Examples with UserAccess org.hisp.dhis.user.sharing.UserAccess used on opensource projects

Example 16 with UserAccess

use of org.hisp.dhis.user.sharing.UserAccess in project dhis2-core by dhis2.

the class AclServiceTest method testUserCantUpdateDeletePrivateDashboard.

@Test
void testUserCantUpdateDeletePrivateDashboard() {
    User user1 = createUser('A');
    User user2 = createUser('B');
    manager.save(user1);
    manager.save(user2);
    Dashboard dashboard = new Dashboard("Dashboard");
    dashboard.setCreatedBy(user1);
    dashboard.getSharing().setOwner(user1);
    dashboard.setAutoFields();
    manager.save(dashboard);
    assertTrue(aclService.canRead(user1, dashboard));
    assertTrue(aclService.canUpdate(user1, dashboard));
    assertTrue(aclService.canDelete(user1, dashboard));
    assertTrue(aclService.canManage(user1, dashboard));
    UserAccess userAccess = new UserAccess();
    userAccess.setUser(user2);
    userAccess.setAccess(AccessStringHelper.READ);
    dashboard.getSharing().addUserAccess(userAccess);
    assertTrue(aclService.canRead(user2, dashboard));
    assertFalse(aclService.canUpdate(user2, dashboard));
    assertFalse(aclService.canDelete(user2, dashboard));
    assertFalse(aclService.canManage(user2, dashboard));
}

Example 17 with UserAccess

use of org.hisp.dhis.user.sharing.UserAccess in project dhis2-core by dhis2.

the class AclServiceTest method testUserBCanUpdateEventVisualizationWithoutAuthority.

@Test
void testUserBCanUpdateEventVisualizationWithoutAuthority() {
    // Given
    User userA = createUser('A');
    manager.save(userA);
    EventVisualization eventVisualization = new EventVisualization();
    eventVisualization.setAutoFields();
    eventVisualization.setName("FavA");
    eventVisualization.setCreatedBy(userA);
    eventVisualization.getSharing().setOwner(userA);
    eventVisualization.setPublicAccess(AccessStringHelper.DEFAULT);
    eventVisualization.setType(EventVisualizationType.COLUMN);
    assertTrue(aclService.canUpdate(userA, eventVisualization));
    manager.save(eventVisualization);
    // Then
    User userB = createUser('B');
    manager.save(userB);
    eventVisualization.getSharing().addUserAccess(new UserAccess(userB, AccessStringHelper.FULL));
    manager.update(eventVisualization);
    assertTrue(aclService.canUpdate(userB, eventVisualization));
}

Example 18 with UserAccess

use of org.hisp.dhis.user.sharing.UserAccess in project dhis2-core by dhis2.

the class MetadataImportServiceTest method testImportWithSkipSharingIsTrueAndNoPermission.

/**
 * User only have READ access to Dashboard object User try to update
 * Dashboard with: skipSharing=true, and payload doesn't include sharing
 * data. Expected: import error
 */
@Test
void testImportWithSkipSharingIsTrueAndNoPermission() {
    clearSecurityContext();
    User userA = createUser("A");
    userService.addUser(userA);
    Dashboard dashboard = new Dashboard();
    dashboard.setName("DashboardA");
    Sharing sharing = new Sharing();
    sharing.addUserAccess(new UserAccess(userA, AccessStringHelper.READ));
    dashboard.setSharing(sharing);
    Map<Class<? extends IdentifiableObject>, List<IdentifiableObject>> metadata = new HashMap<>();
    metadata.put(Dashboard.class, Collections.singletonList(dashboard));
    MetadataImportParams params = createParams(ImportStrategy.CREATE, metadata);
    params.setSkipSharing(false);
    // Create Dashboard
    ImportReport report = importService.importMetadata(params);
    assertEquals(Status.OK, report.getStatus());
    // Check sharing data
    IdentifiableObject savedDashboard = manager.get(Dashboard.class, dashboard.getUid());
    boolean condition = aclService.canWrite(userA, savedDashboard);
    assertFalse(condition);
    assertTrue(aclService.canRead(userA, savedDashboard));
    // Update dashboard with skipSharing=true and no sharing data in payload
    dashboard.setSharing(null);
    metadata.put(Dashboard.class, Collections.singletonList(dashboard));
    params = createParams(ImportStrategy.UPDATE, metadata);
    params.setSkipSharing(true);
    params.setUser(userA);
    report = importService.importMetadata(params);
    assertEquals(Status.ERROR, report.getStatus());
}

Example 19 with UserAccess

use of org.hisp.dhis.user.sharing.UserAccess in project dhis2-core by dhis2.

the class MetadataImportServiceTest method testImportWithSkipSharingIsTrueAndWritePermission.

/**
 * User have READ-WRITE access to Dashboard object User try to update
 * Dashboard with: skipSharing=true, and payload doesn't include sharing
 * data. Expected: import successfully
 */
@Test
void testImportWithSkipSharingIsTrueAndWritePermission() {
    User userA = createUser('A');
    userService.addUser(userA);
    injectSecurityContext(userA);
    Dashboard dashboard = new Dashboard();
    dashboard.setName("DashboardA");
    Sharing sharing = new Sharing();
    sharing.setPublicAccess(AccessStringHelper.DEFAULT);
    sharing.addUserAccess(new UserAccess(userA, AccessStringHelper.READ_WRITE));
    dashboard.setSharing(sharing);
    Map<Class<? extends IdentifiableObject>, List<IdentifiableObject>> metadata = new HashMap<>();
    metadata.put(Dashboard.class, Collections.singletonList(dashboard));
    MetadataImportParams params = createParams(ImportStrategy.CREATE, metadata);
    params.setSkipSharing(false);
    // Create Dashboard
    ImportReport report = importService.importMetadata(params);
    assertEquals(Status.OK, report.getStatus());
    // Check all sharing data
    IdentifiableObject savedDashboard = manager.get(Dashboard.class, dashboard.getUid());
    assertTrue(aclService.canWrite(userA, savedDashboard));
    assertTrue(aclService.canRead(userA, savedDashboard));
    // Update Dashboard with skipSharing=true and no sharing data in payload
    dashboard.setSharing(null);
    metadata.put(Dashboard.class, Collections.singletonList(dashboard));
    params = createParams(ImportStrategy.UPDATE, metadata);
    params.setSkipSharing(true);
    params.setUser(userA);
    report = importService.importMetadata(params);
    assertEquals(Status.OK, report.getStatus());
}

Example 20 with UserAccess

use of org.hisp.dhis.user.sharing.UserAccess in project dhis2-core by dhis2.

the class DefaultAclStoreTest method getAccessibleProgramsReturnsUserAccessibleOnes.

@Test
void getAccessibleProgramsReturnsUserAccessibleOnes() {
    // a private program
    Program programA = createProgram('A');
    programA.setPublicAccess("--------");
    programA.getSharing().setOwner(owner);
    manager.save(programA, false);
    // a private program readable by the user
    Program programB = createProgram('B');
    programB.setPublicAccess("--------");
    programB.getSharing().setOwner(owner);
    UserAccess a = new UserAccess();
    a.setUser(user);
    a.setAccess("--r-----");
    programB.getSharing().addUserAccess(a);
    manager.save(programB, false);
    List<Long> programIds = aclStore.getAccessiblePrograms(user.getUid(), Collections.emptyList());
    assertContainsOnly(programIds, programB.getId());
}