clean install

web/modules/role_delegation/tests/src/Functional/RoleAssignTest.php

@@ -0,0 +1,211 @@
+<?php
+
+namespace Drupal\Tests\role_delegation\Functional;
+
+use Drupal\Tests\BrowserTestBase;
+
+/**
+ * Functional tests for assigning roles.
+ *
+ * @group role_delegation
+ */
+class RoleAssignTest extends BrowserTestBase {
+
+  /**
+   * Modules to enable.
+   *
+   * @var array
+   */
+  protected static $modules = ['user', 'role_delegation', 'node'];
+
+  /**
+   * {@inheritdoc}
+   */
+  protected $defaultTheme = 'stark';
+
+  /**
+   * Ensure we can only see the roles we have permission to assign.
+   */
+  public function testRoleAccess() {
+    $rid1 = $this->drupalCreateRole([]);
+    $rid2 = $this->drupalCreateRole([]);
+    $rid3 = $this->drupalCreateRole([]);
+
+    // Only 2 of the 3 roles appear on the roles edit page.
+    $current_user = $this->drupalCreateUser([
+      sprintf('assign %s role', $rid1),
+      sprintf('assign %s role', $rid2),
+    ]);
+    $this->drupalLogin($current_user);
+    $account = $this->drupalCreateUser();
+    $this->drupalGet(sprintf('/user/%s/roles', $account->id()));
+    $this->assertSession()->fieldExists(sprintf('role_change[%s]', $rid1));
+    $this->assertSession()->fieldExists(sprintf('role_change[%s]', $rid2));
+    $this->assertSession()->fieldNotExists(sprintf('role_change[%s]', $rid3));
+
+    // A user who can access the real roles field should not see the role
+    // delegation field.
+    $current_user = $this->drupalCreateUser([
+      'administer users',
+      'administer permissions',
+      'assign all roles',
+    ]);
+    $this->drupalLogin($current_user);
+    $this->drupalGet(sprintf('/user/%s/edit', $account->id()));
+    $this->assertSession()->fieldExists(sprintf('roles[%s]', $rid1));
+    $this->assertSession()->fieldNotExists(sprintf('role_change[%s]', $rid1));
+
+    // A user who can edit a user, but does not have access to the real role
+    // field, but can delegate should see the role delegation field.
+    $current_user = $this->drupalCreateUser([
+      'administer users',
+      'assign all roles',
+    ]);
+    $this->drupalLogin($current_user);
+    $this->drupalGet(sprintf('/user/%s/edit', $account->id()));
+    $this->assertSession()->fieldNotExists(sprintf('roles[%s]', $rid1), NULL);
+    $this->assertSession()->fieldExists(sprintf('role_change[%s]', $rid1));
+
+    // Similar, but single role permissions rather than assigning all roles.
+    $current_user = $this->drupalCreateUser([
+      'administer users',
+      sprintf('assign %s role', $rid1),
+    ]);
+    $this->drupalLogin($current_user);
+    $this->drupalGet(sprintf('/user/%s/edit', $account->id()));
+    $this->assertSession()->fieldNotExists(sprintf('roles[%s]', $rid1), NULL);
+    $this->assertSession()->fieldExists(sprintf('role_change[%s]', $rid1));
+    $this->assertSession()->fieldNotExists(sprintf('role_change[%s]', $rid2), NULL);
+  }
+
+  /**
+   * Test that we can assign roles we have access to via the Roles form.
+   */
+  public function testRoleAssignRolesForm() {
+    $user_storage = \Drupal::entityTypeManager()->getStorage('user');
+    // Create a role and login as a user with the permission to assign it.
+    $rid1 = $this->drupalCreateRole([]);
+    $rid2 = $this->drupalCreateRole([]);
+    $current_user = $this->drupalCreateUser([
+      sprintf('assign %s role', $rid1),
+      sprintf('assign %s role', $rid2),
+    ]);
+    $this->drupalLogin($current_user);
+
+    // Go to the users roles edit page.
+    $account = $this->drupalCreateUser();
+    $this->drupalGet(sprintf('/user/%s/roles', $account->id()));
+
+    // The form element field id and name.
+    $field_id = sprintf('edit-role-change-%s', $rid1);
+    $field_name = sprintf('role_change[%s]', $rid1);
+
+    // Ensure its disabled by default.
+    $this->assertSession()->checkboxNotChecked($field_id);
+    self::assertFalse($account->hasPermission('assign $rid1 role'), 'The target user does not have the role by default.');
+    $this->assertSession()->checkboxNotChecked($field_id);
+
+    // Assign the role and ensure its now checked and assigned.
+    $this->submitForm([$field_name => $rid1], 'Save');
+    $user_storage->resetCache();
+    $account = $user_storage->load($account->id());
+    self::assertTrue($account->hasRole($rid1), 'The target user has been granted the role.');
+    $this->assertSession()->checkboxChecked($field_id);
+
+    // Revoke the role.
+    $this->submitForm([$field_name => FALSE], 'Save');
+    $user_storage->resetCache();
+    $account = $user_storage->load($account->id());
+    self::assertFalse($account->hasRole($rid1), 'The target user has gotten the role revoked.');
+    $this->assertSession()->checkboxNotChecked($field_id);
+  }
+
+  /**
+   * Test that we can assign roles we have access to via the user edit form.
+   */
+  public function testRoleAssignUserForm() {
+    $user_storage = \Drupal::entityTypeManager()->getStorage('user');
+    $rid1 = $this->drupalCreateRole([]);
+    $current_user = $this->drupalCreateUser([
+      'administer users',
+      'assign all roles',
+    ]);
+    $this->drupalLogin($current_user);
+
+    // Go to the users roles edit page.
+    $account = $this->drupalCreateUser();
+    $this->drupalGet(sprintf('/user/%s/edit', $account->id()));
+
+    // The form element field id and name.
+    $field_id = sprintf('edit-role-change-%s', $rid1);
+    $field_name = sprintf('role_change[%s]', $rid1);
+
+    // Ensure its disabled by default.
+    self::assertFalse($account->hasPermission(sprintf('assign %s role', $rid1)), 'The target user does not have the role by default.');
+    $this->assertSession()->checkboxNotChecked($field_id);
+
+    // Assign the role and ensure its now checked and assigned.
+    $this->submitForm([$field_name => $rid1], 'Save');
+    $user_storage->resetCache();
+    $account = $user_storage->load($account->id());
+    self::assertTrue($account->hasRole($rid1), 'The target user has been granted the role.');
+    $this->assertSession()->checkboxChecked($field_id);
+
+    // Revoke the role.
+    $this->submitForm([$field_name => FALSE], 'Save');
+    $user_storage->resetCache();
+    $account = $user_storage->load($account->id());
+    self::assertFalse($account->hasRole($rid1), 'The target user has gotten the role revoked.');
+    $this->assertSession()->checkboxNotChecked($field_id);
+  }
+
+  /**
+   * Test that the user has access to the role delegation page.
+   */
+  public function testRoleDelegationPageAccess() {
+    $regular_user = $this->drupalCreateUser();
+
+    // Anonymous users can never access the roles page.
+    $this->drupalGet(sprintf('/user/%s/roles', $regular_user->id()));
+    $this->assertSession()->statusCodeEquals(403);
+
+    // Users with 'administer users' cannot view the page, they must use
+    // the normal user edit page or also 'have assign all roles'.
+    $account = $this->createUser(['administer users']);
+    $this->drupalLogin($account);
+    $this->drupalGet(sprintf('/user/%s/roles', $regular_user->id()));
+    $this->assertSession()->statusCodeEquals(403);
+
+    // Users with 'administer permissions' cannot view the page, they must use
+    // the normal user edit page or also 'have assign all roles'.
+    $account = $this->createUser(['administer permissions']);
+    $this->drupalLogin($account);
+    $this->drupalGet(sprintf('/user/%s/roles', $regular_user->id()));
+    $this->assertSession()->statusCodeEquals(403);
+
+    // Users with a custom 'assign %custom role' permission should be able to
+    // see the role admin page.
+    $role = $this->createRole([]);
+    $account = $this->createUser([sprintf('assign %s role', $role)]);
+    $this->drupalLogin($account);
+    $this->drupalGet(sprintf('/user/%s/roles', $regular_user->id()));
+    $this->assertSession()->statusCodeEquals(200);
+
+    // Users with 'assign all roles' can view the page.
+    $account = $this->createUser(['assign all roles']);
+    $this->drupalLogin($account);
+    $this->drupalGet(sprintf('/user/%s/roles', $regular_user->id()));
+    $this->assertSession()->statusCodeEquals(200);
+  }
+
+  /**
+   * Test access to the "Roles" entity operation.
+   */
+  public function testRoleDelegationEntityOperationAccess() {
+    // Make sure the entity operation is only added to users.
+    $node = $this->drupalCreateNode();
+    $this->drupalGet('/admin/content');
+    $this->assertSession()->linkByHrefNotExists(sprintf('/user/%s/roles', $node->id()));
+  }
+
+}

web/modules/role_delegation/tests/src/Functional/Views/RoleDelegationBulkOperationsTest.php

@@ -0,0 +1,141 @@
+<?php
+
+namespace Drupal\Tests\role_delegation\Functional\Views;
+
+use Drupal\Component\Render\FormattableMarkup;
+use Drupal\system\Entity\Action;
+use Drupal\Tests\BrowserTestBase;
+use Drupal\views\Entity\View;
+
+/**
+ * Functional tests for assigning roles in vbo.
+ *
+ * @group role_delegation
+ */
+class RoleDelegationBulkOperationsTest extends BrowserTestBase {
+
+  /**
+   * Modules to enable.
+   *
+   * @var array
+   */
+  protected static $modules = ['action', 'user', 'role_delegation', 'views'];
+
+  /**
+   * {@inheritdoc}
+   */
+  protected $defaultTheme = 'stark';
+
+  /**
+   * Test if a user is able to edit the allowed roles in VBO.
+   */
+  public function testVboRoleDelegation(): void {
+    $rid1 = $this->drupalCreateRole([]);
+    $rid2 = $this->drupalCreateRole([]);
+    $rid3 = $this->drupalCreateRole([]);
+
+    // User that can assign all roles.
+    $account = $this->createUser(['administer users', 'assign all roles']);
+    $this->drupalLogin($account);
+    $this->drupalGet('/admin/people');
+    $this->assertSession()->optionExists('action', sprintf('user_add_role_action.%s', $rid1));
+    $this->assertSession()->optionExists('action', sprintf('user_add_role_action.%s', $rid2));
+    $this->assertSession()->optionExists('action', sprintf('user_add_role_action.%s', $rid3));
+    $this->assertSession()->optionExists('action', sprintf('user_remove_role_action.%s', $rid1));
+    $this->assertSession()->optionExists('action', sprintf('user_remove_role_action.%s', $rid2));
+    $this->assertSession()->optionExists('action', sprintf('user_remove_role_action.%s', $rid3));
+
+    // User that can assign only role 1.
+    $account = $this->createUser([
+      'administer users',
+      sprintf('assign %s role', $rid1),
+    ]);
+    $this->drupalLogin($account);
+    $this->drupalGet('/admin/people');
+    $this->assertSession()->optionExists('action', sprintf('user_add_role_action.%s', $rid1));
+    $this->assertSession()->optionNotExists('action', sprintf('user_add_role_action.%s', $rid2));
+    $this->assertSession()->optionNotExists('action', sprintf('user_add_role_action.%s', $rid3));
+    $this->assertSession()->optionExists('action', sprintf('user_remove_role_action.%s', $rid1));
+    $this->assertSession()->optionNotExists('action', sprintf('user_remove_role_action.%s', $rid2));
+    $this->assertSession()->optionNotExists('action', sprintf('user_remove_role_action.%s', $rid3));
+
+    // User that can assign role 2 and role 3.
+    $account = $this->createUser([
+      'administer users',
+      sprintf('assign %s role', $rid2),
+      sprintf('assign %s role', $rid3),
+    ]);
+    $this->drupalLogin($account);
+    $this->drupalGet('/admin/people');
+    $this->assertSession()->optionNotExists('action', sprintf('user_add_role_action.%s', $rid1));
+    $this->assertSession()->optionExists('action', sprintf('user_add_role_action.%s', $rid2));
+    $this->assertSession()->optionExists('action', sprintf('user_add_role_action.%s', $rid3));
+    $this->assertSession()->optionNotExists('action', sprintf('user_remove_role_action.%s', $rid1));
+    $this->assertSession()->optionExists('action', sprintf('user_remove_role_action.%s', $rid2));
+    $this->assertSession()->optionExists('action', sprintf('user_remove_role_action.%s', $rid3));
+  }
+
+  /**
+   * Test VBO still works without the "administer users" permission.
+   */
+  public function testVboRoleDelegationWithoutAdministerUsersPermission(): void {
+    /** @var \Drupal\views\Entity\View $view */
+    $view = View::load('user_admin_people');
+    $display = &$view->getDisplay('default');
+
+    $display['display_options']['access']['options']['perm'] = 'access administration pages';
+    $view->save();
+
+    $this->container->get('router.builder')->rebuildIfNeeded();
+
+    $rid1 = $this->drupalCreateRole([]);
+    $rid2 = $this->drupalCreateRole([]);
+
+    $account = $this->createUser([
+      'access administration pages',
+      sprintf('assign %s role', $rid1),
+      sprintf('assign %s role', $rid2),
+    ]);
+    $this->drupalLogin($account);
+
+    $this->drupalGet('/admin/people');
+    $this->assertSession()->statusCodeEquals(200);
+
+    $this->submitForm([
+      'action' => 'user_add_role_action.' . $rid1,
+      'user_bulk_form[1]' => TRUE,
+    ],
+      'Apply to selected items'
+    );
+
+    $add_action = Action::load('user_add_role_action.' . $rid1);
+    $this->assertSession()->responseNotContains(new FormattableMarkup('No access to execute %action on the @entity_type_label %entity_label.', [
+      '%action' => $add_action->label(),
+      '@entity_type_label' => 'User',
+      '%entity_label' => $account->label(),
+    ]));
+    $this->assertSession()->responseContains(new FormattableMarkup('%action was applied to @count item.', [
+      '%action' => $add_action->label(),
+      '@count' => 1,
+    ]));
+
+    $this->submitForm([
+      'action' => 'user_remove_role_action.' . $rid2,
+      'user_bulk_form[1]' => TRUE,
+    ],
+      'Apply to selected items'
+    );
+
+    $remove_action = Action::load('user_remove_role_action.' . $rid2);
+    $this->assertSession()->responseNotContains(new FormattableMarkup('No access to execute %action on the @entity_type_label %entity_label.', [
+      '%action' => $remove_action->label(),
+      '@entity_type_label' => 'User',
+      '%entity_label' => $account->label(),
+    ]));
+    $this->assertSession()->responseContains(new FormattableMarkup('%action was applied to @count item.', [
+      '%action' => $remove_action->label(),
+      '@count' => 1,
+    ]));
+  }
+
+}

web/modules/role_delegation/tests/src/Kernel/AccessTest.php

@@ -0,0 +1,71 @@
+<?php
+
+namespace Drupal\Tests\role_delegation\Kernel;
+
+use Drupal\KernelTests\KernelTestBase;
+use Drupal\Tests\user\Traits\UserCreationTrait;
+
+/**
+ * @coversDefaultClass \Drupal\role_delegation\Access\RoleDelegationAccessCheck
+ *
+ * @group role_delegation
+ */
+class AccessTest extends KernelTestBase {
+
+  use UserCreationTrait;
+
+  /**
+   * The modules to enable for this test.
+   *
+   * @var array
+   */
+  protected static $modules = ['system', 'role_delegation', 'user'];
+
+  /**
+   * The Role Delegation access checker.
+   *
+   * @var \Drupal\role_delegation\Access\RoleDelegationAccessCheck
+   */
+  protected $accessChecker;
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function setUp(): void {
+    parent::setUp();
+    $this->installSchema('system', 'sequences');
+    $this->installEntitySchema('user');
+    $this->accessChecker = $this->container->get('access_check.role_delegation');
+
+    // User 1 is still a super user so we create that user first so moving
+    // forward we're just using normal users.
+    $this->createUser();
+  }
+
+  /**
+   * Test the access checker for user/%/roles.
+   *
+   * @covers ::access
+   */
+  public function testRoleDelegationAccess() {
+    // Anonymous users can never access the roles page.
+    $account = $this->createUser();
+    $this->assertEquals(FALSE, $this->accessChecker->access($account)->isAllowed());
+
+    // Users with "administer permissions" cannot view the page, they must use
+    // the normal user edit page or also "have assign all roles".
+    $account = $this->createUser(['administer permissions']);
+    $this->assertEquals(FALSE, $this->accessChecker->access($account)->isAllowed());
+
+    // Users with a custom "assign %custom role" permission should be able to
+    // see the role admin page.
+    $role = $this->createRole([]);
+    $account = $this->createUser([sprintf('assign %s role', $role)]);
+    $this->assertEquals(TRUE, $this->accessChecker->access($account)->isAllowed());
+
+    // Users with 'assign all roles' can view the page.
+    $account = $this->createUser(['assign all roles']);
+    $this->assertEquals(TRUE, $this->accessChecker->access($account)->isAllowed());
+  }
+
+}

web/modules/role_delegation/tests/src/Kernel/DelegatableRolesTest.php

@@ -0,0 +1,96 @@
+<?php
+
+namespace Drupal\Tests\role_delegation\Kernel;
+
+use Drupal\KernelTests\KernelTestBase;
+use Drupal\Tests\user\Traits\UserCreationTrait;
+use Drupal\user\Entity\Role;
+
+/**
+ * @coversDefaultClass \Drupal\role_delegation\DelegatableRoles
+ *
+ * @group role_delegation
+ */
+class DelegatableRolesTest extends KernelTestBase {
+
+  use UserCreationTrait;
+
+  /**
+   * The modules to enable for this test.
+   *
+   * @var array
+   */
+  protected static $modules = ['system', 'role_delegation', 'user'];
+
+  /**
+   * The Role Delegation service.
+   *
+   * @var \Drupal\role_delegation\DelegatableRolesInterface
+   */
+  protected $delegatableRoles;
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function setUp(): void {
+    parent::setUp();
+    $this->installSchema('system', 'sequences');
+    $this->installEntitySchema('user');
+    $this->delegatableRoles = $this->container->get('delegatable_roles');
+
+    // User 1 is still a super user so we create that user first so moving
+    // forward we're just using normal users.
+    $this->createUser();
+  }
+
+  /**
+   * Test the roles that can be assigned by a given user.
+   *
+   * @covers ::getAssignableRoles
+   */
+  public function testAssignableRoles() {
+    $rid1 = $this->createRole([]);
+    $rid2 = $this->createRole([]);
+    $rid3 = $this->createRole([]);
+
+    // Test the 'assign all roles permission'. We have to merge in the roles of
+    // the account as well because createUser() creates a new role.
+    $account = $this->createUser(['assign all roles']);
+    $this->assertEquals(array_merge([$rid1, $rid2, $rid3], $account->getRoles(TRUE)), array_keys($this->delegatableRoles->getAssignableRoles($account)));
+
+    // If they have these two roles, they can assign exactly those two roles.
+    $account = $this->createUser(["assign $rid1 role", "assign $rid2 role"]);
+    $this->assertEquals([$rid1, $rid2], array_keys($this->delegatableRoles->getAssignableRoles($account)));
+
+    // Doesn't matter what permissions they have here, they can never assign
+    // anonymous or authenticated roles.
+    $account = $this->createUser(['administer users', 'administer permissions']);
+    $this->assertEquals([], $this->delegatableRoles->getAssignableRoles($account));
+  }
+
+  /**
+   * Test the all roles methods filters special roles.
+   *
+   * @covers ::getAllRoles
+   */
+  public function testGetAllRoles() {
+    $rid1 = $this->createRole([]);
+    $rid2 = $this->createRole([]);
+    $this->assertEquals([$rid1, $rid2], array_keys($this->delegatableRoles->getAllRoles()));
+  }
+
+  /**
+   * Deleting a role revokes the permission allowing users to assign the role.
+   */
+  public function testDeleteRole() {
+    $rid = $this->createRole([]);
+    $permission = "assign $rid role";
+    $account = $this->createUser([$permission]);
+    $this->assertTrue($account->hasPermission($permission), sprintf('User has "%s" permission.', $permission));
+
+    // Delete the role and ensure the user no longer has the permission.
+    Role::load($rid)->delete();
+    $this->assertFalse($account->hasPermission($permission), sprintf('User no longer has "%s" permission.', $permission));
+  }
+
+}