MAGETWO-91529: Restricted admin user can remove product from other websites

Joan He · Joan He · commit eb7d034353e4 · 2018-06-06T10:40:10.000-05:00
- Disable fields for locked attributes
diff --git a/app/code/Magento/Catalog/Test/Unit/Ui/DataProvider/Product/Form/Modifier/AbstractModifierTest.php b/app/code/Magento/Catalog/Test/Unit/Ui/DataProvider/Product/Form/Modifier/AbstractModifierTest.php
@@ -63,7 +63,8 @@ protected function setUp()
                 'getAttributes',
                 'getStore',
                 'getAttributeDefaultValue',
-                'getExistsStoreValueFlag'
+                'getExistsStoreValueFlag',
+                'isLockedAttribute'
             ])->getMockForAbstractClass();
         $this->storeMock = $this->getMockBuilder(StoreInterface::class)
             ->setMethods(['load', 'getId', 'getConfig'])
@@ -81,9 +82,6 @@ protected function setUp()
         $this->arrayManagerMock->expects($this->any())
             ->method('set')
             ->willReturnArgument(1);
-        $this->arrayManagerMock->expects($this->any())
-            ->method('merge')
-            ->willReturnArgument(1);
         $this->arrayManagerMock->expects($this->any())
             ->method('remove')
             ->willReturnArgument(1);
diff --git a/app/code/Magento/Catalog/Test/Unit/Ui/DataProvider/Product/Form/Modifier/AttributeSetTest.php b/app/code/Magento/Catalog/Test/Unit/Ui/DataProvider/Product/Form/Modifier/AttributeSetTest.php
@@ -5,6 +5,7 @@
  */
 namespace Magento\Catalog\Test\Unit\Ui\DataProvider\Product\Form\Modifier;
 
+use Magento\Catalog\Ui\DataProvider\Product\Form\Modifier\AbstractModifier;
 use Magento\Catalog\Ui\DataProvider\Product\Form\Modifier\AttributeSet;
 use Magento\Eav\Model\ResourceModel\Entity\Attribute\Set\CollectionFactory;
 use Magento\Eav\Model\ResourceModel\Entity\Attribute\Set\Collection;
@@ -84,7 +85,27 @@ protected function createModel()
 
     public function testModifyMeta()
     {
-        $this->assertNotEmpty($this->getModel()->modifyMeta(['test_group' => []]));
+        $modifyMeta = $this->getModel()->modifyMeta(['test_group' => []]);
+        $this->assertNotEmpty($modifyMeta);
+    }
+
+    /**
+     * @param bool $locked
+     * @dataProvider modifyMetaLockedDataProvider
+     */
+    public function testModifyMetaLocked($locked)
+    {
+        $this->productMock->expects($this->any())
+            ->method('isLockedAttribute')
+            ->willReturn($locked);
+        $modifyMeta = $this->getModel()->modifyMeta([AbstractModifier::DEFAULT_GENERAL_PANEL => []]);
+        $this->assertEquals($locked,
+            $modifyMeta[AbstractModifier::DEFAULT_GENERAL_PANEL]['children']['attribute_set_id']['arguments']['data']['config']['disabled']);
+    }
+
+    public function modifyMetaLockedDataProvider()
+    {
+        return [[true], [false]];
     }
 
     public function testModifyMetaToBeEmpty()
diff --git a/app/code/Magento/Catalog/Test/Unit/Ui/DataProvider/Product/Form/Modifier/CategoriesTest.php b/app/code/Magento/Catalog/Test/Unit/Ui/DataProvider/Product/Form/Modifier/CategoriesTest.php
@@ -114,6 +114,44 @@ public function testModifyMeta()
         $this->assertArrayHasKey($groupCode, $this->getModel()->modifyMeta($meta));
     }
 
+    /**
+     * @param bool $locked
+     * @dataProvider modifyMetaLockedDataProvider
+     */
+    public function testModifyMetaLocked($locked)
+    {
+        $groupCode = 'test_group_code';
+        $meta = [
+            $groupCode => [
+                'children' => [
+                    'category_ids' => [
+                        'sortOrder' => 10,
+                    ],
+                ],
+            ],
+        ];
+
+        $this->arrayManagerMock->expects($this->any())
+            ->method('findPath')
+            ->willReturn('path');
+
+        $this->productMock->expects($this->any())
+            ->method('isLockedAttribute')
+            ->willReturn($locked);
+
+        $this->arrayManagerMock->expects($this->any())
+            ->method('merge')
+            ->willReturnArgument(2);
+
+        $modifyMeta = $this->createModel()->modifyMeta($meta);
+        $this->assertEquals($locked, $modifyMeta['arguments']['data']['config']['disabled']);
+    }
+
+    public function modifyMetaLockedDataProvider()
+    {
+        return [[true], [false]];
+    }
+
     public function testModifyMetaWithCaching()
     {
         $this->arrayManagerMock->expects($this->exactly(2))
diff --git a/app/code/Magento/Catalog/Test/Unit/Ui/DataProvider/Product/Form/Modifier/EavTest.php b/app/code/Magento/Catalog/Test/Unit/Ui/DataProvider/Product/Form/Modifier/EavTest.php
@@ -456,20 +456,24 @@ public function testModifyData()
      * @param string $attrValue
      * @param string $note
      * @param array $expected
+     * @param bool $locked
      * @covers \Magento\Catalog\Ui\DataProvider\Product\Form\Modifier\Eav::isProductExists
      * @covers \Magento\Catalog\Ui\DataProvider\Product\Form\Modifier\Eav::setupAttributeMeta
      * @dataProvider setupAttributeMetaDataProvider
      */
-    public function testSetupAttributeMetaDefaultAttribute($productId, $productRequired, $attrValue, $note, $expected)
+    public function testSetupAttributeMetaDefaultAttribute($productId, $productRequired, $attrValue, $note, $expected, $locked = false)
     {
-        $configPath =  'arguments/data/config';
         $groupCode = 'product-details';
         $sortOrder = '0';
 
         $this->productMock->expects($this->any())
             ->method('getId')
             ->willReturn($productId);
 
+        $this->productMock->expects($this->any())
+            ->method('isLockedAttribute')
+            ->willReturn($locked);
+
         $this->productAttributeMock->expects($this->any())
             ->method('getIsRequired')
             ->willReturn($productRequired);
@@ -509,12 +513,7 @@ public function testSetupAttributeMetaDefaultAttribute($productId, $productRequi
 
         $this->arrayManagerMock->expects($this->any())
             ->method('set')
-            ->with(
-                $configPath,
-                [],
-                $expected
-            )
-            ->willReturn($expected);
+            ->willReturnArgument(2);
 
         $this->arrayManagerMock->expects($this->any())
             ->method('merge')
@@ -540,8 +539,10 @@ public function setupAttributeMetaDataProvider()
     {
         return [
             'default_null_prod_not_new_and_required' => $this->defaultNullProdNotNewAndRequired(),
+            'default_null_prod_not_new_locked_and_required' => $this->defaultNullProdNotNewLockedAndRequired(),
             'default_null_prod_not_new_and_not_required' => $this->defaultNullProdNotNewAndNotRequired(),
             'default_null_prod_new_and_not_required' => $this->defaultNullProdNewAndNotRequired(),
+            'default_null_prod_new_locked_and_not_required' => $this->defaultNullProdNewLOckedAndNotRequired(),
             'default_null_prod_new_and_required' => $this->defaultNullProdNewAndRequired(),
             'default_null_prod_new_and_required_and_filled_notice' =>
                 $this->defaultNullProdNewAndRequiredAndFilledNotice()
@@ -575,6 +576,32 @@ private function defaultNullProdNotNewAndRequired()
         ];
     }
 
+    private function defaultNullProdNotNewLockedAndRequired()
+    {
+        return [
+            'productId'       => 1,
+            'productRequired' => true,
+            'attrValue'       => 'val',
+            'note'            => null,
+            'expected'        => [
+                'dataType'    => null,
+                'formElement' => null,
+                'visible'     => null,
+                'required'    => true,
+                'notice'      => null,
+                'default'     => null,
+                'label'       => new Phrase('mylabel'),
+                'code'        => 'code',
+                'source'      => 'product-details',
+                'scopeLabel'  => '',
+                'globalScope' => false,
+                'sortOrder'   => 0,
+                'disabled'    => true,
+            ],
+            'locked' => true
+        ];
+    }
+
     /**
      * @return array
      */
@@ -629,6 +656,32 @@ private function defaultNullProdNewAndNotRequired()
         ];
     }
 
+    private function defaultNullProdNewLockedAndNotRequired()
+    {
+        return [
+            'productId'       => null,
+            'productRequired' => false,
+            'attrValue'       => null,
+            'note'            => null,
+            'expected'        => [
+                'dataType'    => null,
+                'formElement' => null,
+                'visible'     => null,
+                'required'    => false,
+                'notice'      => null,
+                'default'     => 'required_value',
+                'label'       => new Phrase('mylabel'),
+                'code'        => 'code',
+                'source'      => 'product-details',
+                'scopeLabel'  => '',
+                'globalScope' => false,
+                'sortOrder'   => 0,
+                'disabled'    => true,
+            ],
+            'locked' => true,
+        ];
+    }
+
     /**
      * @return array
      */
diff --git a/app/code/Magento/Catalog/Test/Unit/Ui/DataProvider/Product/Form/Modifier/GeneralTest.php b/app/code/Magento/Catalog/Test/Unit/Ui/DataProvider/Product/Form/Modifier/GeneralTest.php
@@ -60,6 +60,9 @@ protected function createModel()
 
     public function testModifyMeta()
     {
+        $this->arrayManagerMock->expects($this->any())
+            ->method('merge')
+            ->willReturnArgument(2);
         $this->assertNotEmpty($this->getModel()->modifyMeta([
             'first_panel_code' => [
                 'arguments' => [
diff --git a/app/code/Magento/Catalog/Test/Unit/Ui/DataProvider/Product/Form/Modifier/ScheduleDesignUpdateTest.php b/app/code/Magento/Catalog/Test/Unit/Ui/DataProvider/Product/Form/Modifier/ScheduleDesignUpdateTest.php
@@ -24,6 +24,9 @@ protected function createModel()
 
     public function testModifyMeta()
     {
+        $this->arrayManagerMock->expects($this->any())
+            ->method('merge')
+            ->willReturnArgument(1);
         $this->assertSame([], $this->getModel()->modifyMeta([]));
     }
 
diff --git a/app/code/Magento/Catalog/Test/Unit/Ui/DataProvider/Product/Form/Modifier/WebsitesTest.php b/app/code/Magento/Catalog/Test/Unit/Ui/DataProvider/Product/Form/Modifier/WebsitesTest.php
@@ -76,7 +76,10 @@ class WebsitesTest extends AbstractModifierTest
 
     protected function setUp()
     {
-        $this->objectManager = new ObjectManager($this);
+        parent::setUp();
+        $this->productMock->expects($this->any())
+            ->method('getId')
+            ->willReturn(self::PRODUCT_ID);
         $this->assignedWebsites = [self::SECOND_WEBSITE_ID];
         $this->websiteMock = $this->getMockBuilder(\Magento\Store\Model\Website::class)
             ->setMethods(['getId', 'getName'])
@@ -101,15 +104,9 @@ protected function setUp()
         $this->storeRepositoryMock = $this->getMockBuilder(\Magento\Store\Api\StoreRepositoryInterface::class)
             ->setMethods(['getList'])
             ->getMockForAbstractClass();
-        $this->locatorMock = $this->getMockBuilder(\Magento\Catalog\Model\Locator\LocatorInterface::class)
-            ->setMethods(['getProduct', 'getWebsiteIds'])
-            ->getMockForAbstractClass();
         $this->productMock = $this->getMockBuilder(\Magento\Catalog\Api\Data\ProductInterface::class)
             ->setMethods(['getId'])
             ->getMockForAbstractClass();
-        $this->locatorMock->expects($this->any())
-            ->method('getProduct')
-            ->willReturn($this->productMock);
         $this->locatorMock->expects($this->any())
             ->method('getWebsiteIds')
             ->willReturn($this->assignedWebsites);
@@ -148,9 +145,6 @@ protected function setUp()
         $this->storeRepositoryMock->expects($this->any())
             ->method('getList')
             ->willReturn([$this->storeViewMock]);
-        $this->productMock->expects($this->any())
-            ->method('getId')
-            ->willReturn(self::PRODUCT_ID);
         $this->secondWebsiteMock->expects($this->any())
             ->method('getId')
             ->willReturn($this->assignedWebsites[0]);
diff --git a/app/code/Magento/Catalog/Ui/DataProvider/Product/Form/Modifier/AdvancedPricing.php b/app/code/Magento/Catalog/Ui/DataProvider/Product/Form/Modifier/AdvancedPricing.php
@@ -432,7 +432,8 @@ private function getTierPriceStructure($tierPricePath)
                         'dndConfig' => [
                             'enabled' => false,
                         ],
-                        'disabled' => false,
+                        'disabled' =>
+                            $this->arrayManager->get($tierPricePath . '/arguments/data/config/disabled', $this->meta),
                         'required' => false,
                         'sortOrder' =>
                             $this->arrayManager->get($tierPricePath . '/arguments/data/config/sortOrder', $this->meta),
diff --git a/app/code/Magento/Catalog/Ui/DataProvider/Product/Form/Modifier/AttributeSet.php b/app/code/Magento/Catalog/Ui/DataProvider/Product/Form/Modifier/AttributeSet.php
@@ -108,6 +108,7 @@ public function modifyMeta(array $meta)
                     self::ATTRIBUTE_SET_FIELD_ORDER
                 ),
                 'multiple' => false,
+                'disabled' => $this->locator->getProduct()->isLockedAttribute('attribute_set_id'),
             ];
         }
 
diff --git a/app/code/Magento/Catalog/Ui/DataProvider/Product/Form/Modifier/Categories.php b/app/code/Magento/Catalog/Ui/DataProvider/Product/Form/Modifier/Categories.php
@@ -228,6 +228,7 @@ protected function customizeCategoriesField(array $meta)
                             'componentType' => 'container',
                             'component' => 'Magento_Ui/js/form/components/group',
                             'scopeLabel' => __('[GLOBAL]'),
+                            'disabled' => $this->locator->getProduct()->isLockedAttribute($fieldCode),
                         ],
                     ],
                 ],
diff --git a/app/code/Magento/Catalog/Ui/DataProvider/Product/Form/Modifier/Eav.php b/app/code/Magento/Catalog/Ui/DataProvider/Product/Form/Modifier/Eav.php
@@ -593,6 +593,7 @@ private function isProductExists()
     public function setupAttributeMeta(ProductAttributeInterface $attribute, $groupCode, $sortOrder)
     {
         $configPath = ltrim(static::META_CONFIG_PATH, ArrayManager::DEFAULT_PATH_DELIMITER);
+        $attributeCode = $attribute->getAttributeCode();
         $meta = $this->arrayManager->set($configPath, [], [
             'dataType' => $attribute->getFrontendInput(),
             'formElement' => $this->getFormElementsMapValue($attribute->getFrontendInput()),
@@ -601,7 +602,7 @@ public function setupAttributeMeta(ProductAttributeInterface $attribute, $groupC
             'notice' => $attribute->getNote() === null ? null : __($attribute->getNote()),
             'default' => (!$this->isProductExists()) ? $this->getAttributeDefaultValue($attribute) : null,
             'label' => __($attribute->getDefaultFrontendLabel()),
-            'code' => $attribute->getAttributeCode(),
+            'code' => $attributeCode,
             'source' => $groupCode,
             'scopeLabel' => $this->getScopeLabel($attribute),
             'globalScope' => $this->isScopeGlobal($attribute),
@@ -630,7 +631,9 @@ public function setupAttributeMeta(ProductAttributeInterface $attribute, $groupC
             ]);
         }
 
-        if (in_array($attribute->getAttributeCode(), $this->attributesToDisable)) {
+        $product = $this->locator->getProduct();
+        if (in_array($attributeCode, $this->attributesToDisable)
+            || $product->isLockedAttribute($attributeCode)) {
             $meta = $this->arrayManager->merge($configPath, $meta, [
                 'disabled' => true,
             ]);
diff --git a/app/code/Magento/Catalog/Ui/DataProvider/Product/Form/Modifier/General.php b/app/code/Magento/Catalog/Ui/DataProvider/Product/Form/Modifier/General.php
@@ -203,7 +203,7 @@ protected function customizeStatusField(array $meta)
     protected function customizeWeightField(array $meta)
     {
         $weightPath = $this->arrayManager->findPath(ProductAttributeInterface::CODE_WEIGHT, $meta, null, 'children');
-
+        $disabled = $this->arrayManager->get($weightPath . '/arguments/data/config/disabled', $meta);
         if ($weightPath) {
             $meta = $this->arrayManager->merge(
                 $weightPath . static::META_CONFIG_PATH,
@@ -215,7 +215,7 @@ protected function customizeWeightField(array $meta)
                     ],
                     'additionalClasses' => 'admin__field-small',
                     'addafter' => $this->locator->getStore()->getConfig('general/locale/weight_unit'),
-                    'imports' => [
+                    'imports' => $disabled ? [] : [
                         'disabled' => '!${$.provider}:' . self::DATA_SCOPE_PRODUCT
                             . '.product_has_weight:value'
                     ]
@@ -255,6 +255,7 @@ protected function customizeWeightField(array $meta)
                         ],
                     ],
                     'value' => (int)$this->locator->getProduct()->getTypeInstance()->hasWeight(),
+                    'disabled' => $disabled,
                 ]
             );
         }
diff --git a/app/code/Magento/Catalog/Ui/DataProvider/Product/Form/Modifier/Websites.php b/app/code/Magento/Catalog/Ui/DataProvider/Product/Form/Modifier/Websites.php
@@ -135,7 +135,6 @@ public function modifyMeta(array $meta)
                                     'collapsible' => true,
                                     'componentType' => Form\Fieldset::NAME,
                                     'dataScope' => self::DATA_SCOPE_PRODUCT,
-                                    'disabled' => false,
                                     'sortOrder' => $this->getNextGroupSortOrder(
                                         $meta,
                                         'search-engine-optimization',
@@ -196,6 +195,7 @@ protected function getFieldsForFieldset()
                                 'false' => '0',
                             ],
                             'value' => $isChecked ? (string)$website['id'] : '0',
+                            'disabled' => $this->locator->getProduct()->isLockedAttribute('website_ids'),
                         ],
                     ],
                 ],
diff --git a/app/code/Magento/CatalogInventory/Ui/DataProvider/Product/Form/Modifier/AdvancedInventory.php b/app/code/Magento/CatalogInventory/Ui/DataProvider/Product/Form/Modifier/AdvancedInventory.php
@@ -223,6 +223,7 @@ private function prepareMeta()
                     $this->arrayManager->slicePath($pathField, 0, -2) . '/arguments/data/config/sortOrder',
                     $this->meta
                 ) - 1,
+                'disabled' => $this->locator->getProduct()->isLockedAttribute($fieldCode),
             ];
             $qty['arguments']['data']['config'] = [
                 'component' => 'Magento_CatalogInventory/js/components/qty-validator-changer',

Original file line number	Diff line number	Diff line change
`@@ -60,6 +60,9 @@ protected function createModel()`
`60`	`60`
`61`	`61`	`public function testModifyMeta()`
`62`	`62`	`{`
	`63`	`+ $this->arrayManagerMock->expects($this->any())`
	`64`	`+ ->method('merge')`
	`65`	`+ ->willReturnArgument(2);`
`63`	`66`	`$this->assertNotEmpty($this->getModel()->modifyMeta([`
`64`	`67`	`'first_panel_code' => [`
`65`	`68`	`'arguments' => [`
Original file line number	Diff line number	Diff line change
`@@ -24,6 +24,9 @@ protected function createModel()`
`24`	`24`
`25`	`25`	`public function testModifyMeta()`
`26`	`26`	`{`
	`27`	`+ $this->arrayManagerMock->expects($this->any())`
	`28`	`+ ->method('merge')`
	`29`	`+ ->willReturnArgument(1);`
`27`	`30`	`$this->assertSame([], $this->getModel()->modifyMeta([]));`
`28`	`31`	`}`
`29`	`32`
Original file line number	Diff line number	Diff line change
`@@ -108,6 +108,7 @@ public function modifyMeta(array $meta)`
`108`	`108`	`self::ATTRIBUTE_SET_FIELD_ORDER`
`109`	`109`	`),`
`110`	`110`	`'multiple' => false,`
	`111`	`+ 'disabled' => $this->locator->getProduct()->isLockedAttribute('attribute_set_id'),`
`111`	`112`	`];`
`112`	`113`	`}`
`113`	`114`