Skip to content

Fix default profile assignment for user who lost all rights because no matched with authorization rules #21594

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 3 commits into from
Closed

Fix default profile assignment for user who lost all rights because no matched with authorization rules #21594

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
7e7c1cd
Fix default profile assignment for user who lost all rights because t…
Lainow Oct 22, 2025
edcd83a
Add units tests
Lainow Oct 22, 2025
b27ae9f
Update composer.json
Lainow Oct 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Add units tests
  • Loading branch information
@Lainow
Lainow committed Oct 22, 2025
commit edcd83a8009eeae08c4d715903eab8b6eda1ea53
104 changes: 104 additions & 0 deletions phpunit/functional/UserTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1857,4 +1857,108 @@ public function testUnsetUndisclosedFieldsWithPartialFields()

$this->assertEquals(['name' => 'test'], $fields);
}

public function testApplyRightRulesWithDefaultProfile()
{
$this->login();

// Create a test user with login info for authentication
$user = new \User();
$uid = $user->add([
'name' => 'test_apply_right_rules_user',
'password' => 'test_password',
'password2' => 'test_password',
]);
$this->assertGreaterThan(0, $uid);
$this->assertTrue($user->getFromDB($uid));

// Get default profile and tech profile
$default_profile = \Profile::getDefault();
$tech_profile = getItemByTypeName('Profile', 'Technician', true);
$this->assertGreaterThan(0, $default_profile);

// Remove the default profile that was automatically added during user creation
$profile_user = new \Profile_User();
$existing_profiles = \Profile_User::getForUser($uid, false);
foreach ($existing_profiles as $existing_profile) {
$profile_user->delete(['id' => $existing_profile['id']]);
}

// Verify user has no profiles
$profiles_before = \Profile_User::getForUser($uid, false);
$this->assertCount(0, $profiles_before);

// Create a right rule that assigns Technician profile based on user name
$rule_right = new \RuleRight();
$rule_id = $rule_right->add([
'name' => 'Test rule for profile assignment',
'is_active' => 1,
'sub_type' => 'RuleRight',
'match' => 'AND',
'condition' => 0,
]);
$this->assertGreaterThan(0, $rule_id);

// Add criteria: if login equals test_apply_right_rules_user
$rule_criteria = new \RuleCriteria();
$criteria_id = $rule_criteria->add([
'rules_id' => $rule_id,
'criteria' => 'LOGIN',
'condition' => 0, // is
'pattern' => 'test_apply_right_rules_user',
]);
$this->assertGreaterThan(0, $criteria_id);

// Add action: assign Technician profile on root entity
$rule_action = new \RuleAction();
$action_id = $rule_action->add([
'rules_id' => $rule_id,
'action_type' => 'assign',
'field' => 'profiles_id',
'value' => $tech_profile,
]);
$this->assertGreaterThan(0, $action_id);

// Add action: assign to root entity
$entity_action_id = $rule_action->add([
'rules_id' => $rule_id,
'action_type' => 'assign',
'field' => 'entities_id',
'value' => 0,
]);
$this->assertGreaterThan(0, $entity_action_id);

// Login as the test user to trigger rule processing
$this->login('test_apply_right_rules_user', 'test_password');

// Verify user now has the Technician profile (assigned by rule)
$profiles_after_rule = \Profile_User::getForUser($uid, false);
$this->assertCount(1, $profiles_after_rule);
$profile_after_rule = reset($profiles_after_rule);
$this->assertEquals($tech_profile, $profile_after_rule['profiles_id']);
$this->assertEquals(1, $profile_after_rule['is_dynamic']); // Profile assigned by rule is dynamic

// Now modify the rule criteria so it doesn't match anymore
$this->assertTrue($rule_criteria->update([
'id' => $criteria_id,
'pattern' => 'different_user_name', // This won't match our user
]));

// Login again to trigger rule re-processing
$this->login('test_apply_right_rules_user', 'test_password');

// Verify user now has the default profile (since rule doesn't match anymore)
$profiles_after_no_match = \Profile_User::getForUser($uid, false);
$this->assertCount(1, $profiles_after_no_match);

$profile_after_no_match = reset($profiles_after_no_match);
$this->assertEquals($default_profile, $profile_after_no_match['profiles_id']);
$this->assertEquals(0, $profile_after_no_match['entities_id']);
$this->assertEquals(1, $profile_after_no_match['is_recursive']);
$this->assertEquals(1, $profile_after_no_match['is_dynamic']);
$this->assertEquals(1, $profile_after_no_match['is_default_profile']);

// Clean up: delete the test rule
$this->assertTrue($rule_right->delete(['id' => $rule_id]));
}
}