hazza/DSpace
1
0
Fork 0
mirror of https://github.com/DSpace/DSpace.git synced 2025-10-07 01:54:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2716 from Micheleboychuk/DS-4411-newlyCreatedUsersHaveNoSpecialRights

Browse Source 
DS-4411 Create Integration Tests to prove newly created users have no special rights
This commit is contained in:
Tim Donohue
2020-03-26 12:06:47 -05:00
committed by GitHub
parent 15aacd0234 db7f9c5c08
commit 77001f9bd4
12 changed files with 360 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

55
dspace-server-webapp/src/test/java/org/dspace/app/rest/BitstreamControllerIT.java
View File

@@ -351,6 +351,61 @@ public class BitstreamControllerIT extends AbstractControllerIntegrationTest {
}
@Test
public void putOnBitstreamInOneBundleForbiddenTest() throws Exception {
context.turnOffAuthorisationSystem();
parentCommunity = CommunityBuilder.createCommunity(context)
.withName("Parent Community")
.build();
Community child1 = CommunityBuilder.createSubCommunity(context, parentCommunity)
.withName("Sub Community")
.build();
Collection col1 = CollectionBuilder.createCollection(context, child1).withName("Collection 1").build();
Item publicItem1 = ItemBuilder.createItem(context, col1)
.withTitle("Test")
.withIssueDate("2016-11-11")
.withAuthor("Smith, Donald")
.withSubject("ExtraEntry")
.build();
Item targetItem = ItemBuilder.createItem(context, col1)
.withTitle("Test")
.withIssueDate("2016-11-11")
.withAuthor("Smith, Donald")
.withSubject("ExtraEntry")
.build();
Bundle bundle1 = BundleBuilder.createBundle(context, publicItem1)
.withName("TEST FIRST BUNDLE")
.build();
Bundle targetBundle = BundleBuilder.createBundle(context, targetItem)
.withName("TARGET BUNDLE")
.build();
String bitstreamContent = "ThisIsSomeDummyText";
Bitstream bitstream = null;
try (InputStream is = IOUtils.toInputStream(bitstreamContent, CharEncoding.UTF_8)) {
bitstream = BitstreamBuilder.createBitstream(context, bundle1, is)
.withName("Bitstream")
.withDescription("description")
.withMimeType("text/plain")
.build();
}
context.restoreAuthSystemState();
String token = getAuthToken(eperson.getEmail(), password);
getClient(token).perform(put("/api/core/bitstreams/" + bitstream.getID() + "/bundle")
.contentType(parseMediaType(TEXT_URI_LIST_VALUE))
.content("https://localhost:8080/spring-rest/api/core/bundles/" + targetBundle.getID()))
.andExpect(status().isForbidden());
}
@Test
public void putOnBitstreamInMultipleBundles() throws Exception {

61
dspace-server-webapp/src/test/java/org/dspace/app/rest/BundleRestRepositoryIT.java
View File

@@ -45,6 +45,7 @@ import org.dspace.app.rest.model.patch.MoveOperation;
import org.dspace.app.rest.model.patch.Operation;
import org.dspace.app.rest.test.AbstractControllerIntegrationTest;
import org.dspace.authorize.ResourcePolicy;
import org.dspace.authorize.service.ResourcePolicyService;
import org.dspace.content.Bitstream;
import org.dspace.content.Bundle;
import org.dspace.content.Collection;
@@ -54,10 +55,14 @@ import org.dspace.eperson.EPerson;
import org.hamcrest.Matchers;
import org.junit.Before;
import org.junit.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.test.web.servlet.MvcResult;
public class BundleRestRepositoryIT extends AbstractControllerIntegrationTest {
@Autowired
ResourcePolicyService resourcePolicyService;
private Collection collection;
private Item item;
private Bundle bundle1;
@@ -136,6 +141,30 @@ public class BundleRestRepositoryIT extends AbstractControllerIntegrationTest {
;
}
@Test
public void findOneForbiddenTest() throws Exception {
context.turnOffAuthorisationSystem();
String bitstreamContent = "Dummy content";
try (InputStream is = IOUtils.toInputStream(bitstreamContent, CharEncoding.UTF_8)) {
bitstream1 = BitstreamBuilder.createBitstream(context, item, is)
.withName("Bitstream")
.withMimeType("text/plain")
.build();
}
bundle1 = BundleBuilder.createBundle(context, item)
.withName("testname")
.withBitstream(bitstream1)
.build();
resourcePolicyService.removePolicies(context, bundle1, Constants.READ);
context.restoreAuthSystemState();
String tokenEperson = getAuthToken(eperson.getEmail(), password);
getClient(tokenEperson).perform(get("/api/core/bundles/" + bundle1.getID()))
.andExpect(status().isForbidden());
}
@Test
public void getItemBundles() throws Exception {
@@ -385,6 +414,38 @@ public class BundleRestRepositoryIT extends AbstractControllerIntegrationTest {
)));
}
@Test
public void getBitstreamsForBundleForbiddenTest() throws Exception {
context.turnOffAuthorisationSystem();
String bitstreamContent = "Dummy content";
try (InputStream is = IOUtils.toInputStream(bitstreamContent, CharEncoding.UTF_8)) {
bitstream1 = BitstreamBuilder.createBitstream(context, item, is)
.withName("Bitstream")
.withDescription("Description")
.withMimeType("text/plain")
.build();
bitstream2 = BitstreamBuilder.createBitstream(context, item, is)
.withName("Bitstream2")
.withDescription("Description2")
.withMimeType("text/plain")
.build();
}
bundle1 = BundleBuilder.createBundle(context, item)
.withName("testname")
.withBitstream(bitstream1)
.withBitstream(bitstream2)
.build();
resourcePolicyService.removePolicies(context, bundle1, Constants.READ);
context.restoreAuthSystemState();
String tokenEperson = getAuthToken(eperson.getEmail(), password);
getClient(tokenEperson).perform(get("/api/core/bundles/" + bundle1.getID() + "/bitstreams"))
.andExpect(status().isForbidden());
}
@Test
public void patchMoveBitstreams() throws Exception {
context.turnOffAuthorisationSystem();

48
dspace-server-webapp/src/test/java/org/dspace/app/rest/EPersonRestRepositoryIT.java
View File

@@ -235,6 +235,28 @@ public class EPersonRestRepositoryIT extends AbstractControllerIntegrationTest {
}
@Test
public void findOneForbiddenTest() throws Exception {
context.turnOffAuthorisationSystem();
EPerson ePerson1 = EPersonBuilder.createEPerson(context)
.withNameInMetadata("Mik", "Reck")
.withEmail("MikReck@email.com")
.withPassword("qwerty01")
.build();
EPerson ePerson2 = EPersonBuilder.createEPerson(context)
.withNameInMetadata("Bob", "Smith")
.withEmail("bobsmith@fake-email.com")
.build();
context.restoreAuthSystemState();
String tokenEperson1 = getAuthToken(ePerson1.getEmail(), "qwerty01");
getClient(tokenEperson1).perform(get("/api/eperson/epersons/" + ePerson2.getID()))
.andExpect(status().isForbidden());
}
@Test
public void readEpersonAuthorizationTest() throws Exception {
context.turnOffAuthorisationSystem();
@@ -1494,6 +1516,31 @@ public class EPersonRestRepositoryIT extends AbstractControllerIntegrationTest {
new MetadataPatchSuite().runWith(getClient(token), "/api/eperson/epersons/" + ePerson.getID(), expectedStatus);
}
@Test
public void newlyCreatedAccountHasNoGroups() throws Exception {
context.turnOffAuthorisationSystem();
EPerson ePerson1 = EPersonBuilder.createEPerson(context)
.withNameInMetadata("Mik", "Reck")
.withEmail("MikReck@email.com")
.withPassword("qwerty01")
.build();
context.restoreAuthSystemState();
String tokenEperson1 = getAuthToken(ePerson1.getEmail(), "qwerty01");
// by contract the groups embedded in the eperson only contains direct explicit membership,
// so the anonymous group is not listed
getClient(tokenEperson1).perform(get("/api/eperson/epersons/" + ePerson1.getID())
.param("projection", "full"))
.andExpect(status().isOk())
.andExpect(content().contentType(contentType))
.andExpect(jsonPath("$", Matchers.allOf(
hasJsonPath("$._embedded.groups._embedded.groups.length()", is(0)),
hasJsonPath("$._embedded.groups.page.totalElements", is(0))
)));
}
/**
* Test that epersons/<:uuid>/groups endpoint returns the direct groups of the epersons
* @throws Exception
@@ -1543,5 +1590,4 @@ public class EPersonRestRepositoryIT extends AbstractControllerIntegrationTest {
);
}
}

29
dspace-server-webapp/src/test/java/org/dspace/app/rest/GroupRestRepositoryIT.java
View File

@@ -36,9 +36,11 @@ import org.dspace.app.rest.model.MetadataRest;
import org.dspace.app.rest.model.MetadataValueRest;
import org.dspace.app.rest.test.AbstractControllerIntegrationTest;
import org.dspace.app.rest.test.MetadataPatchSuite;
import org.dspace.authorize.service.ResourcePolicyService;
import org.dspace.content.Community;
import org.dspace.content.factory.ContentServiceFactory;
import org.dspace.content.service.CommunityService;
import org.dspace.core.Constants;
import org.dspace.eperson.EPerson;
import org.dspace.eperson.Group;
import org.dspace.eperson.factory.EPersonServiceFactory;
@@ -46,6 +48,7 @@ import org.dspace.eperson.service.EPersonService;
import org.dspace.eperson.service.GroupService;
import org.hamcrest.Matchers;
import org.junit.Test;
import org.springframework.beans.factory.annotation.Autowired;
/**
* @author Jonas Van Goolen - (jonas@atmire.com)
@@ -53,6 +56,9 @@ import org.junit.Test;
public class GroupRestRepositoryIT extends AbstractControllerIntegrationTest {
@Autowired
ResourcePolicyService resourcePolicyService;
@Test
public void createTest()
throws Exception {
@@ -186,6 +192,13 @@ public class GroupRestRepositoryIT extends AbstractControllerIntegrationTest {
;
}
@Test
public void findAllForbiddenTest() throws Exception {
String tokenEperson = getAuthToken(eperson.getEmail(), password);
getClient(tokenEperson).perform(get("/api/eperson/groups"))
.andExpect(status().isForbidden());
}
@Test
public void findAllPaginationTest() throws Exception {
@@ -295,6 +308,22 @@ public class GroupRestRepositoryIT extends AbstractControllerIntegrationTest {
Matchers.containsString("/api/eperson/groups/" + group2.getID())));
}
@Test
public void findOneForbiddenTest() throws Exception {
context.turnOffAuthorisationSystem();
Group privateGroup = GroupBuilder.createGroup(context)
.withName("Private Group")
.build();
resourcePolicyService.removePolicies(context, privateGroup, Constants.READ);
context.restoreAuthSystemState();
String tokenEperson = getAuthToken(eperson.getEmail(), password);
getClient(tokenEperson).perform(get("/api/eperson/groups/" + privateGroup.getID()))
.andExpect(status().isForbidden());
}
@Test
public void findOneTestWrongUUID() throws Exception {
context.turnOffAuthorisationSystem();

30
dspace-server-webapp/src/test/java/org/dspace/app/rest/ItemOwningCollectionUpdateRestControllerIT.java
View File

@@ -283,4 +283,34 @@ public class ItemOwningCollectionUpdateRestControllerIT extends AbstractControll
}
@Test
public void moveItemForbiddenTest() throws Exception {
context.turnOffAuthorisationSystem();
parentCommunity = CommunityBuilder.createCommunity(context)
.withName("Parent Community")
.build();
Collection col1 = CollectionBuilder.createCollection(context, parentCommunity)
.withName("Collection 1")
.build();
Collection col2 = CollectionBuilder.createCollection(context, parentCommunity)
.withName("Collection 2")
.build();
Item publicItem1 = ItemBuilder.createItem(context, col1)
.withTitle("Public item 1")
.withIssueDate("2019-10-21")
.withAuthor("Smith, Donald")
.build();
context.restoreAuthSystemState();
String tokenEPerson = getAuthToken(eperson.getEmail(), password);
getClient(tokenEPerson).perform(put("/api/core/items/" + publicItem1.getID() + "/owningCollection/")
.contentType(parseMediaType(TEXT_URI_LIST_VALUE))
.content("https://localhost:8080/spring-rest/api/core/collections/" + col2.getID()))
.andExpect(status().isForbidden());
}
}

7
dspace-server-webapp/src/test/java/org/dspace/app/rest/ItemRestRepositoryIT.java
View File

@@ -123,6 +123,13 @@ public class ItemRestRepositoryIT extends AbstractControllerIntegrationTest {
;
}
@Test
public void findAllForbiddenTest() throws Exception {
String tokenEperson = getAuthToken(eperson.getEmail(), password);
getClient(tokenEperson).perform(get("/api/core/items"))
.andExpect(status().isForbidden());
}
@Test
public void findAllWithPaginationTest() throws Exception {
context.turnOffAuthorisationSystem();

17
dspace-server-webapp/src/test/java/org/dspace/app/rest/ItemTemplateRestControllerIT.java
View File

@@ -32,14 +32,20 @@ import org.dspace.app.rest.model.patch.AddOperation;
import org.dspace.app.rest.model.patch.Operation;
import org.dspace.app.rest.model.patch.ReplaceOperation;
import org.dspace.app.rest.test.AbstractControllerIntegrationTest;
import org.dspace.authorize.service.ResourcePolicyService;
import org.dspace.content.Collection;
import org.dspace.core.Constants;
import org.hamcrest.Matchers;
import org.junit.Before;
import org.junit.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.test.web.servlet.MvcResult;
public class ItemTemplateRestControllerIT extends AbstractControllerIntegrationTest {
@Autowired
ResourcePolicyService resourcePolicyService;
private ObjectMapper mapper;
private String adminAuthToken;
private Collection childCollection;
@@ -160,6 +166,17 @@ public class ItemTemplateRestControllerIT extends AbstractControllerIntegrationT
)));
}
@Test
public void getTemplateItemFromCollectionForbiddenTest() throws Exception {
setupTestTemplate();
String itemUuidString = installTestTemplate();
resourcePolicyService.removePolicies(context, childCollection, Constants.READ);
String tokenEperson = getAuthToken(eperson.getEmail(), password);
getClient(tokenEperson).perform(get(getCollectionTemplateItemUrlTemplate(childCollection.getID().toString())))
.andExpect(status().isForbidden());
}
@Test
public void getTemplateItemFromItemId() throws Exception {
setupTestTemplate();

53
dspace-server-webapp/src/test/java/org/dspace/app/rest/SubmissionDefinitionsControllerIT.java
View File

@@ -8,6 +8,7 @@
package org.dspace.app.rest;
import static com.jayway.jsonpath.matchers.JsonPathMatchers.hasJsonPath;
import static org.dspace.app.rest.test.AbstractControllerIntegrationTest.REST_SERVER_URL;
import static org.hamcrest.Matchers.allOf;
import static org.hamcrest.Matchers.greaterThanOrEqualTo;
import static org.hamcrest.Matchers.hasSize;
@@ -62,6 +63,22 @@ public class SubmissionDefinitionsControllerIT extends AbstractControllerIntegra
;
}
@Test
public void findAllWithNewlyCreatedAccountTest() throws Exception {
String token = getAuthToken(eperson.getEmail(), password);
getClient(token).perform(get("/api/config/submissiondefinitions"))
.andExpect(status().isOk())
.andExpect(content().contentType(contentType))
.andExpect(jsonPath("$.page.size", is(20)))
.andExpect(jsonPath("$.page.totalElements", greaterThanOrEqualTo(1)))
.andExpect(jsonPath("$.page.totalPages", greaterThanOrEqualTo(1)))
.andExpect(jsonPath("$.page.number", is(0)))
.andExpect(jsonPath("$._links.search.href", is(REST_SERVER_URL
+ "config/submissiondefinitions/search")))
//The array of browse index should have a size greater or equals to 1
.andExpect(jsonPath("$._embedded.submissiondefinitions", hasSize(greaterThanOrEqualTo(1))));
}
@Test
public void findDefault() throws Exception {
getClient().perform(get("/api/config/submissiondefinitions/traditional"))
@@ -84,6 +101,19 @@ public class SubmissionDefinitionsControllerIT extends AbstractControllerIntegra
;
}
@Test
public void findOneWithNewlyCreatedAccountTest() throws Exception {
String tokenEPerson = getAuthToken(eperson.getEmail(), password);
getClient(tokenEPerson).perform(get("/api/config/submissiondefinitions/traditional"))
.andExpect(status().isOk())
.andExpect(content().contentType(contentType))
.andExpect(jsonPath("$", allOf(
hasJsonPath("$.isDefault", is(true)),
hasJsonPath("$.name", is("traditional")),
hasJsonPath("$.id", is("traditional")),
hasJsonPath("$.type", is("submissiondefinition")))));
}
@Test
public void findByCollection() throws Exception {
@@ -117,6 +147,29 @@ public class SubmissionDefinitionsControllerIT extends AbstractControllerIntegra
.matchSubmissionDefinition(true, "traditional", "traditional")));
}
@Test
public void findByCollectionWithNewlyCreatedAccountTest() throws Exception {
context.turnOffAuthorisationSystem();
parentCommunity = CommunityBuilder.createCommunity(context)
.withName("Community")
.build();
Collection col1 = CollectionBuilder.createCollection(context, parentCommunity)
.withName("Collection 1")
.build();
String token = getAuthToken(eperson.getEmail(), password);
getClient(token).perform(get("/api/config/submissiondefinitions/search/findByCollection")
.param("uuid", col1.getID().toString()))
.andExpect(status().isOk())
.andDo(MockMvcResultHandlers.print())
.andExpect(content().contentType(contentType))
.andExpect(jsonPath("$", SubmissionDefinitionsMatcher
.matchSubmissionDefinition(true, "traditional", "traditional")));
}
@Test
public void findCollections() throws Exception {

43
dspace-server-webapp/src/test/java/org/dspace/app/rest/SubmissionFormsControllerIT.java
View File

@@ -55,6 +55,21 @@ public class SubmissionFormsControllerIT extends AbstractControllerIntegrationTe
;
}
@Test
public void findAllWithNewlyCreatedAccountTest() throws Exception {
String token = getAuthToken(eperson.getEmail(), password);
getClient(token).perform(get("/api/config/submissionforms"))
.andExpect(status().isOk())
.andExpect(content().contentType(contentType))
.andExpect(jsonPath("$.page.size", is(20)))
.andExpect(jsonPath("$.page.totalElements", equalTo(4)))
.andExpect(jsonPath("$.page.totalPages", equalTo(1)))
.andExpect(jsonPath("$.page.number", is(0)))
.andExpect(jsonPath("$._links.self.href", Matchers.startsWith(REST_SERVER_URL
+ "config/submissionforms")))
.andExpect(jsonPath("$._embedded.submissionforms", hasSize(equalTo(4))));
}
@Test
public void findTraditionalPageOne() throws Exception {
//When we call the root endpoint as anonymous user
@@ -96,6 +111,34 @@ public class SubmissionFormsControllerIT extends AbstractControllerIntegrationTe
;
}
@Test
public void findTraditionalPageOneWithNewlyCreatedAccountTest() throws Exception {
String token = getAuthToken(eperson.getEmail(), password);
getClient(token).perform(get("/api/config/submissionforms/traditionalpageone"))
.andExpect(status().isOk())
.andExpect(content().contentType(contentType))
.andExpect(jsonPath("$.id", is("traditionalpageone")))
.andExpect(jsonPath("$.name", is("traditionalpageone")))
.andExpect(jsonPath("$.type", is("submissionform")))
.andExpect(jsonPath("$._links.self.href", Matchers
.startsWith(REST_SERVER_URL + "config/submissionforms/traditionalpageone")))
.andExpect(jsonPath("$.rows[0].fields", contains(
SubmissionFormFieldMatcher.matchFormFieldDefinition("name", "Author",
null, true,"Add an author", "dc.contributor.author"))))
.andExpect(jsonPath("$.rows[1].fields", contains(
SubmissionFormFieldMatcher.matchFormFieldDefinition("onebox", "Title",
"You must enter a main title for this item.", false,
"Enter the main title of the item.", "dc.title"))))
.andExpect(jsonPath("$.rows[3].fields",contains(
SubmissionFormFieldMatcher.matchFormFieldDefinition("date", "Date of Issue",
"You must enter at least the year.", false,
"Please give the date", "col-sm-4",
"dc.date.issued"),
SubmissionFormFieldMatcher.matchFormFieldDefinition("onebox", "Publisher",
null, false,"Enter the name of",
"col-sm-8","dc.publisher"))));
}
@Test
public void findOpenRelationshipConfig() throws Exception {
String token = getAuthToken(admin.getEmail(), password);

2
dspace-server-webapp/src/test/java/org/dspace/app/rest/SubmissionSectionsControllerIT.java
View File

@@ -33,7 +33,7 @@ public class SubmissionSectionsControllerIT extends AbstractControllerIntegratio
.andExpect(status().isUnauthorized());
String token = getAuthToken(admin.getEmail(), password);
String token = getAuthToken(eperson.getEmail(), password);
//When we call the root endpoint
getClient(token).perform(get("/api/config/submissionsections"))

15
dspace-server-webapp/src/test/java/org/dspace/app/rest/SubmissionUploadsControllerIT.java
View File

@@ -54,4 +54,19 @@ public class SubmissionUploadsControllerIT extends AbstractControllerIntegration
.andExpect(jsonPath("$._embedded.submissionuploads", hasSize(greaterThanOrEqualTo(1))))
;
}
@Test
public void findAllWithNewlyCreatedAccountTest() throws Exception {
String token = getAuthToken(eperson.getEmail(), password);
getClient(token).perform(get("/api/config/submissionuploads"))
.andExpect(status().isOk())
.andExpect(content().contentType(contentType))
.andExpect(jsonPath("$.page.size", is(20)))
.andExpect(jsonPath("$.page.totalElements", greaterThanOrEqualTo(1)))
.andExpect(jsonPath("$.page.totalPages", greaterThanOrEqualTo(1)))
.andExpect(jsonPath("$.page.number", is(0)))
.andExpect(jsonPath("$._links.self.href",
Matchers.startsWith(REST_SERVER_URL + "config/submissionuploads")))
.andExpect(jsonPath("$._embedded.submissionuploads", hasSize(greaterThanOrEqualTo(1))));
}
}

4
dspace-server-webapp/src/test/java/org/dspace/app/rest/ViewEventRestRepositoryIT.java
View File

@@ -453,7 +453,7 @@ public class ViewEventRestRepositoryIT extends AbstractControllerIntegrationTest
@Test
public void postTestAuthenticatedUserSucces() throws Exception {
public void postTestAuthenticatedUserSuccess() throws Exception {
context.turnOffAuthorisationSystem();
@@ -485,7 +485,7 @@ public class ViewEventRestRepositoryIT extends AbstractControllerIntegrationTest
ObjectMapper mapper = new ObjectMapper();
String token = getAuthToken(admin.getEmail(), password);
String token = getAuthToken(eperson.getEmail(), password);
getClient(token).perform(post("/api/statistics/viewevents")
.content(mapper.writeValueAsBytes(viewEventRest))