 8 custom capability implementations .. down from 50+ .. and these havily borrow from the base classes where they can ... makes maintenance MUCH easier!
 * more unit tests
 * used new 'private' capability technique to break up FileRecord capability ... it's now clear what it is doing and could be corrected easily



git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/modules/recordsmanagement/HEAD@35350 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
This commit is contained in:
Roy Wetherall
2012-04-18 04:58:51 +00:00
parent 9d7fe7fd4a
commit 09a0f50882
28 changed files with 482 additions and 691 deletions

View File

@@ -23,6 +23,7 @@ import junit.framework.TestSuite;
import org.alfresco.module.org_alfresco_module_rm.test.capabilities.CapabilitiesTest;
import org.alfresco.module.org_alfresco_module_rm.test.capabilities.DeclarativeCapabilityTest;
import org.alfresco.module.org_alfresco_module_rm.test.capabilities.CompositeCapabilityTest;
/**
@@ -42,6 +43,7 @@ public class CapabilitiesTestSuite extends TestSuite
TestSuite suite = new TestSuite();
suite.addTestSuite(CapabilitiesTest.class);
suite.addTestSuite(DeclarativeCapabilityTest.class);
suite.addTestSuite(CompositeCapabilityTest.class);
return suite;
}
}

View File

@@ -82,6 +82,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
// Give all the users file permission objects
for (String user : testUsers)
{
securityService.setPermission(filePlan, user, FILING);
securityService.setPermission(rmContainer, user, FILING);
}
}
@@ -424,7 +425,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
Map<Capability, AccessStatus> access = securityService
.getCapabilities(filePlan);
assertEquals(65, access.size());
assertEquals(66, access.size());
check(access, ACCESS_AUDIT, AccessStatus.ALLOWED);
check(access, ADD_MODIFY_EVENT_DATES,
AccessStatus.DENIED);
@@ -544,7 +545,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
.getAdminUserName());
Map<Capability, AccessStatus> access = securityService
.getCapabilities(filePlan);
assertEquals(65, access.size());
assertEquals(66, access.size());
check(access, ACCESS_AUDIT, AccessStatus.ALLOWED);
check(access, ADD_MODIFY_EVENT_DATES,
AccessStatus.DENIED);
@@ -666,7 +667,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
.setFullyAuthenticatedUser(rmAdminName);
Map<Capability, AccessStatus> access = securityService
.getCapabilities(filePlan);
assertEquals(65, access.size());
assertEquals(66, access.size());
check(access, ACCESS_AUDIT, AccessStatus.ALLOWED);
check(access, ADD_MODIFY_EVENT_DATES,
AccessStatus.DENIED);
@@ -794,7 +795,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
.setFullyAuthenticatedUser(recordsManagerName);
Map<Capability, AccessStatus> access = securityService
.getCapabilities(filePlan);
assertEquals(65, access.size()); // 58 + File
assertEquals(66, access.size()); // 58 + File
check(access, ACCESS_AUDIT, AccessStatus.ALLOWED);
check(access, ADD_MODIFY_EVENT_DATES,
AccessStatus.DENIED);
@@ -807,7 +808,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
check(access, AUTHORIZE_NOMINATED_TRANSFERS,
AccessStatus.DENIED);
check(access, CHANGE_OR_DELETE_REFERENCES,
AccessStatus.UNDETERMINED);
AccessStatus.DENIED);
check(access, CLOSE_FOLDERS, AccessStatus.DENIED);
check(access, CREATE_AND_ASSOCIATE_SELECTION_LISTS,
AccessStatus.ALLOWED);
@@ -817,7 +818,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
check(access, CREATE_MODIFY_DESTROY_EVENTS,
AccessStatus.ALLOWED);
check(access, CREATE_MODIFY_DESTROY_FILEPLAN_METADATA,
AccessStatus.ALLOWED);
AccessStatus.DENIED);
check(access, CREATE_MODIFY_DESTROY_FILEPLAN_TYPES,
AccessStatus.ALLOWED);
check(access, CREATE_MODIFY_DESTROY_FOLDERS,
@@ -918,7 +919,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
.setFullyAuthenticatedUser(securityOfficerName);
Map<Capability, AccessStatus> access = securityService
.getCapabilities(filePlan);
assertEquals(65, access.size()); // 58 + File
assertEquals(66, access.size()); // 58 + File
check(access, ACCESS_AUDIT, AccessStatus.DENIED);
check(access, ADD_MODIFY_EVENT_DATES,
AccessStatus.DENIED);
@@ -1037,7 +1038,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
.setFullyAuthenticatedUser(powerUserName);
Map<Capability, AccessStatus> access = securityService
.getCapabilities(filePlan);
assertEquals(65, access.size()); // 58 + File
assertEquals(66, access.size()); // 58 + File
check(access, ACCESS_AUDIT, AccessStatus.DENIED);
check(access, ADD_MODIFY_EVENT_DATES,
AccessStatus.DENIED);
@@ -1156,7 +1157,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
.setFullyAuthenticatedUser(rmUserName);
Map<Capability, AccessStatus> access = securityService
.getCapabilities(filePlan);
assertEquals(65, access.size()); // 58 + File
assertEquals(66, access.size()); // 58 + File
check(access, ACCESS_AUDIT, AccessStatus.DENIED);
check(access, ADD_MODIFY_EVENT_DATES,
AccessStatus.DENIED);
@@ -1276,7 +1277,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
Map<Capability, AccessStatus> access = securityService
.getCapabilities(rmContainer);
assertEquals(65, access.size());
assertEquals(66, access.size());
check(access, ACCESS_AUDIT, AccessStatus.ALLOWED);
check(access, ADD_MODIFY_EVENT_DATES,
AccessStatus.DENIED);
@@ -1399,7 +1400,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
.getAdminUserName());
Map<Capability, AccessStatus> access = securityService
.getCapabilities(rmContainer);
assertEquals(65, access.size());
assertEquals(66, access.size());
check(access, ACCESS_AUDIT, AccessStatus.ALLOWED);
check(access, ADD_MODIFY_EVENT_DATES,
AccessStatus.DENIED);
@@ -1521,7 +1522,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
.setFullyAuthenticatedUser(rmAdminName);
Map<Capability, AccessStatus> access = securityService
.getCapabilities(rmContainer);
assertEquals(65, access.size());
assertEquals(66, access.size());
check(access, ACCESS_AUDIT, AccessStatus.ALLOWED);
check(access, ADD_MODIFY_EVENT_DATES,
AccessStatus.DENIED);
@@ -1645,7 +1646,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
// rm_records_manager, FILING, true);
Map<Capability, AccessStatus> access = securityService
.getCapabilities(rmContainer);
assertEquals(65, access.size()); // 58 + File
assertEquals(66, access.size()); // 58 + File
check(access, ACCESS_AUDIT, AccessStatus.ALLOWED);
check(access, ADD_MODIFY_EVENT_DATES,
AccessStatus.DENIED);
@@ -1769,7 +1770,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
// securityOfficerName, FILING, true);
Map<Capability, AccessStatus> access = securityService
.getCapabilities(rmContainer);
assertEquals(65, access.size()); // 58 + File
assertEquals(66, access.size()); // 58 + File
check(access, ACCESS_AUDIT, AccessStatus.DENIED);
check(access, ADD_MODIFY_EVENT_DATES,
AccessStatus.DENIED);
@@ -1890,7 +1891,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
// powerUserName, FILING, true);
Map<Capability, AccessStatus> access = securityService
.getCapabilities(rmContainer);
assertEquals(65, access.size()); // 58 + File
assertEquals(66, access.size()); // 58 + File
check(access, ACCESS_AUDIT, AccessStatus.DENIED);
check(access, ADD_MODIFY_EVENT_DATES,
AccessStatus.DENIED);
@@ -2011,7 +2012,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
// rmUserName, FILING, true);
Map<Capability, AccessStatus> access = securityService
.getCapabilities(rmContainer);
assertEquals(65, access.size()); // 58 + File
assertEquals(66, access.size()); // 58 + File
check(access, ACCESS_AUDIT, AccessStatus.DENIED);
check(access, ADD_MODIFY_EVENT_DATES,
AccessStatus.DENIED);
@@ -2131,7 +2132,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
Map<Capability, AccessStatus> access = securityService
.getCapabilities(rmFolder);
assertEquals(65, access.size());
assertEquals(66, access.size());
check(access, ACCESS_AUDIT, AccessStatus.ALLOWED);
check(access, ADD_MODIFY_EVENT_DATES,
AccessStatus.ALLOWED);
@@ -2260,7 +2261,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
.getAdminUserName());
Map<Capability, AccessStatus> access = securityService
.getCapabilities(rmFolder);
assertEquals(65, access.size());
assertEquals(66, access.size());
check(access, ACCESS_AUDIT, AccessStatus.ALLOWED);
check(access, ADD_MODIFY_EVENT_DATES,
AccessStatus.ALLOWED);
@@ -2383,7 +2384,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
.setFullyAuthenticatedUser(rmAdminName);
Map<Capability, AccessStatus> access = securityService
.getCapabilities(rmFolder);
assertEquals(65, access.size());
assertEquals(66, access.size());
check(access, ACCESS_AUDIT, AccessStatus.ALLOWED);
check(access, ADD_MODIFY_EVENT_DATES,
AccessStatus.ALLOWED);
@@ -2504,7 +2505,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
AuthenticationUtil.setFullyAuthenticatedUser(recordsManagerName);
//setFilingOnRecordFolder(rmFolder, recordsManagerName);
Map<Capability, AccessStatus> access = securityService.getCapabilities(rmFolder);
assertEquals(65, access.size()); // 58 + File
assertEquals(66, access.size()); // 58 + File
check(access, ACCESS_AUDIT, AccessStatus.ALLOWED);
check(access, ADD_MODIFY_EVENT_DATES,
AccessStatus.ALLOWED);
@@ -2625,7 +2626,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
AuthenticationUtil.setFullyAuthenticatedUser(securityOfficerName);
//setFilingOnRecordFolder(rmFolder, securityOfficerName);
Map<Capability, AccessStatus> access = securityService.getCapabilities(rmFolder);
assertEquals(65, access.size()); // 58 + File
assertEquals(66, access.size()); // 58 + File
check(access, ACCESS_AUDIT, AccessStatus.DENIED);
check(access, ADD_MODIFY_EVENT_DATES,
AccessStatus.ALLOWED);
@@ -2743,7 +2744,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
AuthenticationUtil.setFullyAuthenticatedUser(powerUserName);
//setFilingOnRecordFolder(rmFolder, powerUserName);
Map<Capability, AccessStatus> access = securityService.getCapabilities(rmFolder);
assertEquals(65, access.size()); // 58 + File
assertEquals(66, access.size()); // 58 + File
check(access, ACCESS_AUDIT, AccessStatus.DENIED);
check(access, ADD_MODIFY_EVENT_DATES,
AccessStatus.ALLOWED);
@@ -2863,7 +2864,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
//setFilingOnRecordFolder(rmFolder, rmUserName);
Map<Capability, AccessStatus> access = securityService
.getCapabilities(rmFolder);
assertEquals(65, access.size()); // 58 + File
assertEquals(66, access.size()); // 58 + File
check(access, ACCESS_AUDIT, AccessStatus.DENIED);
check(access, ADD_MODIFY_EVENT_DATES,
AccessStatus.DENIED);
@@ -2980,7 +2981,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
{
AuthenticationUtil.setFullyAuthenticatedUser(AuthenticationUtil.SYSTEM_USER_NAME);
Map<Capability, AccessStatus> access = securityService.getCapabilities(record);
assertEquals(65, access.size());
assertEquals(66, access.size());
check(access, ACCESS_AUDIT, AccessStatus.ALLOWED);
check(access, ADD_MODIFY_EVENT_DATES,
AccessStatus.DENIED);
@@ -3007,7 +3008,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
check(access, CREATE_MODIFY_DESTROY_FILEPLAN_TYPES,
AccessStatus.ALLOWED);
check(access, CREATE_MODIFY_DESTROY_FOLDERS,
AccessStatus.ALLOWED);
AccessStatus.DENIED);
check(access, CREATE_MODIFY_DESTROY_RECORD_TYPES,
AccessStatus.ALLOWED);
check(access, CREATE_MODIFY_DESTROY_REFERENCE_TYPES,
@@ -3104,7 +3105,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
.getAdminUserName());
Map<Capability, AccessStatus> access = securityService
.getCapabilities(record);
assertEquals(65, access.size());
assertEquals(66, access.size());
check(access, ACCESS_AUDIT, AccessStatus.ALLOWED);
check(access, ADD_MODIFY_EVENT_DATES,
AccessStatus.DENIED);
@@ -3131,7 +3132,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
check(access, CREATE_MODIFY_DESTROY_FILEPLAN_TYPES,
AccessStatus.ALLOWED);
check(access, CREATE_MODIFY_DESTROY_FOLDERS,
AccessStatus.ALLOWED);
AccessStatus.DENIED);
check(access, CREATE_MODIFY_DESTROY_RECORD_TYPES,
AccessStatus.ALLOWED);
check(access, CREATE_MODIFY_DESTROY_REFERENCE_TYPES,
@@ -3227,7 +3228,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
.setFullyAuthenticatedUser(rmAdminName);
Map<Capability, AccessStatus> access = securityService
.getCapabilities(record);
assertEquals(65, access.size());
assertEquals(66, access.size());
check(access, ACCESS_AUDIT, AccessStatus.ALLOWED);
check(access, ADD_MODIFY_EVENT_DATES,
AccessStatus.DENIED);
@@ -3254,7 +3255,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
check(access, CREATE_MODIFY_DESTROY_FILEPLAN_TYPES,
AccessStatus.ALLOWED);
check(access, CREATE_MODIFY_DESTROY_FOLDERS,
AccessStatus.ALLOWED);
AccessStatus.DENIED);
check(access, CREATE_MODIFY_DESTROY_RECORD_TYPES,
AccessStatus.ALLOWED);
check(access, CREATE_MODIFY_DESTROY_REFERENCE_TYPES,
@@ -3351,7 +3352,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
// setFilingOnRecord(record, recordsManagerName);
Map<Capability, AccessStatus> access = securityService
.getCapabilities(record);
assertEquals(65, access.size()); // 58 + File
assertEquals(66, access.size()); // 58 + File
check(access, ACCESS_AUDIT, AccessStatus.ALLOWED);
check(access, ADD_MODIFY_EVENT_DATES,
AccessStatus.DENIED);
@@ -3378,7 +3379,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
check(access, CREATE_MODIFY_DESTROY_FILEPLAN_TYPES,
AccessStatus.ALLOWED);
check(access, CREATE_MODIFY_DESTROY_FOLDERS,
AccessStatus.ALLOWED);
AccessStatus.DENIED);
check(access, CREATE_MODIFY_DESTROY_RECORD_TYPES,
AccessStatus.ALLOWED);
check(access, CREATE_MODIFY_DESTROY_REFERENCE_TYPES,
@@ -3475,7 +3476,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
// setFilingOnRecord(record, securityOfficerName);
Map<Capability, AccessStatus> access = securityService
.getCapabilities(record);
assertEquals(65, access.size()); // 58 + File
assertEquals(66, access.size()); // 58 + File
check(access, ACCESS_AUDIT, AccessStatus.DENIED);
check(access, ADD_MODIFY_EVENT_DATES,
AccessStatus.DENIED);
@@ -3502,7 +3503,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
check(access, CREATE_MODIFY_DESTROY_FILEPLAN_TYPES,
AccessStatus.DENIED);
check(access, CREATE_MODIFY_DESTROY_FOLDERS,
AccessStatus.ALLOWED);
AccessStatus.DENIED);
check(access, CREATE_MODIFY_DESTROY_RECORD_TYPES,
AccessStatus.DENIED);
check(access, CREATE_MODIFY_DESTROY_REFERENCE_TYPES,
@@ -3597,7 +3598,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
// setFilingOnRecord(record, powerUserName);
Map<Capability, AccessStatus> access = securityService
.getCapabilities(record);
assertEquals(65, access.size()); // 58 + File
assertEquals(66, access.size()); // 58 + File
check(access, ACCESS_AUDIT, AccessStatus.DENIED);
check(access, ADD_MODIFY_EVENT_DATES,
AccessStatus.DENIED);
@@ -3624,7 +3625,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
check(access, CREATE_MODIFY_DESTROY_FILEPLAN_TYPES,
AccessStatus.DENIED);
check(access, CREATE_MODIFY_DESTROY_FOLDERS,
AccessStatus.ALLOWED);
AccessStatus.DENIED);
check(access, CREATE_MODIFY_DESTROY_RECORD_TYPES,
AccessStatus.DENIED);
check(access, CREATE_MODIFY_DESTROY_REFERENCE_TYPES,
@@ -3718,7 +3719,7 @@ public class CapabilitiesTest extends BaseRMTestCase implements
// setFilingOnRecord(record, rmUserName);
Map<Capability, AccessStatus> access = securityService
.getCapabilities(record);
assertEquals(65, access.size()); // 58 + File
assertEquals(66, access.size()); // 58 + File
check(access, ACCESS_AUDIT, AccessStatus.DENIED);
check(access, ADD_MODIFY_EVENT_DATES,
AccessStatus.DENIED);

View File

@@ -31,7 +31,7 @@ import org.alfresco.service.cmr.security.AccessStatus;
*
* @author Roy Wetherall
*/
public class GroupCapabilityTest extends BaseRMTestCase
public class CompositeCapabilityTest extends BaseRMTestCase
{
private NodeRef record;
private NodeRef declaredRecord;

View File

@@ -51,6 +51,8 @@ public class DeclarativeCapabilityTest extends BaseRMTestCase
private NodeRef frozenRecord2;
private NodeRef frozenRecordFolder;
private NodeRef closedFolder;
@Override
protected boolean isUserTest()
{
@@ -66,9 +68,9 @@ public class DeclarativeCapabilityTest extends BaseRMTestCase
record = utils.createRecord(rmFolder, "record.txt");
declaredRecord = utils.createRecord(rmFolder, "declaredRecord.txt");
// Open folder
// Closed folder
closedFolder = rmService.createRecordFolder(rmContainer, "closedFolder");
utils.closeFolder(closedFolder);
recordFolderContainsFrozen = rmService.createRecordFolder(rmContainer, "containsFrozen");
frozenRecord = utils.createRecord(rmFolder, "frozenRecord.txt");
@@ -130,7 +132,7 @@ public class DeclarativeCapabilityTest extends BaseRMTestCase
for (Capability capability : capabilities)
{
if (capability instanceof DeclarativeCapability &&
capability.isGroupCapability() == false &&
capability.isPrivate() == false &&
capability.getName().equals("MoveRecords") == false &&
capability.getName().equals("DeleteLinks") == false &&
capability.getName().equals("ChangeOrDeleteReferences") == false &&
@@ -237,4 +239,48 @@ public class DeclarativeCapabilityTest extends BaseRMTestCase
return result;
}
/** Specific declarative capability tests */
public void testFileCapability()
{
final Capability capability = capabilityService.getCapability("File");
assertNotNull(capability);
doTestInTransaction(new Test<Void>()
{
@Override
public Void run()
{
assertEquals(AccessStatus.DENIED, capability.hasPermission(rmContainer));
assertEquals(AccessStatus.ALLOWED, capability.hasPermission(rmFolder));
assertEquals(AccessStatus.ALLOWED, capability.hasPermission(record));
assertEquals(AccessStatus.DENIED, capability.hasPermission(declaredRecord));
assertEquals(AccessStatus.DENIED, capability.hasPermission(frozenRecordFolder));
assertEquals(AccessStatus.DENIED, capability.hasPermission(recordFolderContainsFrozen));
assertEquals(AccessStatus.DENIED, capability.hasPermission(frozenRecord));
assertEquals(AccessStatus.DENIED, capability.hasPermission(closedFolder));
return null;
}
}, recordsManagerName);
doTestInTransaction(new Test<Void>()
{
@Override
public Void run()
{
assertEquals(AccessStatus.DENIED, capability.hasPermission(rmContainer));
assertEquals(AccessStatus.ALLOWED, capability.hasPermission(rmFolder));
assertEquals(AccessStatus.ALLOWED, capability.hasPermission(record));
assertEquals(AccessStatus.DENIED, capability.hasPermission(declaredRecord));
assertEquals(AccessStatus.DENIED, capability.hasPermission(frozenRecordFolder));
assertEquals(AccessStatus.DENIED, capability.hasPermission(recordFolderContainsFrozen));
assertEquals(AccessStatus.DENIED, capability.hasPermission(frozenRecord));
assertEquals(AccessStatus.DENIED, capability.hasPermission(closedFolder));
return null;
}
}, rmUserName);
}
}

View File

@@ -169,6 +169,19 @@ public class CommonRMTestUtils implements RecordsManagementModel
}
public void closeFolder(final NodeRef recordFolder)
{
AuthenticationUtil.runAs(new RunAsWork<Void>()
{
@Override
public Void doWork() throws Exception
{
actionService.executeRecordsManagementAction(recordFolder, "closeRecordFolder");
return null;
}
}, AuthenticationUtil.getAdminUserName());
}
public void freeze(final NodeRef nodeRef)
{
AuthenticationUtil.runAs(new RunAsWork<Void>()