SAK-33632 Assignments NPE when checking group submitter for assignment (

sakaiproject#5035)
CoderSilence · Nov 27, 2017 · 6875c92 · 6875c92
1 parent aa39548
commit 6875c92
Show file tree

Hide file tree

Showing 2 changed files with 85 additions and 2 deletions.
diff --git a/assignment/impl/src/java/org/sakaiproject/assignment/impl/AssignmentServiceImpl.java b/assignment/impl/src/java/org/sakaiproject/assignment/impl/AssignmentServiceImpl.java
@@ -948,7 +948,7 @@ public AssignmentSubmission addSubmission(String assignmentId, String submitter)
 
                 if (assignment.getIsGroup()) {
                     Group group = site.getGroup(submitter);
-                    if (assignment.getGroups().contains(group.getReference())) {
+                    if (group != null && assignment.getGroups().contains(group.getReference())) {
                         for (Member member : group.getMembers()) {
                             AssignmentSubmissionSubmitter ass = new AssignmentSubmissionSubmitter();
                             ass.setSubmitter(member.getUserId());
@@ -2517,7 +2517,7 @@ private Assignment checkAssignmentAccessibleForUser(Assignment assignment, Strin
             Collection<Group> allowedGroups = getGroupsAllowFunction(SECURE_ACCESS_ASSIGNMENT, context, currentUserId);
             // reject and throw PermissionException if there is no intersection
             if (!allowAllGroups(context)
-                    && StringUtils.equals(assignment.getAuthor(), currentUserId)
+                    && !StringUtils.equals(assignment.getAuthor(), currentUserId)
                     && !CollectionUtils.containsAny(asgGroups, allowedGroups.stream().map(Group::getReference).collect(Collectors.toSet()))) {
                 throw new PermissionException(currentUserId, SECURE_ACCESS_ASSIGNMENT, assignment.getId());
             }

diff --git a/assignment/impl/src/test/org/sakaiproject/assignment/impl/AssignmentServiceTest.java b/assignment/impl/src/test/org/sakaiproject/assignment/impl/AssignmentServiceTest.java
@@ -28,6 +28,7 @@
 import java.text.NumberFormat;
 import java.time.Duration;
 import java.time.Instant;
+import java.time.Period;
 import java.util.Collection;
 import java.util.HashSet;
 import java.util.Map;
@@ -339,6 +340,39 @@ public void addAndGetSubmission() {
         }
     }
 
+    @Test
+    public void addAndGetGroupSubmission() {
+        String context = UUID.randomUUID().toString();
+        String groupSubmitter = UUID.randomUUID().toString();
+        String submitter1 = UUID.randomUUID().toString();
+        String submitter2 = UUID.randomUUID().toString();
+        Set<String> submitters = new HashSet<>();
+        submitters.add(submitter1);
+        submitters.add(submitter2);
+
+        try {
+            AssignmentSubmission savedSubmission = createNewGroupSubmission(context, groupSubmitter, submitters);
+            Assert.assertNotNull(savedSubmission);
+            Assert.assertNotNull(savedSubmission.getId());
+
+            AssignmentSubmission getSubmission = assignmentService.getSubmission(savedSubmission.getId());
+            Assert.assertNotNull(getSubmission);
+            Assert.assertNotNull(getSubmission.getId());
+
+            Assignment assignment = getSubmission.getAssignment();
+            Assert.assertNotNull(assignment.getId());
+            Assert.assertEquals(context, assignment.getContext());
+
+            Set<AssignmentSubmissionSubmitter> submissionSubmitters = getSubmission.getSubmitters();
+            Assert.assertEquals(2, submissionSubmitters.size());
+            submissionSubmitters.forEach(s -> Assert.assertTrue(submitters.contains(s.getSubmitter())));
+            Assert.assertEquals(1, submissionSubmitters.stream().filter(AssignmentSubmissionSubmitter::getSubmittee).collect(Collectors.toList()).size());
+            Assert.assertEquals(groupSubmitter, getSubmission.getGroupId());
+        } catch (Exception e) {
+            Assert.fail("Could not create submission, " + e.getMessage());
+        }
+    }
+
     @Test
     public void removeSubmission() {
         String context = UUID.randomUUID().toString();
@@ -508,6 +542,55 @@ private AssignmentSubmission createNewSubmission(String context, String submitte
         return submission;
     }
 
+    private AssignmentSubmission createNewGroupSubmission(String context, String groupSubmitter, Set<String> submitters) throws UserNotDefinedException, IdUnusedException, PermissionException {
+
+        // Setup an Assignment for Group Submission
+        Assignment assignment = createNewAssignment(context);
+        assignment.setTypeOfAccess(Assignment.Access.GROUP);
+        assignment.setIsGroup(true);
+        assignment.setOpenDate(Instant.now().minus(Period.ofDays(1)));
+        String groupRef = "/site/" + context + "/group/" + groupSubmitter;
+        assignment.getGroups().add(groupRef);
+        String assignmentReference = AssignmentReferenceReckoner.reckoner().assignment(assignment).reckon().getReference();
+        when(securityService.unlock(AssignmentServiceConstants.SECURE_UPDATE_ASSIGNMENT, assignmentReference)).thenReturn(true);
+        assignmentService.updateAssignment(assignment);
+
+        // configure mock group objects
+        Site site = mock(Site.class);
+        Group group = mock(Group.class);
+        when(group.getReference()).thenReturn(groupRef);
+        Collection<Group> groups = new HashSet<>();
+        groups.add(group);
+        when(site.getGroups()).thenReturn(groups);
+        when(site.getGroup(groupSubmitter)).thenReturn(group);
+        Set<Member> members = new HashSet<>();
+        submitters.forEach(s -> {
+                Member member = mock(Member.class);
+                when(member.getUserId()).thenReturn(s);
+                members.add(member);
+        });
+        when(group.getMembers()).thenReturn(members);
+        when(siteService.getSite(context)).thenReturn(site);
+        Set<String> groupRefs = groups.stream().map(Group::getReference).collect(Collectors.toSet());
+
+        // pick a submitter to be the current user
+        String currentUser = submitters.stream().findAny().get();
+        when(sessionManager.getCurrentSessionUserId()).thenReturn(currentUser);
+
+        // drop security to student permissions
+        when(authzGroupService.getAuthzGroupsIsAllowed(currentUser, AssignmentServiceConstants.SECURE_ACCESS_ASSIGNMENT, groupRefs)).thenReturn(groupRefs);
+        when(securityService.unlock(AssignmentServiceConstants.SECURE_ACCESS_ASSIGNMENT, groupSubmitter)).thenReturn(true);
+        when(securityService.unlock(AssignmentServiceConstants.SECURE_ADD_ASSIGNMENT, AssignmentReferenceReckoner.reckoner().context(context).reckon().getReference())).thenReturn(false);
+        when(securityService.unlock(AssignmentServiceConstants.SECURE_ADD_ASSIGNMENT_SUBMISSION, groupRef)).thenReturn(true);
+
+        try {
+            return assignmentService.addSubmission(assignment.getId(), groupSubmitter);
+        } catch (PermissionException e) {
+            Assert.fail(e.getMessage());
+        }
+        return null;
+    }
+
     private Assignment createNewAssignment(String context) {
         String contextReference = AssignmentReferenceReckoner.reckoner().context(context).reckon().getReference();
         when(securityService.unlock(AssignmentServiceConstants.SECURE_ADD_ASSIGNMENT, contextReference)).thenReturn(true);