function InlineBlockPrivateFilesTest::testPrivateFiles

Test access to private files added via inline blocks in the layout builder.

File

core/modules/layout_builder/tests/src/FunctionalJavascript/InlineBlockPrivateFilesTest.php, line 63

Class

InlineBlockPrivateFilesTest

Test access to private files in block fields on the Layout Builder.

Namespace

Code

public function testPrivateFiles() {
    $assert_session = $this->assertSession();
    $this->drupalLogin($this->drupalCreateUser([
        'access contextual links',
        'configure any layout',
        'administer node display',
        'administer node fields',
        'create and edit custom blocks',
    ]));
    // Enable layout builder and overrides.
    $this->drupalPostForm(static::FIELD_UI_PREFIX . '/display/default', [
        'layout[enabled]' => TRUE,
        'layout[allow_custom]' => TRUE,
    ], 'Save');
    $this->drupalLogout();
    // Log in as user you can only configure layouts and access content.
    $this->drupalLogin($this->drupalCreateUser([
        'access contextual links',
        'configure any layout',
        'access content',
        'create and edit custom blocks',
    ]));
    $this->drupalGet('node/1/layout');
    // @todo Occasionally SQLite has database locks here. Waiting seems to
    //   resolve it. https://www.drupal.org/project/drupal/issues/3055983
    $assert_session->assertWaitOnAjaxRequest();
    $file = $this->createPrivateFile('drupal.txt');
    $file_real_path = $this->fileSystem
        ->realpath($file->getFileUri());
    $this->assertFileExists($file_real_path);
    $this->addInlineFileBlockToLayout('The file', $file);
    $this->assertSaveLayout();
    $this->drupalGet('node/1');
    $private_href1 = $this->assertFileAccessibleOnNode($file);
    // Remove the inline block with the private file.
    $this->drupalGet('node/1/layout');
    $this->removeInlineBlockFromLayout();
    $this->assertSaveLayout();
    $this->drupalGet('node/1');
    $assert_session->pageTextNotContains($file->label());
    // Try to access file directly after it has been removed. Since a new
    // revision was not created for the node the inline block is not in the
    // layout of a previous revision of the node.
    $this->drupalGet($private_href1);
    $assert_session->pageTextContains('You are not authorized to access this page');
    $assert_session->pageTextNotContains($this->getFileSecret($file));
    $this->assertFileExists($file_real_path);
    $file2 = $this->createPrivateFile('2ndFile.txt');
    $this->drupalGet('node/1/layout');
    $this->addInlineFileBlockToLayout('Number2', $file2);
    $this->assertSaveLayout();
    $this->drupalGet('node/1');
    $private_href2 = $this->assertFileAccessibleOnNode($file2);
    $this->createNewNodeRevision(1);
    $file3 = $this->createPrivateFile('3rdFile.txt');
    $this->drupalGet('node/1/layout');
    $this->replaceFileInBlock($file3);
    $this->assertSaveLayout();
    $this->drupalGet('node/1');
    $private_href3 = $this->assertFileAccessibleOnNode($file3);
    // $file2 is on a previous revision of the block which is on a previous
    // revision of the node. The user does not have access to view the previous
    // revision of the node.
    $this->drupalGet($private_href2);
    $assert_session->pageTextContains('You are not authorized to access this page');
    $node = Node::load(1);
    $node->setUnpublished();
    $node->save();
    $this->drupalGet('node/1');
    $assert_session->pageTextContains('You are not authorized to access this page');
    $this->drupalGet($private_href3);
    $assert_session->pageTextNotContains($this->getFileSecret($file3));
    $assert_session->pageTextContains('You are not authorized to access this page');
    $this->drupalGet('node/2/layout');
    $file4 = $this->createPrivateFile('drupal_4.txt');
    $this->addInlineFileBlockToLayout('The file', $file4);
    $this->assertSaveLayout();
    $this->drupalGet('node/2');
    $private_href4 = $this->assertFileAccessibleOnNode($file4);
    $this->createNewNodeRevision(2);
    // Remove the inline block with the private file.
    // The inline block will still be attached to the previous revision of the
    // node.
    $this->drupalGet('node/2/layout');
    $this->removeInlineBlockFromLayout();
    $this->assertSaveLayout();
    // Ensure that since the user cannot view the previous revision of the node
    // they can not view the file which is only used on that revision.
    $this->drupalGet($private_href4);
    $assert_session->pageTextContains('You are not authorized to access this page');
}