function AccessTest::testFileAccess

Tests 'update' and 'delete' access to file entities.

File

core/modules/file/tests/src/Kernel/AccessTest.php, line 44

Class

AccessTest

Tests for the File access control.

Namespace

Code

public function testFileAccess() : void {
    // Create a user so the tested users do not have the magic ID of user 1.
    $this->createUser();
    $user_any = $this->createUser([
        'delete any file',
    ]);
    $this->assertGreaterThan(1, (int) $user_any->id());
    $user_own = $this->createUser([
        'delete own files',
    ]);
    $test_files = $this->getTestFiles('text');
    $file1 = File::create((array) $test_files[0]);
    $file1->set('uid', $user_any->id());
    $file1->save();
    $file2 = File::create((array) $test_files[1]);
    $file2->set('uid', $user_own->id());
    $file2->save();
    // User with "* any file" permissions should delete all files and update
    // their own.
    $this->assertTrue($file1->access('delete', $user_any));
    $this->assertTrue($file1->access('update', $user_any));
    $this->assertTrue($file2->access('delete', $user_any));
    $this->assertFalse($file2->access('update', $user_any));
    // User with "* own files" permissions should access only own files.
    $this->assertFalse($file1->access('delete', $user_own));
    $this->assertFalse($file1->access('update', $user_own));
    $this->assertTrue($file2->access('delete', $user_own));
    $this->assertTrue($file2->access('update', $user_own));
    // Ensure cacheability metadata is correct.
    
    /** @var \Drupal\Core\Access\AccessResult $access */
    $access = $file2->access('delete', $user_any, TRUE);
    $this->assertSame([
        'user.permissions',
    ], $access->getCacheContexts());
    $this->assertSame([], $access->getCacheTags());
    
    /** @var \Drupal\Core\Access\AccessResult $access */
    $access = $file2->access('delete', $user_own, TRUE);
    $this->assertSame([
        'user.permissions',
        'user',
    ], $access->getCacheContexts());
    $this->assertSame([
        'file:2',
    ], $access->getCacheTags());
    
    /** @var \Drupal\Core\Access\AccessResult $access */
    $access = $file2->access('update', $user_any, TRUE);
    $this->assertSame([], $access->getCacheContexts());
    $this->assertSame([], $access->getCacheTags());
    
    /** @var \Drupal\Core\Access\AccessResult $access */
    $access = $file2->access('update', $user_own, TRUE);
    $this->assertSame([], $access->getCacheContexts());
    $this->assertSame([], $access->getCacheTags());
    // User without permissions should not be able to delete files even if they
    // are the owner.
    $user_none = $this->createUser();
    $file3 = File::create([
        'uid' => $user_none->id(),
        'filename' => 'druplicon.txt',
        'filemime' => 'text/plain',
    ]);
    $this->assertFalse($file3->access('delete', $user_none));
    $this->assertTrue($file3->access('update', $user_none));
    // Create a file with no user entity.
    $file4 = File::create([
        'filename' => 'druplicon.txt',
        'filemime' => 'text/plain',
    ]);
    $this->assertFalse($file4->access('delete', $user_own));
    $this->assertFalse($file4->access('update', $user_own));
    $this->assertTrue($file4->access('delete', $user_any));
    $this->assertFalse($file4->access('update', $user_any));
}