function FileTest::testCollectionFilterAccess

File

core/modules/jsonapi/tests/src/Functional/FileTest.php, line 231

Class

FileTest

JSON:API integration test for the "File" content entity type.

Namespace

Code

public function testCollectionFilterAccess() : void {
  $label_field_name = 'filename';
  // Verify the expected behavior in the common case: when the file is public.
  $this->doTestCollectionFilterAccessBasedOnPermissions($label_field_name, 'access content');
  $collection_url = Url::fromRoute('jsonapi.entity_test--bar.collection');
  $collection_filter_url = $collection_url->setOption('query', [
    "filter[spotlight.{$label_field_name}]" => $this->entity
      ->label(),
  ]);
  $request_options = [];
  $request_options[RequestOptions::HEADERS]['Accept'] = 'application/vnd.api+json';
  $request_options = NestedArray::mergeDeep($request_options, $this->getAuthenticationRequestOptions());
  // 1 result because the current user is the file owner, even though the file
  // is private.
  $this->entity
    ->setFileUri('private://drupal.txt');
  $this->entity
    ->setOwner($this->account);
  $this->entity
    ->save();
  $response = $this->request('GET', $collection_filter_url, $request_options);
  $doc = $this->getDocumentFromResponse($response);
  $this->assertCount(1, $doc['data']);
  // 0 results because the current user is no longer the file owner and the
  // file is private.
  $this->entity
    ->setOwner(User::load(0));
  $this->entity
    ->save();
  $response = $this->request('GET', $collection_filter_url, $request_options);
  $doc = $this->getDocumentFromResponse($response);
  $this->assertCount(0, $doc['data']);
}