zena 0.15.0

data/test/unit/relation_test.rb

@@ -0,0 +1,48 @@
+require 'test_helper'
+
+# Test Relation. RelationProxy is tested in its own file.
+class RelationTest < Zena::Unit::TestCase
+
+  def test_cannot_create
+    login(:ant) # not an admin
+    relation = Relation.create(:source_role => 'wife', :target_role => 'husband', :source_kpath => 'NRC', :target_kpath => 'NRC', :source_icon => "<img src='/img/user_pink.png'/>", :target_icon => "<img src='/img/user_blue.png'/>")
+    assert relation.new_record?
+    assert_equal 'You do not have the rights to do this.', relation.errors[:base]
+  end
+
+  def test_cannot_update
+    login(:ant) # not an admin
+    relation = relations(:node_has_tags)
+    assert !relation.update_attributes(:target_kpath => 'NP')
+    assert_equal 'You do not have the rights to do this.', relation.errors[:base]
+  end
+
+  def test_can_create
+    login(:lion) # admin
+    relation = Relation.create(:source_role => 'wife', :target_role => 'husband', :source_kpath => 'NRC', :target_kpath => 'NRC', :source_icon => "<img src='/img/user_pink.png'/>", :target_icon => "<img src='/img/user_blue.png'/>")
+    assert !relation.new_record?
+    assert_equal sites_id(:zena), relation[:site_id]
+  end
+
+  def test_cannot_set_site_id
+    login(:lion) # admin
+    relation = Relation.create(:source_role => 'wife', :target_role => 'husband', :source_kpath => 'NRC', :target_kpath => 'NRC', :source_icon => "<img src='/img/user_pink.png'/>", :target_icon => "<img src='/img/user_blue.png'/>", :site_id => sites_id(:ocean))
+    assert !relation.new_record?
+    assert_equal sites_id(:zena), relation[:site_id]
+  end
+
+  def test_set_site_id
+    login(:lion) # admin
+    relation = relations(:node_has_tags)
+    original_site_id = relation.site_id
+    relation.update_attributes(:site_id => 1234)
+    assert_equal original_site_id, relation.site_id
+  end
+
+  def test_can_update
+    login(:lion) # admin
+    relation = relations(:node_has_tags)
+    assert relation.update_attributes(:target_kpath => 'NP')
+    assert_equal 'NP', relation.target_kpath
+  end
+end

data/test/unit/section_test.rb

@@ -0,0 +1,32 @@
+require 'test_helper'
+
+class SectionTest < Zena::Unit::TestCase
+
+
+  def test_section_id_on_create
+    login(:tiger)
+    node = secure!(Section) { Section.create(:parent_id=>nodes_id(:status), :name=>'SuperSection') }
+    assert ! node.new_record?, 'Not a new record'
+    assert_equal node[:id], node.get_section_id
+    assert_equal nodes_id(:zena), node[:section_id]
+    child = secure!(Page) { Page.create(:parent_id=>node[:id], :name=>'child')}
+    assert ! node.new_record?, "Not a new record"
+    assert_equal node[:id], child[:section_id]
+  end
+
+  def test_update_set_section_id_on_update
+    login(:tiger)
+    node = secure!(Section) { Section.find(nodes_id(:people))}
+    assert_equal nodes_id(:people), node.get_section_id
+    node[:parent_id] = nodes_id(:zena)
+    assert node.save, 'Can save node'
+    node.reload
+    assert_equal nodes_id(:people), node.get_section_id
+    assert_equal nodes_id(:zena), node[:section_id]
+    node[:section_id] = nodes_id(:zena)
+    assert node.save, 'Can save node'
+    node.reload
+    assert_equal nodes_id(:people), node.get_section_id
+    assert_equal nodes_id(:zena), node[:section_id]
+  end
+end

data/test/unit/secure_test.rb

@@ -0,0 +1,939 @@
+require 'test_helper'
+
+class SecureTest < Zena::Unit::TestCase
+
+  def create_simple_note(opts={})
+    login(opts[:login] || :ant)
+    # create new node
+    attrs =  {
+      :name => 'hello',
+      :parent_id   => nodes_id(:cleanWater)
+    }.merge(opts[:node] || {})
+
+    node = secure!(Note) { Note.create(attrs) }
+
+    ref  = secure!(Node) { Node.find_by_id(attrs[:parent_id])}
+
+    [node, ref]
+  end
+
+  context 'A class path (kpath)' do
+    should 'represent the class hierarchy' do
+      assert_equal 'N', Node.kpath
+      assert_equal 'NP', Page.kpath
+      assert_equal 'U', PagerDummy.ksel
+      assert_equal 'NU', PagerDummy.kpath
+      assert_equal 'NUS', SubPagerDummy.kpath
+    end
+  end
+
+  context 'A visitor not in any access groups of a node' do
+    setup do
+      login(:anon)
+    end
+
+    should 'raise an exception when trying to find the node with secure! read scope' do
+      assert_raise(ActiveRecord::RecordNotFound) { secure!(Node) { nodes(:secret) }}
+    end
+
+    should 'raise an exception when trying to find the node with secure! write scope' do
+      assert_raise(ActiveRecord::RecordNotFound) { secure_write!(Node) { nodes(:secret) }}
+    end
+
+    should 'raise an exception when trying to find the node with secure! drive scope' do
+      assert_raise(ActiveRecord::RecordNotFound) { secure_drive!(Node) { nodes(:secret) }}
+    end
+
+    should 'receive nil when calling secure read' do
+      node = nil
+      assert_nothing_raised { node = secure(Node) { nodes(:secret) }}
+      assert_nil node
+    end
+
+    should 'receive nil when calling secure write' do
+      node = nil
+      assert_nothing_raised { node = secure_write(Node) { nodes(:secret) }}
+      assert_nil node
+    end
+
+    should 'receive nil when calling secure drive' do
+      node = nil
+      assert_nothing_raised { node = secure_drive(Node) { nodes(:secret) }}
+      assert_nil node
+    end
+
+    should 'receive 0 when counting nodes with any secure scope' do
+      assert_equal 0, secure!(Node)       { Node.count(:conditions => ['id = ?', nodes_id(:secret)])}
+      assert_equal 0, secure(Node)        { Node.count(:conditions => ['id = ?', nodes_id(:secret)])}
+      assert_equal 0, secure_write!(Node) { Node.count(:conditions => ['id = ?', nodes_id(:secret)])}
+      assert_equal 0, secure_write(Node)  { Node.count(:conditions => ['id = ?', nodes_id(:secret)])}
+      assert_equal 0, secure_drive!(Node) { Node.count(:conditions => ['id = ?', nodes_id(:secret)])}
+      assert_equal 0, secure_drive(Node)  { Node.count(:conditions => ['id = ?', nodes_id(:secret)])}
+    end
+
+    context 'loaded without secure' do
+      setup do
+        @node = nodes(:secret)
+        @visitor.visit(@node)
+      end
+
+      should 'receive false when asking can_read?' do
+        assert !@node.can_read?
+      end
+
+      should 'receive false when asking can_write?' do
+        assert !@node.can_write?
+      end
+
+      should 'receive false when asking can_drive?' do
+        assert !@node.can_drive?
+      end
+    end
+  end # A visitor not in any access groups
+
+  context 'A visitor counting nodes' do
+    setup do
+      login(:ant)
+    end
+
+    should 'only see nodes where she is a member of the read group when using secure' do
+      # 'strange' not seen
+      assert_equal 4, secure!(Node) { Node.count(:conditions => ['parent_id = ?', nodes_id(:collections)])}
+      assert_equal 4, secure(Node)  { Node.count(:conditions => ['parent_id = ?', nodes_id(:collections)])}
+    end
+
+    should 'only see nodes where she is a member of the write group when using secure_write' do
+      assert_equal 4, secure_write!(Node) { Node.count(:conditions => ['parent_id = ?', nodes_id(:collections)])}
+      assert_equal 4, secure_write(Node)  { Node.count(:conditions => ['parent_id = ?', nodes_id(:collections)])}
+    end
+
+    should 'only see nodes where she is a member of the drive group when using secure_drive' do
+      assert_equal 1, secure_drive!(Node) { Node.count(:conditions => ['parent_id = ?', nodes_id(:collections)])}
+      assert_equal 1, secure_drive(Node)  { Node.count(:conditions => ['parent_id = ?', nodes_id(:collections)])}
+    end
+
+    should 'see redactions if she is a member of the write group' do
+      assert_equal 7, secure(Node) { Node.count(:conditions => ['parent_id = ?', nodes_id(:cleanWater)])}
+    end
+
+    should 'not see the node even if she is the owner' do
+      # 'proposition' in secret not seen
+      assert_equal 1, secure(Node) { Node.count(:conditions => ['parent_id = ?', nodes_id(:secret)])}
+    end
+  end # A visitor counting nodes
+
+  context 'A visitor only in the read group' do
+    setup do
+      login(:anon)
+    end
+
+    should 'not see a node that is not published yet' do
+      assert_nil secure(Node) { nodes(:crocodiles) }
+    end
+
+    should 'see published nodes' do
+      assert node = secure(Node) { nodes(:cleanWater) }
+    end
+
+    context 'trying to see a future publication' do
+      setup do
+        set_date(:status, :days => 1, :fld => 'publish_from')
+      end
+
+      should 'see nothing' do
+        assert_nil secure(Node) { nodes(:status) }
+      end
+    end
+  end # A visitor only in the read group
+
+
+  context 'A visitor only in the write group' do
+    setup do
+      login(:ant)
+      ids = [:bananas, :crocodiles].map {|r| nodes_id(r)}.join(',')
+      Node.connection.execute "UPDATE nodes SET rgroup_id = #{groups_id(:managers)}, wgroup_id = #{groups_id(:workers)}, dgroup_id = #{groups_id(:managers)} WHERE id IN (#{ids})"
+    end
+
+    should 'see a node that is not published yet' do
+      assert secure(Node) { nodes(:crocodiles) }
+    end
+
+    should 'see published nodes' do
+      assert secure(Node) { nodes(:bananas) }
+    end
+
+    context 'that is a user' do
+      should 'be allowed to write redactions' do
+        node = secure(Node) { nodes(:bananas) }
+        assert node.can_write?
+        assert node.update_attributes(:v_title => 'max havelaar')
+        node = secure(Node) { nodes(:bananas) } # reload
+        assert_equal 'max havelaar', node.version.title
+      end
+    end
+
+    context 'that is not a user' do
+      setup do
+        visitor.status = User::Status[:commentator]
+      end
+
+      should 'not be allowed to write redactions' do
+        node = secure(Node) { nodes(:bananas) }
+        assert !node.can_write?
+        assert !node.update_attributes(:v_title => 'max havelaar')
+      end
+
+      should 'see a node that is not published yet' do
+        assert secure(Node) { nodes(:crocodiles) }
+      end
+    end
+
+    context 'trying to see a future publication' do
+      setup do
+        set_date(:bananas, :days => 1, :fld => 'publish_from')
+      end
+
+      should 'see it' do
+        assert secure(Node) { nodes(:bananas) }
+      end
+    end
+  end # A visitor only in the write group
+
+  context 'A visitor only in the drive group' do
+    setup do
+      login(:ant)
+      ids = [:bananas, :crocodiles].map {|r| nodes_id(r)}.join(',')
+      Node.connection.execute "UPDATE nodes SET rgroup_id = #{groups_id(:managers)}, wgroup_id = #{groups_id(:managers)}, dgroup_id = #{groups_id(:workers)} WHERE id IN (#{ids})"
+    end
+
+    should 'not see a node that is not published yet' do
+      assert_nil secure(Node) { nodes(:crocodiles) }
+    end
+
+    should 'not see published nodes' do
+      assert_nil secure(Node) { nodes(:bananas) }
+    end
+  end # A visitor only in the drive group
+
+  context 'A visitor in the read and drive groups' do
+    setup do
+      login(:ant)
+      ids = [:bananas, :crocodiles].map {|r| nodes_id(r)}.join(',')
+      Node.connection.execute "UPDATE nodes SET rgroup_id = #{groups_id(:workers)}, wgroup_id = #{groups_id(:managers)}, dgroup_id = #{groups_id(:workers)} WHERE id IN (#{ids})"
+    end
+
+    should 'not be allowed to write' do
+      node = secure!(Node) { nodes(:bananas) }
+      assert !node.can_write?
+      assert !node.update_attributes(:v_title => 'Banana republic')
+      assert_equal 'You do not have the rights to edit.', node.errors[:base]
+    end
+
+    should 'not be allowed to create sub-nodes' do
+      node = secure!(Node) { Node.create(defaults.merge(:parent_id => nodes_id(:bananas))) }
+      assert node.new_record?
+      assert_equal 'You do not have the rights to edit.', node.errors[:base]
+    end
+
+    should 'be allowed to drive' do
+      node = secure!(Node) { nodes(:bananas) }
+      assert node.can_drive?
+      assert node.update_attributes(:name => 'NamWa')
+    end
+  end # A visitor in the read and drive groups
+
+
+  def defaults
+    { :name       => 'hello',
+      :parent_id  => nodes_id(:zena) }
+  end
+
+  context 'A visitor in the read and write groups' do
+    setup do
+      login(:ant)
+    end
+
+    context 'without secure' do
+      should 'not be allowed to build new children' do
+        node = Node.new(defaults)
+        assert !node.save
+        assert_equal 'record not secured', node.errors[:base]
+      end
+
+      should 'not be allowed to create new children' do
+        node = Node.create(defaults)
+        assert node.new_record?
+        assert_equal 'record not secured', node.errors[:base]
+      end
+    end
+
+    should 'be allowed to build children nodes' do
+      node = secure(Node) { Node.new(defaults) }
+      assert_difference('Node.count', 1) do
+        assert_difference('Version.count', 1) do
+          assert node.save
+        end
+      end
+    end
+
+    should 'be allowed to create child nodes' do
+      assert_difference('Node.count', 1) do
+        assert_difference('Version.count', 1) do
+          assert node = secure(Node) { Node.create(defaults) }
+          assert !node.new_record?
+        end
+      end
+    end
+
+    should 'not be allowed to create child nodes with custom rights' do
+      node = secure(Node) { Node.create(defaults.merge(:inherit => 0, :wgroup_id => groups_id(:public))) }
+      assert node.new_record?
+      assert node.errors[:inherit]
+      assert node.errors[:wgroup_id]
+    end
+
+    context 'creating a new node' do
+      setup do
+        @node = secure(Node) { Node.create(defaults) }
+      end
+
+      should 'become owner of node and version' do
+        assert_equal visitor.id, @node.user_id
+        assert_equal visitor.id, @node.version.user_id
+      end
+
+      should 'see a draft' do
+        assert @node.draft?
+      end
+    end
+  end # A visitor in the read and write groups
+
+  context 'A visitor in the drive group' do
+    setup do
+      login(:tiger)
+    end
+
+    should 'be allowed to move node' do
+      node = secure!(Node) { nodes(:projects) }
+      node.parent_id = nodes_id(:collections)
+      assert node.save
+    end
+
+    should 'not be allowed to move published node in a parent when she does not have drive rights' do
+      login(:ant)
+      node = secure!(Node) { nodes(:bird_jpg) }
+      assert !node.update_attributes(:parent_id => nodes_id(:cleanWater))
+      assert_equal 'invalid reference', node.errors[:parent_id]
+    end
+
+    should 'not be allowed to move published node out of a parent in which she does not have drive rights' do
+      login(:ant)
+      node = secure!(Node) { nodes(:talk) }
+      assert !node.update_attributes(:parent_id => nodes_id(:wiki))
+      assert_equal 'invalid reference', node.errors[:parent_id]
+    end
+
+    should 'not be allowed to set nil parent' do
+      login(:ant)
+      node = secure!(Node) { nodes(:talk) }
+      assert !node.update_attributes(:parent_id => nil)
+      assert_equal 'invalid reference', node.errors[:parent_id]
+    end
+
+    should 'not be allowed to set bad parent' do
+      login(:ant)
+      node = secure!(Node) { nodes(:talk) }
+      assert !node.update_attributes(:parent_id => nodes_id(:secret))
+      assert_equal 'invalid reference', node.errors[:parent_id]
+    end
+
+    should 'not be allowed to create circular references' do
+      # status is a child of projects/cleanWater
+      node = secure!(Node) { nodes(:projects) }
+      assert !node.update_attributes(:parent_id => nodes_id(:status))
+      assert_equal 'circular reference', node.errors[:parent_id]
+    end
+
+    should 'not be allowed to insert into an existing circular reference' do
+      Node.connection.execute "UPDATE nodes SET parent_id = #{nodes_id(:cleanWater)} WHERE id=#{nodes_id(:projects)}"
+      node = secure!(Node) { nodes(:status)  }
+      assert !node.update_attributes(:parent_id => nodes_id(:projects))
+      assert_equal 'circular reference', node.errors[:parent_id]
+    end
+
+    should 'be allowed to change groups even if she has no rights in the parent' do
+      login(:ant) # does not have any rights on talk's parent node (secret)
+      node = secure!(Node) { nodes(:talk) }
+      node.update_attributes(:dgroup_id => groups_id(:public))
+    end
+
+    should 'be allowed to create with custom groups' do
+      node = secure!(Node) { Node.create(defaults.merge(:inherit => 0, :rgroup_id => groups_id(:managers))) }
+      assert !node.new_record?
+      assert_equal groups_id(:managers), node.rgroup_id
+    end
+
+    should 'be allowed to create with custom groups without setting inherit' do
+      node = secure!(Node) { Node.create(defaults.merge(:rgroup_id => groups_id(:managers))) }
+      assert !node.new_record?
+      assert_equal groups_id(:managers), node.rgroup_id
+    end
+
+    should 'not be allowed create with bad groups' do
+      node = secure!(Node) { Node.create(defaults.merge(:inherit => 0, :rgroup_id => groups_id(:admin))) }
+      assert node.new_record?
+      assert_equal 'unknown group', node.errors[:rgroup_id]
+    end
+
+    should 'not be allowed to create with a bad inheritance mode' do
+      node = secure!(Node) { Node.create(defaults.merge(:inherit => 3, :rgroup_id => groups_id(:public))) }
+      assert node.new_record?
+      assert_equal 'bad inheritance mode', node.errors[:inherit]
+    end
+
+    should 'not be allowed to set a bad inheritance mode' do
+      node = secure!(Node) { nodes(:status) }
+      assert !node.update_attributes(:inherit => 3)
+      assert_equal 'bad inheritance mode', node.errors[:inherit]
+    end
+
+    should 'not be allowed to set a read group she is not in' do
+      node = secure!(Node) { nodes(:status) }
+      assert !node.update_attributes(:inherit => 0, :rgroup_id => groups_id(:admin))
+      assert_equal 'unknown group', node.errors[:rgroup_id]
+    end
+
+    should 'not be allowed to set a write group she is not in' do
+      node = secure!(Node) { nodes(:status) }
+      assert !node.update_attributes(:inherit => 0, :wgroup_id => groups_id(:admin))
+      assert_equal 'unknown group', node.errors[:wgroup_id]
+    end
+
+    should 'not be allowed to set a drive group she is not in' do
+      node = secure!(Node) { nodes(:status) }
+      assert !node.update_attributes(:inherit => 0, :dgroup_id => groups_id(:admin))
+      assert_equal 'unknown group', node.errors[:dgroup_id]
+    end
+
+    should 'not change group without explicitely changing inherit mode' do
+      node = secure!(Node) { nodes(:status) }
+      assert !node.update_attributes(:rgroup_id => groups_id(:managers))
+      assert_equal 'cannot be changed without changing inherit mode', node.errors[:rgroup_id]
+    end
+
+    should 'not be allowed to set nil on groups' do
+      node = secure!(Node) { nodes(:status) }
+      assert !node.update_attributes(:rgroup_id => nil, :inherit => 0)
+      assert_equal 'unknown group', node.errors[:rgroup_id]
+    end
+
+    should 'not be allowed to set publish_from' do
+      node = secure!(Node) { nodes(:lake)  }
+      old = node.publish_from
+      assert node.update_attributes(:publish_from => Time.now)
+      assert_equal old, node.publish_from
+    end
+
+    should 'be allowed to remove empty node' do
+      node = secure!(Node) { nodes(:lake) }
+      assert node.empty?
+      assert node.destroy
+    end
+
+    should 'not be allowed to remove node with children' do
+      node = secure!(Node) { nodes(:wiki)}
+      assert !node.empty?
+      assert !node.destroy
+      assert_equal 'cannot be removed (contains subpages or data)', node.errors[:base]
+    end
+  end # A visitor in the drive group
+
+  context 'A visitor not in the drive group, not on a draft' do
+    setup do
+      login(:ant)
+      @node = secure!(Node) { nodes(:status) }
+    end
+
+    should 'not be a draft' do
+      assert !@node.draft?
+    end
+
+    should 'not be allowed to drive' do
+      assert !@node.can_drive?
+    end
+
+    should 'not be allowed to change groups' do
+      @node.dgroup_id = groups_id(:public)
+      assert !@node.save
+      assert_equal 'You do not have the rights to do this.', @node.errors[:base]
+    end
+
+    should 'not be allowed to change name' do
+      @node.name = 'slitherin'
+      assert !@node.save
+      assert_equal 'You do not have the rights to do this.', @node.errors[:base]
+    end
+
+    should 'not be allowed to change dates' do
+      @node.event_at = Time.now
+      assert !@node.save
+      assert_equal 'You do not have the rights to do this.', @node.errors[:base]
+    end
+
+    should 'not be allowed to destroy' do
+      assert !@node.destroy
+      assert_equal 'You do not have the rights to do this.', @node.errors[:base]
+    end
+  end
+
+  context 'A node readable by anonymous' do
+
+    context 'that is not yet published' do
+      setup do
+        login(:ant)
+        @node = secure!(Node) { nodes(:crocodiles) }
+      end
+
+      should 'not be public' do
+        assert !@node.public?
+      end
+    end
+
+    context 'that is published' do
+      setup do
+        login(:ant)
+        @node = secure!(Node) { nodes(:status) }
+      end
+
+      should 'be public' do
+        assert @node.public?
+      end
+
+      should 'not be public if publication date is not reached yet' do
+        @node.publish_from = Time.now.advance(:days => 1)
+        assert !@node.public?
+      end
+    end
+  end
+
+  context 'A draft' do
+    setup do
+      login(:ant)
+      @node, ref = create_simple_note
+    end
+
+    should 'be a draft' do
+      assert @node.draft?
+    end
+
+    should 'let owner drive' do
+      assert @node.can_drive?
+    end
+
+    should 'not let owner publish' do
+      assert !@node.can_publish?
+      assert !@node.update_attributes(:v_status => Zena::Status[:pub])
+      assert_equal 'You do not have the rights to publish.', @node.errors[:base]
+    end
+
+    should 'should be in inherit mode' do
+      assert_equal 1, @node.inherit
+    end
+
+    should 'not let owner change inherit mode' do
+      @node[:inherit] = 0
+      assert !@node.save
+      assert_equal 'cannot be changed', @node.errors[:inherit]
+    end
+
+    should 'not let owner change groups' do
+      assert !@node.update_attributes(:rgroup_id => groups_id(:workers))
+      assert_equal 'cannot be changed', @node.errors[:rgroup_id]
+    end
+
+    should 'be freely moved around by owner' do
+      @node.parent_id = nodes_id(:status)
+      assert @node.save
+      assert_equal nodes_id(:status), @node.parent_id
+    end
+
+    should 'let owner remove version and destroy itself' do
+      assert @node.can_remove?
+      assert @node.remove
+      assert_difference('Node.count', -1) do
+        assert @node.destroy_version
+      end
+    end
+  end # A draft
+
+  context 'A draft with children' do
+    setup do
+      node_ids = [:wiki,:bird_jpg,:flower_jpg].map{|k| nodes_id(k)}.join(',')
+      login(:ant)
+      Version.connection.execute "UPDATE versions SET status = #{Zena::Status[:red]}, user_id=#{users_id(:ant)} WHERE node_id IN (#{node_ids})"
+      Node.connection.execute "UPDATE nodes SET publish_from = NULL WHERE id IN (#{node_ids})"
+      @node = secure!(Node) { nodes(:wiki) }
+    end
+
+    should 'be freely moved around by owner' do
+      @node.parent_id = nodes_id(:status)
+      assert @node.save
+      assert_equal nodes_id(:status), @node.parent_id
+    end
+
+    should 'not be freely moved around by owner if it contains publications' do
+      Node.connection.execute "UPDATE nodes SET publish_from = '2009-9-26 20:26' WHERE id IN (#{nodes_id(:bird_jpg)})"
+      @node.parent_id = nodes_id(:status)
+      assert @node.send(:published_in_heirs_was_true?)
+      assert !@node.save
+      assert_equal 'invalid reference', @node.errors[:parent_id]
+    end
+
+    should 'not be freely moved around by owner if it contains deeply nested publications' do
+      Node.connection.execute "UPDATE nodes SET parent_id = #{nodes_id(:bird_jpg)} WHERE id IN (#{nodes_id(:status)})"
+      @node.parent_id = nodes_id(:status)
+      assert @node.send(:published_in_heirs_was_true?)
+      assert !@node.save
+      assert_equal 'invalid reference', @node.errors[:parent_id]
+    end
+  end # A draft with children
+
+  context 'A node with children' do
+    setup do
+      login(:tiger)
+      @node = secure!(Node) { nodes(:cleanWater) }
+    end
+
+    should 'update inheriting children groups on group change' do
+      assert @node.update_attributes(:inherit => 0, :rgroup_id => groups_id(:workers))
+      assert_equal groups_id(:workers), @node.rgroup_id
+      # children
+      assert_equal groups_id(:workers), nodes(:status).rgroup_id
+      assert_equal groups_id(:workers), nodes(:water_pdf).rgroup_id
+      # grandchildren
+      assert_equal groups_id(:workers), nodes(:lake_jpg).rgroup_id
+      # not inherited
+      assert_equal groups_id(:managers), nodes(:bananas).rgroup_id
+    end
+
+    should 'update inheriting children groups on parent change' do
+      assert @node.update_attributes(:parent_id => nodes_id(:wiki))
+      assert_equal groups_id(:public), @node.rgroup_id
+      # children
+      assert_equal groups_id(:public), nodes(:status).rgroup_id
+      assert_equal groups_id(:public), nodes(:water_pdf).rgroup_id
+      # grandchildren
+      assert_equal groups_id(:public), nodes(:lake_jpg).rgroup_id
+      assert_equal groups_id(:public), nodes(:lake_jpg).wgroup_id
+      assert_equal groups_id(:public), nodes(:lake_jpg).dgroup_id
+      # not inherited
+      assert_equal groups_id(:managers), nodes(:bananas).rgroup_id
+    end
+
+    should 'update inheriting children skin on skin change' do
+      assert @node.update_attributes(:inherit => 0, :skin => 'wikiSkin')
+      assert_equal 'wikiSkin', @node.skin
+      # children
+      assert_equal 'wikiSkin', nodes(:status).skin
+      assert_equal 'wikiSkin', nodes(:water_pdf).skin
+      # grandchildren
+      assert_equal 'wikiSkin', nodes(:lake_jpg).skin
+      # not inherited
+      assert_equal 'default', nodes(:bananas).skin
+    end
+
+    should 'update inheriting children skin on parent change' do
+      assert @node.update_attributes(:parent_id => nodes_id(:wiki))
+      assert_equal 'wikiSkin', @node.skin
+      # children
+      assert_equal 'wikiSkin', nodes(:status).skin
+      assert_equal 'wikiSkin', nodes(:water_pdf).skin
+      # grandchildren
+      assert_equal 'wikiSkin', nodes(:lake_jpg).skin
+      # not inherited
+      assert_equal 'default', nodes(:bananas).skin
+    end
+  end # A node with children
+
+  context 'Changing node owner' do
+    should 'not be allowed if visitor is not an admin' do
+      login(:tiger)
+      node = secure!(Node) { nodes(:status) }
+      assert !node.update_attributes(:user_id => users_id(:tiger))
+      assert_equal 'Only admins can change owners', node.errors[:user_id]
+    end
+
+    context 'by an admin' do
+      setup do
+        login(:lion)
+      end
+
+      should 'not be allowed if new user is not valid' do
+        node = secure!(Node) { nodes(:status) }
+        assert !node.update_attributes(:user_id => users_id(:whale)) # not in site
+        assert_equal 'unknown user', node.errors[:user_id]
+      end
+
+      should 'be allowed if new user is valid' do
+        node = secure!(Node) { nodes(:status) }
+        assert node.update_attributes(:user_id => users_id(:tiger)) # not in site
+        assert_equal users_id(:tiger), node.user_id
+      end
+    end
+  end # Changing node owner
+
+  context 'Finding users' do
+    setup do
+      login(:ant)
+    end
+
+    context 'with secure!' do
+      should 'raise an exception for users not in the same site' do
+        assert_raise(ActiveRecord::RecordNotFound) { secure!(User) { users(:whale) }}
+      end
+
+      should 'be allowed for users in the same site' do
+        assert user = secure!(User) { users(:tiger) }
+        assert_equal users_id(:tiger), user.id
+      end
+    end
+
+    context 'with secure' do
+      should 'receive nil for users not in the same site' do
+        node = nil
+        assert_nothing_raised { node = secure(User) { users(:whale) }}
+        assert_nil node
+      end
+
+      should 'be allowed for users in the same site' do
+        assert user = secure(User) { users(:tiger) }
+        assert_equal users_id(:tiger), user.id
+      end
+    end
+  end # Finding users
+
+  context 'Finding sites' do
+    setup do
+      login(:ant)
+    end
+
+    context 'with secure!' do
+      should 'raise an exception for other sites' do
+        assert_raise(ActiveRecord::RecordNotFound) { secure!(Site) { sites(:ocean) }}
+      end
+
+      should 'be allowed for current site' do
+        assert site = secure!(Site) { sites(:zena) }
+        assert_equal sites_id(:zena), site.id
+      end
+    end
+
+    context 'with secure' do
+      should 'receive nil for other sites' do
+        site = nil
+        assert_nothing_raised { site = secure(Site) { sites(:ocean) }}
+        assert_nil site
+      end
+
+      should 'be allowed for current site' do
+        assert site = secure(Site) { sites(:zena) }
+        assert_equal sites_id(:zena), site.id
+      end
+    end
+  end # Finding sites
+
+  context 'Finding versions' do
+    setup do
+      login(:ant)
+    end
+
+    context 'with secure' do
+      should 'only return versions where visitor can read or write' do
+        versions = secure(Version) { Version.find(:all, :conditions => "title like 's%'")}
+        # not ["Stranger in the night", "Secret"]
+        assert_equal ["super ouverture", "Skins (layout themes)", "status title", "style", "Solenopsis Invicta"],
+                     versions.map{|v| v.title}
+      end
+    end
+
+    context 'with secure_write' do
+      should 'only return versions where visitor can write' do
+        Node.connection.execute "UPDATE nodes SET wgroup_id = #{groups_id(:admin)} WHERE id = #{nodes_id(:status)}"
+        versions = secure_write(Version) { Version.find(:all, :conditions => "title like 's%'")}
+        # not ["Stranger in the night", "Secret", "status title"]
+        assert_equal ["super ouverture", "Skins (layout themes)", "style", "Solenopsis Invicta"],
+                     versions.map{|v| v.title}
+      end
+    end
+
+    context 'with secure_drive' do
+      should 'only return versions where visitor can drive' do
+        Node.connection.execute "UPDATE nodes SET dgroup_id = #{groups_id(:workers)} WHERE id = #{nodes_id(:status)}"
+        versions = secure_drive(Version) { Version.find(:all, :conditions => "title like 's%'")}
+        assert_equal 2, versions.count
+        assert_equal ['Stranger in the night', 'status title'],
+                     versions.map {|v| v.title }.sort
+      end
+    end
+  end # Finding versions
+
+  context 'Using secure without returning Nodes' do
+    should 'not raise any exception' do
+      hash = nil
+      assert_nothing_raised { hash = secure!(Node) { Hash[:a, 'a', :b, 'b'] } }
+      assert_kind_of Hash, hash
+    end
+  end # Using secure without returning Nodes
+
+  context 'Using clean_options to prepare queries' do
+    should 'remove anything that might disturb ActiveRecord' do
+      assert_equal Hash[:conditions => ['id = ?', 3], :order => 'name ASC'], Node.clean_options(:conditions => ['id = ?', 3], :funky => 'bad', :order => 'name ASC', :from => 'users')
+    end
+  end # Using clean_options to prepare queries
+
+  context 'A visitor with admin status' do
+    setup do
+      login(:lion)
+      @node = secure!(Node) { nodes(:status) }
+    end
+
+    should 'belong to all groups' do
+      assert_equal secure(Group) { Group.count(:all) }, visitor.group_ids.count
+    end
+
+    should 'belong to all groups even if we remove all explicit belongings' do
+      User.connection.execute "DELETE FROM groups_users WHERE user_id = #{users_id(:lion)}"
+      login(:lion)
+      assert_equal secure(Group) { Group.count(:all) }, visitor.group_ids.count
+    end
+
+    should 'be allowed to drive' do
+      assert @node.update_attributes(:parent_id => nodes_id(:wiki))
+    end
+
+    should 'be allowed to write' do
+      assert @node.update_attributes(:v_title => 'Drosophila')
+    end
+  end # A visitor with admin status
+
+  context 'A visitor with user status' do
+    setup do
+      login(:tiger)
+      @node = secure!(Node) { nodes(:status) }
+    end
+
+    should 'be allowed to drive' do
+      assert @node.update_attributes(:parent_id => nodes_id(:wiki))
+    end
+
+    should 'be allowed to write' do
+      assert @node.update_attributes(:v_title => 'Drosophila')
+    end
+
+    should 'be allowed to post comments' do
+      assert_difference('Comment.count', 1) do
+        @node.update_attributes(:m_title => 'changed icon', :m_text => 'new icon is "flower"')
+        err @node
+        comment = @node.comments.last
+        assert_equal 'changed icon', comment.title
+        assert_equal Zena::Status[:pub], comment.status
+      end
+    end
+  end # A visitor with user status
+
+  context 'A visitor with commentator status' do
+    setup do
+      User.connection.execute "UPDATE users SET status = #{User::Status[:commentator]} WHERE id = #{users_id(:tiger)} AND site_id = #{sites_id(:zena)}"
+      login(:tiger)
+      @node = secure!(Node) { nodes(:status) }
+    end
+
+    should 'not be allowed to drive' do
+      assert !@node.update_attributes(:parent_id => nodes_id(:wiki))
+      assert_equal 'You do not have the rights to do this.', @node.errors[:base]
+    end
+
+    should 'not be allowed to write' do
+      assert !@node.update_attributes(:v_title => 'Drosophila')
+      assert_equal 'You do not have the rights to edit.', @node.errors[:base]
+    end
+
+    should 'be allowed to post comments' do
+      assert_difference('Comment.count', 1) do
+        assert @node.update_attributes(:m_title => 'changed icon', :m_text => 'new icon is "flower"')
+        comment = @node.comments.last
+        assert_equal 'changed icon', comment.title
+        assert_equal Zena::Status[:pub], comment.status
+      end
+    end
+  end # A visitor with commentator status
+
+  context 'A visitor with moderated status' do
+    setup do
+      User.connection.execute "UPDATE users SET status = #{User::Status[:moderated]} WHERE id = #{users_id(:tiger)} AND site_id = #{sites_id(:zena)}"
+      login(:tiger)
+      @node = secure!(Node) { nodes(:status) }
+    end
+
+    should 'be a commentator' do
+      visitor.commentator?
+    end
+
+    should 'have moderated comments' do
+      visitor.moderated?
+    end
+
+    should 'not be allowed to drive' do
+      assert !@node.update_attributes(:parent_id => nodes_id(:wiki))
+      assert_equal 'You do not have the rights to do this.', @node.errors[:base]
+    end
+
+    should 'not be allowed to write' do
+      assert !@node.update_attributes(:v_title => 'Drosophila')
+      assert_equal 'You do not have the rights to edit.', @node.errors[:base]
+    end
+
+    should 'be allowed to post moderated comments' do
+      assert_difference('Comment.count', 1) do
+        assert @node.update_attributes(:m_title => 'changed icon', :m_text => 'new icon is "flower"')
+        comment = @node.discussion.comments(:with_prop => true).last
+        assert_equal 'changed icon', comment.title
+        assert_equal Zena::Status[:prop], comment.status
+      end
+    end
+  end # A visitor with moderated status
+
+  context 'A visitor with reader status' do
+    setup do
+      User.connection.execute "UPDATE users SET status = #{User::Status[:reader]} WHERE id = #{users_id(:tiger)} AND site_id = #{sites_id(:zena)}"
+      login(:tiger)
+      @node = secure!(Node) { nodes(:status) }
+    end
+
+    should 'not be allowed to drive' do
+      assert !@node.update_attributes(:parent_id => nodes_id(:wiki))
+      assert_equal 'You do not have the rights to do this.', @node.errors[:base]
+    end
+
+    should 'not be allowed to write' do
+      assert !@node.update_attributes(:v_title => 'Drosophila')
+      assert_equal 'You do not have the rights to edit.', @node.errors[:base]
+    end
+
+    should 'not be allowed to post comments' do
+      assert !@node.update_attributes(:m_title => 'changed icon', :m_text => 'new icon is "flower"')
+      assert_equal 'You do not have the rights to post comments.', @node.errors[:base]
+    end
+  end # A visitor with reader status
+
+  context 'A visitor with deleted status' do
+    setup do
+      User.connection.execute "UPDATE users SET status = #{User::Status[:deleted]} WHERE id = #{users_id(:tiger)} AND site_id = #{sites_id(:zena)}"
+    end
+
+    should 'not be able to login' do
+      login(:tiger)
+      assert_equal users(:anon), visitor
+    end
+  end # A visitor with deleted status
+end