Added application and project roles validation for API procedure calls

21 files changed, 345 insertions, 44 deletions

diff --git a/tests/integration/ActionTest.php b/tests/integration/ActionProcedureTest.php
index 7a5adc4a..432de3d3 100644
--- a/tests/integration/ActionTest.php
+++ b/tests/integration/ActionProcedureTest.php
@@ -1,8 +1,8 @@
 <?php
 
-require_once __DIR__.'/BaseIntegrationTest.php';
+require_once __DIR__.'/BaseProcedureTest.php';
 
-class ActionTest extends BaseIntegrationTest
+class ActionProcedureTest extends BaseProcedureTest
 {
     protected $projectName = 'My project to test actions';
 
diff --git a/tests/integration/AppTest.php b/tests/integration/AppProcedureTest.php
index 287e6299..06135dac 100644
--- a/tests/integration/AppTest.php
+++ b/tests/integration/AppProcedureTest.php
@@ -1,8 +1,8 @@
 <?php
 
-require_once __DIR__.'/BaseIntegrationTest.php';
+require_once __DIR__.'/BaseProcedureTest.php';
 
-class AppTest extends BaseIntegrationTest
+class AppProcedureTest extends BaseProcedureTest
 {
     public function testGetTimezone()
     {
diff --git a/tests/integration/BaseIntegrationTest.php b/tests/integration/BaseProcedureTest.php
index cd837173..e3382e82 100644
--- a/tests/integration/BaseIntegrationTest.php
+++ b/tests/integration/BaseProcedureTest.php
@@ -2,7 +2,7 @@
 
 require_once __DIR__.'/../../vendor/autoload.php';
 
-abstract class BaseIntegrationTest extends PHPUnit_Framework_TestCase
+abstract class BaseProcedureTest extends PHPUnit_Framework_TestCase
 {
     protected $app = null;
     protected $admin = null;
diff --git a/tests/integration/BoardTest.php b/tests/integration/BoardProcedureTest.php
index aa0f61ff..273e93c7 100644
--- a/tests/integration/BoardTest.php
+++ b/tests/integration/BoardProcedureTest.php
@@ -1,8 +1,8 @@
 <?php
 
-require_once __DIR__.'/BaseIntegrationTest.php';
+require_once __DIR__.'/BaseProcedureTest.php';
 
-class BoardTest extends BaseIntegrationTest
+class BoardProcedureTest extends BaseProcedureTest
 {
     protected $projectName = 'My project to test board';
 
diff --git a/tests/integration/CategoryTest.php b/tests/integration/CategoryProcedureTest.php
index c1aec0bc..2f5294ba 100644
--- a/tests/integration/CategoryTest.php
+++ b/tests/integration/CategoryProcedureTest.php
@@ -1,8 +1,8 @@
 <?php
 
-require_once __DIR__.'/BaseIntegrationTest.php';
+require_once __DIR__.'/BaseProcedureTest.php';
 
-class CategoryTest extends BaseIntegrationTest
+class CategoryProcedureTest extends BaseProcedureTest
 {
     protected $projectName = 'My project to test categories';
     private $categoryId = 0;
diff --git a/tests/integration/ColumnTest.php b/tests/integration/ColumnProcedureTest.php
index 5a81badc..fb6a27c3 100644
--- a/tests/integration/ColumnTest.php
+++ b/tests/integration/ColumnProcedureTest.php
@@ -1,8 +1,8 @@
 <?php
 
-require_once __DIR__.'/BaseIntegrationTest.php';
+require_once __DIR__.'/BaseProcedureTest.php';
 
-class ColumnTest extends BaseIntegrationTest
+class ColumnProcedureTest extends BaseProcedureTest
 {
     protected $projectName = 'My project to test columns';
     private $columns = array();
diff --git a/tests/integration/CommentTest.php b/tests/integration/CommentProcedureTest.php
index 34376838..881d938c 100644
--- a/tests/integration/CommentTest.php
+++ b/tests/integration/CommentProcedureTest.php
@@ -1,8 +1,8 @@
 <?php
 
-require_once __DIR__.'/BaseIntegrationTest.php';
+require_once __DIR__.'/BaseProcedureTest.php';
 
-class CommentTest extends BaseIntegrationTest
+class CommentProcedureTest extends BaseProcedureTest
 {
     protected $projectName = 'My project to test comments';
     private $commentId = 0;
diff --git a/tests/integration/GroupMemberTest.php b/tests/integration/GroupMemberProcedureTest.php
index f79499a4..fe243533 100644
--- a/tests/integration/GroupMemberTest.php
+++ b/tests/integration/GroupMemberProcedureTest.php
@@ -1,8 +1,8 @@
 <?php
 
-require_once __DIR__.'/BaseIntegrationTest.php';
+require_once __DIR__.'/BaseProcedureTest.php';
 
-class GroupMemberTest extends BaseIntegrationTest
+class GroupMemberProcedureTest extends BaseProcedureTest
 {
     protected $username = 'user-group-member';
     protected $groupName1 = 'My group member A';
diff --git a/tests/integration/GroupTest.php b/tests/integration/GroupProcedureTest.php
index ffcd7a71..610c121d 100644
--- a/tests/integration/GroupTest.php
+++ b/tests/integration/GroupProcedureTest.php
@@ -1,8 +1,8 @@
 <?php
 
-require_once __DIR__.'/BaseIntegrationTest.php';
+require_once __DIR__.'/BaseProcedureTest.php';
 
-class GroupTest extends BaseIntegrationTest
+class GroupProcedureTest extends BaseProcedureTest
 {
     public function testAll()
     {
diff --git a/tests/integration/LinkTest.php b/tests/integration/LinkProcedureTest.php
index 16b16e50..fb07e694 100644
--- a/tests/integration/LinkTest.php
+++ b/tests/integration/LinkProcedureTest.php
@@ -1,8 +1,8 @@
 <?php
 
-require_once __DIR__.'/BaseIntegrationTest.php';
+require_once __DIR__.'/BaseProcedureTest.php';
 
-class LinkTest extends BaseIntegrationTest
+class LinkProcedureTest extends BaseProcedureTest
 {
     public function testGetAllLinks()
     {
diff --git a/tests/integration/MeTest.php b/tests/integration/MeProcedureTest.php
index 047ebf85..2106419c 100644
--- a/tests/integration/MeTest.php
+++ b/tests/integration/MeProcedureTest.php
@@ -1,8 +1,8 @@
 <?php
 
-require_once __DIR__.'/BaseIntegrationTest.php';
+require_once __DIR__.'/BaseProcedureTest.php';
 
-class MeTest extends BaseIntegrationTest
+class MeProcedureTest extends BaseProcedureTest
 {
     protected $projectName = 'My private project';
 
@@ -41,11 +41,6 @@ class MeTest extends BaseIntegrationTest
     {
         $projects = $this->user->getMyProjects();
         $this->assertNotEmpty($projects);
-        $this->assertCount(1, $projects);
-        $this->assertEquals($this->projectName, $projects[0]['name']);
-        $this->assertNotEmpty($projects[0]['url']['calendar']);
-        $this->assertNotEmpty($projects[0]['url']['board']);
-        $this->assertNotEmpty($projects[0]['url']['list']);
     }
 
     public function assertCreateTask()
diff --git a/tests/integration/OverdueTaskTest.php b/tests/integration/OverdueTaskProcedureTest.php
index 1dea5030..65f52301 100644
--- a/tests/integration/OverdueTaskTest.php
+++ b/tests/integration/OverdueTaskProcedureTest.php
@@ -1,8 +1,8 @@
 <?php
 
-require_once __DIR__.'/BaseIntegrationTest.php';
+require_once __DIR__.'/BaseProcedureTest.php';
 
-class OverdueTaskTest extends BaseIntegrationTest
+class OverdueTaskProcedureTest extends BaseProcedureTest
 {
     protected $projectName = 'My project to test overdue tasks';
 
diff --git a/tests/integration/ProcedureAuthorizationTest.php b/tests/integration/ProcedureAuthorizationTest.php
new file mode 100644
index 00000000..a63e9d8c
--- /dev/null
+++ b/tests/integration/ProcedureAuthorizationTest.php
@@ -0,0 +1,306 @@
+<?php
+
+require_once __DIR__.'/BaseProcedureTest.php';
+
+class ProcedureAuthorizationTest extends BaseProcedureTest
+{
+    public function testApiCredentialDoNotHaveAccessToUserCredentialProcedure()
+    {
+        $this->setExpectedException('JsonRPC\Exception\AccessDeniedException');
+        $this->app->getMe();
+    }
+
+    public function testUserCredentialDoNotHaveAccessToAdminProcedures()
+    {
+        $this->setExpectedException('JsonRPC\Exception\AccessDeniedException');
+        $this->user->getUser(1);
+    }
+
+    public function testManagerCredentialDoNotHaveAccessToAdminProcedures()
+    {
+        $this->setExpectedException('JsonRPC\Exception\AccessDeniedException');
+        $this->user->getAllProjects();
+    }
+
+    public function testUserCredentialDoNotHaveAccessToManagerProcedures()
+    {
+        $this->setExpectedException('JsonRPC\Exception\AccessDeniedException');
+        $this->user->createProject('Team project creation are only for app managers');
+    }
+
+    public function testAppManagerCanCreateTeamProject()
+    {
+        $this->assertNotFalse($this->manager->createProject('Team project created by app manager'));
+    }
+
+    public function testAdminManagerCanCreateTeamProject()
+    {
+        $projectId = $this->admin->createProject('Team project created by admin');
+        $this->assertNotFalse($projectId);
+
+        $this->setExpectedException('JsonRPC\Exception\AccessDeniedException');
+        $this->assertNotNull($this->manager->getProjectById($projectId));
+    }
+
+    public function testProjectManagerCanUpdateHisProject()
+    {
+        $projectId = $this->manager->createProject(array(
+            'name' => 'Team project can be updated',
+            'owner_id' => $this->managerUserId,
+        ));
+
+        $this->assertNotFalse($projectId);
+        $this->assertEquals('project-manager', $this->app->getProjectUserRole($projectId, $this->managerUserId));
+        $this->assertNotNull($this->manager->getProjectById($projectId));
+
+        $this->assertTrue($this->manager->updateProject($projectId, 'My team project have been updated'));
+    }
+
+    public function testProjectAuthorizationForbidden()
+    {
+        $projectId = $this->manager->createProject('A team project without members');
+        $this->assertNotFalse($projectId);
+
+        $this->setExpectedException('JsonRPC\Exception\AccessDeniedException');
+        $this->user->getProjectById($projectId);
+    }
+
+    public function testProjectAuthorizationGranted()
+    {
+        $projectId = $this->manager->createProject(array(
+            'name' => 'A team project with members',
+            'owner_id' => $this->managerUserId,
+        ));
+
+        $this->assertNotFalse($projectId);
+
+        $this->assertTrue($this->manager->addProjectUser($projectId, $this->userUserId));
+        $this->assertNotNull($this->user->getProjectById($projectId));
+    }
+
+    public function testActionAuthorizationForbidden()
+    {
+        $projectId = $this->manager->createProject(array(
+            'name' => 'Test Project',
+            'owner_id' => $this->managerUserId,
+        ));
+
+        $this->assertNotFalse($projectId);
+
+        $actionId = $this->manager->createAction($projectId, 'task.move.column', '\Kanboard\Action\TaskCloseColumn', array('column_id' => 1));
+        $this->assertNotFalse($actionId);
+
+        $this->setExpectedException('JsonRPC\Exception\AccessDeniedException');
+        $this->user->removeAction($projectId);
+    }
+
+    public function testActionAuthorizationForbiddenBecauseNotProjectManager()
+    {
+        $projectId = $this->manager->createProject(array(
+            'name' => 'Test Project',
+            'owner_id' => $this->managerUserId,
+        ));
+
+        $this->assertNotFalse($projectId);
+
+        $actionId = $this->manager->createAction($projectId, 'task.move.column', '\Kanboard\Action\TaskCloseColumn', array('column_id' => 1));
+        $this->assertNotFalse($actionId);
+
+        $this->assertTrue($this->manager->addProjectUser($projectId, $this->userUserId, 'project-member'));
+
+        $this->setExpectedException('JsonRPC\Exception\AccessDeniedException');
+        $this->user->removeAction($actionId);
+    }
+
+    public function testActionAuthorizationGranted()
+    {
+        $projectId = $this->manager->createProject(array(
+            'name' => 'Test Project',
+            'owner_id' => $this->managerUserId,
+        ));
+
+        $this->assertNotFalse($projectId);
+
+        $actionId = $this->manager->createAction($projectId, 'task.move.column', '\Kanboard\Action\TaskCloseColumn', array('column_id' => 1));
+        $this->assertNotFalse($actionId);
+
+        $this->assertTrue($this->manager->addProjectUser($projectId, $this->userUserId, 'project-manager'));
+        $this->assertTrue($this->user->removeAction($actionId));
+    }
+
+    public function testCategoryAuthorizationForbidden()
+    {
+        $projectId = $this->manager->createProject(array(
+            'name' => 'Test Project',
+            'owner_id' => $this->managerUserId,
+        ));
+
+        $this->assertNotFalse($projectId);
+
+        $categoryId = $this->manager->createCategory($projectId, 'Test');
+        $this->assertNotFalse($categoryId);
+
+        $this->setExpectedException('JsonRPC\Exception\AccessDeniedException');
+        $this->user->removeCategory($categoryId);
+    }
+
+    public function testCategoryAuthorizationForbiddenBecauseNotProjectManager()
+    {
+        $projectId = $this->manager->createProject(array(
+            'name' => 'Test Project',
+            'owner_id' => $this->managerUserId,
+        ));
+
+        $this->assertNotFalse($projectId);
+
+        $categoryId = $this->manager->createCategory($projectId, 'Test');
+        $this->assertNotFalse($categoryId);
+
+        $this->assertTrue($this->manager->addProjectUser($projectId, $this->userUserId, 'project-member'));
+        $this->setExpectedException('JsonRPC\Exception\AccessDeniedException');
+        $this->user->removeCategory($categoryId);
+    }
+
+    public function testCategoryAuthorizationGranted()
+    {
+        $projectId = $this->manager->createProject(array(
+            'name' => 'Test Project',
+            'owner_id' => $this->managerUserId,
+        ));
+
+        $this->assertNotFalse($projectId);
+
+        $categoryId = $this->manager->createCategory($projectId, 'Test');
+        $this->assertNotFalse($categoryId);
+
+        $this->assertTrue($this->manager->addProjectUser($projectId, $this->userUserId, 'project-manager'));
+        $this->assertTrue($this->user->removeCategory($categoryId));
+    }
+
+    public function testColumnAuthorizationForbidden()
+    {
+        $projectId = $this->manager->createProject(array(
+            'name' => 'Test Project',
+            'owner_id' => $this->managerUserId,
+        ));
+
+        $this->assertNotFalse($projectId);
+
+        $columnId = $this->manager->addColumn($projectId, 'Test');
+        $this->assertNotFalse($columnId);
+
+        $this->setExpectedException('JsonRPC\Exception\AccessDeniedException');
+        $this->user->removeColumn($columnId);
+    }
+
+    public function testColumnAuthorizationForbiddenBecauseNotProjectManager()
+    {
+        $projectId = $this->manager->createProject(array(
+            'name' => 'Test Project',
+            'owner_id' => $this->managerUserId,
+        ));
+
+        $this->assertNotFalse($projectId);
+
+        $columnId = $this->manager->addColumn($projectId, 'Test');
+        $this->assertNotFalse($columnId);
+
+        $this->assertTrue($this->manager->addProjectUser($projectId, $this->userUserId, 'project-member'));
+        $this->setExpectedException('JsonRPC\Exception\AccessDeniedException');
+        $this->user->removeColumn($columnId);
+    }
+
+    public function testColumnAuthorizationGranted()
+    {
+        $projectId = $this->manager->createProject(array(
+            'name' => 'Test Project',
+            'owner_id' => $this->managerUserId,
+        ));
+
+        $this->assertNotFalse($projectId);
+
+        $columnId = $this->manager->addColumn($projectId, 'Test');
+        $this->assertNotFalse($columnId);
+
+        $this->assertTrue($this->manager->addProjectUser($projectId, $this->userUserId, 'project-manager'));
+        $this->assertTrue($this->user->removeColumn($columnId));
+    }
+
+    public function testCommentAuthorizationForbidden()
+    {
+        $projectId = $this->manager->createProject(array(
+            'name' => 'Test Project',
+            'owner_id' => $this->managerUserId,
+        ));
+
+        $this->assertNotFalse($projectId);
+        $this->assertTrue($this->manager->addProjectUser($projectId, $this->userUserId, 'project-viewer'));
+
+        $taskId = $this->manager->createTask('My Task', $projectId);
+        $this->assertNotFalse($taskId);
+
+        $commentId = $this->manager->createComment($taskId, $this->userUserId, 'My comment');
+        $this->assertNotFalse($commentId);
+
+        $this->setExpectedException('JsonRPC\Exception\AccessDeniedException');
+        $this->user->updateComment($commentId, 'something else');
+    }
+
+    public function testCommentAuthorizationGranted()
+    {
+        $projectId = $this->manager->createProject(array(
+            'name' => 'Test Project',
+            'owner_id' => $this->managerUserId,
+        ));
+
+        $this->assertNotFalse($projectId);
+        $this->assertTrue($this->manager->addProjectUser($projectId, $this->userUserId, 'project-member'));
+
+        $taskId = $this->user->createTask('My Task', $projectId);
+        $this->assertNotFalse($taskId);
+
+        $commentId = $this->user->createComment($taskId, $this->userUserId, 'My comment');
+        $this->assertNotFalse($commentId);
+
+        $this->assertTrue($this->user->updateComment($commentId, 'something else'));
+    }
+
+    public function testSubtaskAuthorizationForbidden()
+    {
+        $projectId = $this->manager->createProject(array(
+            'name' => 'Test Project',
+            'owner_id' => $this->managerUserId,
+        ));
+
+        $this->assertNotFalse($projectId);
+        $this->assertTrue($this->manager->addProjectUser($projectId, $this->userUserId, 'project-viewer'));
+
+        $taskId = $this->manager->createTask('My Task', $projectId);
+        $this->assertNotFalse($taskId);
+
+        $subtaskId = $this->manager->createSubtask($taskId, 'My subtask');
+        $this->assertNotFalse($subtaskId);
+
+        $this->setExpectedException('JsonRPC\Exception\AccessDeniedException');
+        $this->user->removeSubtask($subtaskId);
+    }
+
+    public function testSubtaskAuthorizationGranted()
+    {
+        $projectId = $this->manager->createProject(array(
+            'name' => 'Test Project',
+            'owner_id' => $this->managerUserId,
+        ));
+
+        $this->assertNotFalse($projectId);
+        $this->assertTrue($this->manager->addProjectUser($projectId, $this->userUserId, 'project-member'));
+
+        $taskId = $this->user->createTask('My Task', $projectId);
+        $this->assertNotFalse($taskId);
+
+        $subtaskId = $this->manager->createSubtask($taskId, 'My subtask');
+        $this->assertNotFalse($subtaskId);
+
+        $this->assertTrue($this->user->removeSubtask($subtaskId));
+    }
+}
diff --git a/tests/integration/ProjectPermissionTest.php b/tests/integration/ProjectPermissionProcedureTest.php
index 3ceda07d..74313dc4 100644
--- a/tests/integration/ProjectPermissionTest.php
+++ b/tests/integration/ProjectPermissionProcedureTest.php
@@ -1,8 +1,8 @@
 <?php
 
-require_once __DIR__.'/BaseIntegrationTest.php';
+require_once __DIR__.'/BaseProcedureTest.php';
 
-class ProjectPermissionTest extends BaseIntegrationTest
+class ProjectPermissionProcedureTest extends BaseProcedureTest
 {
     protected $projectName = 'Project with permission';
     protected $username = 'user-project-permission';
diff --git a/tests/integration/ProjectTest.php b/tests/integration/ProjectProcedureTest.php
index 50d4fc53..1ebd48ae 100644
--- a/tests/integration/ProjectTest.php
+++ b/tests/integration/ProjectProcedureTest.php
@@ -1,8 +1,8 @@
 <?php
 
-require_once __DIR__.'/BaseIntegrationTest.php';
+require_once __DIR__.'/BaseProcedureTest.php';
 
-class ProjectTest extends BaseIntegrationTest
+class ProjectProcedureTest extends BaseProcedureTest
 {
     protected $projectName = 'My team project';
 
diff --git a/tests/integration/SubtaskTest.php b/tests/integration/SubtaskProcedureTest.php
index 10082e60..7ab4ef0b 100644
--- a/tests/integration/SubtaskTest.php
+++ b/tests/integration/SubtaskProcedureTest.php
@@ -1,8 +1,8 @@
 <?php
 
-require_once __DIR__.'/BaseIntegrationTest.php';
+require_once __DIR__.'/BaseProcedureTest.php';
 
-class SubtaskTest extends BaseIntegrationTest
+class SubtaskProcedureTest extends BaseProcedureTest
 {
     protected $projectName = 'My project to test subtasks';
     private $subtaskId = 0;
diff --git a/tests/integration/SwimlaneTest.php b/tests/integration/SwimlaneProcedureTest.php
index 4f703414..e64342b4 100644
--- a/tests/integration/SwimlaneTest.php
+++ b/tests/integration/SwimlaneProcedureTest.php
@@ -1,8 +1,8 @@
 <?php
 
-require_once __DIR__.'/BaseIntegrationTest.php';
+require_once __DIR__.'/BaseProcedureTest.php';
 
-class SwimlaneTest extends BaseIntegrationTest
+class SwimlaneProcedureTest extends BaseProcedureTest
 {
     protected $projectName = 'My project to test swimlanes';
     private $swimlaneId = 0;
diff --git a/tests/integration/TaskFileTest.php b/tests/integration/TaskFileProcedureTest.php
index 7e9e943b..61155555 100644
--- a/tests/integration/TaskFileTest.php
+++ b/tests/integration/TaskFileProcedureTest.php
@@ -1,8 +1,8 @@
 <?php
 
-require_once __DIR__.'/BaseIntegrationTest.php';
+require_once __DIR__.'/BaseProcedureTest.php';
 
-class TaskFileTest extends BaseIntegrationTest
+class TaskFileProcedureTest extends BaseProcedureTest
 {
     protected $projectName = 'My project to test task files';
     protected $fileId;
diff --git a/tests/integration/TaskLinkTest.php b/tests/integration/TaskLinkProcedureTest.php
index 03bc437b..a25fced5 100644
--- a/tests/integration/TaskLinkTest.php
+++ b/tests/integration/TaskLinkProcedureTest.php
@@ -1,8 +1,8 @@
 <?php
 
-require_once __DIR__.'/BaseIntegrationTest.php';
+require_once __DIR__.'/BaseProcedureTest.php';
 
-class TaskLinkTest extends BaseIntegrationTest
+class TaskLinkProcedureTest extends BaseProcedureTest
 {
     protected $projectName = 'My project to test task links';
     protected $taskLinkId;
diff --git a/tests/integration/TaskTest.php b/tests/integration/TaskProcedureTest.php
index 6f1d9d62..f456ae52 100644
--- a/tests/integration/TaskTest.php
+++ b/tests/integration/TaskProcedureTest.php
@@ -1,8 +1,8 @@
 <?php
 
-require_once __DIR__.'/BaseIntegrationTest.php';
+require_once __DIR__.'/BaseProcedureTest.php';
 
-class TaskTest extends BaseIntegrationTest
+class TaskProcedureTest extends BaseProcedureTest
 {
     protected $projectName = 'My project to test tasks';
 
diff --git a/tests/integration/UserTest.php b/tests/integration/UserProcedureTest.php
index c407c918..290f87fb 100644
--- a/tests/integration/UserTest.php
+++ b/tests/integration/UserProcedureTest.php
@@ -1,8 +1,8 @@
 <?php
 
-require_once __DIR__.'/BaseIntegrationTest.php';
+require_once __DIR__.'/BaseProcedureTest.php';
 
-class UserTest extends BaseIntegrationTest
+class UserProcedureTest extends BaseProcedureTest
 {
     public function testAll()
     {