Chris@17: <?php
Chris@17: 
Chris@17: namespace Drupal\Tests\taxonomy\Functional;
Chris@17: 
Chris@17: use Drupal\taxonomy\Entity\Term;
Chris@17: use Drupal\taxonomy\TermInterface;
Chris@17: use Drupal\Tests\system\Functional\Cache\AssertPageCacheContextsAndTagsTrait;
Chris@17: 
Chris@17: /**
Chris@17:  * Tests the taxonomy term access permissions.
Chris@17:  *
Chris@17:  * @group taxonomy
Chris@17:  */
Chris@17: class TermAccessTest extends TaxonomyTestBase {
Chris@17: 
Chris@17:   use AssertPageCacheContextsAndTagsTrait;
Chris@17: 
Chris@17:   /**
Chris@17:    * Test access control functionality for taxonomy terms.
Chris@17:    */
Chris@17:   public function testTermAccess() {
Chris@17:     $assert_session = $this->assertSession();
Chris@17: 
Chris@17:     $vocabulary = $this->createVocabulary();
Chris@17: 
Chris@17:     // Create two terms.
Chris@17:     $published_term = Term::create([
Chris@17:       'vid' => $vocabulary->id(),
Chris@17:       'name' => 'Published term',
Chris@17:       'status' => 1,
Chris@17:     ]);
Chris@17:     $published_term->save();
Chris@17:     $unpublished_term = Term::create([
Chris@17:       'vid' => $vocabulary->id(),
Chris@17:       'name' => 'Unpublished term',
Chris@17:       'status' => 0,
Chris@17:     ]);
Chris@17:     $unpublished_term->save();
Chris@17: 
Chris@17:     // Start off logged in as admin.
Chris@17:     $this->drupalLogin($this->drupalCreateUser(['administer taxonomy']));
Chris@17: 
Chris@17:     // Test the 'administer taxonomy' permission.
Chris@17:     $this->drupalGet('taxonomy/term/' . $published_term->id());
Chris@17:     $assert_session->statusCodeEquals(200);
Chris@17:     $this->assertTermAccess($published_term, 'view', TRUE);
Chris@17:     $this->drupalGet('taxonomy/term/' . $unpublished_term->id());
Chris@17:     $assert_session->statusCodeEquals(200);
Chris@17:     $this->assertTermAccess($unpublished_term, 'view', TRUE);
Chris@17: 
Chris@17:     $this->drupalGet('taxonomy/term/' . $published_term->id() . '/edit');
Chris@17:     $assert_session->statusCodeEquals(200);
Chris@17:     $this->assertTermAccess($published_term, 'update', TRUE);
Chris@17:     $this->drupalGet('taxonomy/term/' . $unpublished_term->id() . '/edit');
Chris@17:     $assert_session->statusCodeEquals(200);
Chris@17:     $this->assertTermAccess($unpublished_term, 'update', TRUE);
Chris@17: 
Chris@17:     $this->drupalGet('taxonomy/term/' . $published_term->id() . '/delete');
Chris@17:     $assert_session->statusCodeEquals(200);
Chris@17:     $this->assertTermAccess($published_term, 'delete', TRUE);
Chris@17:     $this->drupalGet('taxonomy/term/' . $unpublished_term->id() . '/delete');
Chris@17:     $assert_session->statusCodeEquals(200);
Chris@17:     $this->assertTermAccess($unpublished_term, 'delete', TRUE);
Chris@17: 
Chris@17:     // Test the 'access content' permission.
Chris@17:     $this->drupalLogin($this->drupalCreateUser(['access content']));
Chris@17: 
Chris@17:     $this->drupalGet('taxonomy/term/' . $published_term->id());
Chris@17:     $assert_session->statusCodeEquals(200);
Chris@17:     $this->assertTermAccess($published_term, 'view', TRUE);
Chris@17: 
Chris@17:     $this->drupalGet('taxonomy/term/' . $unpublished_term->id());
Chris@17:     $assert_session->statusCodeEquals(403);
Chris@17:     $this->assertTermAccess($unpublished_term, 'view', FALSE, "The 'access content' permission is required and the taxonomy term must be published.");
Chris@17: 
Chris@17:     $this->drupalGet('taxonomy/term/' . $published_term->id() . '/edit');
Chris@17:     $assert_session->statusCodeEquals(403);
Chris@17:     $this->assertTermAccess($published_term, 'update', FALSE, "The following permissions are required: 'edit terms in {$vocabulary->id()}' OR 'administer taxonomy'.");
Chris@17:     $this->drupalGet('taxonomy/term/' . $unpublished_term->id() . '/edit');
Chris@17:     $assert_session->statusCodeEquals(403);
Chris@17:     $this->assertTermAccess($unpublished_term, 'update', FALSE, "The following permissions are required: 'edit terms in {$vocabulary->id()}' OR 'administer taxonomy'.");
Chris@17: 
Chris@17:     $this->drupalGet('taxonomy/term/' . $published_term->id() . '/delete');
Chris@17:     $assert_session->statusCodeEquals(403);
Chris@17:     $this->assertTermAccess($published_term, 'delete', FALSE, "The following permissions are required: 'delete terms in {$vocabulary->id()}' OR 'administer taxonomy'.");
Chris@17:     $this->drupalGet('taxonomy/term/' . $unpublished_term->id() . '/delete');
Chris@17:     $assert_session->statusCodeEquals(403);
Chris@17:     $this->assertTermAccess($unpublished_term, 'delete', FALSE, "The following permissions are required: 'delete terms in {$vocabulary->id()}' OR 'administer taxonomy'.");
Chris@17: 
Chris@17:     // Install the Views module and repeat the checks for the 'view' permission.
Chris@17:     \Drupal::service('module_installer')->install(['views'], TRUE);
Chris@17:     $this->rebuildContainer();
Chris@17: 
Chris@17:     $this->drupalGet('taxonomy/term/' . $published_term->id());
Chris@17:     $assert_session->statusCodeEquals(200);
Chris@17: 
Chris@17:     // @todo Change this assertion to expect a 403 status code when
Chris@17:     //   https://www.drupal.org/project/drupal/issues/2983070 is fixed.
Chris@17:     $this->drupalGet('taxonomy/term/' . $unpublished_term->id());
Chris@17:     $assert_session->statusCodeEquals(404);
Chris@17:   }
Chris@17: 
Chris@17:   /**
Chris@17:    * Checks access on taxonomy term.
Chris@17:    *
Chris@17:    * @param \Drupal\taxonomy\TermInterface $term
Chris@17:    *   A taxonomy term entity.
Chris@17:    * @param $access_operation
Chris@17:    *   The entity operation, e.g. 'view', 'edit', 'delete', etc.
Chris@17:    * @param bool $access_allowed
Chris@17:    *   Whether the current use has access to the given operation or not.
Chris@17:    * @param string $access_reason
Chris@17:    *   (optional) The reason of the access result.
Chris@17:    */
Chris@17:   protected function assertTermAccess(TermInterface $term, $access_operation, $access_allowed, $access_reason = '') {
Chris@17:     $access_result = $term->access($access_operation, NULL, TRUE);
Chris@17:     $this->assertSame($access_allowed, $access_result->isAllowed());
Chris@17: 
Chris@17:     if ($access_reason) {
Chris@17:       $this->assertSame($access_reason, $access_result->getReason());
Chris@17:     }
Chris@17:   }
Chris@17: 
Chris@17: }