Commit f75cbbf9 authored by Gabriel Monnerat's avatar Gabriel Monnerat

Add security tests to validate roles used access Slave Instances objects using...

Add security tests to validate roles used access Slave Instances objects using Software Instance user
parent 99e22629
...@@ -33,7 +33,8 @@ from Products.ERP5Type.Errors import UnsupportedWorkflowMethod ...@@ -33,7 +33,8 @@ from Products.ERP5Type.Errors import UnsupportedWorkflowMethod
from Products.ERP5Type.tests.Sequence import SequenceList from Products.ERP5Type.tests.Sequence import SequenceList
from Products.ERP5Type.tests.backportUnittest import expectedFailure from Products.ERP5Type.tests.backportUnittest import expectedFailure
from Products.ERP5Type.tests.backportUnittest import skip from Products.ERP5Type.tests.backportUnittest import skip
from Products.ERP5Type.tests.SecurityTestCase import AssertNoPermissionMethod from Products.ERP5Type.tests.SecurityTestCase import AssertNoPermissionMethod, \
AssertPermissionMethod
from Products.ERP5Type import Permissions from Products.ERP5Type import Permissions
from VifibMixin import testVifibMixin from VifibMixin import testVifibMixin
from random import random from random import random
...@@ -95,7 +96,6 @@ class TestVifibSlapWebService(testVifibMixin): ...@@ -95,7 +96,6 @@ class TestVifibSlapWebService(testVifibMixin):
sale_order_line_portal_type = "Sale Order Line" sale_order_line_portal_type = "Sale Order Line"
sale_packing_list_portal_type = "Sale Packing List" sale_packing_list_portal_type = "Sale Packing List"
service_portal_type = "Service" service_portal_type = "Service"
slave_partition_portal_type = "Slave Partition"
slave_instance_portal_type = "Slave Instance" slave_instance_portal_type = "Slave Instance"
software_instance_portal_type = "Software Instance" software_instance_portal_type = "Software Instance"
software_release_portal_type = "Software Release" software_release_portal_type = "Software Release"
...@@ -107,6 +107,11 @@ class TestVifibSlapWebService(testVifibMixin): ...@@ -107,6 +107,11 @@ class TestVifibSlapWebService(testVifibMixin):
failIfUserCanViewDocument = AssertNoPermissionMethod(Permissions.View) failIfUserCanViewDocument = AssertNoPermissionMethod(Permissions.View)
failIfUserCanAccessDocument = AssertNoPermissionMethod( failIfUserCanAccessDocument = AssertNoPermissionMethod(
Permissions.AccessContentsInformation) Permissions.AccessContentsInformation)
failIfUserCanModifyDocument = AssertNoPermissionMethod(
Permissions.ModifyPortalContent)
assertUserCanViewDocument = AssertPermissionMethod(Permissions.View)
assertUserCanAccessDocument =\
AssertPermissionMethod(Permissions.AccessContentsInformation)
def afterSetUp(self): def afterSetUp(self):
fakeSlapAuth() fakeSlapAuth()
...@@ -4748,7 +4753,7 @@ class TestVifibSlapWebService(testVifibMixin): ...@@ -4748,7 +4753,7 @@ class TestVifibSlapWebService(testVifibMixin):
Logout Logout
LoginDefaultUser LoginDefaultUser
CheckComputerPartitionInstanceHostingSalePackingListStopped CheckComputerPartitionInstanceHostingSalePackingListStopped
Logout \ Logout
""" """
sequence_list.addSequenceString(sequence_string) sequence_list.addSequenceString(sequence_string)
sequence_list.play(self) sequence_list.play(self)
...@@ -4778,7 +4783,8 @@ class TestVifibSlapWebService(testVifibMixin): ...@@ -4778,7 +4783,8 @@ class TestVifibSlapWebService(testVifibMixin):
def stepCheckSlaveInstanceSecurityWithDifferentCustomer(self, sequence): def stepCheckSlaveInstanceSecurityWithDifferentCustomer(self, sequence):
software_instance_uid = sequence["software_instance_uid"] software_instance_uid = sequence["software_instance_uid"]
username = str(self.portal.portal_membership.getAuthenticatedMember()) portal_membership = self.portal.portal_membership
username = portal_membership.getAuthenticatedMember().getUserName()
self.login() self.login()
software_instance = self.portal.portal_catalog.getResultValue( software_instance = self.portal.portal_catalog.getResultValue(
uid=software_instance_uid) uid=software_instance_uid)
...@@ -4823,20 +4829,134 @@ class TestVifibSlapWebService(testVifibMixin): ...@@ -4823,20 +4829,134 @@ class TestVifibSlapWebService(testVifibMixin):
""" """
sequence_list = SequenceList() sequence_list = SequenceList()
sequence_string = self.prepare_install_requested_computer_partition_sequence_string + """ sequence_string = self.prepare_install_requested_computer_partition_sequence_string + """
Tic
SlapLoginCurrentComputer SlapLoginCurrentComputer
CheckEmptySlaveInstanceListFromOneComputerPartition CheckEmptySlaveInstanceListFromOneComputerPartition
LoginAsCustomerA
PersonRequestSlaveInstance
SlapLogout
LoginDefaultUser
ConfirmOrderedSaleOrderActiveSense
Tic Tic
SlapLoginCurrentComputer
CheckSlaveInstanceListFromOneComputerPartition
SlapLogout SlapLogout
"""
sequence_list.addSequenceString(sequence_string)
sequence_list.play(self)
def stepCheckSlaveInstanceAccessUsingCurrentSoftwareInstanceUser(self, sequence):
slave_instance = self.portal.portal_catalog.getResultValue(
uid=sequence['software_instance_uid'])
portal_membership = self.portal.portal_membership
username = portal_membership.getAuthenticatedMember().getUserName()
self.assertUserCanViewDocument(username, slave_instance)
self.assertUserCanAccessDocument(username, slave_instance)
def stepSlapLoginSoftwareInstanceFromCurrentSoftwareInstance(self, sequence):
computer_partition = self.portal.portal_catalog.getResultValue(
uid=sequence["computer_partition_uid"])
sale_packing_list_line_list = self.portal.portal_catalog(
portal_type="Sale Packing List Line",
aggregate_uid=computer_partition.getUid())
for sale_packing_list_line in sale_packing_list_line_list:
software_instance = sale_packing_list_line.getAggregateValue(
portal_type="Software Instance")
if software_instance is not None:
self.stepSlapLogout()
global REMOTE_USER
REMOTE_USER = software_instance.getReference()
self.login(software_instance.getReference())
break
def stepCheckSalePackingListFromSlaveInstanceAccessUsingSoftwareInstanceUser(self,
sequence):
portal_membership = self.portal.portal_membership
sale_packing_list_line = self.portal.portal_catalog.getResultValue(
portal_type="Sale Packing List Line",
uid=sequence["sale_packing_list_line_uid"])
username = portal_membership.getAuthenticatedMember().getUserName()
self.assertUserCanViewDocument(username, sale_packing_list_line)
self.failIfUserCanModifyDocument(username, sale_packing_list_line)
def stepCheckHostingSubscriptionFromSlaveInstanceAccessUsingSoftwareInstanceUser(self,
sequence):
portal_membership = self.portal.portal_membership
sale_packing_list_line = self.portal.portal_catalog.getResultValue(
portal_type="Sale Packing List Line",
uid=sequence["sale_packing_list_line_uid"])
hosting_subscription = sale_packing_list_line.getAggregateValue(
portal_type="Hosting Subscription")
username = portal_membership.getAuthenticatedMember().getUserName()
self.assertUserCanViewDocument(username, hosting_subscription)
self.failIfUserCanModifyDocument(username, hosting_subscription)
def stepStoreSalePackingListLineFromSlaveInstance(self, sequence):
sale_packing_list_line = self.portal.portal_catalog.getResultValue(
portal_type="Sale Packing List Line",
aggregate_uid=sequence["software_instance_uid"])
sequence.edit(sale_packing_list_line_uid=sale_packing_list_line.getUid(),
sale_packing_list_uid=sale_packing_list_line.getParent().getUid())
def test_SlaveInstance_security_with_SoftwareInstance_user(self):
"""
Check that the software instance user can access a Slave Instance
installed in the same computer partition than your software instance
"""
sequence_list = SequenceList()
sequence_string = self.prepare_install_requested_computer_partition_sequence_string + """
Tic Tic
LoginAsCustomerA SlapLoginCurrentComputer
CheckEmptySlaveInstanceListFromOneComputerPartition
LoginTestVifibCustomer
PersonRequestSlaveInstance PersonRequestSlaveInstance
SlapLogout SlapLogout
LoginDefaultUser LoginDefaultUser
ConfirmOrderedSaleOrderActiveSense ConfirmOrderedSaleOrderActiveSense
Tic Tic
StoreSalePackingListLineFromSlaveInstance
SlapLoginCurrentComputer SlapLoginCurrentComputer
CheckSlaveInstanceListFromOneComputerPartition CheckSlaveInstanceListFromOneComputerPartition
SlapLoginSoftwareInstanceFromCurrentSoftwareInstance
CheckSlaveInstanceAccessUsingCurrentSoftwareInstanceUser
CheckSalePackingListFromSlaveInstanceAccessUsingSoftwareInstanceUser
CheckHostingSubscriptionFromSlaveInstanceAccessUsingSoftwareInstanceUser
SlapLogout
"""
sequence_list.addSequenceString(sequence_string)
sequence_list.play(self)
def stepSetConnectionXmlToSlaveInstance(self, sequence):
computer_reference = sequence["computer_reference"]
computer_partition_reference = sequence["computer_partition_reference"]
connection_dict = dict(site_url="https://www.example.com:8080/DeF45uef")
slave_reference = sequence["software_instance_reference"]
self.slap = slap.slap()
self.slap.initializeConnection(self.server_url)
computer_partition = self.slap.registerComputerPartition(
computer_reference, computer_partition_reference)
computer_partition.setConnectionDict(connection_dict,
slave_reference)
@skip("Not finished yet")
def test_SlaveInstance_update_connection_xml(self):
"""
Check that the connection_xml will be update correctly using portal_slap
"""
sequence_list = SequenceList()
sequence_string = self.prepare_install_requested_computer_partition_sequence_string + """
Tic
SlapLoginCurrentComputer
CheckEmptySlaveInstanceListFromOneComputerPartition
LoginAsCustomerA
PersonRequestSlaveInstance
SlapLogout SlapLogout
LoginDefaultUser
ConfirmOrderedSaleOrderActiveSense
Tic
SlapLoginSoftwareInstanceFromCurrentComputerPartition
Stop
SetConnectionXmlToSlaveInstance
""" """
sequence_list.addSequenceString(sequence_string) sequence_list.addSequenceString(sequence_string)
sequence_list.play(self) sequence_list.play(self)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment