Skip to content

Commit fe97154

Browse files
machacjozefmachacjozef
authored
Merge pull request #420 from netgrif/NAE-2387
[NAE-2387] Fix permission evaluation order between ActorRef and proce…
2 parents 92f4890 + 531a2ac commit fe97154

7 files changed

Lines changed: 135 additions & 12 deletions

File tree

‎application-engine/src/main/java/com/netgrif/application/engine/workflow/service/AbstractAuthorizationService.java‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,19 @@
22

33
import com.netgrif.application.engine.objects.auth.domain.AbstractUser;
44

5-
import java.util.HashMap;
6-
import java.util.HashSet;
7-
import java.util.Map;
8-
import java.util.Set;
5+
import java.util.*;
96
import java.util.stream.Collectors;
107

118
public abstract class AbstractAuthorizationService {
129

10+
protected Boolean checkPermissions(Map<String, Boolean> providedPermissions, List<String> requiredPermissions) {
11+
if (requiredPermissions.stream().allMatch(permission -> providedPermissions.get(permission) == null)) {
12+
return null;
13+
}
14+
return requiredPermissions.stream()
15+
.anyMatch(permission -> hasPermission(providedPermissions.get(permission)));
16+
}
17+
1318
protected boolean hasPermission(Boolean permissionValue) {
1419
return permissionValue != null && permissionValue;
1520
}

‎application-engine/src/main/java/com/netgrif/application/engine/workflow/service/TaskAuthorizationService.java‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,7 @@ public Boolean userHasAtLeastOneRolePermission(AbstractUser user, Task task, Rol
3636
}
3737
}
3838

39-
return Arrays.stream(permissions)
40-
.anyMatch(permission -> hasPermission(aggregatePermissions.get(permission.toString())));
39+
return checkPermissions(aggregatePermissions, Arrays.stream(permissions).map(RolePermission::toString).toList());
4140
}
4241

4342
@Override
@@ -62,8 +61,8 @@ public Boolean userHasUserListPermission(AbstractUser user, Task task, RolePermi
6261
return false;
6362
}
6463
}
65-
return Arrays.stream(permissions)
66-
.anyMatch(permission -> hasPermission(userPermissions.get(permission.toString())));
64+
65+
return checkPermissions(userPermissions, Arrays.stream(permissions).map(RolePermission::toString).toList());
6766
}
6867

6968
@Override

‎application-engine/src/main/java/com/netgrif/application/engine/workflow/service/WorkflowAuthorizationService.java‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -63,8 +63,7 @@ public Boolean userHasAtLeastOneRolePermission(AbstractUser user, PetriNet net,
6363
}
6464
}
6565

66-
return Arrays.stream(permissions)
67-
.anyMatch(permission -> hasPermission(aggregatePermissions.get(permission.toString())));
66+
return checkPermissions(aggregatePermissions, Arrays.stream(permissions).map(ProcessRolePermission::toString).toList());
6867
}
6968

7069
@Override
@@ -84,8 +83,7 @@ public Boolean userHasUserListPermission(AbstractUser user, Case useCase, Proces
8483
return false;
8584
}
8685
}
87-
return Arrays.stream(permissions)
88-
.anyMatch(permission -> hasPermission(userPermissions.get(permission.toString())));
86+
return checkPermissions(userPermissions, Arrays.stream(permissions).map(ProcessRolePermission::toString).toList());
8987
}
9088

9189
private Map<String, Boolean> findUserPermissions(Case useCase, AbstractUser user) {

‎application-engine/src/test/groovy/com/netgrif/application/engine/auth/TaskAuthorizationServiceTest.groovy‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -590,4 +590,45 @@ class TaskAuthorizationServiceTest {
590590
workflowService.deleteCase(new DeleteCaseParams(case_.stringId))
591591
}
592592

593+
@Test
594+
void testCanAssignWithRoleAssignTrueAndWithActorRefAssignUndefined() {
595+
ProcessRole positiveRole = this.netWithUserRefs.getRoles().values().find(v -> v.getImportId() == "assign_pos_role")
596+
userService.addRole(testUser, positiveRole.get_id())
597+
Case case_ = workflowService.createCase(CreateCaseParams.with()
598+
.process(netWithUserRefs)
599+
.title("Test assign")
600+
.color("")
601+
.author(ActorTransformer.toLoggedUser(testUser))
602+
.build()).getCase()
603+
604+
String taskId = (new ArrayList<>(case_.getTasks())).get(0).task
605+
case_ = dataService.setData(taskId, ImportHelper.populateDataset([
606+
"view_pos_ul": [
607+
"value": [testUser.stringId],
608+
"type": "actorList"
609+
]
610+
] as Map)).getCase()
611+
assert taskAuthorizationService.canCallAssign(ActorTransformer.toLoggedUser(testUser), (new ArrayList<>(case_.getTasks())).get(0).task)
612+
}
613+
614+
@Test
615+
void testCanAssignWithRoleAssignUndefinedAndWithActorRefAssignTrue() {
616+
ProcessRole positiveRole = this.netWithUserRefs.getRoles().values().find(v -> v.getImportId() == "view_pos_role")
617+
userService.addRole(testUser, positiveRole.get_id())
618+
Case case_ = workflowService.createCase(CreateCaseParams.with()
619+
.process(netWithUserRefs)
620+
.title("Test assign")
621+
.color("")
622+
.author(ActorTransformer.toLoggedUser(testUser))
623+
.build()).getCase()
624+
625+
String taskId = (new ArrayList<>(case_.getTasks())).get(0).task
626+
case_ = dataService.setData(taskId, ImportHelper.populateDataset([
627+
"assign_pos_ul": [
628+
"value": [testUser.stringId],
629+
"type": "actorList"
630+
]
631+
] as Map)).getCase()
632+
assert taskAuthorizationService.canCallAssign(ActorTransformer.toLoggedUser(testUser), (new ArrayList<>(case_.getTasks())).get(0).task)
633+
}
593634
}

‎application-engine/src/test/groovy/com/netgrif/application/engine/auth/WorkflowAuthorizationServiceTest.groovy‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -311,6 +311,46 @@ class WorkflowAuthorizationServiceTest {
311311
userService.removeRole(testUser, negDeleteRole.getStringId())
312312
}
313313

314+
@Test
315+
void testCanCallDeleteWithRoleDeleteTrueAndActorRefDeleteUndefined() {
316+
ProcessRole positiveDeleteRole = this.netWithUserRefs.getRoles().values().find(v -> v.getImportId() == "delete_pos_role")
317+
userService.addRole(testUser, positiveDeleteRole.getStringId())
318+
Case case_ = workflowService.createCase(CreateCaseParams.with()
319+
.process(netWithUserRefs)
320+
.title("Test delete")
321+
.color("")
322+
.author(ActorTransformer.toLoggedUser(testUser))
323+
.build()).getCase()
324+
String taskId = (new ArrayList<>(case_.getTasks())).get(0).task
325+
case_ = dataService.setData(taskId, ImportHelper.populateDataset([
326+
"view_actor_list": [
327+
"value": [testUser.stringId],
328+
"type": "actorList"
329+
]
330+
] as Map)).getCase()
331+
assert workflowAuthorizationService.canCallDelete(ActorTransformer.toLoggedUser(testUser), case_.getStringId())
332+
}
333+
334+
@Test
335+
void testCanCallDeleteWithRoleDeleteUndefinedAndActorRefDeleteTrue() {
336+
ProcessRole positiveViewRole = this.netWithUserRefs.getRoles().values().find(v -> v.getImportId() == "view_pos_role")
337+
userService.addRole(testUser, positiveViewRole.getStringId())
338+
Case case_ = workflowService.createCase(CreateCaseParams.with()
339+
.process(netWithUserRefs)
340+
.title("Test delete")
341+
.color("")
342+
.author(ActorTransformer.toLoggedUser(testUser))
343+
.build()).getCase()
344+
String taskId = (new ArrayList<>(case_.getTasks())).get(0).task
345+
case_ = dataService.setData(taskId, ImportHelper.populateDataset([
346+
"pos_user_list": [
347+
"value": [testUser.stringId],
348+
"type": "actorList"
349+
]
350+
] as Map)).getCase()
351+
assert workflowAuthorizationService.canCallDelete(ActorTransformer.toLoggedUser(testUser), case_.getStringId())
352+
}
353+
314354
@SuppressWarnings("GrMethodMayBeStatic")
315355
private def parseResult(MvcResult result) {
316356
return (new JsonSlurper()).parseText(result.response.contentAsString)

‎application-engine/src/test/resources/task_authorization_service_test_with_userRefs.xml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,10 @@
2020
<id>finish_neg_role</id>
2121
<name>finish neg role</name>
2222
</role>
23+
<role>
24+
<id>view_pos_role</id>
25+
<name>view pos role</name>
26+
</role>
2327
<data type="actorList">
2428
<id>assign_pos_ul</id>
2529
<title/>
@@ -52,6 +56,10 @@
5256
<id>finish_neg_ul</id>
5357
<title/>
5458
</data>
59+
<data type="actorList">
60+
<id>view_pos_ul</id>
61+
<title/>
62+
</data>
5563
<data type="text">
5664
<id>text</id>
5765
<title>Text</title>
@@ -90,6 +98,12 @@
9098
<finish>false</finish>
9199
</logic>
92100
</roleRef>
101+
<roleRef>
102+
<id>view_pos_role</id>
103+
<logic>
104+
<view>true</view>
105+
</logic>
106+
</roleRef>
93107
<actorRef>
94108
<id>assign_pos_ul</id>
95109
<logic>
@@ -138,6 +152,12 @@
138152
<finish>false</finish>
139153
</logic>
140154
</actorRef>
155+
<actorRef>
156+
<id>view_pos_ul</id>
157+
<logic>
158+
<view>true</view>
159+
</logic>
160+
</actorRef>
141161
<dataRef>
142162
<id>text</id>
143163
<logic>

‎application-engine/src/test/resources/workflow_authorization_service_test_with_userRefs.xml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,12 @@
2828
<create>false</create>
2929
</caseLogic>
3030
</roleRef>
31+
<roleRef>
32+
<id>view_pos_role</id>
33+
<caseLogic>
34+
<view>true</view>
35+
</caseLogic>
36+
</roleRef>
3137
<actorRef>
3238
<id>neg_user_list</id>
3339
<caseLogic>
@@ -40,6 +46,12 @@
4046
<delete>true</delete>
4147
</caseLogic>
4248
</actorRef>
49+
<actorRef>
50+
<id>view_actor_list</id>
51+
<caseLogic>
52+
<view>true</view>
53+
</caseLogic>
54+
</actorRef>
4355
<role>
4456
<id>delete_pos_role</id>
4557
<name>delete role</name>
@@ -56,6 +68,10 @@
5668
<id>create_neg_role</id>
5769
<name>create role</name>
5870
</role>
71+
<role>
72+
<id>view_pos_role</id>
73+
<name>view role</name>
74+
</role>
5975
<data type="actorList">
6076
<id>pos_user_list</id>
6177
<title/>
@@ -64,6 +80,10 @@
6480
<id>neg_user_list</id>
6581
<title/>
6682
</data>
83+
<data type="actorList">
84+
<id>view_actor_list</id>
85+
<title/>
86+
</data>
6787
<data type="text">
6888
<id>text</id>
6989
<title>Text</title>

0 commit comments

Comments
 (0)