From 058e823b800cfd13c5bf82a1a52e1d5d395ecc55 Mon Sep 17 00:00:00 2001 From: Serhii Nosko Date: Mon, 8 Jan 2024 15:10:25 +0200 Subject: [PATCH] MODINVOICE-93. Update error code names (#463) --- descriptors/ModuleDescriptor-template.json | 5 +- .../invoices/utils/AcqDesiredPermissions.java | 1 + .../org/folio/invoices/utils/ErrorCodes.java | 1 + .../org/folio/rest/impl/InvoiceHelper.java | 6 +- .../org/folio/utils/UserPermissionsUtil.java | 29 +- .../folio/rest/impl/InvoiceHelperTest.java | 324 ------------------ .../folio/utils/UserPermissionsUtilTest.java | 277 +++++++++++++++ 7 files changed, 309 insertions(+), 334 deletions(-) create mode 100644 src/test/java/org/folio/utils/UserPermissionsUtilTest.java diff --git a/descriptors/ModuleDescriptor-template.json b/descriptors/ModuleDescriptor-template.json index 31dfb575c..fccd2a180 100644 --- a/descriptors/ModuleDescriptor-template.json +++ b/descriptors/ModuleDescriptor-template.json @@ -49,7 +49,10 @@ "permissionsRequired": ["invoice.invoices.item.put"], "permissionsDesired": [ "invoices.acquisitions-units-assignments.manage", - "invoices.fiscal-year.update" + "invoices.fiscal-year.update", + "invoice.item.approve", + "invoice.item.pay", + "invoice.item.cancel" ], "modulePermissions": [ "configuration.entries.collection.get", diff --git a/src/main/java/org/folio/invoices/utils/AcqDesiredPermissions.java b/src/main/java/org/folio/invoices/utils/AcqDesiredPermissions.java index 0c6340137..473871068 100644 --- a/src/main/java/org/folio/invoices/utils/AcqDesiredPermissions.java +++ b/src/main/java/org/folio/invoices/utils/AcqDesiredPermissions.java @@ -10,6 +10,7 @@ public enum AcqDesiredPermissions { MANAGE("invoices.acquisitions-units-assignments.manage"), APPROVE("invoice.item.approve"), PAY("invoice.item.pay"), + CANCEL("invoice.item.cancel"), FISCAL_YEAR_UPDATE("invoices.fiscal-year.update"); private String permission; diff --git a/src/main/java/org/folio/invoices/utils/ErrorCodes.java b/src/main/java/org/folio/invoices/utils/ErrorCodes.java index 0647aa2bc..ba88eadba 100644 --- a/src/main/java/org/folio/invoices/utils/ErrorCodes.java +++ b/src/main/java/org/folio/invoices/utils/ErrorCodes.java @@ -34,6 +34,7 @@ public enum ErrorCodes { USER_HAS_NO_FISCAL_YEAR_UPDATE_PERMISSIONS("userHasNoFiscalYearUpdatePermission", "User does not have permissions to update fiscal year - operation is restricted"), USER_HAS_NO_APPROVE_PERMISSIONS("userHasNoInvoiceApprovePermission", "User does not have permissions to approve this invoice - operation is restricted"), USER_HAS_NO_PAY_PERMISSIONS("userHasNoInvoicePayPermission", "User does not have permissions to pay this invoice - operation is restricted"), + USER_HAS_NO_CANCEL_PERMISSIONS("userHasNoInvoiceCancelPermission", "User does not have permissions to cancel this invoice - operation is restricted"), ACQ_UNITS_NOT_FOUND("acqUnitsNotFound", "Acquisitions units assigned to the record not found"), PENDING_PAYMENT_ERROR("pendingPaymentError", "Failed to create pending payment"), INVOICE_PAYMENT_FAILURE("invoicePaymentFailure", "Invoice payment failure"), diff --git a/src/main/java/org/folio/rest/impl/InvoiceHelper.java b/src/main/java/org/folio/rest/impl/InvoiceHelper.java index 392c105c0..48db8ae94 100644 --- a/src/main/java/org/folio/rest/impl/InvoiceHelper.java +++ b/src/main/java/org/folio/rest/impl/InvoiceHelper.java @@ -23,10 +23,11 @@ import static org.folio.invoices.utils.ResourcePathResolver.INVOICES; import static org.folio.services.voucher.VoucherCommandService.VOUCHER_NUMBER_PREFIX_CONFIG_QUERY; import static org.folio.utils.UserPermissionsUtil.verifyUserHasAssignPermission; -import static org.folio.utils.UserPermissionsUtil.verifyUserHasManagePermission; import static org.folio.utils.UserPermissionsUtil.verifyUserHasFiscalYearUpdatePermission; -import static org.folio.utils.UserPermissionsUtil.verifyUserHasInvoicePayPermission; import static org.folio.utils.UserPermissionsUtil.verifyUserHasInvoiceApprovePermission; +import static org.folio.utils.UserPermissionsUtil.verifyUserHasInvoiceCancelPermission; +import static org.folio.utils.UserPermissionsUtil.verifyUserHasInvoicePayPermission; +import static org.folio.utils.UserPermissionsUtil.verifyUserHasManagePermission; import java.util.Collection; import java.util.Collections; @@ -351,6 +352,7 @@ private Future validateAndHandleInvoiceStatusTransition(Invoice invoice, I verifyUserHasFiscalYearUpdatePermission(invoice.getFiscalYearId(), invoiceFromStorage.getFiscalYearId(), okapiHeaders); verifyUserHasInvoiceApprovePermission(invoice.getStatus(), invoiceFromStorage.getStatus(), okapiHeaders); verifyUserHasInvoicePayPermission(invoice.getStatus(), invoiceFromStorage.getStatus(), okapiHeaders); + verifyUserHasInvoiceCancelPermission(invoice.getStatus(), invoiceFromStorage.getStatus(), okapiHeaders); setSystemGeneratedData(invoiceFromStorage, invoice); return null; diff --git a/src/main/java/org/folio/utils/UserPermissionsUtil.java b/src/main/java/org/folio/utils/UserPermissionsUtil.java index 88cce59aa..5f63328af 100644 --- a/src/main/java/org/folio/utils/UserPermissionsUtil.java +++ b/src/main/java/org/folio/utils/UserPermissionsUtil.java @@ -1,10 +1,11 @@ package org.folio.utils; +import static org.folio.invoices.utils.AcqDesiredPermissions.APPROVE; import static org.folio.invoices.utils.AcqDesiredPermissions.ASSIGN; +import static org.folio.invoices.utils.AcqDesiredPermissions.CANCEL; +import static org.folio.invoices.utils.AcqDesiredPermissions.FISCAL_YEAR_UPDATE; import static org.folio.invoices.utils.AcqDesiredPermissions.MANAGE; import static org.folio.invoices.utils.AcqDesiredPermissions.PAY; -import static org.folio.invoices.utils.AcqDesiredPermissions.APPROVE; -import static org.folio.invoices.utils.AcqDesiredPermissions.FISCAL_YEAR_UPDATE; import static org.folio.invoices.utils.ErrorCodes.USER_HAS_NO_FISCAL_YEAR_UPDATE_PERMISSIONS; import static org.folio.invoices.utils.ErrorCodes.USER_HAS_NO_ACQ_PERMISSIONS; import static org.folio.invoices.utils.ErrorCodes.*; @@ -68,7 +69,7 @@ public static void verifyUserHasManagePermission(List newAcqUnitIds, Lis } /** - * This method checks if user has permission to approve invoice in case when invoice status was changed. + * This method checks if user has permission to approve invoice in case when invoice status was changed to APPROVED. * * @param newInvoiceStatus the new invoice status * @param statusFromStorage the invoice status from DB @@ -76,25 +77,39 @@ public static void verifyUserHasManagePermission(List newAcqUnitIds, Lis * @throws HttpException if user does not have permission to approve invoice */ public static void verifyUserHasInvoiceApprovePermission(Invoice.Status newInvoiceStatus, Invoice.Status statusFromStorage, Map okapiHeaders) { - if (isInvoiceStatusUpdated(newInvoiceStatus, statusFromStorage) && isUserDoesNotHaveDesiredPermission(APPROVE, okapiHeaders)) { + if (isInvoiceStatusUpdated(newInvoiceStatus, statusFromStorage) && Invoice.Status.APPROVED == newInvoiceStatus && isUserDoesNotHaveDesiredPermission(APPROVE, okapiHeaders)) { throw new HttpException(HttpStatus.HTTP_FORBIDDEN.toInt(), USER_HAS_NO_APPROVE_PERMISSIONS); } } /** - * This method checks if user has permission to pay invoice in case when invoice status was changed. + * This method checks if user has permission to pay invoice in case when invoice status was changed to PAID. * * @param newInvoiceStatus the new invoice status * @param statusFromStorage the invoice status from DB * @param okapiHeaders the okapi headers * @throws HttpException if user does not have permission to pay invoice */ - public static void verifyUserHasInvoicePayPermission(Invoice.Status newInvoiceStatus, Invoice.Status statusFromStorage, Map okapiHeaders) { - if (isInvoiceStatusUpdated(newInvoiceStatus, statusFromStorage) && isUserDoesNotHaveDesiredPermission(PAY, okapiHeaders)) { + public static void verifyUserHasInvoicePayPermission(Invoice.Status newInvoiceStatus, Invoice.Status statusFromStorage, Map okapiHeaders) { + if (isInvoiceStatusUpdated(newInvoiceStatus, statusFromStorage) && Invoice.Status.PAID == newInvoiceStatus && isUserDoesNotHaveDesiredPermission(PAY, okapiHeaders)) { throw new HttpException(HttpStatus.HTTP_FORBIDDEN.toInt(), USER_HAS_NO_PAY_PERMISSIONS); } } + /** + * This method checks if user has permission to cancel invoice in case wher invoice status was changed to CANCELLED. + * + * @param newInvoiceStatus the new invoice status + * @param statusFromStorage the invoice status from DB + * @param okapiHeaders the okapi headers + * @throws HttpException if user does not have permission to cancel invoice + */ + public static void verifyUserHasInvoiceCancelPermission(Invoice.Status newInvoiceStatus, Invoice.Status statusFromStorage, Map okapiHeaders) { + if (isInvoiceStatusUpdated(newInvoiceStatus, statusFromStorage) && Invoice.Status.CANCELLED == newInvoiceStatus && isUserDoesNotHaveDesiredPermission(CANCEL, okapiHeaders)) { + throw new HttpException(HttpStatus.HTTP_FORBIDDEN.toInt(), USER_HAS_NO_CANCEL_PERMISSIONS); + } + } + /** * The method checks whether the user has the desired permission to update the fiscal year. * diff --git a/src/test/java/org/folio/rest/impl/InvoiceHelperTest.java b/src/test/java/org/folio/rest/impl/InvoiceHelperTest.java index 872fa6f23..6e82b8a75 100644 --- a/src/test/java/org/folio/rest/impl/InvoiceHelperTest.java +++ b/src/test/java/org/folio/rest/impl/InvoiceHelperTest.java @@ -44,330 +44,6 @@ public void setUp() { okapiHeaders.put(X_OKAPI_USER_ID.getName(), X_OKAPI_USER_ID.getValue()); } - @Test - @DisplayName("Should not throw exception when approve permission is in position") - void shouldNotThrowExceptionWhenApprovePermissionIsInPosition() { - List permissionsList = Arrays.asList( - "invoice.item.approve", - "invoice.invoices.item.put", - "invoices.acquisitions-units-assignments.manage", - "invoices.fiscal-year.update" - ); - - String permissionsJsonArrayString = new JsonArray(permissionsList).encode(); - okapiHeaders.put(UserPermissionsUtil.OKAPI_HEADER_PERMISSIONS, permissionsJsonArrayString); - Invoice invoice = new Invoice(); - invoice.setId("123456783423425"); - invoice.setStatus(Invoice.Status.REVIEWED); - Invoice invoiceFromStorage = new Invoice(); - invoice.setId("123456783423425"); - invoice.setStatus(Invoice.Status.APPROVED); - - assertDoesNotThrow(() -> UserPermissionsUtil.verifyUserHasInvoiceApprovePermission( - invoice.getStatus(), invoiceFromStorage.getStatus(), okapiHeaders)); - } - - @Test - @DisplayName("should throw exception when approve permission is absent") - void shouldThrowExceptionWhenApprovePermissionIsAbsent(){ - List permissionsList = Arrays.asList( - "invoice.invoices.item.put", - "invoices.acquisitions-units-assignments.manage", - "invoices.fiscal-year.update" - ); - - String permissionsJsonArrayString = new JsonArray(permissionsList).encode(); - okapiHeaders.put(UserPermissionsUtil.OKAPI_HEADER_PERMISSIONS, permissionsJsonArrayString); - Invoice invoice = new Invoice(); - invoice.setId("123456783423425"); - invoice.setStatus(Invoice.Status.REVIEWED); - Invoice invoiceFromStorage = new Invoice(); - invoice.setId("123456783423425"); - invoice.setStatus(Invoice.Status.APPROVED); - - assertThrows(HttpException.class, () -> - UserPermissionsUtil.verifyUserHasInvoiceApprovePermission( - invoice.getStatus(), invoiceFromStorage.getStatus(), okapiHeaders)); - } - - @Test - @DisplayName("Should not throw exception when pay permission is in position") - void shouldNotThrowExceptionWhenPayPermissionIsInPosition(){ - List permissionsList = Arrays.asList( - "invoice.item.pay", - "invoice.invoices.item.put", - "invoices.acquisitions-units-assignments.manage", - "invoices.fiscal-year.update" - ); - - String permissionsJsonArrayString = new JsonArray(permissionsList).encode(); - okapiHeaders.put(UserPermissionsUtil.OKAPI_HEADER_PERMISSIONS, permissionsJsonArrayString); - Invoice invoice = new Invoice(); - invoice.setId("123456783423425"); - invoice.setStatus(Invoice.Status.REVIEWED); - Invoice invoiceFromStorage = new Invoice(); - invoice.setId("123456783423425"); - invoice.setStatus(Invoice.Status.APPROVED); - - assertDoesNotThrow(() -> UserPermissionsUtil.verifyUserHasInvoicePayPermission( - invoice.getStatus(), invoiceFromStorage.getStatus(), okapiHeaders)); - } - - @Test - @DisplayName("Should throw exception when pay permission is absent") - void shouldThrowExceptionWhenPayPermissionIsAbsent(){ - List permissionsList = Arrays.asList( - "invoice.invoices.item.put", - "invoices.acquisitions-units-assignments.manage", - "invoices.fiscal-year.update" - ); - - String permissionsJsonArrayString = new JsonArray(permissionsList).encode(); - okapiHeaders.put(UserPermissionsUtil.OKAPI_HEADER_PERMISSIONS, permissionsJsonArrayString); - Invoice invoice = new Invoice(); - invoice.setId("123456783423425"); - invoice.setStatus(Invoice.Status.REVIEWED); - Invoice invoiceFromStorage = new Invoice(); - invoice.setId("123456783423425"); - invoice.setStatus(Invoice.Status.APPROVED); - - assertThrows(HttpException.class, () -> - UserPermissionsUtil.verifyUserHasInvoicePayPermission( - invoice.getStatus(), invoiceFromStorage.getStatus(), okapiHeaders)); - } - -@Test - @DisplayName("Should throw correct error code when pay permission is absent") - void shouldThrowCorrectErrorCodeWhenPayPermissionIsAbsent(){ - List permissionsList = Arrays.asList( - "invoice.invoices.item.put", - "invoices.acquisitions-units-assignments.manage", - "invoices.fiscal-year.update" - ); - - String permissionsJsonArrayString = new JsonArray(permissionsList).encode(); - okapiHeaders.put(UserPermissionsUtil.OKAPI_HEADER_PERMISSIONS, permissionsJsonArrayString); - Invoice invoice = new Invoice(); - invoice.setId("123456783423425"); - invoice.setStatus(Invoice.Status.APPROVED); - Invoice invoiceFromStorage = new Invoice(); - invoice.setId("123456783423425"); - invoice.setStatus(Invoice.Status.PAID); - - var exception = assertThrows(HttpException.class, () -> - UserPermissionsUtil.verifyUserHasInvoicePayPermission( - invoice.getStatus(), invoiceFromStorage.getStatus(), okapiHeaders)); - assertEquals(exception.getCode(), 403); - } - - @Test - @DisplayName("Should throw correct error code when approve permission absent") - void shouldThrowCorrectErrorCodeWhenApprovePermissionIsAbsent(){ - List permissionsList = Arrays.asList( - "invoice.invoices.item.put", - "invoices.acquisitions-units-assignments.manage", - "invoices.fiscal-year.update" - ); - - String permissionsJsonArrayString = new JsonArray(permissionsList).encode(); - okapiHeaders.put(UserPermissionsUtil.OKAPI_HEADER_PERMISSIONS, permissionsJsonArrayString); - Invoice invoice = new Invoice(); - invoice.setId("123456783423425"); - invoice.setStatus(Invoice.Status.REVIEWED); - Invoice invoiceFromStorage = new Invoice(); - invoice.setId("123456783423425"); - invoice.setStatus(Invoice.Status.APPROVED); - - HttpException exception = assertThrows(HttpException.class, () -> - UserPermissionsUtil.verifyUserHasInvoiceApprovePermission( - invoice.getStatus(), invoiceFromStorage.getStatus(), okapiHeaders)); - assertEquals(exception.getCode(), 403); - } - - @Test - @DisplayName("Should throw correct error code when assign permission is absent") - void shouldThrowCorrectErrorCodeWhenAssignPermissionIsAbsent() { - List permissionsList = Arrays.asList( - "invoice.invoices.item.put", - "invoices.acquisitions-units-assignments.manage", - "invoices.fiscal-year.update" - ); - - String permissionsJsonArrayString = new JsonArray(permissionsList).encode(); - okapiHeaders.put(UserPermissionsUtil.OKAPI_HEADER_PERMISSIONS, permissionsJsonArrayString); - var invoiceAcqID = new LinkedList(); - var invoiceFromStorageAcqID = new LinkedList(); - - invoiceAcqID.add("12345678"); - invoiceFromStorageAcqID.add("6475643839"); - Invoice invoice = new Invoice(); - invoice.setId("123456783423425"); - invoice.setStatus(Invoice.Status.REVIEWED); - invoice.setAcqUnitIds(invoiceAcqID); - Invoice invoiceFromStorage = new Invoice(); - invoice.setId("123456783423425"); - invoice.setStatus(Invoice.Status.APPROVED); - invoiceFromStorage.setAcqUnitIds(invoiceFromStorageAcqID); - - var exception = assertThrows(HttpException.class, () -> - UserPermissionsUtil.verifyUserHasAssignPermission( - invoice.getAcqUnitIds(), okapiHeaders)); - assertEquals(exception.getCode(), 403); - } - - @Test - @DisplayName("Should throw exception when assign permission Is absent") - void shouldThrowExceptionWhenAssignPermissionIsAbsent() { - List permissionsList = Arrays.asList( - "invoice.invoices.item.put", - "invoices.acquisitions-units-assignments.manage", - "invoices.fiscal-year.update" - ); - - String permissionsJsonArrayString = new JsonArray(permissionsList).encode(); - okapiHeaders.put(UserPermissionsUtil.OKAPI_HEADER_PERMISSIONS, permissionsJsonArrayString); - var invoiceAcqID = new LinkedList(); - var invoiceFromStorageAcqID = new LinkedList(); - - invoiceAcqID.add("12345678"); - invoiceFromStorageAcqID.add("6475643839"); - Invoice invoice = new Invoice(); - invoice.setId("123456783423425"); - invoice.setStatus(Invoice.Status.REVIEWED); - invoice.setAcqUnitIds(invoiceAcqID); - Invoice invoiceFromStorage = new Invoice(); - invoice.setId("123456783423425"); - invoice.setStatus(Invoice.Status.APPROVED); - invoiceFromStorage.setAcqUnitIds(invoiceFromStorageAcqID); - - assertThrows(HttpException.class, () -> - UserPermissionsUtil.verifyUserHasAssignPermission( - invoice.getAcqUnitIds(), okapiHeaders)); - } - - @Test - @DisplayName("should not throw exception when assign permission is assigned") - void shouldNotThrowExceptionWhenAssignPermissionIsAssigned() { - - List permissionsList = Arrays.asList( - "invoice.invoices.item.put", - "invoices.acquisitions-units-assignments.manage", - "invoices.fiscal-year.update", - "invoices.acquisitions-units-assignments.assign" - ); - - String permissionsJsonArrayString = new JsonArray(permissionsList).encode(); - okapiHeaders.put(UserPermissionsUtil.OKAPI_HEADER_PERMISSIONS, permissionsJsonArrayString); - var invoiceAcqID = new LinkedList(); - var invoiceFromStorageAcqID = new LinkedList(); - - invoiceAcqID.add("12345678"); - invoiceFromStorageAcqID.add("6475643839"); - Invoice invoice = new Invoice(); - invoice.setId("123456783423425"); - invoice.setStatus(Invoice.Status.REVIEWED); - invoice.setAcqUnitIds(invoiceAcqID); - Invoice invoiceFromStorage = new Invoice(); - invoice.setId("123456783423425"); - invoice.setStatus(Invoice.Status.APPROVED); - invoiceFromStorage.setAcqUnitIds(invoiceFromStorageAcqID); - - assertDoesNotThrow(() -> UserPermissionsUtil.verifyUserHasAssignPermission( - invoice.getAcqUnitIds(), okapiHeaders)); - } - - @Test - @DisplayName("Should not throw exception when manage permission is assigned") - void shouldNotThrowExceptionWhenManagePermissionIsAssigned() { - // Create a list of permissions - List permissionsList = Arrays.asList( - "invoice.invoices.item.put", - "invoices.acquisitions-units-assignments.manage", - "invoices.fiscal-year.update", - "invoices.acquisitions-units-assignments.assign" - ); - - String permissionsJsonArrayString = new JsonArray(permissionsList).encode(); - okapiHeaders.put(UserPermissionsUtil.OKAPI_HEADER_PERMISSIONS, permissionsJsonArrayString); - var invoiceAcqID = new LinkedList(); - var invoiceFromStorageAcqID = new LinkedList(); - - invoiceAcqID.add("12345678"); - invoiceFromStorageAcqID.add("6475643839"); - Invoice invoice = new Invoice(); - invoice.setId("123456783423425"); - invoice.setStatus(Invoice.Status.REVIEWED); - invoice.setAcqUnitIds(invoiceAcqID); - Invoice invoiceFromStorage = new Invoice(); - invoice.setId("123456783423425"); - invoice.setStatus(Invoice.Status.APPROVED); - invoiceFromStorage.setAcqUnitIds(invoiceFromStorageAcqID); - - assertDoesNotThrow(() -> UserPermissionsUtil.verifyUserHasManagePermission( - invoice.getAcqUnitIds(), invoiceFromStorage.getAcqUnitIds(), okapiHeaders)); - } - - @Test - @DisplayName("should throw exception when manage permission is absent") - void shouldThrowExceptionWhenManagePermissionIsAbsent() { - List permissionsList = Arrays.asList( - "invoice.invoices.item.put", - "invoices.fiscal-year.update", - "invoices.acquisitions-units-assignments.assign" - ); - - String permissionsJsonArrayString = new JsonArray(permissionsList).encode(); - okapiHeaders.put(UserPermissionsUtil.OKAPI_HEADER_PERMISSIONS, permissionsJsonArrayString); - var invoiceAcqID = new LinkedList(); - var invoiceFromStorageAcqID = new LinkedList(); - - invoiceAcqID.add("12345678"); - invoiceFromStorageAcqID.add("6475643839"); - Invoice invoice = new Invoice(); - invoice.setId("123456783423425"); - invoice.setStatus(Invoice.Status.REVIEWED); - invoice.setAcqUnitIds(invoiceAcqID); - Invoice invoiceFromStorage = new Invoice(); - invoice.setId("123456783423425"); - invoice.setStatus(Invoice.Status.APPROVED); - invoiceFromStorage.setAcqUnitIds(invoiceFromStorageAcqID); - - assertThrows(HttpException.class, () -> - UserPermissionsUtil.verifyUserHasManagePermission( - invoice.getAcqUnitIds(), invoiceFromStorage.getAcqUnitIds(), okapiHeaders)); - } - - @Test - @DisplayName("Should throw correct error code when manage permission is absent") - void shouldThrowCorrectErrorCodeWhenManagePermissionIsAbsent() { - List permissionsList = Arrays.asList( - "invoice.invoices.item.put", - "invoices.fiscal-year.update", - "invoices.acquisitions-units-assignments.assign" - ); - - String permissionsJsonArrayString = new JsonArray(permissionsList).encode(); - okapiHeaders.put(UserPermissionsUtil.OKAPI_HEADER_PERMISSIONS, permissionsJsonArrayString); - var invoiceAcqID = new LinkedList(); - var invoiceFromStorageAcqID = new LinkedList(); - - invoiceAcqID.add("12345678"); - invoiceFromStorageAcqID.add("6475643839"); - Invoice invoice = new Invoice(); - invoice.setId("123456783423425"); - invoice.setStatus(Invoice.Status.REVIEWED); - invoice.setAcqUnitIds(invoiceAcqID); - Invoice invoiceFromStorage = new Invoice(); - invoice.setId("123456783423425"); - invoice.setStatus(Invoice.Status.APPROVED); - invoiceFromStorage.setAcqUnitIds(invoiceFromStorageAcqID); - - HttpException exception = assertThrows(HttpException.class, () -> - UserPermissionsUtil.verifyUserHasManagePermission( - invoice.getAcqUnitIds(), invoiceFromStorage.getAcqUnitIds(), okapiHeaders)); - assertEquals(exception.getCode(), 403); - } - @Test @DisplayName("not decide to update status of POLines with ONGOING status") void shouldReturnFalseWhenCompositeCheckingForUpdatePoLinePaymentStatusIsOngoing() { diff --git a/src/test/java/org/folio/utils/UserPermissionsUtilTest.java b/src/test/java/org/folio/utils/UserPermissionsUtilTest.java new file mode 100644 index 000000000..ff1e5628d --- /dev/null +++ b/src/test/java/org/folio/utils/UserPermissionsUtilTest.java @@ -0,0 +1,277 @@ +package org.folio.utils; + +import io.vertx.core.json.JsonArray; +import org.folio.invoices.rest.exceptions.HttpException; +import org.folio.invoices.utils.ErrorCodes; +import org.folio.rest.jaxrs.model.Invoice; +import org.junit.jupiter.api.DisplayName; +import org.junit.jupiter.api.Test; + +import java.util.*; + +import static org.junit.jupiter.api.Assertions.assertDoesNotThrow; +import static org.junit.jupiter.api.Assertions.assertEquals; +import static org.junit.jupiter.api.Assertions.assertThrows; + +public class UserPermissionsUtilTest { + + private Map okapiHeaders = new HashMap<>(); + + @Test + @DisplayName("Should not throw exception when approve permission is in position") + void shouldNotThrowExceptionWhenApprovePermissionIsInPosition() { + List permissionsList = List.of( + "invoice.item.approve" + ); + + String permissionsJsonArrayString = new JsonArray(permissionsList).encode(); + okapiHeaders.put(UserPermissionsUtil.OKAPI_HEADER_PERMISSIONS, permissionsJsonArrayString); + Invoice invoice = new Invoice(); + invoice.setStatus(Invoice.Status.APPROVED); + Invoice invoiceFromStorage = new Invoice(); + invoiceFromStorage.setStatus(Invoice.Status.REVIEWED); + + assertDoesNotThrow(() -> UserPermissionsUtil.verifyUserHasInvoiceApprovePermission( + invoice.getStatus(), invoiceFromStorage.getStatus(), okapiHeaders)); + } + + @Test + @DisplayName("should throw exception when approve permission is absent") + void shouldThrowExceptionWhenApprovePermissionIsAbsent() { + List permissionsList = Arrays.asList( + "invoice.invoices.item.put", + "invoices.acquisitions-units-assignments.manage", + "invoices.fiscal-year.update" + ); + + String permissionsJsonArrayString = new JsonArray(permissionsList).encode(); + okapiHeaders.put(UserPermissionsUtil.OKAPI_HEADER_PERMISSIONS, permissionsJsonArrayString); + Invoice invoice = new Invoice(); + invoice.setStatus(Invoice.Status.APPROVED); + Invoice invoiceFromStorage = new Invoice(); + invoiceFromStorage.setStatus(Invoice.Status.REVIEWED); + + assertThrows(HttpException.class, () -> + UserPermissionsUtil.verifyUserHasInvoiceApprovePermission( + invoice.getStatus(), invoiceFromStorage.getStatus(), okapiHeaders)); + } + + @Test + @DisplayName("Should not throw exception when pay permission is in position") + void shouldNotThrowExceptionWhenPayPermissionIsInPosition() { + List permissionsList = List.of( + "invoice.item.pay" + ); + + String permissionsJsonArrayString = new JsonArray(permissionsList).encode(); + okapiHeaders.put(UserPermissionsUtil.OKAPI_HEADER_PERMISSIONS, permissionsJsonArrayString); + Invoice invoice = new Invoice(); + invoice.setStatus(Invoice.Status.PAID); + Invoice invoiceFromStorage = new Invoice(); + invoiceFromStorage.setStatus(Invoice.Status.APPROVED); + + assertDoesNotThrow(() -> UserPermissionsUtil.verifyUserHasInvoicePayPermission( + invoice.getStatus(), invoiceFromStorage.getStatus(), okapiHeaders)); + } + + @Test + @DisplayName("Should throw correct error code when pay permission is absent") + void shouldThrowCorrectErrorCodeWhenPayPermissionIsAbsent() { + List permissionsList = Arrays.asList( + "invoice.invoices.item.put", + "invoices.acquisitions-units-assignments.manage", + "invoices.fiscal-year.update" + ); + + String permissionsJsonArrayString = new JsonArray(permissionsList).encode(); + okapiHeaders.put(UserPermissionsUtil.OKAPI_HEADER_PERMISSIONS, permissionsJsonArrayString); + Invoice invoice = new Invoice(); + invoice.setStatus(Invoice.Status.PAID); + Invoice invoiceFromStorage = new Invoice(); + invoiceFromStorage.setStatus(Invoice.Status.APPROVED); + + var exception = assertThrows(HttpException.class, () -> + UserPermissionsUtil.verifyUserHasInvoicePayPermission( + invoice.getStatus(), invoiceFromStorage.getStatus(), okapiHeaders)); + assertEquals(exception.getCode(), 403); + } + + @Test + @DisplayName("Should not throw exception when cancel permission is in position") + void shouldNotThrowExceptionWhenCancelPermissionIsInPosition() { + List permissionsList = List.of( + "invoice.item.cancel" + ); + + String permissionsJsonArrayString = new JsonArray(permissionsList).encode(); + okapiHeaders.put(UserPermissionsUtil.OKAPI_HEADER_PERMISSIONS, permissionsJsonArrayString); + Invoice invoice = new Invoice(); + invoice.setStatus(Invoice.Status.CANCELLED); + Invoice invoiceFromStorage = new Invoice(); + invoiceFromStorage.setStatus(Invoice.Status.PAID); + + assertDoesNotThrow(() -> UserPermissionsUtil.verifyUserHasInvoiceCancelPermission( + invoice.getStatus(), invoiceFromStorage.getStatus(), okapiHeaders)); + } + + @Test + @DisplayName("Should throw correct error code when cancel permission absent") + void shouldThrowCorrectErrorCodeWhenCancelPermissionIsAbsent() { + List permissionsList = Arrays.asList( + "invoice.item.approve", + "invoice.item.pay" + ); + + String permissionsJsonArrayString = new JsonArray(permissionsList).encode(); + okapiHeaders.put(UserPermissionsUtil.OKAPI_HEADER_PERMISSIONS, permissionsJsonArrayString); + Invoice invoice = new Invoice(); + invoice.setStatus(Invoice.Status.CANCELLED); + Invoice invoiceFromStorage = new Invoice(); + invoiceFromStorage.setStatus(Invoice.Status.PAID); + + HttpException exception = assertThrows(HttpException.class, () -> + UserPermissionsUtil.verifyUserHasInvoiceCancelPermission( + invoice.getStatus(), invoiceFromStorage.getStatus(), okapiHeaders)); + assertEquals(exception.getCode(), 403); + } + + @Test + @DisplayName("Should throw correct error code when assign permission is absent") + void shouldThrowCorrectErrorCodeWhenAssignPermissionIsAbsent() { + List permissionsList = Arrays.asList( + "invoice.invoices.item.put", + "invoices.acquisitions-units-assignments.manage", + "invoices.fiscal-year.update" + ); + + String permissionsJsonArrayString = new JsonArray(permissionsList).encode(); + okapiHeaders.put(UserPermissionsUtil.OKAPI_HEADER_PERMISSIONS, permissionsJsonArrayString); + + Invoice invoice = new Invoice(); + invoice.setStatus(Invoice.Status.REVIEWED); + invoice.setAcqUnitIds(List.of("12345678")); + Invoice invoiceFromStorage = new Invoice(); + invoiceFromStorage.setStatus(Invoice.Status.REVIEWED); + invoiceFromStorage.setAcqUnitIds(new ArrayList<>()); + + var exception = assertThrows(HttpException.class, () -> + UserPermissionsUtil.verifyUserHasAssignPermission( + invoice.getAcqUnitIds(), okapiHeaders)); + assertEquals(exception.getCode(), 403); + } + + @Test + @DisplayName("should not throw exception when assign permission is assigned") + void shouldNotThrowExceptionWhenAssignPermissionIsAssigned() { + + List permissionsList = Arrays.asList( + "invoice.invoices.item.put", + "invoices.acquisitions-units-assignments.manage", + "invoices.fiscal-year.update", + "invoices.acquisitions-units-assignments.assign" + ); + + String permissionsJsonArrayString = new JsonArray(permissionsList).encode(); + okapiHeaders.put(UserPermissionsUtil.OKAPI_HEADER_PERMISSIONS, permissionsJsonArrayString); + + Invoice invoice = new Invoice(); + invoice.setStatus(Invoice.Status.REVIEWED); + invoice.setAcqUnitIds(List.of("12345678")); + Invoice invoiceFromStorage = new Invoice(); + invoiceFromStorage.setStatus(Invoice.Status.REVIEWED); + invoiceFromStorage.setAcqUnitIds(new ArrayList<>()); + + assertDoesNotThrow(() -> UserPermissionsUtil.verifyUserHasAssignPermission( + invoice.getAcqUnitIds(), okapiHeaders)); + } + + @Test + @DisplayName("should throw exception when manage permission is absent") + void shouldThrowExceptionWhenManagePermissionIsAbsent() { + List permissionsList = List.of( + "invoices.acquisitions-units-assignments.assign" + ); + + String permissionsJsonArrayString = new JsonArray(permissionsList).encode(); + okapiHeaders.put(UserPermissionsUtil.OKAPI_HEADER_PERMISSIONS, permissionsJsonArrayString); + + Invoice invoice = new Invoice(); + invoice.setStatus(Invoice.Status.REVIEWED); + invoice.setAcqUnitIds(List.of("12345678")); + Invoice invoiceFromStorage = new Invoice(); + invoiceFromStorage.setStatus(Invoice.Status.REVIEWED); + invoiceFromStorage.setAcqUnitIds(List.of("6475643839")); + + assertThrows(HttpException.class, () -> + UserPermissionsUtil.verifyUserHasManagePermission( + invoice.getAcqUnitIds(), invoiceFromStorage.getAcqUnitIds(), okapiHeaders)); + } + + @Test + @DisplayName("Should not throw exception when manage permission is assigned") + void shouldNotThrowExceptionWhenManagePermissionIsAssigned() { + // Create a list of permissions + List permissionsList = Arrays.asList( + "invoices.acquisitions-units-assignments.manage", + "invoices.acquisitions-units-assignments.assign" + ); + + String permissionsJsonArrayString = new JsonArray(permissionsList).encode(); + okapiHeaders.put(UserPermissionsUtil.OKAPI_HEADER_PERMISSIONS, permissionsJsonArrayString); + + Invoice invoice = new Invoice(); + invoice.setStatus(Invoice.Status.REVIEWED); + invoice.setAcqUnitIds(List.of("12345678")); + Invoice invoiceFromStorage = new Invoice(); + invoiceFromStorage.setStatus(Invoice.Status.REVIEWED); + invoiceFromStorage.setAcqUnitIds(List.of("6475643839")); + + assertDoesNotThrow(() -> UserPermissionsUtil.verifyUserHasManagePermission( + invoice.getAcqUnitIds(), invoiceFromStorage.getAcqUnitIds(), okapiHeaders)); + } + + @Test + @DisplayName("should throw exception when fiscal year update permission is absent") + void shouldThrowExceptionWhenFiscalYearUpdatePermissionIsAbsent() { + List permissionsList = List.of( + "invoices.acquisitions-units-assignments.assign" + ); + + String permissionsJsonArrayString = new JsonArray(permissionsList).encode(); + okapiHeaders.put(UserPermissionsUtil.OKAPI_HEADER_PERMISSIONS, permissionsJsonArrayString); + + Invoice invoice = new Invoice(); + invoice.setStatus(Invoice.Status.REVIEWED); + invoice.setFiscalYearId("2006"); + Invoice invoiceFromStorage = new Invoice(); + invoiceFromStorage.setStatus(Invoice.Status.REVIEWED); + invoiceFromStorage.setFiscalYearId("2005"); + + assertThrows(HttpException.class, () -> + UserPermissionsUtil.verifyUserHasFiscalYearUpdatePermission( + invoice.getFiscalYearId(), invoiceFromStorage.getFiscalYearId(), okapiHeaders)); + } + + @Test + @DisplayName("Should not throw exception when fiscal year update permission is assigned") + void shouldNotThrowExceptionWhenFiscalYearUpdatePermissionIsAssigned() { + // Create a list of permissions + List permissionsList = Arrays.asList( + "invoices.fiscal-year.update", + "invoices.acquisitions-units-assignments.assign" + ); + + String permissionsJsonArrayString = new JsonArray(permissionsList).encode(); + okapiHeaders.put(UserPermissionsUtil.OKAPI_HEADER_PERMISSIONS, permissionsJsonArrayString); + + Invoice invoice = new Invoice(); + invoice.setStatus(Invoice.Status.REVIEWED); + invoice.setFiscalYearId("2006"); + Invoice invoiceFromStorage = new Invoice(); + invoiceFromStorage.setStatus(Invoice.Status.REVIEWED); + invoiceFromStorage.setFiscalYearId("2005"); + + assertDoesNotThrow(() -> UserPermissionsUtil.verifyUserHasManagePermission( + invoice.getAcqUnitIds(), invoiceFromStorage.getAcqUnitIds(), okapiHeaders)); + } +}