Java tutorial
/* JSPWiki - a JSP-based WikiWiki clone. Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ package com.ecyrd.jspwiki.auth; import java.security.Principal; import java.util.Collection; import java.util.List; import java.util.Properties; import org.apache.commons.lang.ArrayUtils; import junit.framework.TestCase; import com.ecyrd.jspwiki.*; import com.ecyrd.jspwiki.auth.authorize.Group; import com.ecyrd.jspwiki.auth.authorize.GroupManager; import com.ecyrd.jspwiki.auth.permissions.PermissionFactory; import com.ecyrd.jspwiki.auth.user.*; import com.ecyrd.jspwiki.workflow.*; /** * @author Andrew Jaquith */ public class UserManagerTest extends TestCase { private TestEngine m_engine; private UserManager m_mgr; private UserDatabase m_db; private String m_groupName; /** * @see junit.framework.TestCase#setUp() */ protected void setUp() throws Exception { super.setUp(); Properties props = new Properties(); props.load(TestEngine.findTestProperties()); // Make sure user profile save workflow is OFF props.remove("jspwiki.approver" + UserManager.SAVE_APPROVER); // Make sure we are using the XML user database props.put(XMLUserDatabase.PROP_USERDATABASE, "tests/etc/userdatabase.xml"); m_engine = new TestEngine(props); m_mgr = m_engine.getUserManager(); m_db = m_mgr.getUserDatabase(); m_groupName = "Group" + System.currentTimeMillis(); } protected void tearDown() throws Exception { GroupManager groupManager = m_engine.getGroupManager(); if (groupManager.findRole(m_groupName) != null) { groupManager.removeGroup(m_groupName); } } /** Call this setup program to use the save-profile workflow. */ protected void setUpWithWorkflow() throws Exception { Properties props = new Properties(); props.load(TestEngine.findTestProperties()); // Turn on user profile saves by the Admin group props.put("jspwiki.approver." + UserManager.SAVE_APPROVER, "Admin"); // Make sure we are using the XML user database props.put(XMLUserDatabase.PROP_USERDATABASE, "tests/etc/userdatabase.xml"); m_engine = new TestEngine(props); m_mgr = m_engine.getUserManager(); m_db = m_mgr.getUserDatabase(); } public void testSetRenamedUserProfile() throws Exception { // First, count the number of users, groups, and pages int oldUserCount = m_db.getWikiNames().length; GroupManager groupManager = m_engine.getGroupManager(); PageManager pageManager = m_engine.getPageManager(); AuthorizationManager authManager = m_engine.getAuthorizationManager(); int oldGroupCount = groupManager.getRoles().length; int oldPageCount = pageManager.getTotalPageCount(); // Setup Step 1: create a new user with random name WikiSession session = m_engine.guestSession(); long now = System.currentTimeMillis(); String oldLogin = "TestLogin" + now; String oldName = "Test User " + now; String newLogin = "RenamedLogin" + now; String newName = "Renamed User " + now; UserProfile profile = m_db.newProfile(); profile.setEmail("testuser@testville.com"); profile.setLoginName(oldLogin); profile.setFullname(oldName); profile.setPassword("password"); m_mgr.setUserProfile(session, profile); // 1a. Make sure the profile saved successfully and that we're logged in profile = m_mgr.getUserProfile(session); assertEquals(oldLogin, profile.getLoginName()); assertEquals(oldName, profile.getFullname()); assertEquals(oldUserCount + 1, m_db.getWikiNames().length); assertTrue(session.isAuthenticated()); // Setup Step 2: create a new group with our test user in it Group group = groupManager.parseGroup(m_groupName, "Alice \n Bob \n Charlie \n " + oldLogin + "\n" + oldName, true); groupManager.setGroup(session, group); // 2a. Make sure the group is created with the user in it, and the role is added to the Subject assertEquals(oldGroupCount + 1, groupManager.getRoles().length); assertTrue(group.isMember(new WikiPrincipal(oldLogin))); assertTrue(group.isMember(new WikiPrincipal(oldName))); assertFalse(group.isMember(new WikiPrincipal(newLogin))); assertFalse(group.isMember(new WikiPrincipal(newName))); assertTrue(groupManager.isUserInRole(session, group.getPrincipal())); // Setup Step 3: create a new page with our test user in the ACL String pageName = "TestPage" + now; m_engine.saveText(pageName, "Test text. [{ALLOW view " + oldName + ", " + oldLogin + ", Alice}] More text."); // 3a. Make sure the page got saved, and that ONLY our test user has permission to read it. WikiPage p = m_engine.getPage(pageName); assertEquals(oldPageCount + 1, pageManager.getTotalPageCount()); assertNotNull(p.getAcl().getEntry(new WikiPrincipal(oldLogin))); assertNotNull(p.getAcl().getEntry(new WikiPrincipal(oldName))); assertNull(p.getAcl().getEntry(new WikiPrincipal(newLogin))); assertNull(p.getAcl().getEntry(new WikiPrincipal(newName))); assertTrue("Test User view page", authManager.checkPermission(session, PermissionFactory.getPagePermission(p, "view"))); WikiSession bobSession = WikiSessionTest.authenticatedSession(m_engine, Users.BOB, Users.BOB_PASS); assertFalse("Bob !view page", authManager.checkPermission(bobSession, PermissionFactory.getPagePermission(p, "view"))); // Setup Step 4: change the user name in the profile and see what happens profile = m_db.newProfile(); profile.setEmail("testuser@testville.com"); profile.setLoginName(oldLogin); profile.setFullname(newName); profile.setPassword("password"); m_mgr.setUserProfile(session, profile); // Test 1: the wiki session should have the new wiki name in Subject Principal[] principals = session.getPrincipals(); assertTrue(ArrayUtils.contains(principals, new WikiPrincipal(oldLogin))); assertFalse(ArrayUtils.contains(principals, new WikiPrincipal(oldName))); assertFalse(ArrayUtils.contains(principals, new WikiPrincipal(newLogin))); assertTrue(ArrayUtils.contains(principals, new WikiPrincipal(newName))); // Test 2: our group should not contain the old name OR login name any more // (the full name is always used) group = groupManager.getGroup(m_groupName); assertFalse(group.isMember(new WikiPrincipal(oldLogin))); assertFalse(group.isMember(new WikiPrincipal(oldName))); assertFalse(group.isMember(new WikiPrincipal(newLogin))); assertTrue(group.isMember(new WikiPrincipal(newName))); // Test 3: our page should not contain the old wiki name OR login name // in the ACL any more (the full name is always used) p = m_engine.getPage(pageName); assertNull(p.getAcl().getEntry(new WikiPrincipal(oldLogin))); assertNull(p.getAcl().getEntry(new WikiPrincipal(oldName))); assertNull(p.getAcl().getEntry(new WikiPrincipal(newLogin))); assertNotNull(p.getAcl().getEntry(new WikiPrincipal(newName))); assertTrue("Test User view page", authManager.checkPermission(session, PermissionFactory.getPagePermission(p, "view"))); assertFalse("Bob !view page", authManager.checkPermission(bobSession, PermissionFactory.getPagePermission(p, "view"))); // Test 4: our page text should have been re-written // (The new full name should be in the ACL, but the login name should have been removed) String expectedText = "[{ALLOW view Alice," + newName + "}]\nTest text. More text.\r\n"; String actualText = m_engine.getText(pageName); assertEquals(expectedText, actualText); // Remove our test page m_engine.deletePage(pageName); // Setup Step 6: re-create the group with our old test user names in it group = groupManager.parseGroup(m_groupName, "Alice \n Bob \n Charlie \n " + oldLogin + "\n" + oldName, true); groupManager.setGroup(session, group); // Setup Step 7: Save a new page with the old login/wiki names in the ACL again // The test user should still be able to see the page (because the login name matches...) pageName = "TestPage2" + now; m_engine.saveText(pageName, "More test text. [{ALLOW view " + oldName + ", " + oldLogin + ", Alice}] More text."); p = m_engine.getPage(pageName); assertEquals(oldPageCount + 1, pageManager.getTotalPageCount()); assertNotNull(p.getAcl().getEntry(new WikiPrincipal(oldLogin))); assertNotNull(p.getAcl().getEntry(new WikiPrincipal(oldName))); assertNull(p.getAcl().getEntry(new WikiPrincipal(newLogin))); assertNull(p.getAcl().getEntry(new WikiPrincipal(newName))); assertTrue("Test User view page", authManager.checkPermission(session, PermissionFactory.getPagePermission(p, "view"))); assertFalse("Bob !view page", authManager.checkPermission(bobSession, PermissionFactory.getPagePermission(p, "view"))); // Setup Step 8: re-save the profile with the new login name profile = m_db.newProfile(); profile.setEmail("testuser@testville.com"); profile.setLoginName(newLogin); profile.setFullname(oldName); profile.setPassword("password"); m_mgr.setUserProfile(session, profile); // Test 5: the wiki session should have the new login name in Subject principals = session.getPrincipals(); assertFalse(ArrayUtils.contains(principals, new WikiPrincipal(oldLogin))); assertTrue(ArrayUtils.contains(principals, new WikiPrincipal(oldName))); assertTrue(ArrayUtils.contains(principals, new WikiPrincipal(newLogin))); assertFalse(ArrayUtils.contains(principals, new WikiPrincipal(newName))); // Test 6: our group should not contain the old name OR login name any more // (the full name is always used) group = groupManager.getGroup(m_groupName); assertFalse(group.isMember(new WikiPrincipal(oldLogin))); assertTrue(group.isMember(new WikiPrincipal(oldName))); assertFalse(group.isMember(new WikiPrincipal(newLogin))); assertFalse(group.isMember(new WikiPrincipal(newName))); // Test 7: our page should not contain the old wiki name OR login name // in the ACL any more (the full name is always used) p = m_engine.getPage(pageName); assertNull(p.getAcl().getEntry(new WikiPrincipal(oldLogin))); assertNotNull(p.getAcl().getEntry(new WikiPrincipal(oldName))); assertNull(p.getAcl().getEntry(new WikiPrincipal(newLogin))); assertNull(p.getAcl().getEntry(new WikiPrincipal(newName))); assertTrue("Test User view page", authManager.checkPermission(session, PermissionFactory.getPagePermission(p, "view"))); assertFalse("Bob !view page", authManager.checkPermission(bobSession, PermissionFactory.getPagePermission(p, "view"))); // Test 8: our page text should have been re-written // (The new full name should be in the ACL, but the login name should have been removed) expectedText = "[{ALLOW view Alice," + oldName + "}]\nMore test text. More text.\r\n"; actualText = m_engine.getText(pageName); assertEquals(expectedText, actualText); // CLEANUP: delete the profile; user and page; should be back to old counts m_db.deleteByLoginName(newLogin); assertEquals(oldUserCount, m_db.getWikiNames().length); groupManager.removeGroup(group.getName()); assertEquals(oldGroupCount, groupManager.getRoles().length); m_engine.deletePage(pageName); assertEquals(oldPageCount, pageManager.getTotalPageCount()); } public void testSetUserProfile() throws Exception { // First, count the number of users in the db now. int oldUserCount = m_db.getWikiNames().length; // Create a new user with random name WikiSession session = m_engine.guestSession(); String loginName = "TestUser" + String.valueOf(System.currentTimeMillis()); UserProfile profile = m_db.newProfile(); profile.setEmail("testuser@testville.com"); profile.setLoginName(loginName); profile.setFullname("FullName" + loginName); profile.setPassword("password"); m_mgr.setUserProfile(session, profile); // Make sure the profile saved successfully profile = m_mgr.getUserProfile(session); assertEquals(loginName, profile.getLoginName()); assertEquals(oldUserCount + 1, m_db.getWikiNames().length); // Now delete the profile; should be back to old count m_db.deleteByLoginName(loginName); assertEquals(oldUserCount, m_db.getWikiNames().length); } public void testSetUserProfileWithApproval() throws Exception { setUpWithWorkflow(); // First, count the number of users in the db now. int oldUserCount = m_db.getWikiNames().length; // Create a new user with random name WikiSession session = m_engine.guestSession(); String loginName = "TestUser" + String.valueOf(System.currentTimeMillis()); UserProfile profile = m_db.newProfile(); profile.setEmail("testuser@testville.com"); profile.setLoginName(loginName); profile.setFullname("FullName" + loginName); profile.setPassword("password"); // Because user profile saves require approvals, we will catch a Redirect try { m_mgr.setUserProfile(session, profile); fail("We should have caught a DecisionRequiredException caused by approval!"); } catch (DecisionRequiredException e) { } // The user should NOT be saved yet assertEquals(oldUserCount, m_db.getWikiNames().length); // Now, look in Admin's queue, and verify there's a pending Decision there DecisionQueue dq = m_engine.getWorkflowManager().getDecisionQueue(); Collection decisions = dq.getActorDecisions(m_engine.adminSession()); assertEquals(1, decisions.size()); // Verify that the Decision has all the facts and attributes we need Decision d = (Decision) decisions.iterator().next(); List facts = d.getFacts(); assertEquals(new Fact(UserManager.PREFS_FULL_NAME, profile.getFullname()), facts.get(0)); assertEquals(new Fact(UserManager.PREFS_LOGIN_NAME, profile.getLoginName()), facts.get(1)); assertEquals(new Fact(UserManager.FACT_SUBMITTER, session.getUserPrincipal().getName()), facts.get(2)); assertEquals(new Fact(UserManager.PREFS_EMAIL, profile.getEmail()), facts.get(3)); assertEquals(profile, d.getWorkflow().getAttribute(UserManager.SAVED_PROFILE)); // Approve the profile d.decide(Outcome.DECISION_APPROVE); // Make sure the profile saved successfully assertEquals(oldUserCount + 1, m_db.getWikiNames().length); // Now delete the profile; should be back to old count m_db.deleteByLoginName(loginName); assertEquals(oldUserCount, m_db.getWikiNames().length); } public void testSetUserProfileWithDenial() throws Exception { setUpWithWorkflow(); // First, count the number of users in the db now. int oldUserCount = m_db.getWikiNames().length; // Create a new user with random name WikiSession session = m_engine.guestSession(); String loginName = "TestUser" + String.valueOf(System.currentTimeMillis()); UserProfile profile = m_db.newProfile(); profile.setEmail("testuser@testville.com"); profile.setLoginName(loginName); profile.setFullname("FullName" + loginName); profile.setPassword("password"); // Because user profile saves require approvals, we will catch a Redirect try { m_mgr.setUserProfile(session, profile); fail("We should have caught a DecisionRequiredException caused by approval!"); } catch (DecisionRequiredException e) { } // The user should NOT be saved yet assertEquals(oldUserCount, m_db.getWikiNames().length); // Now, look in Admin's queue, and verify there's a pending Decision there DecisionQueue dq = m_engine.getWorkflowManager().getDecisionQueue(); Collection decisions = dq.getActorDecisions(m_engine.adminSession()); assertEquals(1, decisions.size()); // Verify that the Decision has all the facts and attributes we need Decision d = (Decision) decisions.iterator().next(); List facts = d.getFacts(); assertEquals(new Fact(UserManager.PREFS_FULL_NAME, profile.getFullname()), facts.get(0)); assertEquals(new Fact(UserManager.PREFS_LOGIN_NAME, profile.getLoginName()), facts.get(1)); assertEquals(new Fact(UserManager.FACT_SUBMITTER, session.getUserPrincipal().getName()), facts.get(2)); assertEquals(new Fact(UserManager.PREFS_EMAIL, profile.getEmail()), facts.get(3)); assertEquals(profile, d.getWorkflow().getAttribute(UserManager.SAVED_PROFILE)); // Approve the profile d.decide(Outcome.DECISION_DENY); // Make sure the profile did NOT save assertEquals(oldUserCount, m_db.getWikiNames().length); } public void testSetCollidingUserProfile() throws Exception { // First, count the number of users in the db now. int oldUserCount = m_db.getWikiNames().length; // Create a new user with random name WikiSession session = m_engine.guestSession(); String loginName = "TestUser" + String.valueOf(System.currentTimeMillis()); UserProfile profile = m_db.newProfile(); profile.setEmail("testuser@testville.com"); profile.setLoginName(loginName); profile.setFullname("FullName" + loginName); profile.setPassword("password"); // Set the login name to collide with Janne's: should prohibit saving profile.setLoginName("janne"); try { m_mgr.setUserProfile(session, profile); fail("UserManager allowed saving of user with login name 'janne', but it shouldn't have."); } catch (DuplicateUserException e) { // Good! That's what we expected; reset for next test profile.setLoginName(loginName); } // Set the login name to collide with Janne's: should prohibit saving profile.setFullname("Janne Jalkanen"); try { m_mgr.setUserProfile(session, profile); fail("UserManager allowed saving of user with login name 'janne', but it shouldn't have."); } catch (DuplicateUserException e) { // Good! That's what we expected } // There shouldn't have been any users added assertEquals(oldUserCount, m_db.getWikiNames().length); } }