From d3f9255eefcf0e46c62d2f677cb66392f8fe3bcb Mon Sep 17 00:00:00 2001 From: Eric Davis Date: Tue, 5 Oct 2010 11:30:19 -0700 Subject: [PATCH] [#4601] Change Manage Budget to a givable permission --- init.rb | 2 +- test/integration/contracts_delete_test.rb | 8 ++--- test/integration/contracts_edit_test.rb | 23 +++++++++++++- test/integration/contracts_list_test.rb | 24 +++++++++++++- test/integration/contracts_new_test.rb | 23 +++++++++++++- test/integration/contracts_show_test.rb | 23 +++++++++++++- test/integration/deliverable_details_test.rb | 31 ++++++++++++++++++- test/integration/deliverables_delete_test.rb | 24 +++++++++++++- test/integration/deliverables_edit_test.rb | 25 +++++++++++++-- test/integration/deliverables_list_test.rb | 3 ++ test/integration/deliverables_new_test.rb | 23 +++++++++++++- test/integration/deliverables_show_test.rb | 3 ++ .../disabled_contracts_module_test.rb | 8 ++--- test/test_helper.rb | 21 +++++++++++++ 14 files changed, 222 insertions(+), 19 deletions(-) diff --git a/init.rb b/init.rb index 0d3be6e..81786bb 100644 --- a/init.rb +++ b/init.rb @@ -24,7 +24,7 @@ Redmine::Plugin.register :redmine_contracts do permission(:manage_budget, { :contracts => [:index, :new, :create, :show, :edit, :update, :destroy], :deliverables => [:index, :new, :create, :show, :edit, :update, :destroy] - }, :public => true) + }) end contract_list_submenu_items = Proc.new {|project| diff --git a/test/integration/contracts_delete_test.rb b/test/integration/contracts_delete_test.rb index f40d1a2..ce3e33e 100644 --- a/test/integration/contracts_delete_test.rb +++ b/test/integration/contracts_delete_test.rb @@ -6,6 +6,9 @@ class ContractsDeleteTest < ActionController::IntegrationTest def setup @project = Project.generate!(:identifier => 'main') @contract = Contract.generate!(:project => @project, :name => 'A Contract') + @user = User.generate_user_with_permission_to_manage_budget(:project => @project) + + login_as(@user.login, 'contracts') end should "allow admins to delete the contract" do @@ -39,10 +42,7 @@ class ContractsDeleteTest < ActionController::IntegrationTest assert_select "a", :text => /Delete/, :count => 0 delete contract_path(@project, @contract) - assert_response :redirect - follow_redirect! - assert_response :success - assert_template 'account/login' # Prompt for login + assert_forbidden assert Contract.find_by_id(@contract.id), "Contract deleted" end diff --git a/test/integration/contracts_edit_test.rb b/test/integration/contracts_edit_test.rb index 8931b56..0e10ae7 100644 --- a/test/integration/contracts_edit_test.rb +++ b/test/integration/contracts_edit_test.rb @@ -9,9 +9,30 @@ class ContractsEditTest < ActionController::IntegrationTest @role = Role.generate! User.add_to_project(@account_executive, @project, @role) @contract = Contract.generate!(:project => @project, :name => 'A Contract', :account_executive => @account_executive) + @user = User.generate_user_with_permission_to_manage_budget(:project => @project) + + login_as(@user.login, 'contracts') end - should "allow any user to edit the contract" do + should "block anonymous users from editing the contract" do + logout + visit "/projects/#{@project.identifier}/contracts/#{@contract.id}/edit" + + assert_requires_login + end + + should "block unauthorized users from editing the contract" do + logout + + @user = User.generate!(:password => 'test', :password_confirmation => 'test') + login_as(@user.login, 'test') + + visit "/projects/#{@project.identifier}/contracts/#{@contract.id}/edit" + + assert_forbidden + end + + should "allow authorized users to edit the contract" do visit_contracts_for_project(@project) click_link @contract.id assert_response :success diff --git a/test/integration/contracts_list_test.rb b/test/integration/contracts_list_test.rb index 358a3f6..a80d290 100644 --- a/test/integration/contracts_list_test.rb +++ b/test/integration/contracts_list_test.rb @@ -16,9 +16,31 @@ class ContractsListTest < ActionController::IntegrationTest @contract2, @other_contract ].map {|c| c.reload } + + @user = User.generate_user_with_permission_to_manage_budget(:project => @project) + + login_as(@user.login, 'contracts') end - should "allow any user to list the contracts on a project" do + should "block anonymous users from listing the contracts" do + logout + visit "/projects/#{@project.identifier}/contracts" + + assert_requires_login + end + + should "block unauthorized users from listing contracts" do + logout + + @user = User.generate!(:password => 'test', :password_confirmation => 'test') + login_as(@user.login, 'test') + + visit "/projects/#{@project.identifier}/contracts" + + assert_forbidden + end + + should "allow authorized users to list the contracts on a project" do visit_contracts_for_project(@project) end diff --git a/test/integration/contracts_new_test.rb b/test/integration/contracts_new_test.rb index d84ecaf..399d970 100644 --- a/test/integration/contracts_new_test.rb +++ b/test/integration/contracts_new_test.rb @@ -7,9 +7,30 @@ class ContractsNewTest < ActionController::IntegrationTest @project = Project.generate!(:identifier => 'main') PaymentTerm.generate!(:type => 'PaymentTerm', :name => 'Net 15') PaymentTerm.generate!(:type => 'PaymentTerm', :name => 'Net 30') + @user = User.generate_user_with_permission_to_manage_budget(:project => @project) + + login_as(@user.login, 'contracts') end - should "allow any user to open the new contracts form" do + should "block anonymous users from opening the new contract form" do + logout + visit "/projects/#{@project.identifier}/contracts/new" + + assert_requires_login + end + + should "block unauthorized users from opening the new contract form" do + logout + + @user = User.generate!(:password => 'test', :password_confirmation => 'test') + login_as(@user.login, 'test') + + visit "/projects/#{@project.identifier}/contracts/new" + + assert_forbidden + end + + should "allow authorized users to open the new contracts form" do visit_contracts_for_project(@project) click_link 'New Contract' assert_response :success diff --git a/test/integration/contracts_show_test.rb b/test/integration/contracts_show_test.rb index 18374f2..c558712 100644 --- a/test/integration/contracts_show_test.rb +++ b/test/integration/contracts_show_test.rb @@ -6,9 +6,30 @@ class ContractsShowTest < ActionController::IntegrationTest def setup @project = Project.generate!(:identifier => 'main').reload @contract = Contract.generate!(:project => @project) + @user = User.generate_user_with_permission_to_manage_budget(:project => @project) + + login_as(@user.login, 'contracts') end - should "allow any user to view the contract" do + should "block anonymous users from viewing the contract" do + logout + visit "/projects/#{@project.identifier}/contracts/#{@contract.id}" + + assert_requires_login + end + + should "block unauthorized users from viewing the contract" do + logout + + @user = User.generate!(:password => 'test', :password_confirmation => 'test') + login_as(@user.login, 'test') + + visit "/projects/#{@project.identifier}/contracts/#{@contract.id}" + + assert_forbidden + end + + should "allow authorized users to view the contract" do visit_contracts_for_project(@project) click_link @contract.id assert_response :success diff --git a/test/integration/deliverable_details_test.rb b/test/integration/deliverable_details_test.rb index acb5a3d..ceddce4 100644 --- a/test/integration/deliverable_details_test.rb +++ b/test/integration/deliverable_details_test.rb @@ -12,9 +12,38 @@ class DeliverableDetailsShowTest < ActionController::IntegrationTest @deliverable1.overhead_budgets << OverheadBudget.spawn(:budget => 200, :hours => 10) @deliverable1.save! + @user = User.generate_user_with_permission_to_manage_budget(:project => @project) + + login_as(@user.login, 'contracts') end - context "for a JS request" do + context "for an anonymous JS request" do + should "require login" do + logout + + visit "/projects/#{@project.id}/contracts/#{@contract.id}/deliverables/#{@deliverable1.id}", :get, {:format => 'js', :as => 'deliverable_details_row'} + + assert_response :unauthorized + end + + end + + context "for an unauthorized JS request" do + should "be forbidden" do + logout + + @user = User.generate!(:password => 'test', :password_confirmation => 'test') + login_as(@user.login, 'test') + + visit "/projects/#{@project.id}/contracts/#{@contract.id}/deliverables/#{@deliverable1.id}", :get, {:format => 'js', :as => 'deliverable_details_row'} + + assert_response :forbidden + end + + end + + + context "for an authorized JS request" do should "render the details for the deliverable" do visit "/projects/#{@project.id}/contracts/#{@contract.id}/deliverables/#{@deliverable1.id}", :get, {:format => 'js', :as => 'deliverable_details_row'} diff --git a/test/integration/deliverables_delete_test.rb b/test/integration/deliverables_delete_test.rb index bc377ad..6a63904 100644 --- a/test/integration/deliverables_delete_test.rb +++ b/test/integration/deliverables_delete_test.rb @@ -8,9 +8,31 @@ class DeliverablesDeleteTest < ActionController::IntegrationTest @contract = Contract.generate!(:project => @project, :name => 'A Contract') @manager = User.generate! @deliverable = FixedDeliverable.generate!(:contract => @contract, :manager => @manager) + @user = User.generate_user_with_permission_to_manage_budget(:project => @project) + + login_as(@user.login, 'contracts') end - should "allow anyone to delete the deliverable" do + should "block anonymous users from deleting the deliverable" do + logout + delete "/projects/#{@project.identifier}/contracts/#{@contract.id}/deliverables/#{@deliverable.id}" + follow_redirect! + + assert_requires_login + end + + should "block unauthorized users from deleting the deliverable" do + logout + + @user = User.generate!(:password => 'test', :password_confirmation => 'test') + login_as(@user.login, 'test') + + delete "/projects/#{@project.identifier}/contracts/#{@contract.id}/deliverables/#{@deliverable.id}" + + assert_forbidden + end + + should "allow authorized users to delete the deliverable" do visit_contract_page(@contract) click_link_within "#deliverable_details_#{@deliverable.id}", 'Delete' diff --git a/test/integration/deliverables_edit_test.rb b/test/integration/deliverables_edit_test.rb index 8511a38..c898e8e 100644 --- a/test/integration/deliverables_edit_test.rb +++ b/test/integration/deliverables_edit_test.rb @@ -12,9 +12,30 @@ class DeliverablesEditTest < ActionController::IntegrationTest @fixed_deliverable = FixedDeliverable.generate!(:contract => @contract, :manager => @manager, :title => 'The Title') @hourly_deliverable = HourlyDeliverable.generate!(:contract => @contract, :manager => @manager, :title => 'An Hourly') + @user = User.generate_user_with_permission_to_manage_budget(:project => @project) + + login_as(@user.login, 'contracts') end - should "allow any user to edit the Fixed deliverable" do + should "block anonymous users from editing the deliverable" do + logout + visit "/projects/#{@project.identifier}/contracts/#{@contract.id}/deliverables/#{@fixed_deliverable.id}" + + assert_requires_login + end + + should "block unauthorized users from editing the deliverable" do + logout + + @user = User.generate!(:password => 'test', :password_confirmation => 'test') + login_as(@user.login, 'test') + + visit "/projects/#{@project.identifier}/contracts/#{@contract.id}/deliverables/#{@fixed_deliverable.id}" + + assert_forbidden + end + + should "allow authorized users to edit the Fixed deliverable" do visit_contract_page(@contract) click_link_within "#deliverable_details_#{@fixed_deliverable.id}", 'Edit' assert_response :success @@ -44,7 +65,7 @@ class DeliverablesEditTest < ActionController::IntegrationTest end - should "allow any user to edit the Hourly deliverable" do + should "allow authorized users to edit the Hourly deliverable" do visit_contract_page(@contract) click_link_within "#deliverable_details_#{@hourly_deliverable.id}", 'Edit' assert_response :success diff --git a/test/integration/deliverables_list_test.rb b/test/integration/deliverables_list_test.rb index 706bfac..8e3f6f0 100644 --- a/test/integration/deliverables_list_test.rb +++ b/test/integration/deliverables_list_test.rb @@ -8,6 +8,9 @@ class DeliverablesListTest < ActionController::IntegrationTest @contract = Contract.generate!(:project => @project) @manager = User.generate! @deliverable = FixedDeliverable.generate!(:contract => @contract, :manager => @manager) + @user = User.generate_user_with_permission_to_manage_budget(:project => @project) + + login_as(@user.login, 'contracts') end should "redirect to the contract page" do diff --git a/test/integration/deliverables_new_test.rb b/test/integration/deliverables_new_test.rb index a211f6d..a27ed6c 100644 --- a/test/integration/deliverables_new_test.rb +++ b/test/integration/deliverables_new_test.rb @@ -6,9 +6,30 @@ class DeliverablesNewTest < ActionController::IntegrationTest def setup @project = Project.generate!(:identifier => 'main') @contract = Contract.generate!(:project => @project) + @user = User.generate_user_with_permission_to_manage_budget(:project => @project) + + login_as(@user.login, 'contracts') end - should "allow any user to open the new deliverable form" do + should "block anonymous users from opening the new deliverable form" do + logout + visit "/projects/#{@project.identifier}/contracts/#{@contract.id}/deliverables/new" + + assert_requires_login + end + + should "block unauthorized users from opening the new deliverable form" do + logout + + @user = User.generate!(:password => 'test', :password_confirmation => 'test') + login_as(@user.login, 'test') + + visit "/projects/#{@project.identifier}/contracts/#{@contract.id}/deliverables/new" + + assert_forbidden + end + + should "allow authorized users open the new deliverable form" do visit_contract_page(@contract) click_link 'Add New' assert_response :success diff --git a/test/integration/deliverables_show_test.rb b/test/integration/deliverables_show_test.rb index 62902d5..b3da14b 100644 --- a/test/integration/deliverables_show_test.rb +++ b/test/integration/deliverables_show_test.rb @@ -8,6 +8,9 @@ class DeliverablesShowTest < ActionController::IntegrationTest @contract = Contract.generate!(:project => @project) @manager = User.generate! @deliverable = FixedDeliverable.generate!(:contract => @contract, :manager => @manager) + @user = User.generate_user_with_permission_to_manage_budget(:project => @project) + + login_as(@user.login, 'contracts') end should "redirect to the contract page" do diff --git a/test/integration/disabled_contracts_module_test.rb b/test/integration/disabled_contracts_module_test.rb index 8096258..88b2f3e 100644 --- a/test/integration/disabled_contracts_module_test.rb +++ b/test/integration/disabled_contracts_module_test.rb @@ -1,17 +1,15 @@ require 'test_helper' class DisabledContractsModuleTest < ActionController::IntegrationTest - def setup - @user = User.generate!(:login => 'existing', :password => 'existing', :password_confirmation => 'existing', :admin => true) - login_as - end - context "on a project with the Contracts module disabled" do setup do @project = Project.generate! @project.enabled_modules.find_by_name('contracts').destroy @project.reload assert !@project.module_enabled?(:contracts), "Contracts enabled on project" + + @user = User.generate_user_with_permission_to_manage_budget(:project => @project) + login_as(@user.login, 'contracts') end should "not show the menu item" do diff --git a/test/test_helper.rb b/test/test_helper.rb index bd92085..74e2708 100644 --- a/test/test_helper.rb +++ b/test/test_helper.rb @@ -34,6 +34,16 @@ def User.add_to_project(user, project, role) Member.generate!(:principal => user, :project => project, :roles => [role]) end +def User.generate_user_with_permission_to_manage_budget(options={}) + project = options[:project] + + user = User.generate!(:password => 'contracts', :password_confirmation => 'contracts') + role = Role.generate!(:permissions => [:view_issues, :edit_issues, :add_issues, :manage_budget]) + User.add_to_project(user, project, role) + user +end + + module IntegrationTestHelper def login_as(user="existing", password="existing") visit "/login" @@ -44,6 +54,12 @@ module IntegrationTestHelper assert User.current.logged? end + def logout + visit '/logout' + assert_response :success + assert !User.current.logged? + end + def visit_project(project) visit '/' assert_response :success @@ -83,6 +99,11 @@ module IntegrationTestHelper assert_response :forbidden assert_template 'common/403' end + + def assert_requires_login + assert_response :success + assert_template 'account/login' + end end