class WorkflowCustomStateTransitionAccessTest

class WorkflowCustomStateTransitionAccessTest extends BrowserTestBase {
    
    /**
     * {@inheritdoc}
     */
    protected static $modules = [
        'workflows',
        'workflow_type_test',
    ];
    
    /**
     * {@inheritdoc}
     */
    protected $defaultTheme = 'stark';
    
    /**
     * A test admin user.
     *
     * @var \Drupal\Core\Session\AccountInterface
     */
    protected $adminUser;
    
    /**
     * A test workflow.
     *
     * @var \Drupal\workflows\WorkflowInterface
     */
    protected $testWorkflow;
    
    /**
     * {@inheritdoc}
     */
    protected function setUp() : void {
        parent::setUp();
        $this->adminUser = $this->createUser([
            'administer workflows',
        ]);
        $this->testWorkflow = Workflow::create([
            'label' => 'Test workflow',
            'id' => 'test_type',
            'type' => 'workflow_custom_access_type',
        ]);
        $this->testWorkflow
            ->save();
    }
    
    /**
     * Tests the custom state/transition operation access rules.
     */
    public function testCustomWorkflowAccessOperations() {
        $this->drupalLogin($this->adminUser);
        $forbidden_paths = [
            'admin/config/workflow/workflows/manage/test_type/state/cannot_delete/delete',
            'admin/config/workflow/workflows/manage/test_type/state/cannot_update',
            'admin/config/workflow/workflows/manage/test_type/transition/cannot_update',
            'admin/config/workflow/workflows/manage/test_type/transition/cannot_delete/delete',
            'admin/config/workflow/workflows/manage/test_type/add_state',
            'admin/config/workflow/workflows/manage/test_type/add_transition',
        ];
        // Until the list of forbidden operations have been set, the admin user
        // should be able to access all the forbidden paths.
        foreach ($forbidden_paths as $forbidden_path) {
            $this->drupalGet($forbidden_path);
            $this->assertSession()
                ->statusCodeEquals(200);
        }
        // Update the forbidden operations which deny access to the actions
        // represented by the above paths.
        $this->container
            ->get('state')
            ->set('workflow_type_test_forbidden_operations', [
            'update-state:cannot_update',
            'delete-state:cannot_delete',
            'update-transition:cannot_update',
            'delete-transition:cannot_delete',
            'add-state',
            'add-transition',
        ]);
        foreach ($forbidden_paths as $forbidden_path) {
            $this->drupalGet($forbidden_path);
            $this->assertSession()
                ->statusCodeEquals(403);
        }
    }

}