Tests are categorised by the most specific element involved in the scenario, where the below list is most specific to least:
-- User entity permissions.
- Role entity permissions.
- Fallback entity permissions.
- Role permissions.
-- TODO - Test fallback in the context of the above.
-
## General Permission Logical Rules
The below are some general rules we follow to standardise the behaviour of permissions in the platform:
- Most specific permission application (as above) take priority and can deny less specific permissions.
-- Parent user/role entity permissions that may be inherited, are considered to essentially be applied on the item they are inherited to unless a lower level has its own permission rule for an already specific role/user.
+- Parent role entity permissions that may be inherited, are considered to essentially be applied on the item they are inherited to unless a lower level has its own permission rule for an already specific role.
- Where both grant and deny exist at the same specificity, we side towards grant.
## Cases
User denied page permission.
-#### test_80_multi_role_inherited_deny_via_parent
+#### test_71_multi_role_inheriting_deny_on_own
- Page permissions have inherit enabled.
-- Chapter permissions have inherit enabled.
-- Role A has all-pages role permission.
-- Role B has entity denied chapter permission.
-- User has Role A & B.
-
-User denied page permission.
-
----
-
-### Entity User Permissions
-
-These are tests related to entity-level user-specific permission overrides.
-
-#### test_01_explicit_allow
-
-- Page permissions have inherit disabled.
-- User has entity allow page permission.
-
-User granted page permission.
-
-#### test_02_explicit_deny
-
-- Page permissions have inherit disabled.
-- User has entity deny page permission.
+- Role A has own page role permission.
+- Role B has entity denied page permission.
+- User has Role A and B.
+- Use owns Page.
User denied page permission.
-#### test_10_allow_inherit
+#### test_75_multi_role_inherited_deny_via_parent
- Page permissions have inherit enabled.
-- Chapter permissions have inherit disabled.
-- User has entity allow chapter permission.
-
-User granted page permission.
-
-#### test_11_deny_inherit
-
-- Page permissions have inherit enabled.
-- Chapter permissions have inherit disabled.
-- User has entity deny chapter permission.
+- Chapter permissions have inherit enabled.
+- Role A has all-pages role permission.
+- Role B has entity denied chapter permission.
+- User has Role A & B.
User denied page permission.
-#### test_12_allow_inherit_override
-
-- Page permissions have inherit enabled.
-- Chapter permissions have inherit disabled.
-- User has entity deny chapter permission.
-- User has entity allow page permission.
-
-User granted page permission.
-
-#### test_13_deny_inherit_override
+#### test_76_multi_role_inherited_deny_via_parent_on_own
- Page permissions have inherit enabled.
-- Chapter permissions have inherit disabled.
-- User has entity allow chapter permission.
-- User has entity deny page permission.
+- Chapter permissions have inherit enabled.
+- Role A has own page role permission.
+- Role B has entity denied chapter permission.
+- User has Role A & B.
User denied page permission.
-#### test_40_entity_role_override_allow
+#### test_80_fallback_override_allow
- Page permissions have inherit disabled.
-- User has entity allow page permission.
-- Role A has entity deny page permission.
-- User has role A.
+- Page fallback has entity deny permission.
+- Role A has entity allow page permission.
+- User has Role A.
User granted page permission.
-#### test_41_entity_role_override_deny
+#### test_81_fallback_override_deny
- Page permissions have inherit disabled.
-- User has entity deny page permission.
-- Role A has entity allow page permission.
-- User has role A.
-
-User denied page permission.
-
-#### test_42_entity_role_override_allow_via_inherit
-
-- Page permissions have inherit enabled.
-- Chapter permissions have inherit disabled.
-- User has entity allow chapter permission.
+- Page fallback has entity allow permission.
- Role A has entity deny page permission.
-- User has role A.
-
-User granted page permission.
-
-#### test_43_entity_role_override_deny_via_inherit
-
-- Page permissions have inherit enabled.
-- Chapter permissions have inherit disabled.
-- User has entity deny chapter permission.
-- Role A has entity allow page permission.
-- User has role A.
+- User has Role A.
User denied page permission.
-#### test_50_role_override_allow
+#### test_84_fallback_override_allow_multi_role
-- Page permissions have inherit enabled.
-- Role A has no page role permission.
-- User has entity allow page permission.
-- User has Role A.
+- Page permissions have inherit disabled.
+- Page fallback has entity deny permission.
+- Role A has entity allow page permission.
+- Role B has no entity page permissions.
+- User has Role A & B.
User granted page permission.
-#### test_51_role_override_deny
+#### test_85_fallback_override_deny_multi_role
-- Page permissions have inherit enabled.
-- Role A has all-page role permission.
-- User has entity deny page permission.
-- User has Role A.
+- Page permissions have inherit disabled.
+- Page fallback has entity allow permission.
+- Role A has entity deny page permission.
+- Role B has no entity page permissions.
+- User has Role A & B.
User denied page permission.
-#### test_60_inherited_role_override_allow
+#### test_86_fallback_override_allow_inherit
+- Chapter permissions have inherit disabled.
- Page permissions have inherit enabled.
-- Role A has no page role permission.
-- User has entity allow chapter permission.
+- Chapter fallback has entity deny permission.
+- Role A has entity allow chapter permission.
- User has Role A.
User granted page permission.
-#### test_61_inherited_role_override_deny
-
-- Page permissions have inherit enabled.
-- Role A has view-all page role permission.
-- User has entity deny chapter permission.
-- User has Role A.
-
-User denied page permission.
-
-#### test_61_inherited_role_override_deny_on_own
+#### test_87_fallback_override_deny_inherit
+- Chapter permissions have inherit disabled.
- Page permissions have inherit enabled.
-- Role A has view-own page role permission.
-- User has entity deny chapter permission.
+- Chapter fallback has entity allow permission.
+- Role A has entity deny chapter permission.
- User has Role A.
-- User owns Page.
User denied page permission.
-#### test_70_all_override_allow
+#### test_88_fallback_override_allow_multi_role_inherit
+- Chapter permissions have inherit disabled.
- Page permissions have inherit enabled.
-- Role A has no page role permission.
-- Role A has entity deny page permission.
-- User has entity allow page permission.
-- User has Role A.
+- Chapter fallback has entity deny permission.
+- Role A has entity allow chapter permission.
+- Role B has no entity chapter permissions.
+- User has Role A & B.
User granted page permission.
-#### test_71_all_override_deny
+#### test_89_fallback_override_deny_multi_role_inherit
+- Chapter permissions have inherit disabled.
- Page permissions have inherit enabled.
-- Role A has page-all role permission.
-- Role A has entity allow page permission.
-- User has entity deny page permission.
-- User has Role A.
+- Chapter fallback has entity allow permission.
+- Role A has entity deny chapter permission.
+- Role B has no entity chapter permissions.
+- User has Role A & B.
User denied page permission.
-#### test_80_inherited_all_override_allow
+#### test_90_fallback_overrides_parent_entity_role_deny
-- Page permissions have inherit enabled.
-- Role A has no page role permission.
-- Role A has entity deny chapter permission.
-- User has entity allow chapter permission.
+- Chapter permissions have inherit disabled.
+- Page permissions have inherit disabled.
+- Chapter fallback has entity deny permission.
+- Page fallback has entity deny permission.
+- Role A has entity allow chapter permission.
- User has Role A.
-User granted page permission.
+User denied page permission.
-#### test_81_inherited_all_override_deny
+#### test_91_fallback_overrides_parent_entity_role_inherit
+- Book permissions have inherit disabled.
+- Chapter permissions have inherit disabled.
- Page permissions have inherit enabled.
-- Role A has view-all page role permission.
-- Role A has entity allow chapter permission.
-- User has entity deny chapter permission.
+- Book fallback has entity deny permission.
+- Chapter fallback has entity deny permission.
+- Role A has entity allow book permission.
- User has Role A.
User denied page permission.
\ No newline at end of file
projects / bookstack / blobdiff