snapshot of https://github.com/espocrm/espocrm.git (master, 2026-09-18; blobs > 131072B omitted)

tests/integration/Espo/Actions/ActionTest.php

@@ -0,0 +1,367 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2026 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace tests\integration\Espo\Actions;
+
+use Espo\Core\Action\Actions\Merge\Merger;
+use Espo\Core\Action\Api\PostProcess;
+use Espo\Core\Action\Params;
+use Espo\Core\Application;
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Field\EmailAddress;
+use Espo\Core\Field\PhoneNumber;
+use Espo\Core\ORM\EntityManager;
+
+use Espo\Modules\Crm\Entities\Account;
+use Espo\Modules\Crm\Entities\Contact;
+use tests\integration\Core\BaseTestCase;
+
+class ActionTest extends BaseTestCase
+{
+    /** @var EntityManager */
+    private $entityManager;
+
+    /** @var Merger */
+    private $merger;
+
+    private ?PostProcess $action = null;
+
+    private function init(): void
+    {
+        $this->entityManager = $this->getApplication()
+            ->getContainer()
+            ->getByClass(EntityManager::class);
+
+        $this->action = $this->getInjectableFactory()->create(PostProcess::class);
+
+        $this->merger = $this->getApplication()
+            ->getInjectableFactory()
+            ->create(Merger::class);
+    }
+
+    public function testActionNotAllowed(): void
+    {
+        $this->init();
+
+        $data = [
+            'entityType' => 'Role',
+            'action' => 'convertCurrency',
+            'id' => 'arbitrary-id',
+            'data' => (object) [],
+        ];
+
+        $request = $this->createRequest(
+            'POST',
+            [],
+            ['Content-Type' => 'application/json'],
+            json_encode($data)
+        );
+
+        $this->expectException(Forbidden::class);
+
+        $this->action->process($request);
+    }
+
+    public function testActionMerge1(): void
+    {
+        $this->createUser('tester', [
+            'assignmentPermission' => 'all',
+            'data' => [
+                'Contact' => [
+                    'create' => 'all',
+                    'read' => 'all',
+                    'edit' => 'all',
+                    'delete' => 'all',
+                ],
+            ],
+        ]);
+
+        $this->authenticate('tester');
+
+        $this->init();
+
+        $team1 = $this->entityManager->createEntity('Team', []);
+        $team2 = $this->entityManager->createEntity('Team', []);
+
+        $account1 = $this->entityManager->createEntity('Account', []);
+        $account2 = $this->entityManager->createEntity('Account', []);
+
+        /* @var $contact1 Contact */
+        $contact1 = $this->entityManager->getNewEntity('Contact');
+
+        $emailAddressGroup1 = $contact1->getEmailAddressGroup()
+            ->withAdded(EmailAddress::create('c1a@test.com'))
+            ->withAdded(EmailAddress::create('c1b@test.com')->invalid());
+
+        $contact1->setEmailAddressGroup($emailAddressGroup1);
+
+        $phoneNumberGroup1 = $contact1->getPhoneNumberGroup()
+            ->withAdded(PhoneNumber::create('+11000000000'))
+            ->withAdded(PhoneNumber::create('+12000000000')->invalid());
+
+        $contact1->setPhoneNumberGroup($phoneNumberGroup1);
+
+        $contact1->set('accountId', $account1->getId());
+
+        $contact1->set('teamsIds', [$team1->getId()]);
+
+        /* @var $contact2 Contact */
+        $contact2 =  $this->entityManager->getNewEntity('Contact');
+
+        $emailAddressGroup2 = $contact1->getEmailAddressGroup()
+            ->withAdded(EmailAddress::create('c2a@test.com'))
+            ->withAdded(EmailAddress::create('c2b@test.com')->optedOut());
+
+        $contact2->setEmailAddressGroup($emailAddressGroup2);
+
+        $phoneNumberGroup2 = $contact2->getPhoneNumberGroup()
+            ->withAdded(PhoneNumber::create('+11100000000'))
+            ->withAdded(PhoneNumber::create('+12100000000')->optedOut());
+
+        $contact2->setPhoneNumberGroup($phoneNumberGroup2);
+
+        $contact2->set('accountId', $account2->getId());
+
+        $contact2->set('teamsIds', [$team2->getId()]);
+
+        $this->entityManager->saveEntity($contact1);
+        $this->entityManager->saveEntity($contact2);
+
+        $this->entityManager->createEntity('Note', [
+            'type' => 'Post',
+            'parentType' => 'Contact',
+            'parentId' => $contact1->getId(),
+        ]);
+
+        $note2 = $this->entityManager->createEntity('Note', [
+            'type' => 'Post',
+            'parentType' => 'Contact',
+            'parentId' => $contact2->getId(),
+        ]);
+
+        $opportunity1 = $this->entityManager->createEntity('Opportunity', []);
+        $opportunity2 = $this->entityManager->createEntity('Opportunity', []);
+
+        $this->entityManager
+            ->getRDBRepository('Contact')
+            ->getRelation($contact1, 'opportunities')
+            ->relate($opportunity1);
+
+        $this->entityManager
+            ->getRDBRepository('Contact')
+            ->getRelation($contact2, 'opportunities')
+            ->relate($opportunity2);
+
+        $data = [
+            'entityType' => 'Contact',
+            'action' => 'merge',
+            'id' => $contact1->getId(),
+            'data' => (object) [
+                'attributes' => (object) [
+                    'description' => 'merged',
+                ],
+                'sourceIdList' => [$contact2->getId()],
+            ],
+        ];
+
+        $request = $this->createRequest(
+            'POST',
+            [],
+            ['Content-Type' => 'application/json'],
+            json_encode($data)
+        );
+
+        $this->action->process($request);
+
+        /* @var $contact1Reloaded Contact */
+        $contact1Reloaded = $this->entityManager->getEntityById('Contact', $contact1->getId());
+        $contact2Reloaded = $this->entityManager->getEntityById('Contact', $contact2->getId());
+
+        $this->assertEquals('merged', $contact1Reloaded->get('description'));
+
+        $this->assertNull($contact2Reloaded);
+
+        $emailAddressGroup = $contact1Reloaded->getEmailAddressGroup();
+        $phoneNumberGroup = $contact1Reloaded->getPhoneNumberGroup();
+
+        $this->assertEquals(4, $emailAddressGroup->getCount());
+        $this->assertEquals(4, $phoneNumberGroup->getCount());
+
+        $this->assertEquals(
+            'c1a@test.com',
+            $emailAddressGroup->getPrimary()->getAddress()
+        );
+
+        $this->assertEquals(
+            '+11000000000',
+            $phoneNumberGroup->getPrimary()->getNumber()
+        );
+
+        $this->assertTrue(
+            $emailAddressGroup->getByAddress('c2b@test.com')->isOptedOut()
+        );
+
+        $this->assertTrue(
+            $emailAddressGroup->getByAddress('c1b@test.com')->isInvalid()
+        );
+
+        $this->assertTrue(
+            $phoneNumberGroup->getByNumber('+12100000000')->isOptedOut()
+        );
+
+        $this->assertTrue(
+            $phoneNumberGroup->getByNumber('+12000000000')->isInvalid()
+        );
+
+        $this->assertEquals(
+            $contact1->getId(),
+            $this->entityManager
+                ->getEntityById('Note', $note2->getId())
+                ->get('parentId')
+        );
+
+        $this->assertEquals(
+            2,
+            $this->entityManager
+                ->getRDBRepository('Contact')
+                ->getRelation($contact1Reloaded, 'opportunities')
+                ->count()
+        );
+
+        $this->assertEquals(
+            2,
+            $this->entityManager
+                ->getRDBRepository('Contact')
+                ->getRelation($contact1Reloaded, 'teams')
+                ->count()
+        );
+
+        $this->assertEquals(
+            2,
+            count($contact1Reloaded->getLinkMultipleIdList('accounts'))
+        );
+    }
+
+    public function testMergeRelationshipColumns(): void
+    {
+        $em = $this->getEntityManager();
+
+        $account = $em->getRDBRepositoryByClass(Account::class)->getNew();
+        $accountSource = $em->getRDBRepositoryByClass(Account::class)->getNew();
+        $contact = $em->getRDBRepositoryByClass(Contact::class)->getNew();
+
+        $em->saveEntity($account);
+        $em->saveEntity($accountSource);
+        $em->saveEntity($contact);
+
+        $em->getRelation($accountSource, 'contacts')
+            ->relate($contact, [
+                'role' => 'Tester',
+                'isInactive' => true,
+            ]);
+
+        $merger = $this->getInjectableFactory()->create(Merger::class);
+
+        /** @noinspection PhpUnhandledExceptionInspection */
+        $merger->process(
+            new Params(Account::ENTITY_TYPE, $account->getId()),
+            [$accountSource->getId()],
+            (object) []
+        );
+
+        $em->refreshEntity($account);
+
+        $relation = $em->getRelation($account, 'contacts');
+
+        $this->assertEquals(
+            'Tester',
+            $relation->getColumn($contact, 'role')
+        );
+
+        $this->assertTrue(
+            $relation->getColumn($contact, 'isInactive')
+        );
+    }
+
+    public function testMergeNoEditAccess(): void
+    {
+        $this->createUser('tester', [
+            'assignmentPermission' => 'all',
+            'data' => [
+                'Contact' => [
+                    'create' => 'own',
+                    'read' => 'all',
+                    'edit' => 'own',
+                    'delete' => 'no',
+                ],
+            ],
+        ]);
+
+        $this->authenticate('tester');
+
+        $this->init();
+
+        $contact1 = $this->entityManager->createEntity('Contact', []);
+        $contact2 = $this->entityManager->createEntity('Contact', []);
+
+        $params = new Params('Contact', $contact1->getId());
+
+        $this->expectException(Forbidden::class);
+
+        $this->merger->process($params, [$contact2->getId()], (object) []);
+    }
+
+    public function testMergeNoDeleteAccess(): void
+    {
+        $this->createUser('tester', [
+            'assignmentPermission' => 'all',
+            'data' => [
+                'Contact' => [
+                    'create' => 'own',
+                    'read' => 'all',
+                    'edit' => 'all',
+                    'delete' => 'no',
+                ],
+            ],
+        ]);
+
+        $this->authenticate('tester');
+
+        $this->init();
+
+        $contact1 = $this->entityManager->createEntity('Contact', []);
+        $contact2 = $this->entityManager->createEntity('Contact', []);
+
+        $params = new Params('Contact', $contact1->getId());
+
+        $this->expectException(Forbidden::class);
+
+        $this->merger->process($params, [$contact2->getId()], (object) []);
+    }
+}

tests/integration/Espo/Actions/MassActionTest.php

@@ -0,0 +1,349 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2026 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace tests\integration\Espo\Actions;
+
+use Espo\Core\MassAction\Api\PostProcess;
+use Espo\Entities\User;
+use Espo\Modules\Crm\Entities\Account;
+
+use Espo\Core\MassAction\ServiceParams;
+use Espo\Core\MassAction\Service;
+use Espo\Core\MassAction\Params as MassActionParams;
+use Espo\Core\MassAction\Jobs\Process as JobProcess;
+use Espo\Core\Job\Job\Data as JobData;
+
+use Espo\Core\Select\SearchParams;
+
+use Espo\Core\Api\ResponseWrapper;
+use Espo\Core\Exceptions\Error;
+use Espo\Core\Exceptions\Forbidden;
+use Espo\ORM\EntityManager;
+use Espo\Modules\Crm\Entities\Contact;
+use Espo\Modules\Crm\Entities\Opportunity;
+use Espo\Tools\MassUpdate\Data as MassUpdateData;
+use Espo\Tools\MassUpdate\Processor;
+use RuntimeException;
+use tests\integration\Core\BaseTestCase;
+
+class MassActionTest extends BaseTestCase
+{
+    /** @var EntityManager */
+    private $entityManager;
+
+    private ?PostProcess $action = null;
+
+    private function init(): void
+    {
+        $this->entityManager = $this->getApplication()
+            ->getContainer()
+            ->getByClass(EntityManager::class);
+
+        $this->action = $this->getInjectableFactory()->create(PostProcess::class);
+    }
+
+    private function getAdminUser(): User
+    {
+        $repository = $this->getContainer()
+            ->getByClass(EntityManager::class)
+            ->getRDBRepositoryByClass(User::class);
+
+        $user = $repository
+            ->where(['type' => User::TYPE_ADMIN])
+            ->findOne();
+
+        if (!$user) {
+            $user = $repository->getNew();
+            $user->set('userName', 'test-admin');
+            $user->set('type', User::TYPE_ADMIN);
+
+            $repository->save($user);
+        }
+
+        return $user;
+    }
+
+    public function testUpdate1(): void
+    {
+        $adminUser = $this->getAdminUser();
+
+        $this->createUser([
+            'userName' => 'admin-test',
+            'type' => 'admin',
+        ]);
+
+        $this->authenticate('admin-test');
+        $this->init();
+
+        $account = $this->entityManager->createEntity('Account', [
+            'name' => 'test',
+        ]);
+
+        $data = [
+            'entityType' => 'Account',
+            'action' => 'update',
+            'params' => [
+                'ids' => [$account->getId()],
+            ],
+            'data' => [
+                'assignedUserId' => $adminUser->getId(),
+            ],
+        ];
+
+        $request = $this->createRequest(
+            'POST',
+            [],
+            ['Content-Type' => 'application/json'],
+            json_encode($data)
+        );
+
+        $this->action->process($request);
+
+        $accountReloaded = $this->entityManager->getEntityById('Account', $account->getId());
+
+        $this->assertEquals($adminUser->getId(), $accountReloaded->get('assignedUserId'));
+    }
+
+    public function testUpdateNotAllowed(): void
+    {
+        $this->init();
+
+        $data = [
+            'entityType' => 'Role',
+            'action' => 'update',
+            'params' => [
+                'ids' => ['arbitrary-id'],
+            ],
+            'data' => [
+                'name' => '1'
+            ],
+        ];
+
+        $request = $this->createRequest(
+            'POST',
+            [],
+            ['Content-Type' => 'application/json'],
+            json_encode($data)
+        );
+
+        $this->createMock(ResponseWrapper::class);
+
+        $this->expectException(Forbidden::class);
+
+        $this->action->process($request);
+    }
+
+    public function testAcl1(): void
+    {
+        $em = $this->getEntityManager();
+
+        $user = $this->createUser('tester', [
+            'massUpdatePermission' => 'yes',
+            'data' => [
+                'Account' => [
+                    'create' => 'no',
+                    'read' => 'all',
+                    'edit' => 'own',
+                    'delete' => 'no',
+                ],
+            ],
+        ]);
+
+        $account1 = $em->createEntity(Account::ENTITY_TYPE, [
+            'name' => '1',
+            'assignedUserId' => $user->getId(),
+        ]);
+
+        $account2 = $em->createEntity(Account::ENTITY_TYPE, [
+            'name' => '2',
+        ]);
+
+        $this->authenticate('tester');
+
+        $injectableFactory = $this->getInjectableFactory();
+
+        $this->assertEquals($user->getId(), $this->getContainer()->getByClass(User::class)->getId());
+
+        /** @var Service $service */
+        $service = $injectableFactory->create(Service::class);
+
+        $serviceParams = ServiceParams
+            ::create(
+                MassActionParams::createWithSearchParams('Account', SearchParams::create())
+            )
+            ->withIsIdle();
+
+        $serviceResult = $service->process(
+            'Account',
+            'update',
+            $serviceParams,
+            (object) [
+                'type' => 'Customer',
+            ]
+        );
+
+        $this->assertFalse($serviceResult->hasResult());
+
+        $massActionId = $serviceResult->getId();
+
+        $this->authenticate(null);
+
+        $this->assertEquals('system', $this->getContainer()->getByClass(User::class)->getId());
+
+        $injectableFactory1 = $this->getInjectableFactory();
+
+        $process = $injectableFactory1->create(JobProcess::class);
+
+        $process->run(JobData::create()->withTargetId($massActionId));
+
+        $em->refreshEntity($account1);
+        $em->refreshEntity($account2);
+
+        $this->assertEquals('Customer', $account1->get('type'));
+        $this->assertEquals(null, $account2->get('type'));
+    }
+
+    public function testAcl2()
+    {
+        $user = $this->createUser('tester', [
+            'massUpdatePermission' => 'yes',
+            'data' => [
+                'User' => [
+                    'create' => 'no',
+                    'read' => 'all',
+                    'edit' => 'own',
+                    'delete' => 'no',
+                ],
+            ],
+        ]);
+
+        $this->createUser('tester-1', []);
+
+        $this->authenticate('tester');
+
+        $injectableFactory = $this->getInjectableFactory();
+
+        $this->assertEquals($user->getId(), $this->getContainer()->getByClass(User::class)->getId());
+
+        $service = $injectableFactory->create(Service::class);
+
+        $serviceParams = ServiceParams
+            ::create(
+                MassActionParams::createWithSearchParams('User', SearchParams::create())
+            )
+            ->withIsIdle();
+
+        $serviceResult = $service->process(
+            'User',
+            'update',
+            $serviceParams,
+            (object) [
+                'title' => 'Tester',
+            ]
+        );
+
+        $this->assertFalse($serviceResult->hasResult());
+
+        $massActionId = $serviceResult->getId();
+
+        $this->authenticate(null);
+
+        $this->assertEquals('system', $this->getContainer()->getByClass(User::class)->getId());
+
+        $injectableFactory1 = $this->getInjectableFactory();
+
+        $process = $injectableFactory1->create(JobProcess::class);
+
+        // Mass-update for User entity type is allowed only for admins.
+        $this->expectException(RuntimeException::class);
+
+        $process->run(JobData::create()->withTargetId($massActionId));
+    }
+
+    public function testMassUpdateLinkAccess(): void
+    {
+        $user = $this->createUser('tester', [
+            'massUpdatePermission' => 'yes',
+            'data' => [
+                'Contact' => [
+                    'create' => 'no',
+                    'read' => 'own',
+                    'edit' => 'no',
+                    'delete' => 'no'
+                ],
+                'Opportunity' => [
+                    'create' => 'yes',
+                    'read' => 'team',
+                    'edit' => 'own',
+                    'delete' => 'own'
+                ],
+            ],
+        ]);
+
+
+        $this->authenticate('tester');
+
+        $contact1 = $this->getEntityManager()
+            ->createEntity(Contact::ENTITY_TYPE, [
+                'lastName' => 'Contact 1',
+                'assignedUserId' => $user->getId(),
+            ]);
+
+        $contact2 = $this->getEntityManager()
+            ->createEntity(Contact::ENTITY_TYPE, [
+                'lastName' => 'Contact 2',
+            ]);
+
+        $opp1 = $this->getEntityManager()
+            ->createEntity(Opportunity::ENTITY_TYPE, [
+                'name' => 'Opp 1',
+                'assignedUserId' => $user->getId(),
+            ]);
+
+        $opp2 = $this->getEntityManager()
+            ->createEntity(Opportunity::ENTITY_TYPE, [
+                'name' => 'Opp 2',
+                'assignedUserId' => $user->getId(),
+            ]);
+
+        $processor = $this->getInjectableFactory()->create(Processor::class);
+
+        $params = MassActionParams::createWithIds(Opportunity::ENTITY_TYPE, [$opp1->getId(), $opp2->getId()]);
+
+        $data = MassUpdateData::create()
+            ->with('contactsIds', [$contact1->getId()]);
+        $result = $processor->process($params, $data);
+        $this->assertEquals(2, $result->getCount());
+
+        $data = MassUpdateData::create()
+            ->with('contactsIds', [$contact2->getId()]);
+        $result = $processor->process($params, $data);
+        $this->assertEquals(0, $result->getCount());
+    }
+}