AccessTest.php

<?php

declare (strict_types=1);
namespace Drupal\Tests\file\Kernel;

use Drupal\file\Entity\File;
use Drupal\KernelTests\KernelTestBase;
use Drupal\Tests\TestFileCreationTrait;
use Drupal\Tests\user\Traits\UserCreationTrait;
use Drupal\user\Entity\User;

/**
 * Tests for the File access control.
 *
 * @group file
 */
class AccessTest extends KernelTestBase {
  use UserCreationTrait;
  use TestFileCreationTrait;
  
  /**
   * {@inheritdoc}
   */
  protected static $modules = [
    'file',
    'system',
    'user',
  ];
  
  /**
   * {@inheritdoc}
   */
  protected function setUp() : void {
    parent::setUp();
    $this->installEntitySchema('file');
    $this->installEntitySchema('user');
    $this->installSchema('file', [
      'file_usage',
    ]);
  }
  
  /**
   * Tests 'update' and 'delete' access to file entities.
   */
  public function testFileAccess() : void {
    // Create a user so the tested users do not have the magic ID of user 1.
    $this->createUser();
    $user_any = $this->createUser([
      'delete any file',
    ]);
    $this->assertGreaterThan(1, (int) $user_any->id());
    $user_own = $this->createUser([
      'delete own files',
    ]);
    $test_files = $this->getTestFiles('text');
    $file1 = File::create((array) $test_files[0]);
    $file1->set('uid', $user_any->id());
    $file1->save();
    $file2 = File::create((array) $test_files[1]);
    $file2->set('uid', $user_own->id());
    $file2->save();
    // User with "* any file" permissions should delete all files and update
    // their own.
    $this->assertTrue($file1->access('delete', $user_any));
    $this->assertTrue($file1->access('update', $user_any));
    $this->assertTrue($file2->access('delete', $user_any));
    $this->assertFalse($file2->access('update', $user_any));
    // User with "* own files" permissions should access only own files.
    $this->assertFalse($file1->access('delete', $user_own));
    $this->assertFalse($file1->access('update', $user_own));
    $this->assertTrue($file2->access('delete', $user_own));
    $this->assertTrue($file2->access('update', $user_own));
    // Ensure cacheability metadata is correct.
    /** @var \Drupal\Core\Access\AccessResult $access */
    $access = $file2->access('delete', $user_any, TRUE);
    $this->assertSame([
      'user.permissions',
    ], $access->getCacheContexts());
    $this->assertSame([], $access->getCacheTags());
    /** @var \Drupal\Core\Access\AccessResult $access */
    $access = $file2->access('delete', $user_own, TRUE);
    $this->assertSame([
      'user.permissions',
      'user',
    ], $access->getCacheContexts());
    $this->assertSame([
      'file:2',
    ], $access->getCacheTags());
    /** @var \Drupal\Core\Access\AccessResult $access */
    $access = $file2->access('update', $user_any, TRUE);
    $this->assertSame([], $access->getCacheContexts());
    $this->assertSame([], $access->getCacheTags());
    /** @var \Drupal\Core\Access\AccessResult $access */
    $access = $file2->access('update', $user_own, TRUE);
    $this->assertSame([], $access->getCacheContexts());
    $this->assertSame([], $access->getCacheTags());
    // User without permissions should not be able to delete files even if they
    // are the owner.
    $user_none = $this->createUser();
    $file3 = File::create([
      'uid' => $user_none->id(),
      'filename' => 'druplicon.txt',
      'filemime' => 'text/plain',
    ]);
    $this->assertFalse($file3->access('delete', $user_none));
    $this->assertTrue($file3->access('update', $user_none));
    // Create a file with no user entity.
    $file4 = File::create([
      'filename' => 'druplicon.txt',
      'filemime' => 'text/plain',
    ]);
    $this->assertFalse($file4->access('delete', $user_own));
    $this->assertFalse($file4->access('update', $user_own));
    $this->assertTrue($file4->access('delete', $user_any));
    $this->assertFalse($file4->access('update', $user_any));
  }
  
  /**
   * Tests file entity field access.
   *
   * @see \Drupal\file\FileAccessControlHandler::checkFieldAccess()
   */
  public function testCheckFieldAccess() : void {
    $this->setUpCurrentUser();
    /** @var \Drupal\file\FileInterface $file */
    $file = File::create([
      'uri' => 'public://test.png',
    ]);
    // While creating a file entity access will be allowed for create-only
    // fields.
    $this->assertTrue($file->get('uri')
      ->access('edit'));
    $this->assertTrue($file->get('filemime')
      ->access('edit'));
    $this->assertTrue($file->get('filesize')
      ->access('edit'));
    // Access to the status field is denied whilst creating a file entity.
    $this->assertFalse($file->get('status')
      ->access('edit'));
    $file->save();
    // After saving the entity is no longer new and, therefore, access to
    // create-only fields and the status field will be denied.
    $this->assertFalse($file->get('uri')
      ->access('edit'));
    $this->assertFalse($file->get('filemime')
      ->access('edit'));
    $this->assertFalse($file->get('filesize')
      ->access('edit'));
    $this->assertFalse($file->get('status')
      ->access('edit'));
  }
  
  /**
   * Tests create access is always denied even for user 1.
   *
   * @see \Drupal\file\FileAccessControlHandler::checkCreateAccess()
   */
  public function testCreateAccess() : void {
    $user1 = $this->createUser([
      'delete own files',
    ]);
    $this->assertSame('1', $user1->id());
    $file = File::create([
      'uid' => $user1->id(),
      'filename' => 'druplicon.txt',
      'filemime' => 'text/plain',
    ]);
    $this->assertFalse($file->access('create'));
    \Drupal::currentUser()->setAccount($user1);
    $this->assertFalse($file->access('create'));
  }
  
  /**
   * Tests cacheability metadata.
   */
  public function testFileCacheability() : void {
    $file = File::create([
      'filename' => 'green-scarf',
      'uri' => 'private://green-scarf',
      'filemime' => 'text/plain',
    ]);
    $file->setPermanent();
    $file->save();
    \Drupal::service('session')->set('anonymous_allowed_file_ids', [
      $file->id() => $file->id(),
    ]);
    $account = User::getAnonymousUser();
    $file->setOwnerId($account->id())
      ->save();
    $this->assertSame([
      'session',
      'user',
    ], $file->access('view', $account, TRUE)
      ->getCacheContexts());
    $this->assertSame([
      'session',
      'user',
    ], $file->access('download', $account, TRUE)
      ->getCacheContexts());
    $account = $this->createUser();
    $file->setOwnerId($account->id())
      ->save();
    $this->assertSame([
      'user',
    ], $file->access('view', $account, TRUE)
      ->getCacheContexts());
    $this->assertSame([
      'user',
    ], $file->access('download', $account, TRUE)
      ->getCacheContexts());
  }

}