factory = $this->get(AppRoleWithScopesFactory::class); $this->connection = $this->get('database_connection'); $this->accessDecisionManager = $this->get('security.access.decision_manager'); } protected function getConfiguration(): Configuration { return $this->catalog->useMinimalCatalog(); } public function test_it_creates_a_role_with_permissions_derived_from_the_scopes() { $role = $this->factory->createRole('foo', [ 'read_products', 'write_products', ]); Assert::assertInstanceOf(RoleInterface::class, $role); Assert::assertEquals('foo', $role->getLabel()); $this->assertRoleIsPersisted($role); $this->assertRoleAcls($role->getRole(), [ 'pim_api_overall_access' => true, 'pim_api_product_list' => true, 'pim_api_product_edit' => true, 'pim_api_product_remove' => false, ]); } private function assertRoleIsPersisted(RoleInterface $role): void { $query = <<connection->executeQuery($query, [ 'label' => $role->getLabel(), ]); $raw = $stmt->fetchAssociative(); Assert::assertNotFalse($raw); Assert::assertArrayHasKey('role', $raw); Assert::assertEquals($role->getRole(), $raw['role']); Assert::assertArrayHasKey('label', $raw); Assert::assertEquals($role->getLabel(), $raw['label']); Assert::assertArrayHasKey('type', $raw); Assert::assertEquals('app', $raw['type']); } private function assertRoleAcls(string $role, array $acls): void { $token = new UsernamePasswordToken('username', 'main', [$role]); foreach ($acls as $acl => $expectedValue) { \assert(\is_bool($expectedValue)); $isAllowed = $this->accessDecisionManager->decide($token, ['EXECUTE'], new ObjectIdentity('action', $acl)); $this->assertEquals($expectedValue, $isAllowed); } } }