1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
|
#!/usr/bin/perl -w
use Test::More qw(no_plan);
use RT;
ok( RT::LoadConfig, "Locating config files" );
ok( RT::Init, "Basic initialization and DB connectivity" );
my ($u1, $g1, $pg1, $pg2, $ace, @groups, @users, @principals);
@groups = (\$g1, \$pg1, \$pg2);
@users = (\$u1);
@principals = (@groups, @users);
my($ret, $msg);
$u1 = RT::User->new($RT::SystemUser);
( $ret, $msg ) = $u1->LoadOrCreateByEmail('delegtest1@example.com');
ok( $ret, "Load / Create test user 1: $msg" );
$u1->SetPrivileged(1);
$g1 = RT::Group->new($RT::SystemUser);
( $ret, $msg) = $g1->LoadUserDefinedGroup('dg1');
unless ($ret) {
( $ret, $msg ) = $g1->CreateUserDefinedGroup( Name => 'dg1' );
}
$pg1 = RT::Group->new($RT::SystemUser);
( $ret, $msg ) = $pg1->LoadPersonalGroup( Name => 'dpg1',
User => $u1->PrincipalId );
unless ($ret) {
( $ret, $msg ) = $pg1->CreatePersonalGroup( Name => 'dpg1',
PrincipalId => $u1->PrincipalId );
}
ok( $ret, "Load / Create test personal group 1: $msg" );
$pg2 = RT::Group->new($RT::SystemUser);
( $ret, $msg ) = $pg2->LoadPersonalGroup( Name => 'dpg2',
User => $u1->PrincipalId );
unless ($ret) {
( $ret, $msg ) = $pg2->CreatePersonalGroup( Name => 'dpg2',
PrincipalId => $u1->PrincipalId );
}
ok( $ret, "Load / Create test personal group 2: $msg" );
clear_acls_and_groups();
( $ret, $msg ) = $u1->PrincipalObj->GrantRight( Right => 'DelegateRights' );
ok( $ret, "Grant DelegateRights to u1: $msg" );
( $ret, $msg ) = $g1->PrincipalObj->GrantRight( Right => 'ShowConfigTab' );
ok( $ret, "Grant ShowConfigTab to g1: $msg" );
( $ret, $msg ) = $g1->AddMember( $u1->PrincipalId );
ok( $ret, "Add test user 1 to g1: $msg" );
$ace = RT::ACE->new($u1);
( $ret, $msg ) = $ace->LoadByValues(
RightName => 'ShowConfigTab',
Object => $RT::System,
PrincipalType => 'Group',
PrincipalId => $g1->PrincipalId
);
ok( $ret, "Look up ACE to be delegated: $msg" );
( $ret, $msg ) = $ace->Delegate( PrincipalId => $pg1->PrincipalId );
ok( $ret, "Delegate ShowConfigTab to pg1: $msg" );
( $ret, $msg ) = $ace->Delegate( PrincipalId => $pg2->PrincipalId );
ok( $ret, "Delegate ShowConfigTab to pg2: $msg" );
ok(( $pg1->PrincipalObj->HasRight( Right => 'ShowConfigTab',
Object => $RT::System ) and
$pg2->PrincipalObj->HasRight( Right => 'ShowConfigTab',
Object => $RT::System )),
"Test personal groups have ShowConfigTab right after delegation" );
( $ret, $msg ) = $g1->DeleteMember( $u1->PrincipalId );
ok( $ret, "Delete test user 1 from g1: $msg" );
ok( not( $pg1->PrincipalObj->HasRight( Right => 'ShowConfigTab',
Object => $RT::System )),
"Test personal group 1 lacks ShowConfigTab after user removed from g1" );
ok( not( $pg2->PrincipalObj->HasRight( Right => 'ShowConfigTab',
Object => $RT::System )),
"Test personal group 2 lacks ShowConfigTab after user removed from g1" );
( $ret, $msg ) = $g1->AddMember( $u1->PrincipalId );
ok( $ret, "Add test user 1 to g1: $msg" );
( $ret, $msg ) = $ace->Delegate( PrincipalId => $pg1->PrincipalId );
ok( $ret, "Delegate ShowConfigTab to pg1: $msg" );
( $ret, $msg ) = $ace->Delegate( PrincipalId => $pg2->PrincipalId );
ok( $ret, "Delegate ShowConfigTab to pg2: $msg" );
ok(( $pg1->PrincipalObj->HasRight( Right => 'ShowConfigTab',
Object => $RT::System ) and
$pg2->PrincipalObj->HasRight( Right => 'ShowConfigTab',
Object => $RT::System )),
"Test personal groups have ShowConfigTab right after delegation" );
( $ret, $msg ) = $g1->PrincipalObj->RevokeRight( Right => 'ShowConfigTab' );
ok( $ret, "Revoke ShowConfigTab from g1: $msg" );
ok( not( $pg1->PrincipalObj->HasRight( Right => 'ShowConfigTab',
Object => $RT::System )),
"Test personal group 1 lacks ShowConfigTab after user removed from g1" );
ok( not( $pg2->PrincipalObj->HasRight( Right => 'ShowConfigTab',
Object => $RT::System )),
"Test personal group 2 lacks ShowConfigTab after user removed from g1" );
#######
sub clear_acls_and_groups {
# Revoke all rights granted to our cast
my $acl = RT::ACL->new($RT::SystemUser);
foreach (@principals) {
$acl->LimitToPrincipal(Type => $$_->PrincipalObj->PrincipalType,
Id => $$_->PrincipalObj->Id);
}
while (my $ace = $acl->Next()) {
$ace->Delete();
}
# Remove all group memberships
my $members = RT::GroupMembers->new($RT::SystemUser);
foreach (@groups) {
$members->LimitToMembersOfGroup( $$_->PrincipalId );
}
while (my $member = $members->Next()) {
$member->Delete();
}
$acl->RedoSearch();
ok( $acl->Count() == 0,
"All principals have no rights after clearing ACLs" );
$members->RedoSearch();
ok( $members->Count() == 0,
"All groups have no members after clearing groups" );
}
|
