class FilePrivateTestCase

class FilePrivateTestCase extends FileFieldTestCase {
    public static function getInfo() {
        return array(
            'name' => 'Private file test',
            'description' => 'Uploads a test to a private node and checks access.',
            'group' => 'File',
        );
    }
    function setUp() {
        parent::setUp(array(
            'node_access_test',
            'field_test',
        ));
        node_access_rebuild();
        variable_set('node_access_test_private', TRUE);
    }
    
    /**
     * Tests file access for file uploaded to a private node.
     */
    function testPrivateFile() {
        // Use 'page' instead of 'article', so that the 'article' image field does
        // not conflict with this test. If in the future the 'page' type gets its
        // own default file or image field, this test can be made more robust by
        // using a custom node type.
        $type_name = 'page';
        $field_name = strtolower($this->randomName());
        $this->createFileField($field_name, $type_name, array(
            'uri_scheme' => 'private',
        ));
        // Create a field with no view access - see field_test_field_access().
        $no_access_field_name = 'field_no_view_access';
        $this->createFileField($no_access_field_name, $type_name, array(
            'uri_scheme' => 'private',
        ));
        $test_file = $this->getTestFile('text');
        $nid = $this->uploadNodeFile($test_file, $field_name, $type_name, TRUE, array(
            'private' => TRUE,
        ));
        $node = node_load($nid, NULL, TRUE);
        $node_file = (object) $node->{$field_name}[LANGUAGE_NONE][0];
        // Ensure the file can be downloaded.
        $this->drupalGet(file_create_url($node_file->uri));
        $this->assertResponse(200, 'Confirmed that the generated URL is correct by downloading the shipped file.');
        $this->drupalLogOut();
        $this->drupalGet(file_create_url($node_file->uri));
        $this->assertResponse(403, 'Confirmed that access is denied for the file without the needed permission.');
        // Test with the field that should deny access through field access.
        $this->drupalLogin($this->admin_user);
        $nid = $this->uploadNodeFile($test_file, $no_access_field_name, $type_name, TRUE, array(
            'private' => TRUE,
        ));
        $node = node_load($nid, NULL, TRUE);
        $node_file = (object) $node->{$no_access_field_name}[LANGUAGE_NONE][0];
        // Ensure the file cannot be downloaded.
        $this->drupalGet(file_create_url($node_file->uri));
        $this->assertResponse(403, 'Confirmed that access is denied for the file without view field access permission.');
        // Attempt to reuse the existing file when creating a new node, and confirm
        // that access is still denied.
        $edit = array();
        $edit['title'] = $this->randomName(8);
        $edit[$field_name . '[' . LANGUAGE_NONE . '][0][fid]'] = $node_file->fid;
        $this->drupalPost('node/add/page', $edit, t('Save'));
        $new_node = $this->drupalGetNodeByTitle($edit['title']);
        $this->assertTrue(!empty($new_node), 'Node was created.');
        $this->assertUrl('node/' . $new_node->nid);
        $this->assertNoRaw($node_file->filename, 'File without view field access permission does not appear after attempting to attach it to a new node.');
        $this->drupalGet(file_create_url($node_file->uri));
        $this->assertResponse(403, 'Confirmed that access is denied for the file without view field access permission after attempting to attach it to a new node.');
        // As an anonymous user, create a temporary file with no references and
        // confirm that only the session that uploaded it may view it.
        $this->drupalLogout();
        user_role_grant_permissions(DRUPAL_ANONYMOUS_RID, array(
            "create {$type_name} content",
            'access content',
        ));
        $test_file = $this->getTestFile('text');
        $this->drupalGet('node/add/' . $type_name);
        $edit = array(
            'files[' . $field_name . '_' . LANGUAGE_NONE . '_0]' => drupal_realpath($test_file->uri),
        );
        $this->drupalPost(NULL, $edit, t('Upload'));
        $files = file_load_multiple(array(), array(
            'uid' => 0,
        ));
        $this->assertEqual(1, count($files), 'Loaded one anonymous file.');
        $file = end($files);
        $this->assertNotEqual($file->status, FILE_STATUS_PERMANENT, 'File is temporary.');
        $usage = file_usage_list($file);
        $this->assertFalse($usage, 'No file usage found.');
        $file_url = file_create_url($file->uri);
        $this->drupalGet($file_url);
        $this->assertResponse(200, 'Confirmed that the anonymous uploader has access to the temporary file.');
        // Close the prior connection and remove the session cookie.
        $this->curlClose();
        $this->cookies = array();
        $this->drupalGet($file_url);
        $this->assertResponse(403, 'Confirmed that another anonymous user cannot access the temporary file.');
        // As an anonymous user, create a permanent file that is referenced by a
        // published node and confirm that all anonymous users may view it.
        $test_file = $this->getTestFile('text');
        $this->drupalGet('node/add/' . $type_name);
        $edit = array();
        $edit['title'] = $this->randomName();
        $edit['files[' . $field_name . '_' . LANGUAGE_NONE . '_0]'] = drupal_realpath($test_file->uri);
        $this->drupalPost(NULL, $edit, t('Save'));
        $new_node = $this->drupalGetNodeByTitle($edit['title']);
        $file = file_load($new_node->{$field_name}[LANGUAGE_NONE][0]['fid']);
        $this->assertEqual($file->status, FILE_STATUS_PERMANENT, 'File is permanent.');
        $usage = file_usage_list($file);
        $this->assertTrue($usage, 'File usage found.');
        $file_url = file_create_url($file->uri);
        $this->drupalGet($file_url);
        $this->assertResponse(200, 'Confirmed that the anonymous uploader has access to the permanent file that is referenced by a published node.');
        // Close the prior connection and remove the session cookie.
        $this->curlClose();
        $this->cookies = array();
        $this->drupalGet($file_url);
        $this->assertResponse(200, 'Confirmed that another anonymous user also has access to the permanent file that is referenced by a published node.');
        // As an anonymous user, create a permanent file that is referenced by an
        // unpublished node and confirm that no anonymous users may view it (even
        // the session that uploaded the file) because they cannot view the
        // unpublished node.
        $test_file = $this->getTestFile('text');
        $this->drupalGet('node/add/' . $type_name);
        $edit = array();
        $edit['title'] = $this->randomName();
        $edit['files[' . $field_name . '_' . LANGUAGE_NONE . '_0]'] = drupal_realpath($test_file->uri);
        $this->drupalPost(NULL, $edit, t('Save'));
        $new_node = $this->drupalGetNodeByTitle($edit['title']);
        $new_node->status = NODE_NOT_PUBLISHED;
        node_save($new_node);
        $file = file_load($new_node->{$field_name}[LANGUAGE_NONE][0]['fid']);
        $this->assertEqual($file->status, FILE_STATUS_PERMANENT, 'File is permanent.');
        $usage = file_usage_list($file);
        $this->assertTrue($usage, 'File usage found.');
        $file_url = file_create_url($file->uri);
        $this->drupalGet($file_url);
        $this->assertResponse(403, 'Confirmed that the anonymous uploader cannot access the permanent file when it is referenced by an unpublished node.');
        // Close the prior connection and remove the session cookie.
        $this->curlClose();
        $this->cookies = array();
        $this->drupalGet($file_url);
        $this->assertResponse(403, 'Confirmed that another anonymous user cannot access the permanent file when it is referenced by an unpublished node.');
    }
    
    /**
     * Tests file access for private nodes when file download access is granted.
     */
    function testPrivateFileDownloadAccessGranted() {
        // Tell file_module_test to attempt to grant access to all private files,
        // and ensure that it is doing so correctly.
        $test_file = $this->getTestFile('text');
        $uri = file_unmanaged_move($test_file->uri, 'private://');
        $file_url = file_create_url($uri);
        $this->drupalGet($file_url);
        $this->assertResponse(403, 'Access is not granted to an arbitrary private file by default.');
        variable_set('file_module_test_grant_download_access', TRUE);
        $this->drupalGet($file_url);
        $this->assertResponse(200, 'Access is granted to an arbitrary private file after a module grants access to all private files in hook_file_download().');
        // Create a public node with a file attached.
        $type_name = 'page';
        $field_name = strtolower($this->randomName());
        $this->createFileField($field_name, $type_name, array(
            'uri_scheme' => 'private',
        ));
        $test_file = $this->getTestFile('text');
        $nid = $this->uploadNodeFile($test_file, $field_name, $type_name, TRUE, array(
            'private' => FALSE,
        ));
        $node = node_load($nid, NULL, TRUE);
        $file_url = file_create_url($node->{$field_name}[LANGUAGE_NONE][0]['uri']);
        // Unpublish the node and ensure that only administrators (not anonymous
        // users) can access the node and download the file; the expectation is
        // that the File module's hook_file_download() implementation will deny
        // access and thereby override the file_module_test module's access grant.
        $node->status = NODE_NOT_PUBLISHED;
        node_save($node);
        $this->drupalLogin($this->admin_user);
        $this->drupalGet("node/{$nid}");
        $this->assertResponse(200, 'Administrator can access the unpublished node.');
        $this->drupalGet($file_url);
        $this->assertResponse(200, 'Administrator can download the file attached to the unpublished node.');
        $this->drupalLogOut();
        $this->drupalGet("node/{$nid}");
        $this->assertResponse(403, 'Anonymous user cannot access the unpublished node.');
        $this->drupalGet($file_url);
        $this->assertResponse(403, 'Anonymous user cannot download the file attached to the unpublished node.');
        // Re-publish the node and ensure that the node and file can be accessed by
        // everyone.
        $node->status = NODE_PUBLISHED;
        node_save($node);
        $this->drupalLogin($this->admin_user);
        $this->drupalGet("node/{$nid}");
        $this->assertResponse(200, 'Administrator can access the published node.');
        $this->drupalGet($file_url);
        $this->assertResponse(200, 'Administrator can download the file attached to the published node.');
        $this->drupalLogOut();
        $this->drupalGet("node/{$nid}");
        $this->assertResponse(200, 'Anonymous user can access the published node.');
        $this->drupalGet($file_url);
        $this->assertResponse(200, 'Anonymous user can download the file attached to the published node.');
        // Make the node private via the node access system and test that only
        // administrators (not anonymous users) can access the node and download
        // the file.
        $node->private = TRUE;
        node_save($node);
        $this->drupalLogin($this->admin_user);
        $this->drupalGet("node/{$nid}");
        $this->assertResponse(200, 'Administrator can access the private node.');
        $this->drupalGet($file_url);
        $this->assertResponse(200, 'Administrator can download the file attached to the private node.');
        $this->drupalLogOut();
        $this->drupalGet("node/{$nid}");
        $this->assertResponse(403, 'Anonymous user cannot access the private node.');
        $this->drupalGet($file_url);
        $this->assertResponse(403, 'Anonymous user cannot download the file attached to the private node.');
    }

}