server/test/unittest_security.py
author Sylvain Thénault <sylvain.thenault@logilab.fr>
Thu, 07 Jul 2011 16:22:08 +0200
changeset 7629 58f11f7dad68
parent 7398 26695dd703d8
child 7791 31bb51ea5485
permissions -rw-r--r--
[range facet] closes #1806937: simply retrieve min/max values when computing vocabulary/possible_values, this is enough
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
5421
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5419
diff changeset
     1
# copyright 2003-2010 LOGILAB S.A. (Paris, FRANCE), all rights reserved.
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5419
diff changeset
     2
# contact http://www.logilab.fr/ -- mailto:contact@logilab.fr
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5419
diff changeset
     3
#
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5419
diff changeset
     4
# This file is part of CubicWeb.
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5419
diff changeset
     5
#
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5419
diff changeset
     6
# CubicWeb is free software: you can redistribute it and/or modify it under the
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5419
diff changeset
     7
# terms of the GNU Lesser General Public License as published by the Free
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5419
diff changeset
     8
# Software Foundation, either version 2.1 of the License, or (at your option)
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5419
diff changeset
     9
# any later version.
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5419
diff changeset
    10
#
5424
8ecbcbff9777 replace logilab-common by CubicWeb in disclaimer
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5421
diff changeset
    11
# CubicWeb is distributed in the hope that it will be useful, but WITHOUT
5421
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5419
diff changeset
    12
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5419
diff changeset
    13
# FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5419
diff changeset
    14
# details.
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5419
diff changeset
    15
#
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5419
diff changeset
    16
# You should have received a copy of the GNU Lesser General Public License along
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5419
diff changeset
    17
# with CubicWeb.  If not, see <http://www.gnu.org/licenses/>.
5886
00a78298d30d cleanups
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5426
diff changeset
    18
"""functional tests for server'security"""
00a78298d30d cleanups
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5426
diff changeset
    19
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    20
import sys
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    21
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    22
from logilab.common.testlib import unittest_main, TestCase
2773
b2530e3e0afb [testlib] #345052 and #344207: major test lib refactoring/cleanup + update usage
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2608
diff changeset
    23
from cubicweb.devtools.testlib import CubicWebTC
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    24
6410
2e7a7b0829ed [test] fix tests broken by transaction behaviour on Unauthorized/ValidationError (no rollback but connection marked as non-commitable)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6340
diff changeset
    25
from cubicweb import Unauthorized, ValidationError, QueryError
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    26
from cubicweb.server.querier import check_read_access
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    27
2773
b2530e3e0afb [testlib] #345052 and #344207: major test lib refactoring/cleanup + update usage
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2608
diff changeset
    28
class BaseSecurityTC(CubicWebTC):
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    29
7072
bcf96f2a4c5d [test] properly close connections
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6410
diff changeset
    30
    def setup_database(self):
bcf96f2a4c5d [test] properly close connections
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6410
diff changeset
    31
        super(BaseSecurityTC, self).setup_database()
7244
a918f76441ce fix tests broken by fcb8932082a5 (continued)
Alexandre Fayolle <alexandre.fayolle@logilab.fr>
parents: 7078
diff changeset
    32
        req = self.request()
a918f76441ce fix tests broken by fcb8932082a5 (continued)
Alexandre Fayolle <alexandre.fayolle@logilab.fr>
parents: 7078
diff changeset
    33
        self.create_user(req, 'iaminusersgrouponly')
7078
bad26a22fe29 [test] New Handling of database for test.
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 7072
diff changeset
    34
        readoriggroups = self.schema['Personne'].permissions['read']
bad26a22fe29 [test] New Handling of database for test.
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 7072
diff changeset
    35
        addoriggroups = self.schema['Personne'].permissions['add']
bad26a22fe29 [test] New Handling of database for test.
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 7072
diff changeset
    36
        def fix_perm():
bad26a22fe29 [test] New Handling of database for test.
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 7072
diff changeset
    37
            self.schema['Personne'].set_action_permissions('read', readoriggroups)
bad26a22fe29 [test] New Handling of database for test.
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 7072
diff changeset
    38
            self.schema['Personne'].set_action_permissions('add', addoriggroups)
bad26a22fe29 [test] New Handling of database for test.
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 7072
diff changeset
    39
        self.addCleanup(fix_perm)
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    40
1802
d628defebc17 delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents: 1398
diff changeset
    41
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    42
class LowLevelSecurityFunctionTC(BaseSecurityTC):
1802
d628defebc17 delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents: 1398
diff changeset
    43
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    44
    def test_check_read_access(self):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    45
        rql = u'Personne U where U nom "managers"'
3252
c0e10da6f1cf tests update
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2920
diff changeset
    46
        rqlst = self.repo.vreg.rqlhelper.parse(rql).children[0]
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    47
        origgroups = self.schema['Personne'].get_groups('read')
3877
7ca53fc72a0a reldefsecurity branch :
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3252
diff changeset
    48
        self.schema['Personne'].set_action_permissions('read', ('users', 'managers'))
4711
7ef3b029e10b [test] we should properly use vreg method to compute solutions
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4691
diff changeset
    49
        self.repo.vreg.solutions(self.session, rqlst, None)
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    50
        solution = rqlst.solutions[0]
5419
0b7805928a27 [repo security] deal with rewriten constant nodes in check_read_access, necessary when repo is used as an external source
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4915
diff changeset
    51
        check_read_access(self.session, rqlst, solution, {})
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    52
        cnx = self.login('anon')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    53
        cu = cnx.cursor()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    54
        self.assertRaises(Unauthorized,
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    55
                          check_read_access,
5419
0b7805928a27 [repo security] deal with rewriten constant nodes in check_read_access, necessary when repo is used as an external source
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4915
diff changeset
    56
                          self.session, rqlst, solution, {})
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    57
        self.assertRaises(Unauthorized, cu.execute, rql)
1802
d628defebc17 delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents: 1398
diff changeset
    58
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    59
    def test_upassword_not_selectable(self):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    60
        self.assertRaises(Unauthorized,
1398
5fe84a5f7035 rename internal entity types to have CW prefix instead of E
sylvain.thenault@logilab.fr
parents: 389
diff changeset
    61
                          self.execute, 'Any X,P WHERE X is CWUser, X upassword P')
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    62
        self.rollback()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    63
        cnx = self.login('iaminusersgrouponly')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    64
        cu = cnx.cursor()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    65
        self.assertRaises(Unauthorized,
1398
5fe84a5f7035 rename internal entity types to have CW prefix instead of E
sylvain.thenault@logilab.fr
parents: 389
diff changeset
    66
                          cu.execute, 'Any X,P WHERE X is CWUser, X upassword P')
1802
d628defebc17 delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents: 1398
diff changeset
    67
d628defebc17 delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents: 1398
diff changeset
    68
5888
3ee80d487f11 [security] fix read rql expression insertion: we should not insert rql expr on variables only referenced in neged relation
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5886
diff changeset
    69
class SecurityRewritingTC(BaseSecurityTC):
3ee80d487f11 [security] fix read rql expression insertion: we should not insert rql expr on variables only referenced in neged relation
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5886
diff changeset
    70
    def hijack_source_execute(self):
3ee80d487f11 [security] fix read rql expression insertion: we should not insert rql expr on variables only referenced in neged relation
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5886
diff changeset
    71
        def syntax_tree_search(*args, **kwargs):
3ee80d487f11 [security] fix read rql expression insertion: we should not insert rql expr on variables only referenced in neged relation
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5886
diff changeset
    72
            self.query = (args, kwargs)
3ee80d487f11 [security] fix read rql expression insertion: we should not insert rql expr on variables only referenced in neged relation
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5886
diff changeset
    73
            return []
3ee80d487f11 [security] fix read rql expression insertion: we should not insert rql expr on variables only referenced in neged relation
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5886
diff changeset
    74
        self.repo.system_source.syntax_tree_search = syntax_tree_search
3ee80d487f11 [security] fix read rql expression insertion: we should not insert rql expr on variables only referenced in neged relation
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5886
diff changeset
    75
3ee80d487f11 [security] fix read rql expression insertion: we should not insert rql expr on variables only referenced in neged relation
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5886
diff changeset
    76
    def tearDown(self):
3ee80d487f11 [security] fix read rql expression insertion: we should not insert rql expr on variables only referenced in neged relation
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5886
diff changeset
    77
        self.repo.system_source.__dict__.pop('syntax_tree_search', None)
7072
bcf96f2a4c5d [test] properly close connections
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6410
diff changeset
    78
        super(SecurityRewritingTC, self).tearDown()
5888
3ee80d487f11 [security] fix read rql expression insertion: we should not insert rql expr on variables only referenced in neged relation
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5886
diff changeset
    79
3ee80d487f11 [security] fix read rql expression insertion: we should not insert rql expr on variables only referenced in neged relation
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5886
diff changeset
    80
    def test_not_relation_read_security(self):
3ee80d487f11 [security] fix read rql expression insertion: we should not insert rql expr on variables only referenced in neged relation
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5886
diff changeset
    81
        cnx = self.login('iaminusersgrouponly')
3ee80d487f11 [security] fix read rql expression insertion: we should not insert rql expr on variables only referenced in neged relation
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5886
diff changeset
    82
        self.hijack_source_execute()
3ee80d487f11 [security] fix read rql expression insertion: we should not insert rql expr on variables only referenced in neged relation
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5886
diff changeset
    83
        self.execute('Any U WHERE NOT A todo_by U, A is Affaire')
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
    84
        self.assertEqual(self.query[0][1].as_string(),
5888
3ee80d487f11 [security] fix read rql expression insertion: we should not insert rql expr on variables only referenced in neged relation
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5886
diff changeset
    85
                          'Any U WHERE NOT EXISTS(A todo_by U), A is Affaire')
3ee80d487f11 [security] fix read rql expression insertion: we should not insert rql expr on variables only referenced in neged relation
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5886
diff changeset
    86
        self.execute('Any U WHERE NOT EXISTS(A todo_by U), A is Affaire')
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
    87
        self.assertEqual(self.query[0][1].as_string(),
5888
3ee80d487f11 [security] fix read rql expression insertion: we should not insert rql expr on variables only referenced in neged relation
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5886
diff changeset
    88
                          'Any U WHERE NOT EXISTS(A todo_by U), A is Affaire')
7072
bcf96f2a4c5d [test] properly close connections
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6410
diff changeset
    89
        cnx.close()
5888
3ee80d487f11 [security] fix read rql expression insertion: we should not insert rql expr on variables only referenced in neged relation
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5886
diff changeset
    90
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    91
class SecurityTC(BaseSecurityTC):
1802
d628defebc17 delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents: 1398
diff changeset
    92
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    93
    def setUp(self):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    94
        BaseSecurityTC.setUp(self)
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    95
        # implicitly test manager can add some entities
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    96
        self.execute("INSERT Affaire X: X sujet 'cool'")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    97
        self.execute("INSERT Societe X: X nom 'logilab'")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    98
        self.execute("INSERT Personne X: X nom 'bidule'")
1398
5fe84a5f7035 rename internal entity types to have CW prefix instead of E
sylvain.thenault@logilab.fr
parents: 389
diff changeset
    99
        self.execute('INSERT CWGroup X: X name "staff"')
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   100
        self.commit()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   101
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   102
    def test_insert_security(self):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   103
        cnx = self.login('anon')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   104
        cu = cnx.cursor()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   105
        cu.execute("INSERT Personne X: X nom 'bidule'")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   106
        self.assertRaises(Unauthorized, cnx.commit)
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   107
        self.assertEqual(cu.execute('Personne X').rowcount, 1)
7072
bcf96f2a4c5d [test] properly close connections
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6410
diff changeset
   108
        cnx.close()
1802
d628defebc17 delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents: 1398
diff changeset
   109
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   110
    def test_insert_rql_permission(self):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   111
        # test user can only add une affaire related to a societe he owns
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   112
        cnx = self.login('iaminusersgrouponly')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   113
        cu = cnx.cursor()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   114
        cu.execute("INSERT Affaire X: X sujet 'cool'")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   115
        self.assertRaises(Unauthorized, cnx.commit)
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   116
        # test nothing has actually been inserted
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   117
        self.restore_connection()
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   118
        self.assertEqual(self.execute('Affaire X').rowcount, 1)
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   119
        cnx = self.login('iaminusersgrouponly')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   120
        cu = cnx.cursor()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   121
        cu.execute("INSERT Affaire X: X sujet 'cool'")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   122
        cu.execute("INSERT Societe X: X nom 'chouette'")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   123
        cu.execute("SET A concerne S WHERE A sujet 'cool', S nom 'chouette'")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   124
        cnx.commit()
7072
bcf96f2a4c5d [test] properly close connections
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6410
diff changeset
   125
        cnx.close()
1802
d628defebc17 delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents: 1398
diff changeset
   126
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   127
    def test_update_security_1(self):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   128
        cnx = self.login('anon')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   129
        cu = cnx.cursor()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   130
        # local security check
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   131
        cu.execute( "SET X nom 'bidulechouette' WHERE X is Personne")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   132
        self.assertRaises(Unauthorized, cnx.commit)
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   133
        self.restore_connection()
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   134
        self.assertEqual(self.execute('Personne X WHERE X nom "bidulechouette"').rowcount, 0)
1802
d628defebc17 delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents: 1398
diff changeset
   135
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   136
    def test_update_security_2(self):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   137
        cnx = self.login('anon')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   138
        cu = cnx.cursor()
3877
7ca53fc72a0a reldefsecurity branch :
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3252
diff changeset
   139
        self.repo.schema['Personne'].set_action_permissions('read', ('users', 'managers'))
7ca53fc72a0a reldefsecurity branch :
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3252
diff changeset
   140
        self.repo.schema['Personne'].set_action_permissions('add', ('guests', 'users', 'managers'))
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   141
        self.assertRaises(Unauthorized, cu.execute, "SET X nom 'bidulechouette' WHERE X is Personne")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   142
        #self.assertRaises(Unauthorized, cnx.commit)
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   143
        # test nothing has actually been inserted
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   144
        self.restore_connection()
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   145
        self.assertEqual(self.execute('Personne X WHERE X nom "bidulechouette"').rowcount, 0)
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   146
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   147
    def test_update_security_3(self):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   148
        cnx = self.login('iaminusersgrouponly')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   149
        cu = cnx.cursor()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   150
        cu.execute("INSERT Personne X: X nom 'biduuule'")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   151
        cu.execute("INSERT Societe X: X nom 'looogilab'")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   152
        cu.execute("SET X travaille S WHERE X nom 'biduuule', S nom 'looogilab'")
7072
bcf96f2a4c5d [test] properly close connections
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6410
diff changeset
   153
        cnx.close()
1802
d628defebc17 delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents: 1398
diff changeset
   154
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   155
    def test_update_rql_permission(self):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   156
        self.execute("SET A concerne S WHERE A is Affaire, S is Societe")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   157
        self.commit()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   158
        # test user can only update une affaire related to a societe he owns
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   159
        cnx = self.login('iaminusersgrouponly')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   160
        cu = cnx.cursor()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   161
        cu.execute("SET X sujet 'pascool' WHERE X is Affaire")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   162
        # this won't actually do anything since the selection query won't return anything
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   163
        cnx.commit()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   164
        # to actually get Unauthorized exception, try to update an entity we can read
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   165
        cu.execute("SET X nom 'toto' WHERE X is Societe")
1802
d628defebc17 delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents: 1398
diff changeset
   166
        self.assertRaises(Unauthorized, cnx.commit)
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   167
        cu.execute("INSERT Affaire X: X sujet 'pascool'")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   168
        cu.execute("INSERT Societe X: X nom 'chouette'")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   169
        cu.execute("SET A concerne S WHERE A sujet 'pascool', S nom 'chouette'")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   170
        cu.execute("SET X sujet 'habahsicestcool' WHERE X sujet 'pascool'")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   171
        cnx.commit()
7072
bcf96f2a4c5d [test] properly close connections
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6410
diff changeset
   172
        cnx.close()
1802
d628defebc17 delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents: 1398
diff changeset
   173
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   174
    def test_delete_security(self):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   175
        # FIXME: sample below fails because we don't detect "owner" can't delete
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   176
        # user anyway, and since no user with login == 'bidule' exists, no
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   177
        # exception is raised
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   178
        #user._groups = {'guests':1}
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   179
        #self.assertRaises(Unauthorized,
1398
5fe84a5f7035 rename internal entity types to have CW prefix instead of E
sylvain.thenault@logilab.fr
parents: 389
diff changeset
   180
        #                  self.o.execute, user, "DELETE CWUser X WHERE X login 'bidule'")
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   181
        # check local security
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   182
        cnx = self.login('iaminusersgrouponly')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   183
        cu = cnx.cursor()
1398
5fe84a5f7035 rename internal entity types to have CW prefix instead of E
sylvain.thenault@logilab.fr
parents: 389
diff changeset
   184
        self.assertRaises(Unauthorized, cu.execute, "DELETE CWGroup Y WHERE Y name 'staff'")
7072
bcf96f2a4c5d [test] properly close connections
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6410
diff changeset
   185
        cnx.close()
1802
d628defebc17 delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents: 1398
diff changeset
   186
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   187
    def test_delete_rql_permission(self):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   188
        self.execute("SET A concerne S WHERE A is Affaire, S is Societe")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   189
        self.commit()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   190
        # test user can only dele une affaire related to a societe he owns
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   191
        cnx = self.login('iaminusersgrouponly')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   192
        cu = cnx.cursor()
1802
d628defebc17 delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents: 1398
diff changeset
   193
        # this won't actually do anything since the selection query won't return anything
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   194
        cu.execute("DELETE Affaire X")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   195
        cnx.commit()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   196
        # to actually get Unauthorized exception, try to delete an entity we can read
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   197
        self.assertRaises(Unauthorized, cu.execute, "DELETE Societe S")
6410
2e7a7b0829ed [test] fix tests broken by transaction behaviour on Unauthorized/ValidationError (no rollback but connection marked as non-commitable)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6340
diff changeset
   198
        self.assertRaises(QueryError, cnx.commit) # can't commit anymore
2e7a7b0829ed [test] fix tests broken by transaction behaviour on Unauthorized/ValidationError (no rollback but connection marked as non-commitable)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6340
diff changeset
   199
        cnx.rollback() # required after Unauthorized
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   200
        cu.execute("INSERT Affaire X: X sujet 'pascool'")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   201
        cu.execute("INSERT Societe X: X nom 'chouette'")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   202
        cu.execute("SET A concerne S WHERE A sujet 'pascool', S nom 'chouette'")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   203
        cnx.commit()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   204
##         # this one should fail since it will try to delete two affaires, one authorized
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   205
##         # and the other not
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   206
##         self.assertRaises(Unauthorized, cu.execute, "DELETE Affaire X")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   207
        cu.execute("DELETE Affaire X WHERE X sujet 'pascool'")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   208
        cnx.commit()
7072
bcf96f2a4c5d [test] properly close connections
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6410
diff changeset
   209
        cnx.close()
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   210
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   211
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   212
    def test_insert_relation_rql_permission(self):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   213
        cnx = self.login('iaminusersgrouponly')
2773
b2530e3e0afb [testlib] #345052 and #344207: major test lib refactoring/cleanup + update usage
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2608
diff changeset
   214
        session = self.session
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   215
        cu = cnx.cursor(session)
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   216
        cu.execute("SET A concerne S WHERE A is Affaire, S is Societe")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   217
        # should raise Unauthorized since user don't own S
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   218
        # though this won't actually do anything since the selection query won't return anything
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   219
        cnx.commit()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   220
        # to actually get Unauthorized exception, try to insert a relation were we can read both entities
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   221
        rset = cu.execute('Personne P')
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   222
        self.assertEqual(len(rset), 1)
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   223
        ent = rset.get_entity(0, 0)
7398
26695dd703d8 [repository api] definitly kill usage of word 'pool' to refer to connections set used by a session
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 7244
diff changeset
   224
        session.set_cnxset() # necessary
5557
1a534c596bff [entity] continue cleanup of Entity/AnyEntity namespace
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5556
diff changeset
   225
        self.assertRaises(Unauthorized, ent.cw_check_perm, 'update')
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   226
        self.assertRaises(Unauthorized,
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   227
                          cu.execute, "SET P travaille S WHERE P is Personne, S is Societe")
6410
2e7a7b0829ed [test] fix tests broken by transaction behaviour on Unauthorized/ValidationError (no rollback but connection marked as non-commitable)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6340
diff changeset
   228
        self.assertRaises(QueryError, cnx.commit) # can't commit anymore
2e7a7b0829ed [test] fix tests broken by transaction behaviour on Unauthorized/ValidationError (no rollback but connection marked as non-commitable)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6340
diff changeset
   229
        cnx.rollback()
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   230
        # test nothing has actually been inserted:
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   231
        self.assertEqual(cu.execute('Any P,S WHERE P travaille S,P is Personne, S is Societe').rowcount, 0)
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   232
        cu.execute("INSERT Societe X: X nom 'chouette'")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   233
        cu.execute("SET A concerne S WHERE A is Affaire, S nom 'chouette'")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   234
        cnx.commit()
7072
bcf96f2a4c5d [test] properly close connections
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6410
diff changeset
   235
        cnx.close()
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   236
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   237
    def test_delete_relation_rql_permission(self):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   238
        self.execute("SET A concerne S WHERE A is Affaire, S is Societe")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   239
        self.commit()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   240
        cnx = self.login('iaminusersgrouponly')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   241
        cu = cnx.cursor()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   242
        # this won't actually do anything since the selection query won't return anything
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   243
        cu.execute("DELETE A concerne S")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   244
        cnx.commit()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   245
        # to actually get Unauthorized exception, try to delete a relation we can read
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   246
        self.restore_connection()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   247
        eid = self.execute("INSERT Affaire X: X sujet 'pascool'")[0][0]
5174
78438ad513ca #759035: Automate addition of eid cachekey in RQL analysis
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4915
diff changeset
   248
        self.execute('SET X owned_by U WHERE X eid %(x)s, U login "iaminusersgrouponly"', {'x': eid})
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   249
        self.execute("SET A concerne S WHERE A sujet 'pascool', S is Societe")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   250
        self.commit()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   251
        cnx = self.login('iaminusersgrouponly')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   252
        cu = cnx.cursor()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   253
        self.assertRaises(Unauthorized, cu.execute, "DELETE A concerne S")
6410
2e7a7b0829ed [test] fix tests broken by transaction behaviour on Unauthorized/ValidationError (no rollback but connection marked as non-commitable)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6340
diff changeset
   254
        self.assertRaises(QueryError, cnx.commit) # can't commit anymore
2e7a7b0829ed [test] fix tests broken by transaction behaviour on Unauthorized/ValidationError (no rollback but connection marked as non-commitable)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6340
diff changeset
   255
        cnx.rollback() # required after Unauthorized
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   256
        cu.execute("INSERT Societe X: X nom 'chouette'")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   257
        cu.execute("SET A concerne S WHERE A is Affaire, S nom 'chouette'")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   258
        cnx.commit()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   259
        cu.execute("DELETE A concerne S WHERE S nom 'chouette'")
7072
bcf96f2a4c5d [test] properly close connections
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6410
diff changeset
   260
        cnx.close()
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   261
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   262
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   263
    def test_user_can_change_its_upassword(self):
7244
a918f76441ce fix tests broken by fcb8932082a5 (continued)
Alexandre Fayolle <alexandre.fayolle@logilab.fr>
parents: 7078
diff changeset
   264
        req = self.request()
a918f76441ce fix tests broken by fcb8932082a5 (continued)
Alexandre Fayolle <alexandre.fayolle@logilab.fr>
parents: 7078
diff changeset
   265
        ueid = self.create_user(req, 'user').eid
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   266
        cnx = self.login('user')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   267
        cu = cnx.cursor()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   268
        cu.execute('SET X upassword %(passwd)s WHERE X eid %(x)s',
5174
78438ad513ca #759035: Automate addition of eid cachekey in RQL analysis
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4915
diff changeset
   269
                   {'x': ueid, 'passwd': 'newpwd'})
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   270
        cnx.commit()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   271
        cnx.close()
4191
01638461d4b0 test update. All cw tests OK
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3890
diff changeset
   272
        cnx = self.login('user', password='newpwd')
7072
bcf96f2a4c5d [test] properly close connections
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6410
diff changeset
   273
        cnx.close()
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   274
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   275
    def test_user_cant_change_other_upassword(self):
7244
a918f76441ce fix tests broken by fcb8932082a5 (continued)
Alexandre Fayolle <alexandre.fayolle@logilab.fr>
parents: 7078
diff changeset
   276
        req = self.request()
a918f76441ce fix tests broken by fcb8932082a5 (continued)
Alexandre Fayolle <alexandre.fayolle@logilab.fr>
parents: 7078
diff changeset
   277
        ueid = self.create_user(req, 'otheruser').eid
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   278
        cnx = self.login('iaminusersgrouponly')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   279
        cu = cnx.cursor()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   280
        cu.execute('SET X upassword %(passwd)s WHERE X eid %(x)s',
5174
78438ad513ca #759035: Automate addition of eid cachekey in RQL analysis
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4915
diff changeset
   281
                   {'x': ueid, 'passwd': 'newpwd'})
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   282
        self.assertRaises(Unauthorized, cnx.commit)
7072
bcf96f2a4c5d [test] properly close connections
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6410
diff changeset
   283
        cnx.close()
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   284
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   285
    # read security test
1802
d628defebc17 delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents: 1398
diff changeset
   286
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   287
    def test_read_base(self):
3877
7ca53fc72a0a reldefsecurity branch :
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3252
diff changeset
   288
        self.schema['Personne'].set_action_permissions('read', ('users', 'managers'))
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   289
        cnx = self.login('anon')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   290
        cu = cnx.cursor()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   291
        self.assertRaises(Unauthorized,
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   292
                          cu.execute, 'Personne U where U nom "managers"')
7072
bcf96f2a4c5d [test] properly close connections
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6410
diff changeset
   293
        cnx.close()
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   294
321
247947250382 fix security bug w/ query using 'NOT X eid 123'
Sylvain Thenault <sylvain.thenault@logilab.fr>
parents: 0
diff changeset
   295
    def test_read_erqlexpr_base(self):
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   296
        eid = self.execute("INSERT Affaire X: X sujet 'cool'")[0][0]
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   297
        self.commit()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   298
        cnx = self.login('iaminusersgrouponly')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   299
        cu = cnx.cursor()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   300
        rset = cu.execute('Affaire X')
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   301
        self.assertEqual(rset.rows, [])
5174
78438ad513ca #759035: Automate addition of eid cachekey in RQL analysis
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4915
diff changeset
   302
        self.assertRaises(Unauthorized, cu.execute, 'Any X WHERE X eid %(x)s', {'x': eid})
321
247947250382 fix security bug w/ query using 'NOT X eid 123'
Sylvain Thenault <sylvain.thenault@logilab.fr>
parents: 0
diff changeset
   303
        # cache test
5174
78438ad513ca #759035: Automate addition of eid cachekey in RQL analysis
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4915
diff changeset
   304
        self.assertRaises(Unauthorized, cu.execute, 'Any X WHERE X eid %(x)s', {'x': eid})
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   305
        aff2 = cu.execute("INSERT Affaire X: X sujet 'cool'")[0][0]
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   306
        soc1 = cu.execute("INSERT Societe X: X nom 'chouette'")[0][0]
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   307
        cu.execute("SET A concerne S WHERE A is Affaire, S is Societe")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   308
        cnx.commit()
5174
78438ad513ca #759035: Automate addition of eid cachekey in RQL analysis
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4915
diff changeset
   309
        rset = cu.execute('Any X WHERE X eid %(x)s', {'x': aff2})
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   310
        self.assertEqual(rset.rows, [[aff2]])
321
247947250382 fix security bug w/ query using 'NOT X eid 123'
Sylvain Thenault <sylvain.thenault@logilab.fr>
parents: 0
diff changeset
   311
        # more cache test w/ NOT eid
5174
78438ad513ca #759035: Automate addition of eid cachekey in RQL analysis
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4915
diff changeset
   312
        rset = cu.execute('Affaire X WHERE NOT X eid %(x)s', {'x': eid})
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   313
        self.assertEqual(rset.rows, [[aff2]])
5174
78438ad513ca #759035: Automate addition of eid cachekey in RQL analysis
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4915
diff changeset
   314
        rset = cu.execute('Affaire X WHERE NOT X eid %(x)s', {'x': aff2})
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   315
        self.assertEqual(rset.rows, [])
4765
c33d12865641 more tests
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4711
diff changeset
   316
        # test can't update an attribute of an entity that can't be readen
5174
78438ad513ca #759035: Automate addition of eid cachekey in RQL analysis
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4915
diff changeset
   317
        self.assertRaises(Unauthorized, cu.execute, 'SET X sujet "hacked" WHERE X eid %(x)s', {'x': eid})
7072
bcf96f2a4c5d [test] properly close connections
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6410
diff changeset
   318
        cnx.close()
4765
c33d12865641 more tests
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4711
diff changeset
   319
c33d12865641 more tests
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4711
diff changeset
   320
c33d12865641 more tests
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4711
diff changeset
   321
    def test_entity_created_in_transaction(self):
c33d12865641 more tests
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4711
diff changeset
   322
        affschema = self.schema['Affaire']
c33d12865641 more tests
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4711
diff changeset
   323
        origperms = affschema.permissions['read']
c33d12865641 more tests
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4711
diff changeset
   324
        affschema.set_action_permissions('read', affschema.permissions['add'])
c33d12865641 more tests
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4711
diff changeset
   325
        try:
c33d12865641 more tests
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4711
diff changeset
   326
            cnx = self.login('iaminusersgrouponly')
c33d12865641 more tests
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4711
diff changeset
   327
            cu = cnx.cursor()
c33d12865641 more tests
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4711
diff changeset
   328
            aff2 = cu.execute("INSERT Affaire X: X sujet 'cool'")[0][0]
c33d12865641 more tests
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4711
diff changeset
   329
            # entity created in transaction are readable *by eid*
5174
78438ad513ca #759035: Automate addition of eid cachekey in RQL analysis
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4915
diff changeset
   330
            self.failUnless(cu.execute('Any X WHERE X eid %(x)s', {'x':aff2}))
4765
c33d12865641 more tests
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4711
diff changeset
   331
            # XXX would be nice if it worked
c33d12865641 more tests
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4711
diff changeset
   332
            rset = cu.execute("Affaire X WHERE X sujet 'cool'")
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   333
            self.assertEqual(len(rset), 0)
4765
c33d12865641 more tests
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4711
diff changeset
   334
        finally:
c33d12865641 more tests
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4711
diff changeset
   335
            affschema.set_action_permissions('read', origperms)
c33d12865641 more tests
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4711
diff changeset
   336
            cnx.close()
1802
d628defebc17 delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents: 1398
diff changeset
   337
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   338
    def test_read_erqlexpr_has_text1(self):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   339
        aff1 = self.execute("INSERT Affaire X: X sujet 'cool'")[0][0]
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   340
        card1 = self.execute("INSERT Card X: X title 'cool'")[0][0]
5174
78438ad513ca #759035: Automate addition of eid cachekey in RQL analysis
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4915
diff changeset
   341
        self.execute('SET X owned_by U WHERE X eid %(x)s, U login "iaminusersgrouponly"', {'x': card1})
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   342
        self.commit()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   343
        cnx = self.login('iaminusersgrouponly')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   344
        cu = cnx.cursor()
2920
64322aa83a1d start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2608
diff changeset
   345
        aff2 = cu.execute("INSERT Affaire X: X sujet 'cool'")[0][0]
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   346
        soc1 = cu.execute("INSERT Societe X: X nom 'chouette'")[0][0]
5174
78438ad513ca #759035: Automate addition of eid cachekey in RQL analysis
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4915
diff changeset
   347
        cu.execute("SET A concerne S WHERE A eid %(a)s, S eid %(s)s", {'a': aff2, 's': soc1})
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   348
        cnx.commit()
5174
78438ad513ca #759035: Automate addition of eid cachekey in RQL analysis
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4915
diff changeset
   349
        self.assertRaises(Unauthorized, cu.execute, 'Any X WHERE X eid %(x)s', {'x':aff1})
78438ad513ca #759035: Automate addition of eid cachekey in RQL analysis
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4915
diff changeset
   350
        self.failUnless(cu.execute('Any X WHERE X eid %(x)s', {'x':aff2}))
78438ad513ca #759035: Automate addition of eid cachekey in RQL analysis
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4915
diff changeset
   351
        self.failUnless(cu.execute('Any X WHERE X eid %(x)s', {'x':card1}))
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   352
        rset = cu.execute("Any X WHERE X has_text 'cool'")
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   353
        self.assertEqual(sorted(eid for eid, in rset.rows),
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   354
                          [card1, aff2])
7072
bcf96f2a4c5d [test] properly close connections
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6410
diff changeset
   355
        cnx.close()
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   356
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   357
    def test_read_erqlexpr_has_text2(self):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   358
        self.execute("INSERT Personne X: X nom 'bidule'")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   359
        self.execute("INSERT Societe X: X nom 'bidule'")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   360
        self.commit()
3877
7ca53fc72a0a reldefsecurity branch :
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3252
diff changeset
   361
        self.schema['Personne'].set_action_permissions('read', ('managers',))
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   362
        cnx = self.login('iaminusersgrouponly')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   363
        cu = cnx.cursor()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   364
        rset = cu.execute('Any N WHERE N has_text "bidule"')
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   365
        self.assertEqual(len(rset.rows), 1, rset.rows)
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   366
        rset = cu.execute('Any N WITH N BEING (Any N WHERE N has_text "bidule")')
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   367
        self.assertEqual(len(rset.rows), 1, rset.rows)
7072
bcf96f2a4c5d [test] properly close connections
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6410
diff changeset
   368
        cnx.close()
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   369
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   370
    def test_read_erqlexpr_optional_rel(self):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   371
        self.execute("INSERT Personne X: X nom 'bidule'")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   372
        self.execute("INSERT Societe X: X nom 'bidule'")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   373
        self.commit()
3877
7ca53fc72a0a reldefsecurity branch :
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3252
diff changeset
   374
        self.schema['Personne'].set_action_permissions('read', ('managers',))
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   375
        cnx = self.login('anon')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   376
        cu = cnx.cursor()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   377
        rset = cu.execute('Any N,U WHERE N has_text "bidule", N owned_by U?')
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   378
        self.assertEqual(len(rset.rows), 1, rset.rows)
7072
bcf96f2a4c5d [test] properly close connections
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6410
diff changeset
   379
        cnx.close()
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   380
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   381
    def test_read_erqlexpr_aggregat(self):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   382
        self.execute("INSERT Affaire X: X sujet 'cool'")[0][0]
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   383
        self.commit()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   384
        cnx = self.login('iaminusersgrouponly')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   385
        cu = cnx.cursor()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   386
        rset = cu.execute('Any COUNT(X) WHERE X is Affaire')
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   387
        self.assertEqual(rset.rows, [[0]])
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   388
        aff2 = cu.execute("INSERT Affaire X: X sujet 'cool'")[0][0]
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   389
        soc1 = cu.execute("INSERT Societe X: X nom 'chouette'")[0][0]
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   390
        cu.execute("SET A concerne S WHERE A is Affaire, S is Societe")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   391
        cnx.commit()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   392
        rset = cu.execute('Any COUNT(X) WHERE X is Affaire')
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   393
        self.assertEqual(rset.rows, [[1]])
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   394
        rset = cu.execute('Any ETN, COUNT(X) GROUPBY ETN WHERE X is ET, ET name ETN')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   395
        values = dict(rset)
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   396
        self.assertEqual(values['Affaire'], 1)
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   397
        self.assertEqual(values['Societe'], 2)
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   398
        rset = cu.execute('Any ETN, COUNT(X) GROUPBY ETN WHERE X is ET, ET name ETN WITH X BEING ((Affaire X) UNION (Societe X))')
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   399
        self.assertEqual(len(rset), 2)
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   400
        values = dict(rset)
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   401
        self.assertEqual(values['Affaire'], 1)
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   402
        self.assertEqual(values['Societe'], 2)
7072
bcf96f2a4c5d [test] properly close connections
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6410
diff changeset
   403
        cnx.close()
1802
d628defebc17 delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents: 1398
diff changeset
   404
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   405
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   406
    def test_attribute_security(self):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   407
        # only managers should be able to edit the 'test' attribute of Personne entities
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   408
        eid = self.execute("INSERT Personne X: X nom 'bidule', X web 'http://www.debian.org', X test TRUE")[0][0]
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   409
        self.commit()
5174
78438ad513ca #759035: Automate addition of eid cachekey in RQL analysis
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4915
diff changeset
   410
        self.execute('SET X test FALSE WHERE X eid %(x)s', {'x': eid})
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   411
        self.commit()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   412
        cnx = self.login('iaminusersgrouponly')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   413
        cu = cnx.cursor()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   414
        cu.execute("INSERT Personne X: X nom 'bidule', X web 'http://www.debian.org', X test TRUE")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   415
        self.assertRaises(Unauthorized, cnx.commit)
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   416
        cu.execute("INSERT Personne X: X nom 'bidule', X web 'http://www.debian.org', X test FALSE")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   417
        self.assertRaises(Unauthorized, cnx.commit)
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   418
        eid = cu.execute("INSERT Personne X: X nom 'bidule', X web 'http://www.debian.org'")[0][0]
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   419
        cnx.commit()
5174
78438ad513ca #759035: Automate addition of eid cachekey in RQL analysis
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4915
diff changeset
   420
        cu.execute('SET X test FALSE WHERE X eid %(x)s', {'x': eid})
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   421
        self.assertRaises(Unauthorized, cnx.commit)
5174
78438ad513ca #759035: Automate addition of eid cachekey in RQL analysis
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4915
diff changeset
   422
        cu.execute('SET X test TRUE WHERE X eid %(x)s', {'x': eid})
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   423
        self.assertRaises(Unauthorized, cnx.commit)
5174
78438ad513ca #759035: Automate addition of eid cachekey in RQL analysis
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4915
diff changeset
   424
        cu.execute('SET X web "http://www.logilab.org" WHERE X eid %(x)s', {'x': eid})
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   425
        cnx.commit()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   426
        cnx.close()
1802
d628defebc17 delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents: 1398
diff changeset
   427
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   428
    def test_attribute_security_rqlexpr(self):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   429
        # Note.para attribute editable by managers or if the note is in "todo" state
2920
64322aa83a1d start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2608
diff changeset
   430
        note = self.execute("INSERT Note X: X para 'bidule'").get_entity(0, 0)
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   431
        self.commit()
5556
9ab2b4c74baf [entity] introduce a new 'adapters' registry
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5426
diff changeset
   432
        note.cw_adapt_to('IWorkflowable').fire_transition('markasdone')
5174
78438ad513ca #759035: Automate addition of eid cachekey in RQL analysis
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4915
diff changeset
   433
        self.execute('SET X para "truc" WHERE X eid %(x)s', {'x': note.eid})
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   434
        self.commit()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   435
        cnx = self.login('iaminusersgrouponly')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   436
        cu = cnx.cursor()
5174
78438ad513ca #759035: Automate addition of eid cachekey in RQL analysis
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4915
diff changeset
   437
        cu.execute("SET X para 'chouette' WHERE X eid %(x)s", {'x': note.eid})
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   438
        self.assertRaises(Unauthorized, cnx.commit)
2920
64322aa83a1d start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2608
diff changeset
   439
        note2 = cu.execute("INSERT Note X: X para 'bidule'").get_entity(0, 0)
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   440
        cnx.commit()
5556
9ab2b4c74baf [entity] introduce a new 'adapters' registry
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5426
diff changeset
   441
        note2.cw_adapt_to('IWorkflowable').fire_transition('markasdone')
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   442
        cnx.commit()
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   443
        self.assertEqual(len(cu.execute('Any X WHERE X in_state S, S name "todo", X eid %(x)s', {'x': note2.eid})),
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   444
                          0)
5174
78438ad513ca #759035: Automate addition of eid cachekey in RQL analysis
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4915
diff changeset
   445
        cu.execute("SET X para 'chouette' WHERE X eid %(x)s", {'x': note2.eid})
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   446
        self.assertRaises(Unauthorized, cnx.commit)
5556
9ab2b4c74baf [entity] introduce a new 'adapters' registry
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5426
diff changeset
   447
        note2.cw_adapt_to('IWorkflowable').fire_transition('redoit')
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   448
        cnx.commit()
5174
78438ad513ca #759035: Automate addition of eid cachekey in RQL analysis
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4915
diff changeset
   449
        cu.execute("SET X para 'chouette' WHERE X eid %(x)s", {'x': note2.eid})
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   450
        cnx.commit()
7072
bcf96f2a4c5d [test] properly close connections
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6410
diff changeset
   451
        cnx.close()
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   452
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   453
    def test_attribute_read_security(self):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   454
        # anon not allowed to see users'login, but they can see users
3877
7ca53fc72a0a reldefsecurity branch :
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3252
diff changeset
   455
        self.repo.schema['CWUser'].set_action_permissions('read', ('guests', 'users', 'managers'))
7ca53fc72a0a reldefsecurity branch :
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3252
diff changeset
   456
        self.repo.schema['CWUser'].rdef('login').set_action_permissions('read', ('users', 'managers'))
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   457
        cnx = self.login('anon')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   458
        cu = cnx.cursor()
1398
5fe84a5f7035 rename internal entity types to have CW prefix instead of E
sylvain.thenault@logilab.fr
parents: 389
diff changeset
   459
        rset = cu.execute('CWUser X')
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   460
        self.failUnless(rset)
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   461
        x = rset.get_entity(0, 0)
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   462
        self.assertEqual(x.login, None)
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   463
        self.failUnless(x.creation_date)
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   464
        x = rset.get_entity(1, 0)
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   465
        x.complete()
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   466
        self.assertEqual(x.login, None)
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   467
        self.failUnless(x.creation_date)
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   468
        cnx.rollback()
7072
bcf96f2a4c5d [test] properly close connections
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6410
diff changeset
   469
        cnx.close()
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   470
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   471
class BaseSchemaSecurityTC(BaseSecurityTC):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   472
    """tests related to the base schema permission configuration"""
1802
d628defebc17 delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents: 1398
diff changeset
   473
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   474
    def test_user_can_delete_object_he_created(self):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   475
        # even if some other user have changed object'state
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   476
        cnx = self.login('iaminusersgrouponly')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   477
        cu = cnx.cursor()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   478
        # due to security test, affaire has to concerne a societe the user owns
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   479
        cu.execute('INSERT Societe X: X nom "ARCTIA"')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   480
        cu.execute('INSERT Affaire X: X ref "ARCT01", X concerne S WHERE S nom "ARCTIA"')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   481
        cnx.commit()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   482
        self.restore_connection()
2920
64322aa83a1d start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2608
diff changeset
   483
        affaire = self.execute('Any X WHERE X ref "ARCT01"').get_entity(0, 0)
5556
9ab2b4c74baf [entity] introduce a new 'adapters' registry
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5426
diff changeset
   484
        affaire.cw_adapt_to('IWorkflowable').fire_transition('abort')
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   485
        self.commit()
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   486
        self.assertEqual(len(self.execute('TrInfo X WHERE X wf_info_for A, A ref "ARCT01"')),
2920
64322aa83a1d start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2608
diff changeset
   487
                          1)
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   488
        self.assertEqual(len(self.execute('TrInfo X WHERE X wf_info_for A, A ref "ARCT01",'
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   489
                                           'X owned_by U, U login "admin"')),
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   490
                          1) # TrInfo at the above state change
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   491
        cnx = self.login('iaminusersgrouponly')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   492
        cu = cnx.cursor()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   493
        cu.execute('DELETE Affaire X WHERE X ref "ARCT01"')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   494
        cnx.commit()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   495
        self.failIf(cu.execute('Affaire X'))
7072
bcf96f2a4c5d [test] properly close connections
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6410
diff changeset
   496
        cnx.close()
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   497
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   498
    def test_users_and_groups_non_readable_by_guests(self):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   499
        cnx = self.login('anon')
2773
b2530e3e0afb [testlib] #345052 and #344207: major test lib refactoring/cleanup + update usage
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2608
diff changeset
   500
        anon = cnx.user(self.session)
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   501
        cu = cnx.cursor()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   502
        # anonymous user can only read itself
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   503
        rset = cu.execute('Any L WHERE X owned_by U, U login L')
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   504
        self.assertEqual(rset.rows, [['anon']])
1398
5fe84a5f7035 rename internal entity types to have CW prefix instead of E
sylvain.thenault@logilab.fr
parents: 389
diff changeset
   505
        rset = cu.execute('CWUser X')
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   506
        self.assertEqual(rset.rows, [[anon.eid]])
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   507
        # anonymous user can read groups (necessary to check allowed transitions for instance)
1398
5fe84a5f7035 rename internal entity types to have CW prefix instead of E
sylvain.thenault@logilab.fr
parents: 389
diff changeset
   508
        self.assert_(cu.execute('CWGroup X'))
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   509
        # should only be able to read the anonymous user, not another one
2773
b2530e3e0afb [testlib] #345052 and #344207: major test lib refactoring/cleanup + update usage
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2608
diff changeset
   510
        origuser = self.adminsession.user
1802
d628defebc17 delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents: 1398
diff changeset
   511
        self.assertRaises(Unauthorized,
5174
78438ad513ca #759035: Automate addition of eid cachekey in RQL analysis
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4915
diff changeset
   512
                          cu.execute, 'CWUser X WHERE X eid %(x)s', {'x': origuser.eid})
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   513
        # nothing selected, nothing updated, no exception raised
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   514
        #self.assertRaises(Unauthorized,
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   515
        #                  cu.execute, 'SET X login "toto" WHERE X eid %(x)s',
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   516
        #                  {'x': self.user.eid})
1802
d628defebc17 delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents: 1398
diff changeset
   517
5174
78438ad513ca #759035: Automate addition of eid cachekey in RQL analysis
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4915
diff changeset
   518
        rset = cu.execute('CWUser X WHERE X eid %(x)s', {'x': anon.eid})
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   519
        self.assertEqual(rset.rows, [[anon.eid]])
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   520
        # but can't modify it
4915
d657b89df9f4 fix test broken by recent rql rewrite / querier changes
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4787
diff changeset
   521
        cu.execute('SET X login "toto" WHERE X eid %(x)s', {'x': anon.eid})
d657b89df9f4 fix test broken by recent rql rewrite / querier changes
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4787
diff changeset
   522
        self.assertRaises(Unauthorized, cnx.commit)
7072
bcf96f2a4c5d [test] properly close connections
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6410
diff changeset
   523
        cnx.close()
1802
d628defebc17 delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents: 1398
diff changeset
   524
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   525
    def test_in_group_relation(self):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   526
        cnx = self.login('iaminusersgrouponly')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   527
        cu = cnx.cursor()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   528
        rql = u"DELETE U in_group G WHERE U login 'admin'"
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   529
        self.assertRaises(Unauthorized, cu.execute, rql)
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   530
        rql = u"SET U in_group G WHERE U login 'admin', G name 'users'"
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   531
        self.assertRaises(Unauthorized, cu.execute, rql)
7072
bcf96f2a4c5d [test] properly close connections
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6410
diff changeset
   532
        cnx.close()
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   533
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   534
    def test_owned_by(self):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   535
        self.execute("INSERT Personne X: X nom 'bidule'")
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   536
        self.commit()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   537
        cnx = self.login('iaminusersgrouponly')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   538
        cu = cnx.cursor()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   539
        rql = u"SET X owned_by U WHERE U login 'iaminusersgrouponly', X is Personne"
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   540
        self.assertRaises(Unauthorized, cu.execute, rql)
7072
bcf96f2a4c5d [test] properly close connections
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6410
diff changeset
   541
        cnx.close()
1802
d628defebc17 delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents: 1398
diff changeset
   542
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   543
    def test_bookmarked_by_guests_security(self):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   544
        beid1 = self.execute('INSERT Bookmark B: B path "?vid=manage", B title "manage"')[0][0]
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   545
        beid2 = self.execute('INSERT Bookmark B: B path "?vid=index", B title "index", B bookmarked_by U WHERE U login "anon"')[0][0]
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   546
        self.commit()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   547
        cnx = self.login('anon')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   548
        cu = cnx.cursor()
2773
b2530e3e0afb [testlib] #345052 and #344207: major test lib refactoring/cleanup + update usage
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2608
diff changeset
   549
        anoneid = self.session.user.eid
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   550
        self.assertEqual(cu.execute('Any T,P ORDERBY lower(T) WHERE B is Bookmark,B title T,B path P,'
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   551
                                     'B bookmarked_by U, U eid %s' % anoneid).rows,
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   552
                          [['index', '?vid=index']])
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   553
        self.assertEqual(cu.execute('Any T,P ORDERBY lower(T) WHERE B is Bookmark,B title T,B path P,'
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   554
                                     'B bookmarked_by U, U eid %(x)s', {'x': anoneid}).rows,
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   555
                          [['index', '?vid=index']])
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   556
        # can read others bookmarks as well
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   557
        self.assertEqual(cu.execute('Any B where B is Bookmark, NOT B bookmarked_by U').rows,
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   558
                          [[beid1]])
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   559
        self.assertRaises(Unauthorized, cu.execute,'DELETE B bookmarked_by U')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   560
        self.assertRaises(Unauthorized,
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   561
                          cu.execute, 'SET B bookmarked_by U WHERE U eid %(x)s, B eid %(b)s',
5174
78438ad513ca #759035: Automate addition of eid cachekey in RQL analysis
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4915
diff changeset
   562
                          {'x': anoneid, 'b': beid1})
7072
bcf96f2a4c5d [test] properly close connections
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6410
diff changeset
   563
        cnx.close()
1802
d628defebc17 delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents: 1398
diff changeset
   564
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   565
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   566
    def test_ambigous_ordered(self):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   567
        cnx = self.login('anon')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   568
        cu = cnx.cursor()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   569
        names = [t for t, in cu.execute('Any N ORDERBY lower(N) WHERE X name N')]
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   570
        self.assertEqual(names, sorted(names, key=lambda x: x.lower()))
7072
bcf96f2a4c5d [test] properly close connections
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6410
diff changeset
   571
        cnx.close()
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   572
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   573
    def test_in_state_without_update_perm(self):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   574
        """check a user change in_state without having update permission on the
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   575
        subject
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   576
        """
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   577
        eid = self.execute('INSERT Affaire X: X ref "ARCT01"')[0][0]
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   578
        self.commit()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   579
        cnx = self.login('iaminusersgrouponly')
2773
b2530e3e0afb [testlib] #345052 and #344207: major test lib refactoring/cleanup + update usage
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2608
diff changeset
   580
        session = self.session
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   581
        # needed to avoid check_perm error
7398
26695dd703d8 [repository api] definitly kill usage of word 'pool' to refer to connections set used by a session
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 7244
diff changeset
   582
        session.set_cnxset()
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   583
        # needed to remove rql expr granting update perm to the user
4691
ae468fae9965 [test] fix test inter-dependancies pb. Pytest ok in each individual test dir, though not yet for whole cubicweb, but for different reasons
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4191
diff changeset
   584
        affaire_perms = self.schema['Affaire'].permissions.copy()
3877
7ca53fc72a0a reldefsecurity branch :
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3252
diff changeset
   585
        self.schema['Affaire'].set_action_permissions('update', self.schema['Affaire'].get_groups('update'))
2920
64322aa83a1d start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2608
diff changeset
   586
        try:
4691
ae468fae9965 [test] fix test inter-dependancies pb. Pytest ok in each individual test dir, though not yet for whole cubicweb, but for different reasons
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4191
diff changeset
   587
            self.assertRaises(Unauthorized,
ae468fae9965 [test] fix test inter-dependancies pb. Pytest ok in each individual test dir, though not yet for whole cubicweb, but for different reasons
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4191
diff changeset
   588
                              self.schema['Affaire'].check_perm, session, 'update', eid=eid)
ae468fae9965 [test] fix test inter-dependancies pb. Pytest ok in each individual test dir, though not yet for whole cubicweb, but for different reasons
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4191
diff changeset
   589
            cu = cnx.cursor()
ae468fae9965 [test] fix test inter-dependancies pb. Pytest ok in each individual test dir, though not yet for whole cubicweb, but for different reasons
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4191
diff changeset
   590
            self.schema['Affaire'].set_action_permissions('read', ('users',))
2920
64322aa83a1d start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2608
diff changeset
   591
            aff = cu.execute('Any X WHERE X ref "ARCT01"').get_entity(0, 0)
5556
9ab2b4c74baf [entity] introduce a new 'adapters' registry
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5426
diff changeset
   592
            aff.cw_adapt_to('IWorkflowable').fire_transition('abort')
2920
64322aa83a1d start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2608
diff changeset
   593
            cnx.commit()
64322aa83a1d start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2608
diff changeset
   594
            # though changing a user state (even logged user) is reserved to managers
3447
0a0f8df4a2f7 test fixes
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3293
diff changeset
   595
            user = cnx.user(self.session)
2920
64322aa83a1d start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2608
diff changeset
   596
            # XXX wether it should raise Unauthorized or ValidationError is not clear
64322aa83a1d start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2608
diff changeset
   597
            # the best would probably ValidationError if the transition doesn't exist
64322aa83a1d start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2608
diff changeset
   598
            # from the current state but Unauthorized if it exists but user can't pass it
5556
9ab2b4c74baf [entity] introduce a new 'adapters' registry
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5426
diff changeset
   599
            self.assertRaises(ValidationError,
9ab2b4c74baf [entity] introduce a new 'adapters' registry
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5426
diff changeset
   600
                              user.cw_adapt_to('IWorkflowable').fire_transition, 'deactivate')
2920
64322aa83a1d start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2608
diff changeset
   601
        finally:
4691
ae468fae9965 [test] fix test inter-dependancies pb. Pytest ok in each individual test dir, though not yet for whole cubicweb, but for different reasons
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4191
diff changeset
   602
            # restore orig perms
ae468fae9965 [test] fix test inter-dependancies pb. Pytest ok in each individual test dir, though not yet for whole cubicweb, but for different reasons
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4191
diff changeset
   603
            for action, perms in affaire_perms.iteritems():
ae468fae9965 [test] fix test inter-dependancies pb. Pytest ok in each individual test dir, though not yet for whole cubicweb, but for different reasons
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4191
diff changeset
   604
                self.schema['Affaire'].set_action_permissions(action, perms)
7072
bcf96f2a4c5d [test] properly close connections
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6410
diff changeset
   605
        cnx.close()
1802
d628defebc17 delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents: 1398
diff changeset
   606
2501
fa86d99c2c3a test and fix wf history security
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2500
diff changeset
   607
    def test_trinfo_security(self):
fa86d99c2c3a test and fix wf history security
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2500
diff changeset
   608
        aff = self.execute('INSERT Affaire X: X ref "ARCT01"').get_entity(0, 0)
5556
9ab2b4c74baf [entity] introduce a new 'adapters' registry
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5426
diff changeset
   609
        iworkflowable = aff.cw_adapt_to('IWorkflowable')
2501
fa86d99c2c3a test and fix wf history security
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2500
diff changeset
   610
        self.commit()
5556
9ab2b4c74baf [entity] introduce a new 'adapters' registry
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5426
diff changeset
   611
        iworkflowable.fire_transition('abort')
2920
64322aa83a1d start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2608
diff changeset
   612
        self.commit()
2501
fa86d99c2c3a test and fix wf history security
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2500
diff changeset
   613
        # can change tr info comment
fa86d99c2c3a test and fix wf history security
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2500
diff changeset
   614
        self.execute('SET TI comment %(c)s WHERE TI wf_info_for X, X ref "ARCT01"',
2920
64322aa83a1d start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2608
diff changeset
   615
                     {'c': u'bouh!'})
2501
fa86d99c2c3a test and fix wf history security
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2500
diff changeset
   616
        self.commit()
5557
1a534c596bff [entity] continue cleanup of Entity/AnyEntity namespace
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5556
diff changeset
   617
        aff.cw_clear_relation_cache('wf_info_for', 'object')
5556
9ab2b4c74baf [entity] introduce a new 'adapters' registry
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5426
diff changeset
   618
        trinfo = iworkflowable.latest_trinfo()
6340
470d8e828fda [test] update test to unittest2 api (still using lgc.testlib though)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5890
diff changeset
   619
        self.assertEqual(trinfo.comment, 'bouh!')
2501
fa86d99c2c3a test and fix wf history security
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2500
diff changeset
   620
        # but not from_state/to_state
5557
1a534c596bff [entity] continue cleanup of Entity/AnyEntity namespace
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5556
diff changeset
   621
        aff.cw_clear_relation_cache('wf_info_for', role='object')
2501
fa86d99c2c3a test and fix wf history security
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2500
diff changeset
   622
        self.assertRaises(Unauthorized,
fa86d99c2c3a test and fix wf history security
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2500
diff changeset
   623
                          self.execute, 'SET TI from_state S WHERE TI eid %(ti)s, S name "ben non"',
5174
78438ad513ca #759035: Automate addition of eid cachekey in RQL analysis
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4915
diff changeset
   624
                          {'ti': trinfo.eid})
2501
fa86d99c2c3a test and fix wf history security
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2500
diff changeset
   625
        self.assertRaises(Unauthorized,
fa86d99c2c3a test and fix wf history security
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2500
diff changeset
   626
                          self.execute, 'SET TI to_state S WHERE TI eid %(ti)s, S name "pitetre"',
5174
78438ad513ca #759035: Automate addition of eid cachekey in RQL analysis
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4915
diff changeset
   627
                          {'ti': trinfo.eid})
2501
fa86d99c2c3a test and fix wf history security
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2500
diff changeset
   628
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   629
if __name__ == '__main__':
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   630
    unittest_main()