class ManagedFileFidValidationTest

class ManagedFileFidValidationTest extends FileFieldTestBase {
  
  /**
   * {@inheritdoc}
   */
  protected $defaultTheme = 'stark';
  
  /**
   * File owner user.
   *
   * @var \Drupal\user\UserInterface
   */
  protected UserInterface $fileOwner;
  
  /**
   * Another user with limited access.
   *
   * @var \Drupal\user\UserInterface
   */
  protected UserInterface $anotherUser;
  
  /**
   * A private file owned by the file owner.
   *
   * @var \Drupal\file\Entity\File
   */
  protected File $ownerFile;
  
  /**
   * {@inheritdoc}
   */
  protected function setUp() : void {
    parent::setUp();
    // Create the file owner user.
    $this->fileOwner = $this->drupalCreateUser([
      'access content',
    ]);
    // Create a second user.
    $this->anotherUser = $this->drupalCreateUser([
      'access content',
    ]);
    $this->drupalLogin($this->fileOwner);
    $file_name = $this->randomMachineName();
    $this->ownerFile = File::create([
      'uid' => $this->fileOwner
        ->id(),
      'filename' => \sprintf('%s.pdf', $file_name),
      'uri' => \sprintf('private://%s.pdf', $file_name),
      'filemime' => 'application/pdf',
      'status' => 0,
    ]);
    $this->ownerFile
      ->save();
    $this->assertNotNull($this->ownerFile
      ->id(), 'Owner file was created.');
  }
  
  /**
   * Tests that another user cannot access the owner's temporary file.
   */
  public function testOtherUserCannotAccessOwnerFile() : void {
    $this->assertFalse($this->ownerFile
      ->access('download', $this->anotherUser));
    $this->assertEquals($this->fileOwner
      ->id(), $this->ownerFile
      ->getOwnerId());
    $this->assertTrue($this->ownerFile
      ->isTemporary());
  }
  
  /**
   * Tests that other users' file IDs are rejected when passed via URL.
   */
  public function testOtherUsersFileIdNotAcceptedViaUrl() : void {
    $this->drupalLogin($this->anotherUser);
    $owner_fid = $this->ownerFile
      ->id();
    // Visit the form with the other user's file ID in the URL.
    $this->drupalGet('file/test/1/1/1/' . $owner_fid);
    $this->submitForm([], 'Save');
    $this->getSession()
      ->getPage()
      ->getText();
    $this->assertSession()
      ->pageTextContains('The file ids are');
    $response = $this->getSession()
      ->getPage()
      ->getText();
    $this->assertStringNotContainsString("The file ids are {$owner_fid}.", $response);
    $this->assertSession()
      ->pageTextContains('The file ids are .');
  }
  
  /**
   * Tests that other users' file IDs are rejected even with a valid upload.
   */
  public function testOtherUsersFileIdNotAcceptedWithUpload() : void {
    $this->drupalLogin($this->anotherUser);
    $owner_fid = $this->ownerFile
      ->id();
    $test_file = $this->getTestFile('text');
    // The other user visits the form with the owner's file ID AND uploads a
    // legitimate file.
    $this->drupalGet('file/test/1/1/1/' . $owner_fid);
    $this->submitForm([
      'files[nested_file][]' => \Drupal::service('file_system')->realpath($test_file->getFileUri()),
    ], 'Save');
    $response = $this->getSession()
      ->getPage()
      ->getText();
    $uploaded_fid = $this->getLastFileId();
    $this->assertSession()
      ->pageTextContains('The file ids are');
    $contains_owner_file = str_contains($response, (string) $owner_fid);
    $contains_uploaded = str_contains($response, (string) $uploaded_fid);
    $this->assertFalse($contains_owner_file);
    $this->assertTrue($contains_uploaded);
  }

}