<?php

/**
 * @file
 * Tests for field_permissions.module.
 */

/**
 * Tests the Field Permissions module.
 */
class FieldPermissionsTestCase extends DrupalWebTestCase {
  private $admin_user = NULL;
  private $limited_user = NULL;
  private $admin_rid = NULL;
  private $limited_rid = NULL;

  public static function getInfo() {
    return array(
      'name' => 'Field permissions functionality',
      'description' => 'Test field permissions.',
      'group' => 'Field permissions'
    );
  }

  function setUp() {
    parent::setUp('field_ui', 'field_permissions');

    // Create test user.
    $admin_permissions = array('access content', 'administer nodes', 'bypass node access', 'administer content types', 'administer taxonomy', 'administer permissions', 'create page content', 'administer fields');
    $this->limited_user = $this->drupalCreateUser($admin_permissions);
    $all_rids = array_keys($this->limited_user->roles);
    sort($all_rids);
    $this->limited_rid = array_pop($all_rids);

    $admin_permissions[] = 'administer field permissions';
    $admin_permissions[] = 'administer users';
    $this->admin_user = $this->drupalCreateUser($admin_permissions);
    $all_rids = array_keys($this->admin_user->roles);
    sort($all_rids);
    $this->admin_rid = array_pop($all_rids);

    $this->drupalLogin($this->limited_user);
  }

  function testPermissionsUI() {
    // This depends on a page node type with a body field, standard install.
    // Could alternatively extend field_ui.test classes, but would be much
    // slower to run. Tradeoffs.
    $field_info = array(
      'admin_path' => 'admin/structure/types/manage/page/fields/body',
      'machine_name' => 'body',
      'add_path' => 'node/add/page',
      'name' => 'Body',
      'form_field' => 'body[und][0][value]',
      'value' => $this->randomName(),
    );

    // Check if we can see the field on the entity creation form.
    $this->drupalGet($field_info['add_path']);
    $this->assertText($field_info['name']);

    // Admin users cannot access field permissions without specifically being
    // granted the permission to do so.
    $this->drupalGet($field_info['admin_path']);
    $this->assertNoText(t('Field visibility and permissions'));

    // Switch to admin user who can see the field permissions UI.
    $this->drupalGet('user/logout');
    $this->drupalLogin($this->admin_user);
    $this->drupalGet($field_info['admin_path']);
    $this->assertText(t('Field visibility and permissions'));

    // == PUBLIC FIELD =========================================================

    $this->assertFieldChecked('edit-field-field-permissions-type-0');

    // Although simpletest could create a node for us, we are doing this directly
    // to ensure we have full control over the process. Given that we work with
    // field permissions.
    $this->drupalGet('user/logout');
    $this->drupalLogin($this->limited_user);
    $node1_values = array(
      'title' => $this->randomName(),
      $field_info['form_field'] => $field_info['value'],
    );
    $this->drupalPost($field_info['add_path'], $node1_values, t('Save'));
    $this->assertText($node1_values['title']);
    $this->assertText($field_info['value']);
    $url = $this->getUrl();
    $nid1 = preg_replace('!^.*node/(\d+)$!', '\1', $url);

    // Switch to admin user to check we can see the body.
    $this->drupalGet('user/logout');
    $this->drupalLogin($this->admin_user);
    $this->drupalGet('node/' . $nid1);
    $this->assertText($node1_values['title']);
    $this->assertText($field_info['value']);

    // And we can edit the title and body.
    $this->drupalGet('node/' . $nid1 . '/edit');
    $this->assertText('Title');
    $this->assertText($node1_values['title']);
    $this->assertText($field_info['name']);
    $this->assertText($field_info['value']);

    // == PRIVATE FIELD ========================================================

    // Switch to admin user to set field to private.
    $edit = array(
      'field[field_permissions][type]' => 1,
    );
    $this->drupalPost($field_info['admin_path'], $edit, t('Save settings'));

    // Now we should not have access to see or edit this field.
    $this->drupalGet('node/' . $nid1);
    $this->assertText($node1_values['title']);
    $this->assertNoText($field_info['value']);
    $this->drupalGet($field_info['add_path']);
    $this->assertText('Title');
    $this->assertText($field_info['name']);
    $this->drupalGet('node/' . $nid1 . '/edit');
    $this->assertText('Title');
    $this->assertNoText($field_info['name']);
    $this->assertNoText($field_info['value']);

    // Grant this user the Drupal core administrator role. This will give them
    // the 'access private fields' permission (tested here), and it also means
    // that when custom field permissions are created later on in this test,
    // the admin user will automatically get those permissions granted also.
    $user_admin_rid = variable_get('user_admin_role', 0);
    $edit = array(
      "roles[$user_admin_rid]" => TRUE,
    );
    $this->drupalPost('user/' . $this->admin_user->uid . '/edit', $edit, t('Save'));

    // Now we should have access to see or submit or edit this field again.
    $this->drupalGet('node/' . $nid1);
    $this->assertText($node1_values['title']);
    $this->assertText($field_info['value']);
    $this->drupalGet($field_info['add_path']);
    $this->assertText('Title');
    $this->assertText($field_info['name']);
    $this->drupalGet('node/' . $nid1 . '/edit');
    $this->assertText('Title');
    $this->assertText($field_info['name']);
    $this->assertText($field_info['value']);

    // == CUSTOM PERMISSIONS ===================================================

    // Introduce body creation permission.
    $edit = array(
      'field[field_permissions][type]' => 2,
    );
    $this->drupalPost($field_info['admin_path'], $edit, t('Save settings'));
    $this->drupalGet($field_info['admin_path']);
    $this->assertRaw(t('Create own value for field %field', array('%field' => $field_info['name'])));
    $this->assertRaw(t('Edit own value for field %field', array('%field' => $field_info['name'])));
    $this->assertRaw(t("Edit anyone's value for field %field", array('%field' => $field_info['name'])));
    $this->assertRaw(t('View own value for field %field', array('%field' => $field_info['name'])));
    $this->assertRaw(t("View anyone's value for field %field", array('%field' => $field_info['name'])));

    // See if we have that exposed on the permissions UI as well now.
    $this->drupalGet('admin/people/permissions');
    $this->assertText(t('Field Permissions'));
    $this->assertRaw(t('Create own value for field %field', array('%field' => $field_info['machine_name'])));
    $this->assertRaw(t('Edit own value for field %field', array('%field' => $field_info['machine_name'])));
    $this->assertRaw(t("Edit anyone's value for field %field", array('%field' => $field_info['machine_name'])));
    $this->assertRaw(t('View own value for field %field', array('%field' => $field_info['machine_name'])));
    $this->assertRaw(t("View anyone's value for field %field", array('%field' => $field_info['machine_name'])));

    // == CREATE ===============================================================

    // The admin user should have been automatically granted the create
    // permission, but the limited user shouldn't have it yet.
    $this->assertUserHasPermission($this->admin_user, 'create ' . $field_info['machine_name'], t('Admin user does have "create @field" permission.', array('@field' => $field_info['machine_name'])));
    $this->assertUserDoesNotHavePermission($this->limited_user, 'create ' . $field_info['machine_name'], t('Limited user does not have "create @field" permission.', array('@field' => $field_info['machine_name'])));

    // Should not see the field on the entity creation form anymore for limited_user.
    $this->drupalGet('user/logout');
    $this->drupalLogin($this->limited_user);
    $this->drupalGet($field_info['add_path']);
    $this->assertNoText($field_info['name']);

    // Grant body creation permission to limited users too.
    $edit = array(
      $this->limited_rid .'[create '. $field_info['machine_name'] .']' => TRUE,
    );
    $this->drupalPost('admin/people/permissions', $edit, t('Save permissions'));
    $this->assertUserHasPermission($this->admin_user, 'create ' . $field_info['machine_name'], t('Admin user does have "create @field" permission.', array('@field' => $field_info['machine_name'])));
    $this->assertUserHasPermission($this->limited_user, 'create ' . $field_info['machine_name'], t('Limited user does have "create @field" permission.', array('@field' => $field_info['machine_name'])));

    // Should see the field again on the entity creation form.
    $this->drupalGet($field_info['add_path']);
    $this->assertText($field_info['name']);

    // Although simpletest could create a node for us, we are doing this directly
    // to ensure we have full control over the process. Given that we work with
    // field permissions.
    $node2_values = array(
      'title' => $this->randomName(),
      $field_info['form_field'] => $field_info['value'],
    );
    $this->drupalPost($field_info['add_path'], $node2_values, t('Save'));
    $this->assertText($node2_values['title']);
    // The body will not yet be visible to this user.
    $this->assertNoText($field_info['value']);
    $url = $this->getUrl();
    $nid2 = preg_replace('!^.*node/(\d+)$!', '\1', $url);

    // Switch to admin user and prove she has access to body.
    $this->drupalGet('user/logout');
    $this->drupalLogin($this->admin_user);
    $this->drupalGet('node/' . $nid2);
    $this->assertText($node2_values['title']);
    $this->assertText($field_info['value']);

    // == VIEW =================================================================

    // Grant body view permission to limited users too.
    $edit = array(
      $this->limited_rid .'[view '. $field_info['machine_name'] .']' => TRUE,
    );
    $this->drupalPost('admin/people/permissions', $edit, t('Save permissions'));
    $this->assertUserHasPermission($this->admin_user, 'view ' . $field_info['machine_name'], t('Admin user does have "view @field" permission.', array('@field' => $field_info['machine_name'])));
    $this->assertUserHasPermission($this->limited_user, 'view ' . $field_info['machine_name'], t('Limited user does have "view @field" permission.', array('@field' => $field_info['machine_name'])));

    // Limited user can now see the field.
    $this->drupalGet('user/logout');
    $this->drupalLogin($this->limited_user);
    $this->drupalGet('node/' . $nid2);
    $this->assertText($node2_values['title']);
    $this->assertText($field_info['value']);

    // == EDIT =================================================================

    // We still don't have access to edit our field.
    $this->drupalGet('node/' . $nid2 . '/edit');
    $this->assertNoText($field_info['value']);

    // Switch to admin user to configure edit permissions.
    $this->drupalGet('user/logout');
    $this->drupalLogin($this->admin_user);

    // Ensure the editing screen now has the body.
    $this->drupalGet('node/' . $nid2 . '/edit');
    $this->assertText($field_info['value']);

    // Grant body editing permission for the limited role.
    $edit = array(
      $this->limited_rid .'[edit '. $field_info['machine_name'] .']' => TRUE,
    );
    $this->drupalPost('admin/people/permissions', $edit, t('Save permissions'));
    $this->assertUserHasPermission($this->admin_user, 'edit ' . $field_info['machine_name'], t('Admin user does have "edit @field" permission.', array('@field' => $field_info['machine_name'])));
    $this->assertUserHasPermission($this->limited_user, 'edit ' . $field_info['machine_name'], t('Limited user does have "edit @field" permission.', array('@field' => $field_info['machine_name'])));

    // Ensure the editing screen still has the body.
    $this->drupalGet('node/' . $nid2 . '/edit');
    $this->assertText($field_info['value']);

    // Switch to limited user to check that we can edit body now.
    $this->drupalGet('user/logout');
    $this->drupalLogin($this->limited_user);
    $this->drupalGet('node/' . $nid2 . '/edit');
    $this->assertText($field_info['value']);
  }

  function testUserFields() {
    // Create a field attached to users and make it appear on the user
    // registration form with (default) custom permissions.
    $this->drupalLogin($this->admin_user);
    $label = 'Field attached to users';
    $edit = array(
      'fields[_add_new_field][label]' => $label,
      'fields[_add_new_field][field_name]' => 'attached_to_users',
      'fields[_add_new_field][type]' => 'text',
      'fields[_add_new_field][widget_type]' => 'text_textfield',
    );
    $this->drupalPost('admin/config/people/accounts/fields',  $edit, t('Save'));
    $this->drupalPost(NULL, array(), t('Save field settings'));
    $edit = array(
      'field[field_permissions][type]' => 2,
      'instance[settings][user_register_form]' => TRUE,
    );
    $this->drupalPost(NULL, $edit, t('Save settings'));

    // Log out, go to the registration form and make sure the field appears
    // there for anonymous users.
    $this->drupalLogout();
    $this->drupalGet('user/register');
    $this->assertText($label);

    // Log in and make sure the user does not have access to edit the field
    // (i.e., there are only default permissions to create it).
    $this->drupalLogin($this->limited_user);
    $this->drupalGet('user/' . $this->limited_user->uid . '/edit');
    $this->assertResponse(200);
    $this->assertNoText($label);
  }

  /**
   * Asserts that a user account has a permission.
   */
  protected function assertUserHasPermission($account, $permission, $message) {
     $this->_assertUserPermissionState($account, $permission, $message, TRUE);
  }

  /**
   * Asserts that a user account does not have a permission.
   */
  protected function assertUserDoesNotHavePermission($account, $permission, $message) {
    $this->_assertUserPermissionState($account, $permission, $message, FALSE);
  }

  /**
   * Helper function for asserting user permissions.
   */
  protected function _assertUserPermissionState($account, $permission, $message, $should_have_permission) {
    // We need to clear static caches since the tests may have recently changed
    // the permissions via the UI (i.e., in a different thread than the one
    // running the tests).
    drupal_static_reset('user_access');
    drupal_static_reset('user_role_permissions');

    // Load the full user account, since we may have been provided an out of
    // date pseudo-account of the kind SimpleTest uses (e.g. as returned by
    // drupalCreateUser()), rather than an up to date object that actually
    // contains the full list of roles this user has been assigned.
    $full_account = user_load($account->uid);

    // Now check the permission.
    $has_permission = user_access($permission, $full_account);
    if ($should_have_permission) {
      $this->assertTrue($has_permission, $message);
    }
    else {
      $this->assertFalse($has_permission, $message);
    }
  }
}