public void CombiningMultipleRules() { InsertCurrentPrincipal(); // Not related to row permissions. // Insert the test data (server code bypasses row permissions): using (var container = new RhetosTestContainer(commitChanges: true)) { var repository = container.Resolve<Common.DomRepository>(); var context = container.Resolve<Common.ExecutionContext>(); repository.DemoRowPermissions2.DocumentApproval.Delete(repository.DemoRowPermissions2.DocumentApproval.All()); repository.DemoRowPermissions2.DocumentComment.Delete(repository.DemoRowPermissions2.DocumentComment.All()); repository.DemoRowPermissions2.Document.Delete(repository.DemoRowPermissions2.Document.All()); repository.DemoRowPermissions2.RegionSupervisor.Delete(repository.DemoRowPermissions2.RegionSupervisor.All()); repository.DemoRowPermissions2.Employee.Delete(repository.DemoRowPermissions2.Employee.All()); repository.DemoRowPermissions2.Division.Delete(repository.DemoRowPermissions2.Division.All()); repository.DemoRowPermissions2.Region.Delete(repository.DemoRowPermissions2.Region.All()); var reg3 = new DemoRowPermissions2.Region { Name = "reg3" }; repository.DemoRowPermissions2.Region.Insert(new[] { reg3 }); var div1 = new DemoRowPermissions2.Division { Name = "div1" }; var div2 = new DemoRowPermissions2.Division { Name = "div2" }; var div3 = new DemoRowPermissions2.Division { Name = "div3", Region = reg3 }; repository.DemoRowPermissions2.Division.Insert(new[] { div1, div2, div3 }); // The current user: var emp1 = new DemoRowPermissions2.Employee { UserName = context.UserInfo.UserName, Division = div1 }; repository.DemoRowPermissions2.Employee.Insert(new[] { emp1 }); var sup3 = new DemoRowPermissions2.RegionSupervisor { Employee = emp1, Region = reg3 }; repository.DemoRowPermissions2.RegionSupervisor.Insert(new[] { sup3 }); // The user can access doc1, because it's in the same division: var doc1 = new DemoRowPermissions2.Document { Title = "doc1", Division = div1 }; // The user cannot access doc2: var doc2 = new DemoRowPermissions2.Document { Title = "doc2", Division = div2 }; // The user can access doc3, because it's in the region he supervises: var doc3 = new DemoRowPermissions2.Document { Title = "doc3", Division = div3 }; // The user can access doc4 (same division), but cannot edit it (previous year): var doc4 = new DemoRowPermissions2.Document { Title = "doc4", Division = div1, Created = DateTime.Now.AddYears(-1) }; repository.DemoRowPermissions2.Document.Insert(new[] { doc1, doc2, doc3, doc4 }); } // Simulate client request: Reading all documents (access denied) using (var container = new NoClaimsRhetosTestContainer()) { var processingEngine = container.Resolve<IProcessingEngine>(); var serverCommand = new ReadCommandInfo { DataSource = typeof(DemoRowPermissions2.Document).FullName, ReadRecords = true }; var serverResponse = processingEngine.Execute(new[] { serverCommand }); var report = GenerateReport(serverResponse); Console.WriteLine("Server response: " + report); Assert.IsTrue(report.Contains("You are not authorized")); } // Simulate client request: Reading the user's documents using (var container = new NoClaimsRhetosTestContainer()) { var processingEngine = container.Resolve<IProcessingEngine>(); var serverCommand = new ReadCommandInfo { DataSource = typeof(DemoRowPermissions2.Document).FullName, ReadRecords = true, Filters = new[] { new FilterCriteria(typeof(Common.RowPermissionsReadItems)) } }; var serverResponse = processingEngine.Execute(new[] { serverCommand }); var report = GenerateReport(serverResponse); Console.WriteLine("Server response: " + report); Assert.AreEqual("doc1, doc3, doc4", report); } // Simulate client request: Edit doc1 (ok) using (var container = new NoClaimsRhetosTestContainer()) { var repository = container.Resolve<Common.DomRepository>(); var doc1 = repository.DemoRowPermissions2.Document.Query().Where(d => d.Title == "doc1").Single(); doc1.Title += "x"; var processingEngine = container.Resolve<IProcessingEngine>(); var serverCommand = new SaveEntityCommandInfo { Entity = typeof(DemoRowPermissions2.Document).FullName, DataToUpdate = new[] { doc1 } }; var serverResponse = processingEngine.Execute(new[] { serverCommand }); var report = GenerateReport(serverResponse); Console.WriteLine("Server response: " + report); Assert.AreEqual("Comand executed", report); var documents = repository.DemoRowPermissions2.Document.Query().Select(d => d.Title).OrderBy(t => t); Assert.AreEqual("doc1x, doc2, doc3, doc4", string.Join(", ", documents)); } // Simulate client request: Edit doc4 (acces denied) using (var container = new NoClaimsRhetosTestContainer()) { var repository = container.Resolve<Common.DomRepository>(); var doc4 = repository.DemoRowPermissions2.Document.Query().Where(d => d.Title == "doc4").Single(); doc4.Title += "x"; var processingEngine = container.Resolve<IProcessingEngine>(); var serverCommand = new SaveEntityCommandInfo { Entity = typeof(DemoRowPermissions2.Document).FullName, DataToUpdate = new[] { doc4 } }; var serverResponse = processingEngine.Execute(new[] { serverCommand }); var report = GenerateReport(serverResponse); Console.WriteLine("Server response: " + report); Assert.IsTrue(report.Contains("Insufficient permissions")); } }
public void SimpleRowPermissionRules() { InsertCurrentPrincipal(); // Not related to row permissions. // Insert the test data (server code bypasses row permissions): using (var container = new RhetosTestContainer(commitChanges: true)) { var repository = container.Resolve<Common.DomRepository>(); var context = container.Resolve<Common.ExecutionContext>(); repository.DemoRowPermissions1.Document.Delete(repository.DemoRowPermissions1.Document.All()); repository.DemoRowPermissions1.Employee.Delete(repository.DemoRowPermissions1.Employee.All()); repository.DemoRowPermissions1.Division.Delete(repository.DemoRowPermissions1.Division.All()); var div1 = new DemoRowPermissions1.Division { Name = "div1" }; var div2 = new DemoRowPermissions1.Division { Name = "div2" }; repository.DemoRowPermissions1.Division.Insert(new[] { div1, div2 }); // The current user: var emp1 = new DemoRowPermissions1.Employee { UserName = context.UserInfo.UserName, Division = div1 }; repository.DemoRowPermissions1.Employee.Insert(new[] { emp1 }); // The user can access doc1, because it's in the same division: var doc1 = new DemoRowPermissions1.Document { Title = "doc1", Division = div1 }; // The user cannot access doc2: var doc2 = new DemoRowPermissions1.Document { Title = "doc2", Division = div2 }; repository.DemoRowPermissions1.Document.Insert(new[] { doc1, doc2 }); } // Simulate client request: Reading all documents (access denied) using (var container = new NoClaimsRhetosTestContainer()) { var processingEngine = container.Resolve<IProcessingEngine>(); var serverCommand = new ReadCommandInfo { DataSource = typeof(DemoRowPermissions1.Document).FullName, ReadRecords = true }; var serverResponse = processingEngine.Execute(new[] { serverCommand }); var report = GenerateReport(serverResponse); Console.WriteLine("Server response: " + report); Assert.IsTrue(report.Contains("You are not authorized")); } // Simulate client request: Reading the user's documents using (var container = new NoClaimsRhetosTestContainer()) { var processingEngine = container.Resolve<IProcessingEngine>(); var serverCommand = new ReadCommandInfo { DataSource = typeof(DemoRowPermissions1.Document).FullName, ReadRecords = true, Filters = new[] { new FilterCriteria(typeof(Common.RowPermissionsReadItems)) } }; var serverResponse = processingEngine.Execute(new[] { serverCommand }); var report = GenerateReport(serverResponse); Console.WriteLine("Server response: " + report); Assert.AreEqual("doc1", report); } }