1 files changed, 179 insertions, 131 deletions

diff --git a/tests/units/Helper/UserHelperTest.php b/tests/units/Helper/UserHelperTest.php
index 4cc9fa65..f1099faa 100644
--- a/tests/units/Helper/UserHelperTest.php
+++ b/tests/units/Helper/UserHelperTest.php
@@ -4,179 +4,227 @@ require_once __DIR__.'/../Base.php';
 
 use Kanboard\Helper\User;
 use Kanboard\Model\Project;
-use Kanboard\Model\ProjectPermission;
+use Kanboard\Model\ProjectUserRole;
 use Kanboard\Model\User as UserModel;
-use Kanboard\Core\Session;
+use Kanboard\Core\Security\Role;
 
 class UserHelperTest extends Base
 {
     public function testInitials()
     {
-        $h = new User($this->container);
+        $helper = new User($this->container);
 
-        $this->assertEquals('CN', $h->getInitials('chuck norris'));
-        $this->assertEquals('A', $h->getInitials('admin'));
+        $this->assertEquals('CN', $helper->getInitials('chuck norris'));
+        $this->assertEquals('A', $helper->getInitials('admin'));
     }
 
-    public function testIsProjectAdministrationAllowedForProjectAdmin()
+    public function testGetRoleName()
     {
-        $h = new User($this->container);
-        $p = new Project($this->container);
-        $pp = new ProjectPermission($this->container);
-        $u = new UserModel($this->container);
-        $session = new Session;
-
-        // We create our user
-        $this->assertEquals(2, $u->create(array('username' => 'unittest', 'password' => 'unittest')));
-
-        // We create a project and set our user as project manager
-        $this->assertEquals(1, $p->create(array('name' => 'UnitTest')));
-        $this->assertTrue($pp->addMember(1, 2));
-        $this->assertTrue($pp->isMember(1, 2));
-        $this->assertFalse($pp->isManager(1, 2));
-
-        // We fake a session for him
-        $session['user'] = array(
+        $helper = new User($this->container);
+        $this->assertEquals('Administrator', $helper->getRoleName(Role::APP_ADMIN));
+        $this->assertEquals('Manager', $helper->getRoleName(Role::APP_MANAGER));
+        $this->assertEquals('Project Viewer', $helper->getRoleName(Role::PROJECT_VIEWER));
+    }
+
+    public function testHasAccessForAdmins()
+    {
+        $helper = new User($this->container);
+
+        $this->container['sessionStorage']->user = array(
+            'id' => 2,
+            'role' => Role::APP_ADMIN,
+        );
+
+        $this->assertTrue($helper->hasAccess('user', 'create'));
+        $this->assertTrue($helper->hasAccess('ProjectCreation', 'create'));
+        $this->assertTrue($helper->hasAccess('ProjectCreation', 'createPrivate'));
+    }
+
+    public function testHasAccessForManagers()
+    {
+        $helper = new User($this->container);
+
+        $this->container['sessionStorage']->user = array(
+            'id' => 2,
+            'role' => Role::APP_MANAGER,
+        );
+
+        $this->assertFalse($helper->hasAccess('user', 'create'));
+        $this->assertTrue($helper->hasAccess('ProjectCreation', 'create'));
+        $this->assertTrue($helper->hasAccess('ProjectCreation', 'createPrivate'));
+    }
+
+    public function testHasAccessForUsers()
+    {
+        $helper = new User($this->container);
+
+        $this->container['sessionStorage']->user = array(
+            'id' => 2,
+            'role' => Role::APP_USER,
+        );
+
+        $this->assertFalse($helper->hasAccess('user', 'create'));
+        $this->assertFalse($helper->hasAccess('ProjectCreation', 'create'));
+        $this->assertTrue($helper->hasAccess('ProjectCreation', 'createPrivate'));
+    }
+
+    public function testHasProjectAccessForAdmins()
+    {
+        $helper = new User($this->container);
+        $project = new Project($this->container);
+
+        $this->container['sessionStorage']->user = array(
+            'id' => 2,
+            'role' => Role::APP_ADMIN,
+        );
+
+        $this->assertEquals(1, $project->create(array('name' => 'My project')));
+
+        $this->assertTrue($helper->hasProjectAccess('ProjectEdit', 'edit', 1));
+        $this->assertTrue($helper->hasProjectAccess('board', 'show', 1));
+    }
+
+    public function testHasProjectAccessForManagers()
+    {
+        $helper = new User($this->container);
+        $project = new Project($this->container);
+
+        $this->container['sessionStorage']->user = array(
             'id' => 2,
-            'is_admin' => false,
-            'is_project_admin' => true,
+            'role' => Role::APP_MANAGER,
         );
 
-        $this->assertTrue($h->isProjectAdministrationAllowed(1));
+        $this->assertEquals(1, $project->create(array('name' => 'My project')));
+
+        $this->assertFalse($helper->hasProjectAccess('ProjectEdit', 'edit', 1));
+        $this->assertFalse($helper->hasProjectAccess('board', 'show', 1));
     }
 
-    public function testIsProjectAdministrationAllowedForProjectMember()
+    public function testHasProjectAccessForUsers()
     {
-        $h = new User($this->container);
-        $p = new Project($this->container);
-        $pp = new ProjectPermission($this->container);
-        $u = new UserModel($this->container);
-        $session = new Session;
-
-        // We create our user
-        $this->assertEquals(2, $u->create(array('username' => 'unittest', 'password' => 'unittest')));
-
-        // We create a project and set our user as project member
-        $this->assertEquals(1, $p->create(array('name' => 'UnitTest')));
-        $this->assertTrue($pp->addMember(1, 2));
-        $this->assertTrue($pp->isMember(1, 2));
-        $this->assertFalse($pp->isManager(1, 2));
-
-        // We fake a session for him
-        $session['user'] = array(
+        $helper = new User($this->container);
+        $project = new Project($this->container);
+
+        $this->container['sessionStorage']->user = array(
             'id' => 2,
-            'is_admin' => false,
-            'is_project_admin' => false,
+            'role' => Role::APP_USER,
         );
 
-        $this->assertFalse($h->isProjectAdministrationAllowed(1));
+        $this->assertEquals(1, $project->create(array('name' => 'My project')));
+
+        $this->assertFalse($helper->hasProjectAccess('ProjectEdit', 'edit', 1));
+        $this->assertFalse($helper->hasProjectAccess('board', 'show', 1));
     }
 
-    public function testIsProjectAdministrationAllowedForProjectManager()
+    public function testHasProjectAccessForAppManagerAndProjectManagers()
     {
-        $h = new User($this->container);
-        $p = new Project($this->container);
-        $pp = new ProjectPermission($this->container);
-        $u = new UserModel($this->container);
-        $session = new Session;
-
-        // We create our user
-        $this->assertEquals(2, $u->create(array('username' => 'unittest', 'password' => 'unittest')));
-
-        // We create a project and set our user as project member
-        $this->assertEquals(1, $p->create(array('name' => 'UnitTest')));
-        $this->assertTrue($pp->addManager(1, 2));
-        $this->assertTrue($pp->isMember(1, 2));
-        $this->assertTrue($pp->isManager(1, 2));
-
-        // We fake a session for him
-        $session['user'] = array(
+        $helper = new User($this->container);
+        $user = new UserModel($this->container);
+        $project = new Project($this->container);
+        $projectUserRole = new ProjectUserRole($this->container);
+
+        $this->container['sessionStorage']->user = array(
             'id' => 2,
-            'is_admin' => false,
-            'is_project_admin' => false,
+            'role' => Role::APP_MANAGER,
         );
 
-        $this->assertFalse($h->isProjectAdministrationAllowed(1));
+        $this->assertEquals(1, $project->create(array('name' => 'My project')));
+        $this->assertEquals(2, $project->create(array('name' => 'My project')));
+        $this->assertEquals(2, $user->create(array('username' => 'user')));
+        $this->assertTrue($projectUserRole->addUser(1, 2, Role::PROJECT_MANAGER));
+
+        $this->assertTrue($helper->hasProjectAccess('ProjectEdit', 'edit', 1));
+        $this->assertTrue($helper->hasProjectAccess('board', 'show', 1));
+        $this->assertTrue($helper->hasProjectAccess('task', 'show', 1));
+        $this->assertTrue($helper->hasProjectAccess('taskcreation', 'save', 1));
+
+        $this->assertFalse($helper->hasProjectAccess('ProjectEdit', 'edit', 2));
+        $this->assertFalse($helper->hasProjectAccess('board', 'show', 2));
+        $this->assertFalse($helper->hasProjectAccess('task', 'show', 2));
+        $this->assertFalse($helper->hasProjectAccess('taskcreation', 'save', 2));
     }
 
-    public function testIsProjectManagementAllowedForProjectAdmin()
+    public function testHasProjectAccessForProjectManagers()
     {
-        $h = new User($this->container);
-        $p = new Project($this->container);
-        $pp = new ProjectPermission($this->container);
-        $u = new UserModel($this->container);
-        $session = new Session;
-
-        // We create our user
-        $this->assertEquals(2, $u->create(array('username' => 'unittest', 'password' => 'unittest')));
-
-        // We create a project and set our user as project manager
-        $this->assertEquals(1, $p->create(array('name' => 'UnitTest')));
-        $this->assertTrue($pp->addMember(1, 2));
-        $this->assertTrue($pp->isMember(1, 2));
-        $this->assertFalse($pp->isManager(1, 2));
-
-        // We fake a session for him
-        $session['user'] = array(
+        $helper = new User($this->container);
+        $user = new UserModel($this->container);
+        $project = new Project($this->container);
+        $projectUserRole = new ProjectUserRole($this->container);
+
+        $this->container['sessionStorage']->user = array(
             'id' => 2,
-            'is_admin' => false,
-            'is_project_admin' => true,
+            'role' => Role::APP_USER,
         );
 
-        $this->assertTrue($h->isProjectManagementAllowed(1));
+        $this->assertEquals(1, $project->create(array('name' => 'My project')));
+        $this->assertEquals(2, $project->create(array('name' => 'My project')));
+        $this->assertEquals(2, $user->create(array('username' => 'user')));
+        $this->assertTrue($projectUserRole->addUser(1, 2, Role::PROJECT_MANAGER));
+
+        $this->assertTrue($helper->hasProjectAccess('ProjectEdit', 'edit', 1));
+        $this->assertTrue($helper->hasProjectAccess('board', 'show', 1));
+        $this->assertTrue($helper->hasProjectAccess('task', 'show', 1));
+        $this->assertTrue($helper->hasProjectAccess('taskcreation', 'save', 1));
+
+        $this->assertFalse($helper->hasProjectAccess('ProjectEdit', 'edit', 2));
+        $this->assertFalse($helper->hasProjectAccess('board', 'show', 2));
+        $this->assertFalse($helper->hasProjectAccess('task', 'show', 2));
+        $this->assertFalse($helper->hasProjectAccess('taskcreation', 'save', 2));
     }
 
-    public function testIsProjectManagementAllowedForProjectMember()
+    public function testHasProjectAccessForProjectMembers()
     {
-        $h = new User($this->container);
-        $p = new Project($this->container);
-        $pp = new ProjectPermission($this->container);
-        $u = new UserModel($this->container);
-        $session = new Session;
-
-        // We create our user
-        $this->assertEquals(2, $u->create(array('username' => 'unittest', 'password' => 'unittest')));
-
-        // We create a project and set our user as project member
-        $this->assertEquals(1, $p->create(array('name' => 'UnitTest')));
-        $this->assertTrue($pp->addMember(1, 2));
-        $this->assertTrue($pp->isMember(1, 2));
-        $this->assertFalse($pp->isManager(1, 2));
-
-        // We fake a session for him
-        $session['user'] = array(
+        $helper = new User($this->container);
+        $user = new UserModel($this->container);
+        $project = new Project($this->container);
+        $projectUserRole = new ProjectUserRole($this->container);
+
+        $this->container['sessionStorage']->user = array(
             'id' => 2,
-            'is_admin' => false,
-            'is_project_admin' => false,
+            'role' => Role::APP_USER,
         );
 
-        $this->assertFalse($h->isProjectManagementAllowed(1));
+        $this->assertEquals(1, $project->create(array('name' => 'My project')));
+        $this->assertEquals(2, $project->create(array('name' => 'My project')));
+        $this->assertEquals(2, $user->create(array('username' => 'user')));
+        $this->assertTrue($projectUserRole->addUser(1, 2, Role::PROJECT_MEMBER));
+
+        $this->assertFalse($helper->hasProjectAccess('ProjectEdit', 'edit', 1));
+        $this->assertTrue($helper->hasProjectAccess('board', 'show', 1));
+        $this->assertTrue($helper->hasProjectAccess('task', 'show', 1));
+        $this->assertTrue($helper->hasProjectAccess('taskcreation', 'save', 1));
+
+        $this->assertFalse($helper->hasProjectAccess('ProjectEdit', 'edit', 2));
+        $this->assertFalse($helper->hasProjectAccess('board', 'show', 2));
+        $this->assertFalse($helper->hasProjectAccess('task', 'show', 2));
+        $this->assertFalse($helper->hasProjectAccess('taskcreation', 'save', 2));
     }
 
-    public function testIsProjectManagementAllowedForProjectManager()
+    public function testHasProjectAccessForProjectViewers()
     {
-        $h = new User($this->container);
-        $p = new Project($this->container);
-        $pp = new ProjectPermission($this->container);
-        $u = new UserModel($this->container);
-        $session = new Session;
-
-        // We create our user
-        $this->assertEquals(2, $u->create(array('username' => 'unittest', 'password' => 'unittest')));
-
-        // We create a project and set our user as project member
-        $this->assertEquals(1, $p->create(array('name' => 'UnitTest')));
-        $this->assertTrue($pp->addManager(1, 2));
-        $this->assertTrue($pp->isMember(1, 2));
-        $this->assertTrue($pp->isManager(1, 2));
-
-        // We fake a session for him
-        $session['user'] = array(
+        $helper = new User($this->container);
+        $user = new UserModel($this->container);
+        $project = new Project($this->container);
+        $projectUserRole = new ProjectUserRole($this->container);
+
+        $this->container['sessionStorage']->user = array(
             'id' => 2,
-            'is_admin' => false,
-            'is_project_admin' => false,
+            'role' => Role::APP_USER,
         );
 
-        $this->assertTrue($h->isProjectManagementAllowed(1));
+        $this->assertEquals(1, $project->create(array('name' => 'My project')));
+        $this->assertEquals(2, $project->create(array('name' => 'My project')));
+        $this->assertEquals(2, $user->create(array('username' => 'user')));
+        $this->assertTrue($projectUserRole->addUser(1, 2, Role::PROJECT_VIEWER));
+
+        $this->assertFalse($helper->hasProjectAccess('ProjectEdit', 'edit', 1));
+        $this->assertTrue($helper->hasProjectAccess('board', 'show', 1));
+        $this->assertTrue($helper->hasProjectAccess('task', 'show', 1));
+        $this->assertFalse($helper->hasProjectAccess('taskcreation', 'save', 1));
+
+        $this->assertFalse($helper->hasProjectAccess('ProjectEdit', 'edit', 2));
+        $this->assertFalse($helper->hasProjectAccess('board', 'show', 2));
+        $this->assertFalse($helper->hasProjectAccess('task', 'show', 2));
+        $this->assertFalse($helper->hasProjectAccess('taskcreation', 'save', 2));
     }
 }