FileTest.php

<?php

declare (strict_types=1);
namespace Drupal\Tests\jsonapi\Functional;

use Drupal\Component\Utility\NestedArray;
use Drupal\Core\Url;
use Drupal\file\Entity\File;
use Drupal\file\FileInterface;
use Drupal\Tests\jsonapi\Traits\CommonCollectionFilterAccessTestPatternsTrait;
use Drupal\user\Entity\User;
use GuzzleHttp\RequestOptions;

/**
 * JSON:API integration test for the "File" content entity type.
 *
 * @group jsonapi
 * @group #slow
 */
class FileTest extends ResourceTestBase {
    use CommonCollectionFilterAccessTestPatternsTrait;
    
    /**
     * {@inheritdoc}
     */
    protected static $modules = [
        'file',
        'user',
    ];
    
    /**
     * {@inheritdoc}
     */
    protected $defaultTheme = 'stark';
    
    /**
     * {@inheritdoc}
     */
    protected static $entityTypeId = 'file';
    
    /**
     * {@inheritdoc}
     */
    protected static $resourceTypeName = 'file--file';
    
    /**
     * {@inheritdoc}
     *
     * @var \Drupal\file\FileInterface
     */
    protected $entity;
    
    /**
     * {@inheritdoc}
     */
    protected static $patchProtectedFieldNames = [
        'uri' => NULL,
        'filemime' => NULL,
        'filesize' => NULL,
        'status' => NULL,
        'changed' => NULL,
    ];
    
    /**
     * The file author.
     *
     * @var \Drupal\user\UserInterface
     */
    protected $author;
    
    /**
     * {@inheritdoc}
     */
    protected function setUpAuthorization($method) {
        switch ($method) {
            case 'GET':
                $this->grantPermissionsToTestedRole([
                    'access content',
                ]);
                break;
            case 'PATCH':
                // \Drupal\file\FileAccessControlHandler::checkAccess() grants 'update'
                // access only to the user that owns the file. So there is no permission
                // to grant: instead, the file owner must be changed from its default
                // (user 1) to the current user.
                $this->makeCurrentUserFileOwner();
                return;
            case 'DELETE':
                $this->grantPermissionsToTestedRole([
                    'delete any file',
                ]);
                break;
        }
    }
    
    /**
     * Makes the current user the file owner.
     */
    protected function makeCurrentUserFileOwner() {
        $account = User::load(2);
        $this->entity
            ->setOwnerId($account->id());
        $this->entity
            ->setOwner($account);
        $this->entity
            ->save();
    }
    
    /**
     * {@inheritdoc}
     */
    protected function createEntity() {
        $this->author = User::load(1);
        $file = File::create();
        $file->setOwnerId($this->author
            ->id());
        $file->setFilename('drupal.txt');
        $file->setMimeType('text/plain');
        $file->setFileUri('public://drupal.txt');
        $file->set('status', FileInterface::STATUS_PERMANENT);
        $file->save();
        file_put_contents($file->getFileUri(), 'Drupal');
        return $file;
    }
    
    /**
     * {@inheritdoc}
     */
    protected function createAnotherEntity($key) {
        
        /** @var \Drupal\file\FileInterface $duplicate */
        $duplicate = parent::createAnotherEntity($key);
        $duplicate->setFileUri("public://{$key}.txt");
        $duplicate->save();
        return $duplicate;
    }
    
    /**
     * {@inheritdoc}
     */
    protected function getExpectedDocument() {
        $self_url = Url::fromUri('base:/jsonapi/file/file/' . $this->entity
            ->uuid())
            ->setAbsolute()
            ->toString(TRUE)
            ->getGeneratedUrl();
        return [
            'jsonapi' => [
                'meta' => [
                    'links' => [
                        'self' => [
                            'href' => 'http://jsonapi.org/format/1.0/',
                        ],
                    ],
                ],
                'version' => '1.0',
            ],
            'links' => [
                'self' => [
                    'href' => $self_url,
                ],
            ],
            'data' => [
                'id' => $this->entity
                    ->uuid(),
                'type' => 'file--file',
                'links' => [
                    'self' => [
                        'href' => $self_url,
                    ],
                ],
                'attributes' => [
                    'created' => (new \DateTime())->setTimestamp($this->entity
                        ->getCreatedTime())
                        ->setTimezone(new \DateTimeZone('UTC'))
                        ->format(\DateTime::RFC3339),
                    'changed' => (new \DateTime())->setTimestamp($this->entity
                        ->getChangedTime())
                        ->setTimezone(new \DateTimeZone('UTC'))
                        ->format(\DateTime::RFC3339),
                    'filemime' => 'text/plain',
                    'filename' => 'drupal.txt',
                    'filesize' => (int) $this->entity
                        ->getSize(),
                    'langcode' => 'en',
                    'status' => TRUE,
                    'uri' => [
                        'url' => base_path() . $this->siteDirectory . '/files/drupal.txt',
                        'value' => 'public://drupal.txt',
                    ],
                    'drupal_internal__fid' => 1,
                ],
                'relationships' => [
                    'uid' => [
                        'data' => [
                            'id' => $this->author
                                ->uuid(),
                            'meta' => [
                                'drupal_internal__target_id' => (int) $this->author
                                    ->id(),
                            ],
                            'type' => 'user--user',
                        ],
                        'links' => [
                            'related' => [
                                'href' => $self_url . '/uid',
                            ],
                            'self' => [
                                'href' => $self_url . '/relationships/uid',
                            ],
                        ],
                    ],
                ],
            ],
        ];
    }
    
    /**
     * {@inheritdoc}
     */
    protected function getPostDocument() {
        return [
            'data' => [
                'type' => 'file--file',
                'attributes' => [
                    'filename' => 'drupal.txt',
                ],
            ],
        ];
    }
    
    /**
     * Tests POST/PATCH/DELETE for an individual resource.
     */
    public function testIndividual() : void {
        // @todo https://www.drupal.org/node/1927648
        // Add doTestPostIndividual().
        $this->doTestPatchIndividual();
        $this->entity = $this->resaveEntity($this->entity, $this->account);
        $this->revokePermissions();
        $this->config('jsonapi.settings')
            ->set('read_only', TRUE)
            ->save(TRUE);
        $this->doTestDeleteIndividual();
    }
    
    /**
     * {@inheritdoc}
     */
    protected function getExpectedUnauthorizedAccessMessage($method) {
        return match ($method) {    'GET' => "The 'access content' permission is required.",
            'PATCH' => "Only the file owner can update the file entity.",
            'DELETE' => "The 'delete any file' permission is required.",
            default => parent::getExpectedUnauthorizedAccessMessage($method),
        
        };
    }
    
    /**
     * {@inheritdoc}
     */
    public function testCollectionFilterAccess() : void {
        $label_field_name = 'filename';
        // Verify the expected behavior in the common case: when the file is public.
        $this->doTestCollectionFilterAccessBasedOnPermissions($label_field_name, 'access content');
        $collection_url = Url::fromRoute('jsonapi.entity_test--bar.collection');
        $collection_filter_url = $collection_url->setOption('query', [
            "filter[spotlight.{$label_field_name}]" => $this->entity
                ->label(),
        ]);
        $request_options = [];
        $request_options[RequestOptions::HEADERS]['Accept'] = 'application/vnd.api+json';
        $request_options = NestedArray::mergeDeep($request_options, $this->getAuthenticationRequestOptions());
        // 1 result because the current user is the file owner, even though the file
        // is private.
        $this->entity
            ->setFileUri('private://drupal.txt');
        $this->entity
            ->setOwner($this->account);
        $this->entity
            ->save();
        $response = $this->request('GET', $collection_filter_url, $request_options);
        $doc = $this->getDocumentFromResponse($response);
        $this->assertCount(1, $doc['data']);
        // 0 results because the current user is no longer the file owner and the
        // file is private.
        $this->entity
            ->setOwner(User::load(0));
        $this->entity
            ->save();
        $response = $this->request('GET', $collection_filter_url, $request_options);
        $doc = $this->getDocumentFromResponse($response);
        $this->assertCount(0, $doc['data']);
    }

}