1   /*
2    *  TestSecurity.java
3    *
4    *  Copyright (c) 1998-2001, The University of Sheffield.
5    *
6    *  This file is part of GATE (see http://gate.ac.uk/), and is free
7    *  software, licenced under the GNU Library General Public License,
8    *  Version 2, June 1991 (in the distribution as file licence.html,
9    *  and also available at http://gate.ac.uk/gate/licence.html).
10   *
11   *  Kalina Bontcheva, 01/Oct/01
12   *
13   *  $Id: TestSecurity.java,v 1.24 2002/03/14 11:10:34 kalina Exp $
14   */
15  
16  package gate.security;
17  
18  import java.util.*;
19  import java.io.*;
20  import java.net.*;
21  import java.beans.*;
22  import java.lang.reflect.*;
23  import junit.framework.*;
24  
25  import gate.*;
26  import gate.util.*;
27  import gate.corpora.*;
28  import gate.security.*;
29  
30  /** Persistence test class
31    */
32  public class TestSecurity extends TestCase
33  {
34    /** Debug flag */
35    private static final boolean DEBUG = false;
36    private static final int ADMIN_GROUP_ID = 0;
37    private static final int ADMIN_USER_ID = 0;
38  
39    private static final int SUAHILI_GROUP_ID = 101;
40    private static final int ENGLISH_GROUP_ID = 101;
41  
42  
43    /** JDBC URL */
44    private static String JDBC_URL;
45  
46    private boolean exceptionThrown = false;
47  
48    /** Construction */
49    public TestSecurity(String name) throws GateException { super(name); }
50  
51    /** Fixture set up */
52    public void setUp() throws Exception {
53      if (! Gate.getDataStoreRegister().getConfigData().containsKey("url-test"))
54        throw new GateRuntimeException("DB URL not configured in gate.xml");
55      else
56        JDBC_URL =
57          (String) Gate.getDataStoreRegister().getConfigData().get("url-test");
58    } // setUp
59  
60    /** Put things back as they should be after running tests
61      * (reinitialise the CREOLE register).
62      */
63    public void tearDown() throws Exception {
64    } // tearDown
65  
66  
67    public void testSecurityTables() throws Exception {
68  //    AccessController ac = new AccessControllerImpl(JDBC_URL);
69      AccessController ac = Factory.createAccessController(JDBC_URL);
70      ac.open();
71  
72      User myUser = ac.findUser("kalina");
73      Assert.assertNotNull(myUser);
74      Assert.assertEquals(myUser.getName(), "kalina");
75  
76      List myGroups = myUser.getGroups();
77  
78      Assert.assertNotNull(myGroups);
79      for (int i = 0; i< myGroups.size(); i++) {
80        Group myGroup = //ac.findGroup((Long) myGroups.get(i));
81          (Group)myGroups.get(i);
82        if (i == 0)
83          Assert.assertEquals(myGroup.getName(), "English Language Group");
84        else if (i == 1)
85          Assert.assertEquals(myGroup.getName(), "Suahili Group");
86        //now it is allowed for the test user to be a member of more than these
87        //two groups, as it was creating a problem
88      }//for
89  
90      Session mySession = ac.login("kalina", "sesame",
91                                ac.findGroup("English Language Group").getID());
92      Assert.assertNotNull(mySession);
93  //    Assert.assertTrue(ac.isValidSession(mySession));
94  
95    } // testSecurityTables
96  
97  
98  
99    public void testUserGroupManipulation() throws Exception {
100 
101     //1. open security factory
102     AccessController ac = Factory.createAccessController(JDBC_URL);
103     ac.open();
104 
105     //1.1 list groups and users
106     List groups = ac.listGroups();
107     Assert.assertNotNull(groups);
108 
109     if(DEBUG)
110       Err.prln("+++ found ["+groups.size()+"] groups...");
111 
112     List users = ac.listUsers();
113     Assert.assertNotNull(users);
114     if(DEBUG)
115       Err.prln("+++ found ["+users.size()+"] users...");
116 
117     //2. log into the securoty factory
118     Session adminSession = ac.login("ADMIN", "sesame",new Long(ADMIN_GROUP_ID));
119     //check session
120     Assert.assertNotNull(adminSession);
121     //is session valid?
122     Assert.assertTrue(true == ac.isValidSession(adminSession));
123     //assert session is privieged
124     Assert.assertTrue(adminSession.isPrivilegedSession());
125 
126     //3. create a new user and group
127     User myUser;
128     try {
129       myUser = ac.createUser("myUser", "myPassword",adminSession);
130     } catch (gate.security.SecurityException ex) {
131       //user kalina hasn't got enough priviliges, so login as admin
132       adminSession = ac.login("ADMIN", "sesame", ac.findGroup("ADMINS").getID());
133       //assert session is privieged
134       Assert.assertTrue(adminSession.isPrivilegedSession());
135 
136       myUser = ac.createUser("myUser", "myPassword",adminSession);
137     }
138 
139     //is the user aded to the security factory?
140     Assert.assertNotNull(ac.findUser("myUser"));
141     //is the user in the security factory equal() to what we put there?
142     Assert.assertEquals(myUser,ac.findUser("myUser"));
143     //is the key correct?
144     Assert.assertEquals(myUser.getName(),ac.findUser("myUser").getName());
145 
146 
147 
148     Group myGroup = ac.createGroup("myGroup",adminSession);
149     //is the group aded to the security factory?
150     Assert.assertNotNull(ac.findGroup("myGroup"));
151     //is the group in the security factory equal() to what we put there?
152     Assert.assertEquals(myGroup,ac.findGroup("myGroup"));
153     //is the key correct?
154     Assert.assertEquals(myGroup.getName(), "myGroup");
155 
156 
157 
158     //4. add user to group
159     myGroup.addUser(myUser, adminSession);
160     //is the user added to the group?
161     Assert.assertTrue(myGroup.getUsers().contains(myUser));
162 
163     //4.1 does the user know he's member of the group now?
164     Assert.assertTrue(myUser.getGroups().contains(myGroup));
165 
166     //5. change group name
167     String oldName = myGroup.getName();
168     myGroup.setName("my new group", adminSession);
169     //is the name changed?
170     Assert.assertEquals("my new group",myGroup.getName());
171     //test objectModification propagation
172     //[does change of group name reflect change of keys in the collections
173     //of the security factory?]
174     Assert.assertNotNull(ac.findGroup("my new group"));
175     //check that there is nothing hashed
176     //with the old key
177     exceptionThrown = false;
178     try { ac.findGroup(oldName); }
179     catch(SecurityException sex) {exceptionThrown = true;}
180     Assert.assertTrue(exceptionThrown);
181 
182     //5.5 change user name
183     oldName = myUser.getName();
184     myUser.setName("my new user", adminSession);
185     //is the name changed?
186     Assert.assertEquals("my new user",myUser.getName());
187     //test objectModification propagation
188     //[does change of user name reflect change of keys in the collections
189     //of the security factory?]
190     Assert.assertNotNull(ac.findUser("my new user"));
191     //check that there is nothing hashed
192     //with the old key
193     exceptionThrown = false;
194     try { ac.findUser(oldName); }
195     catch(SecurityException sex) {exceptionThrown = true;}
196     Assert.assertTrue(exceptionThrown);
197 
198     //5.6. restore name
199     myUser.setName(oldName, adminSession);
200 
201     //6. get users
202     List myUsers = myGroup.getUsers();
203     Assert.assertNotNull(myUsers);
204     for (int i = 0; i< myUsers.size(); i++) {
205       //verify that there are no junk users
206       //i.e. evry user in the collection is known by the security factory
207       User myUser1 = ac.findUser(((User)myUsers.get(i)).getID());
208       //verify that the user is aware he's nmember of the group
209       Assert.assertTrue(myUser1.getGroups().contains(myGroup));
210 
211 
212     }//for
213 
214     //7. change name again
215     myGroup.setName("my new group again", adminSession);
216     //is the name changed?
217     Assert.assertEquals("my new group again",myGroup.getName());
218 
219     //8. try to log the user in
220     Session mySession = ac.login("myUser", "myPassword",
221                               ac.findGroup("my new group again").getID());
222     //check session
223     Assert.assertNotNull(mySession);
224     //is valid session?
225     Assert.assertTrue(true == ac.isValidSession(mySession));
226 
227     //9. logout
228     ac.logout(mySession);
229     //is session invalidated?
230     Assert.assertTrue(false == ac.isValidSession(mySession));
231 
232     //10. try to perform an operation with invalid session
233     exceptionThrown = false;
234     try {
235       myGroup.removeUser(myUser,mySession);
236     }
237     catch(SecurityException ex) {
238       exceptionThrown = true;
239       if(DEBUG)
240         Err.prln("++++ OK, got exception ["+ex.getMessage()+"]");
241     }
242     Assert.assertTrue(true == exceptionThrown);
243 
244     //10.1 login again
245     mySession = ac.login("myUser", "myPassword",
246                               ac.findGroup("my new group again").getID());
247     //check session
248     Assert.assertNotNull(mySession);
249     //is valid session?
250     Assert.assertTrue(true == ac.isValidSession(mySession));
251 
252     //11. try to delete group
253     ac.deleteGroup(myGroup, adminSession);
254     //is the group deleted?
255     exceptionThrown = false;
256     try {
257       ac.findGroup(myGroup.getName());
258     }
259     catch(SecurityException se) {
260 
261       if(DEBUG)
262         Err.prln("++ OK, got exception");
263 
264       exceptionThrown = true;
265     }
266     Assert.assertTrue(exceptionThrown);
267 
268     //11.1 does the user know that he's no longer member of the group?
269     Assert.assertTrue(false == myUser.getGroups().contains(myGroup));
270 
271     //11.2 is the user's sesion invalidated?
272     Assert.assertTrue(false == ac.isValidSession(mySession));
273 
274     //11.3 add the user to new group
275     Group suahiliGrp = ac.findGroup(new Long(this.SUAHILI_GROUP_ID));
276     Assert.assertNotNull(suahiliGrp);
277     suahiliGrp.addUser(myUser,adminSession);
278     //11.4 check if the group knows the user is now mmeber
279     Assert.assertTrue(suahiliGrp.getUsers().contains(myUser));
280     //11.5 check if the user know he's member of the group
281     Assert.assertTrue(myUser.getGroups().contains(suahiliGrp));
282     //11.6 login again [with the new group]
283     Session newSession = ac.login("myUser","myPassword",suahiliGrp.getID());
284     //11.7 check session
285     Assert.assertTrue(ac.isValidSession(newSession));
286 
287 
288     //12. check that the sessions are invalidated if the
289     //group/user in the session is deleted
290 
291     //12.1 delete user
292     ac.deleteUser(myUser,adminSession);
293     //12.2 assert he's deleted from the Security Controller
294     exceptionThrown = false;
295     try {
296       ac.findUser(myUser.getName());
297     }
298     catch(SecurityException se) {
299 
300       if(DEBUG)
301         Err.prln("++ OK, got exception");
302 
303       exceptionThrown = true;
304     }
305     Assert.assertTrue(exceptionThrown);
306     //12.3 assert the group has deleted the user as member
307     Assert.assertTrue(false == suahiliGrp.getUsers().contains(myUser));
308     //12.4 assert the session is invalidated
309     Assert.assertTrue(false == ac.isValidSession(newSession));
310 
311     //13. check objectModification events
312 
313     //14.
314 
315   } // testUserGroupManipulation
316 
317 
318 
319   /** Test suite routine for the test runner */
320   public static Test suite() {
321     return new TestSuite(TestSecurity.class);
322   } // suite
323 
324   public static void main(String[] args){
325     try{
326       Gate.setLocalWebServer(false);
327       Gate.setNetConnected(false);
328       Gate.init();
329       TestSecurity test = new TestSecurity("");
330 
331       test.setUp();
332       test.testSecurityTables();
333       test.tearDown();
334 
335       test.setUp();
336       test.testUserGroupManipulation();
337       test.tearDown();
338 
339     }catch(Exception e){
340       e.printStackTrace();
341     }
342   }
343 } // class TestPersist
344