snapshot of https://github.com/espocrm/espocrm.git (master, 2026-09-18; blobs > 131072B omitted)

tests/integration/Espo/Core/Acl/AclTest.php

@@ -0,0 +1,309 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2026 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace tests\integration\Espo\Core\Acl;
+
+use Espo\Core\AclManager;
+use Espo\Core\Acl;
+use Espo\Core\Field\LinkMultiple;
+use Espo\Entities\Role;
+use Espo\Entities\User;
+use Espo\Modules\Crm\Entities\Account;
+use Espo\Modules\Crm\Entities\Call;
+use Espo\Modules\Crm\Entities\Meeting;
+use Espo\Modules\Crm\Entities\Task;
+use RuntimeException;
+use tests\integration\Core\BaseTestCase;
+
+class AclTest extends BaseTestCase
+{
+    public function testGetReadOwnerUserField()
+    {
+        $aclManager = $this->getContainer()->getByClass(AclManager::class);
+
+        $this->assertEquals(
+            'assignedUser',
+            $aclManager->getReadOwnerUserField('Account')
+        );
+
+        $this->assertEquals(
+            'createdBy',
+            $aclManager->getReadOwnerUserField('Import')
+        );
+
+        $this->assertEquals(
+            'users',
+            $aclManager->getReadOwnerUserField('Email')
+        );
+
+        $this->assertEquals(
+            'users',
+            $aclManager->getReadOwnerUserField('Meeting')
+        );
+    }
+
+    public function testTryCheck(): void
+    {
+        /* @var $Acl Acl */
+        $acl = $this->getContainer()->get('acl');
+
+        $this->assertFalse($acl->tryCheck('NonExistingEntityType'));
+    }
+
+    public function testCheckScopeAccess(): void
+    {
+        $this->createUser('tester', [
+            'data' => [
+                Task::ENTITY_TYPE => false,
+                Call::ENTITY_TYPE => [
+                    'create' => Acl\Table::LEVEL_NO,
+                    'read' => Acl\Table::LEVEL_NO,
+                    'edit' => Acl\Table::LEVEL_NO,
+                    'delete' => Acl\Table::LEVEL_NO,
+                ],
+                Meeting::ENTITY_TYPE => [
+                    'create' => Acl\Table::LEVEL_YES,
+                    'read' => Acl\Table::LEVEL_YES,
+                    'edit' => Acl\Table::LEVEL_NO,
+                    'delete' => Acl\Table::LEVEL_NO,
+                ],
+            ],
+        ]);
+
+        $this->authenticate('tester');
+
+        $acl = $this->getContainer()->getByClass(Acl::class);
+
+        $this->assertFalse($acl->checkScope(Task::ENTITY_TYPE));
+        $this->assertTrue($acl->checkScope(Call::ENTITY_TYPE));
+        $this->assertTrue($acl->checkScope(Meeting::ENTITY_TYPE));
+
+        $this->assertFalse($acl->check(Task::ENTITY_TYPE, Acl\Table::ACTION_READ));
+        $this->assertFalse($acl->check(Call::ENTITY_TYPE, Acl\Table::ACTION_READ));
+        $this->assertTrue($acl->check(Meeting::ENTITY_TYPE, Acl\Table::ACTION_READ));
+    }
+
+    public function testCheckField(): void
+    {
+        $user = $this->createUser('tester', [
+            'fieldData' => [
+                'Call' => [
+                    'direction' => [
+                        'read' => Acl\Table::LEVEL_NO,
+                        'edit' => Acl\Table::LEVEL_NO,
+                    ],
+                    'contacts' => [
+                        'read' => Acl\Table::LEVEL_YES,
+                        'edit' => Acl\Table::LEVEL_NO,
+                    ],
+                ],
+            ],
+        ]);
+
+        /** @var User $user */
+        $user = $this->getEntityManager()->getEntityById(User::ENTITY_TYPE, $user->getId());
+
+        $aclManager = $this->getContainer()->getByClass(AclManager::class);
+
+        $this->assertFalse($aclManager->checkField($user, 'Call', 'direction'));
+        $this->assertTrue($aclManager->checkField($user, 'Call', 'contacts'));
+        $this->assertFalse($aclManager->checkField($user, 'Call', 'contacts', Acl\Table::ACTION_EDIT));
+    }
+
+    public function testDisabledField(): void
+    {
+        $metadata = $this->getMetadata();
+
+        $metadata->set('entityDefs', 'Account', [
+            'fields' => [
+                'assignedUser' => [
+                    'disabled' => true,
+                ]
+            ]
+        ]);
+        $metadata->save();
+
+        $this->reCreateApplication(reuse: true);
+
+        $acl = $this->getContainer()->getByClass(Acl::class);
+
+        $this->assertFalse($acl->checkField(Account::ENTITY_TYPE, 'assignedUser'));
+        $this->assertTrue($acl->checkField(Account::ENTITY_TYPE, 'name'));
+    }
+
+    public function testDisabledLink(): void
+    {
+        $metadata = $this->getMetadata();
+
+        $metadata->set('entityDefs', 'Account', [
+            'links' => [
+                'opportunities' => [
+                    'disabled' => true,
+                ]
+            ]
+        ]);
+        $metadata->save();
+
+        $this->reCreateApplication(reuse: true);
+
+        $acl = $this->getContainer()->getByClass(Acl::class);
+
+        $this->assertFalse($acl->checkLink('Account', 'opportunities'));
+    }
+
+    public function testMultipleRoles(): void
+    {
+        $em = $this->getEntityManager();
+
+        $role1 = $em->getRDBRepositoryByClass(Role::class)->getNew();
+        $role1->setRawData([
+            'Lead' => [
+                Acl\Table::ACTION_CREATE => Acl\Table::LEVEL_YES,
+            ],
+            'Opportunity' => [
+                Acl\Table::ACTION_EDIT => Acl\Table::LEVEL_NO,
+            ],
+            'Account' => [
+                Acl\Table::ACTION_CREATE => Acl\Table::LEVEL_NO,
+            ],
+            'Meeting' => [
+                Acl\Table::ACTION_CREATE => Acl\Table::LEVEL_YES,
+                Acl\Table::ACTION_EDIT => Acl\Table::LEVEL_NO,
+                Acl\Table::ACTION_STREAM => Acl\Table::LEVEL_NO,
+            ],
+            'Call' => [
+                Acl\Table::ACTION_CREATE => Acl\Table::LEVEL_NO,
+                Acl\Table::ACTION_EDIT => Acl\Table::LEVEL_ALL,
+            ],
+        ]);
+        $em->saveEntity($role1);
+
+        $role2 = $em->getRDBRepositoryByClass(Role::class)->getNew();
+        $role2->setRawData([
+            'Lead' => [
+                Acl\Table::ACTION_EDIT => Acl\Table::LEVEL_NO,
+            ],
+            'Opportunity' => [
+                Acl\Table::ACTION_CREATE => Acl\Table::LEVEL_YES,
+            ],
+            'Account' => [
+                Acl\Table::ACTION_EDIT => Acl\Table::LEVEL_NO,
+            ],
+            'Meeting' => [
+                Acl\Table::ACTION_CREATE => Acl\Table::LEVEL_NO,
+                Acl\Table::ACTION_EDIT => Acl\Table::LEVEL_ALL,
+                Acl\Table::ACTION_STREAM => Acl\Table::LEVEL_NO,
+            ],
+            'Call' => [
+                Acl\Table::ACTION_CREATE => Acl\Table::LEVEL_YES,
+                Acl\Table::ACTION_EDIT => Acl\Table::LEVEL_NO,
+            ],
+        ]);
+        $em->saveEntity($role2);
+
+        $user = $em->getRDBRepositoryByClass(User::class)->getNew();
+        $user
+            ->setUserName('test-1')
+            ->setRoles(LinkMultiple::create()->withAddedIdList([$role1->getId(), $role2->getId()]));
+        $em->saveEntity($user);
+
+        $em->refreshEntity($user);
+
+        $aclManager = $this->getContainer()->getByClass(AclManager::class);
+
+        $this->assertTrue($aclManager->checkScope($user, 'Lead', Acl\Table::ACTION_CREATE));
+        $this->assertTrue($aclManager->checkScope($user, 'Opportunity', Acl\Table::ACTION_CREATE));
+        $this->assertFalse($aclManager->checkScope($user, 'Account', Acl\Table::ACTION_CREATE));
+        $this->assertFalse($aclManager->checkScope($user, 'Opportunity', Acl\Table::ACTION_EDIT));
+        $this->assertFalse($aclManager->checkScope($user, 'Account', Acl\Table::ACTION_EDIT));
+        $this->assertTrue($aclManager->checkScope($user, 'Meeting', Acl\Table::ACTION_CREATE));
+        $this->assertTrue($aclManager->checkScope($user, 'Meeting', Acl\Table::ACTION_EDIT));
+        $this->assertFalse($aclManager->checkScope($user, 'Meeting', Acl\Table::ACTION_STREAM));
+        $this->assertTrue($aclManager->checkScope($user, 'Call', Acl\Table::ACTION_CREATE));
+        $this->assertTrue($aclManager->checkScope($user, 'Call', Acl\Table::ACTION_EDIT));
+    }
+
+    public function testCheckAdmin(): void
+    {
+        $user = $this->createUser(
+            userData: [
+                User::FIELD_USER_NAME => 'test',
+            ],
+        );
+
+        $admin = $this->createUser(
+            userData: [
+                User::FIELD_USER_NAME => 'admin-test',
+                User::FIELD_TYPE => User::TYPE_ADMIN,
+            ],
+        );
+
+        $aclManager = $this->getInjectableFactory()->create(AclManager::class);
+
+        //
+
+        $user = $this->reFetchUser($user);
+        $admin = $this->reFetchUser($admin);
+
+        $this->assertFalse($aclManager->checkAdmin($user));
+        $this->assertTrue($aclManager->checkAdmin($admin));
+
+        $this->assertFalse($aclManager->createUserAcl($user)->checkAdmin());
+        $this->assertTrue($aclManager->createUserAcl($admin)->checkAdmin());
+
+        //
+
+        $user = $this->reFetchUser($user);
+        $admin = $this->reFetchUser($admin);
+
+        $user->setScopes([Acl\Scope::ADMIN]);
+        $admin->setScopes([Acl\Scope::ADMIN]);
+
+        $this->assertFalse($aclManager->checkAdmin($user));
+        $this->assertTrue($aclManager->checkAdmin($admin));
+
+        //
+
+        $user = $this->reFetchUser($user);
+        $admin = $this->reFetchUser($admin);
+
+        $user->setScopes([]);
+        $admin->setScopes([]);
+
+        $this->assertFalse($aclManager->checkAdmin($user));
+        $this->assertFalse($aclManager->checkAdmin($admin));
+    }
+
+    private function reFetchUser(User $user): User
+    {
+        return $this->getEntityManager()
+            ->getRDBRepositoryByClass(User::class)
+            ->getById($user->getId()) ?? throw new RuntimeException();
+    }
+}