MNT-16881 Fix unit test and write an additional one.

rm-community/rm-community-repo/unit-test/java/org/alfresco/module/org_alfresco_module_rm/permission/RecordsManagementPermissionPostProcessorUnitTest.java

@@ -28,8 +28,8 @@
 package org.alfresco.module.org_alfresco_module_rm.permission;
 
 import static java.util.Arrays.asList;
-
 import static org.junit.Assert.assertEquals;
+import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 
 import java.util.List;
@@ -37,6 +37,8 @@ import java.util.List;
 import org.alfresco.module.org_alfresco_module_rm.capability.RMPermissionModel;
 import org.alfresco.module.org_alfresco_module_rm.model.RecordsManagementModel;
 import org.alfresco.module.org_alfresco_module_rm.test.util.AlfMock;
+import org.alfresco.repo.security.permissions.PermissionReference;
+import org.alfresco.repo.security.permissions.impl.model.PermissionModel;
 import org.alfresco.service.cmr.repository.NodeRef;
 import org.alfresco.service.cmr.repository.NodeService;
 import org.alfresco.service.cmr.security.AccessStatus;
@@ -47,20 +49,26 @@ import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.mockito.MockitoAnnotations;
 
+import com.google.common.collect.Sets;
+
 /**
  * Unit tests for {@link RecordsManagementPermissionPostProcessor}.
  *
  * @author David Webster
+ * @author Tom Page
  * @since 2.4.1
  */
 public class RecordsManagementPermissionPostProcessorUnitTest
 {
+    @InjectMocks
+    private RecordsManagementPermissionPostProcessor recordsManagementPermissionPostProcessor = new RecordsManagementPermissionPostProcessor();
 
-    private @InjectMocks
+    @Mock
-    RecordsManagementPermissionPostProcessor recordsManagementPermissionPostProcessor = new RecordsManagementPermissionPostProcessor();
+    private NodeService mockNodeService;
-
+    @Mock
-    private @Mock NodeService nodeService;
+    private PermissionService mockPermissionService;
-    private @Mock PermissionService permissionService;
+    @Mock
+    private PermissionModel mockPermissionModel;
 
     @Before
     public void setup()
@@ -83,9 +91,9 @@ public class RecordsManagementPermissionPostProcessorUnitTest
         List<String> configuredReadPermissions = asList("ReadProperties", "ReadChildren", perm);
         List<String> configuredFilePermissions = asList("WriteProperties", "AddChildren");
 
-        when(nodeService.hasAspect(nodeRef, RecordsManagementModel.ASPECT_FILE_PLAN_COMPONENT))
+        when(mockNodeService.hasAspect(nodeRef, RecordsManagementModel.ASPECT_FILE_PLAN_COMPONENT))
             .thenReturn(true);
-        when(permissionService.hasPermission(nodeRef, RMPermissionModel.READ_RECORDS))
+        when(mockPermissionService.hasPermission(nodeRef, RMPermissionModel.READ_RECORDS))
             .thenReturn(AccessStatus.ALLOWED);
 
         AccessStatus result = recordsManagementPermissionPostProcessor.process(accessStatus, nodeRef, perm, configuredReadPermissions, configuredFilePermissions);
@@ -108,13 +116,51 @@ public class RecordsManagementPermissionPostProcessorUnitTest
         List<String> configuredReadPermissions = asList("ReadProperties", "ReadChildren");
         List<String> configuredFilePermissions = asList("WriteProperties", "AddChildren");
 
-        when(nodeService.hasAspect(nodeRef, RecordsManagementModel.ASPECT_FILE_PLAN_COMPONENT))
+        when(mockNodeService.hasAspect(nodeRef, RecordsManagementModel.ASPECT_FILE_PLAN_COMPONENT))
             .thenReturn(true);
-        when(permissionService.hasPermission(nodeRef, RMPermissionModel.READ_RECORDS))
+        when(mockPermissionService.hasPermission(nodeRef, RMPermissionModel.READ_RECORDS))
             .thenReturn(AccessStatus.ALLOWED);
 
         AccessStatus result = recordsManagementPermissionPostProcessor.process(accessStatus, nodeRef, perm, configuredReadPermissions, configuredFilePermissions);
 
         assertEquals(AccessStatus.DENIED, result);
     }
+
+    /**
+     * Test that the permission groups configured in the global properties file imply descendant permission groups.
+     * <p>
+     * Given a configured permission is an ancestor of another permission P
+     * And the post processor checks if the user has P
+     * Then the post processor says that they do.
+     */
+    @Test
+    public void permissionInherittedFromConfiguredGroup()
+    {
+        NodeRef nodeRef = new NodeRef("node://ref/");
+        // permissions do not include perm created above
+        List<String> configuredReadPermissions = asList();
+        List<String> configuredFilePermissions = asList("WriteProperties");
+
+        when(mockNodeService.hasAspect(nodeRef, RecordsManagementModel.ASPECT_FILE_PLAN_COMPONENT))
+            .thenReturn(true);
+        when(mockPermissionService.hasPermission(nodeRef, RMPermissionModel.FILE_RECORDS))
+            .thenReturn(AccessStatus.ALLOWED);
+
+        // Set up "WriteProperties" to imply three other permission groups.
+        PermissionReference mockWritePropsPermRef = mock(PermissionReference.class);
+        when(mockPermissionModel.getPermissionReference(null, "WriteProperties")).thenReturn(mockWritePropsPermRef);
+        PermissionReference childOne = mock(PermissionReference.class);
+        when(childOne.getName()).thenReturn("Not this one");
+        PermissionReference childTwo = mock(PermissionReference.class);
+        when(childOne.getName()).thenReturn("This is the requested permission");
+        PermissionReference childThree = mock(PermissionReference.class);
+        when(childThree.getName()).thenReturn("Not this one either");
+        when(mockPermissionModel.getGranteePermissions(mockWritePropsPermRef)).thenReturn(Sets.newHashSet(childOne, childTwo, childThree));
+
+        // Call the method under test.
+        AccessStatus result = recordsManagementPermissionPostProcessor.process(AccessStatus.DENIED, nodeRef,
+                    "This is the requested permission", configuredReadPermissions, configuredFilePermissions);
+
+        assertEquals(AccessStatus.ALLOWED, result);
+    }
 }