Skip to content

Commit 334b017

Browse files
pefernanpefernan
committed
incubator-kie-issues#1388: UserTasks without Actors/Groups assignments can transition to any phase without checking any security policy
1 parent e79f1b5 commit 334b017

File tree

4 files changed

+62
-19
lines changed

4 files changed

+62
-19
lines changed

‎kogito-quarkus-examples/flexible-process-quarkus/src/main/resources/service-desk.bpmn

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
<bpmn2:definitions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:bpmn2="http://www.omg.org/spec/BPMN/20100524/MODEL" xmlns:bpmndi="http://www.omg.org/spec/BPMN/20100524/DI" xmlns:bpsim="http://www.bpsim.org/schemas/1.0" xmlns:dc="http://www.omg.org/spec/DD/20100524/DC" xmlns:di="http://www.omg.org/spec/DD/20100524/DI" xmlns:drools="http://www.jboss.org/drools" id="_fswpMKJxEDiZN4UVlvQdCA" exporter="jBPM Process Modeler" exporterVersion="2.0" targetNamespace="http://www.omg.org/bpmn20">
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<bpmn2:definitions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:bpmn2="http://www.omg.org/spec/BPMN/20100524/MODEL" xmlns:bpmndi="http://www.omg.org/spec/BPMN/20100524/DI" xmlns:bpsim="http://www.bpsim.org/schemas/1.0" xmlns:dc="http://www.omg.org/spec/DD/20100524/DC" xmlns:di="http://www.omg.org/spec/DD/20100524/DI" xmlns:drools="http://www.jboss.org/drools" id="_pNgJkCgBED20EbaiDTNDeg" xsi:schemaLocation="http://www.omg.org/spec/BPMN/20100524/MODEL BPMN20.xsd http://www.jboss.org/drools drools.xsd http://www.bpsim.org/schemas/1.0 bpsim.xsd http://www.omg.org/spec/DD/20100524/DC DC.xsd http://www.omg.org/spec/DD/20100524/DI DI.xsd " exporter="jBPM Process Modeler" exporterVersion="2.0" targetNamespace="http://www.omg.org/bpmn20">
23
<bpmn2:itemDefinition id="_supportCaseItem" structureRef="org.kie.kogito.flexible.example.model.SupportCase"/>
34
<bpmn2:itemDefinition id="_supportGroupItem" structureRef="String"/>
45
<bpmn2:itemDefinition id="_commentItem" structureRef="org.kie.kogito.flexible.example.model.Comment"/>
@@ -499,11 +500,13 @@
499500
<bpmn2:ioSpecification>
500501
<bpmn2:dataInput id="_AD768963-CBF7-4269-9D43-51FE0D5D2556_TaskNameInputX" drools:dtype="Object" itemSubjectRef="__AD768963-CBF7-4269-9D43-51FE0D5D2556_TaskNameInputXItem" name="TaskName"/>
501502
<bpmn2:dataInput id="_AD768963-CBF7-4269-9D43-51FE0D5D2556_SkippableInputX" drools:dtype="Object" itemSubjectRef="__AD768963-CBF7-4269-9D43-51FE0D5D2556_SkippableInputXItem" name="Skippable"/>
503+
<bpmn2:dataInput id="_AD768963-CBF7-4269-9D43-51FE0D5D2556_GroupIdInputX" drools:dtype="Object" itemSubjectRef="__AD768963-CBF7-4269-9D43-51FE0D5D2556_GroupIdInputXItem" name="GroupId"/>
502504
<bpmn2:dataOutput id="_AD768963-CBF7-4269-9D43-51FE0D5D2556_evaluationOutputX" drools:dtype="Integer" itemSubjectRef="__AD768963-CBF7-4269-9D43-51FE0D5D2556_evaluationOutputXItem" name="evaluation"/>
503505
<bpmn2:dataOutput id="_AD768963-CBF7-4269-9D43-51FE0D5D2556_commentOutputX" drools:dtype="String" itemSubjectRef="__AD768963-CBF7-4269-9D43-51FE0D5D2556_commentOutputXItem" name="comment"/>
504506
<bpmn2:inputSet>
505507
<bpmn2:dataInputRefs>_AD768963-CBF7-4269-9D43-51FE0D5D2556_TaskNameInputX</bpmn2:dataInputRefs>
506508
<bpmn2:dataInputRefs>_AD768963-CBF7-4269-9D43-51FE0D5D2556_SkippableInputX</bpmn2:dataInputRefs>
509+
<bpmn2:dataInputRefs>_AD768963-CBF7-4269-9D43-51FE0D5D2556_GroupIdInputX</bpmn2:dataInputRefs>
507510
</bpmn2:inputSet>
508511
<bpmn2:outputSet>
509512
<bpmn2:dataOutputRefs>_AD768963-CBF7-4269-9D43-51FE0D5D2556_evaluationOutputX</bpmn2:dataOutputRefs>
@@ -524,6 +527,13 @@
524527
<bpmn2:to xsi:type="bpmn2:tFormalExpression"><![CDATA[_AD768963-CBF7-4269-9D43-51FE0D5D2556_SkippableInputX]]></bpmn2:to>
525528
</bpmn2:assignment>
526529
</bpmn2:dataInputAssociation>
530+
<bpmn2:dataInputAssociation>
531+
<bpmn2:targetRef>_AD768963-CBF7-4269-9D43-51FE0D5D2556_GroupIdInputX</bpmn2:targetRef>
532+
<bpmn2:assignment>
533+
<bpmn2:from xsi:type="bpmn2:tFormalExpression"><![CDATA[customer]]></bpmn2:from>
534+
<bpmn2:to xsi:type="bpmn2:tFormalExpression"><![CDATA[_AD768963-CBF7-4269-9D43-51FE0D5D2556_GroupIdInputX]]></bpmn2:to>
535+
</bpmn2:assignment>
536+
</bpmn2:dataInputAssociation>
527537
<bpmn2:dataOutputAssociation>
528538
<bpmn2:sourceRef>_AD768963-CBF7-4269-9D43-51FE0D5D2556_evaluationOutputX</bpmn2:sourceRef>
529539
<bpmn2:targetRef>evaluation</bpmn2:targetRef>

‎kogito-quarkus-examples/flexible-process-quarkus/src/test/java/org/kie/kogito/flexible/example/quarkus/ServiceDeskProcessTest.java

Lines changed: 18 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,7 @@ private void addSupportComment(String id) {
9494
String location = given()
9595
.basePath(BASE_PATH)
9696
.contentType(ContentType.JSON)
97+
.queryParam("group", "support")
9798
.when()
9899
.post("/{id}/ReceiveSupportComment", id)
99100
.then()
@@ -125,9 +126,11 @@ private void addSupportComment(String id) {
125126

126127
private void addCustomerComment(String id) {
127128
String location = given()
128-
.basePath(BASE_PATH + "/" + id).contentType(ContentType.JSON)
129+
.basePath(BASE_PATH)
130+
.contentType(ContentType.JSON)
131+
.queryParam("group", "customer")
129132
.when()
130-
.post("/ReceiveCustomerComment")
133+
.post("/{id}/ReceiveCustomerComment", id)
131134
.then()
132135
.statusCode(201)
133136
.header("Location", notNullValue())
@@ -156,16 +159,23 @@ private void addCustomerComment(String id) {
156159
}
157160

158161
private void resolveCase(String id) {
159-
given().basePath(BASE_PATH + "/" + id).contentType(ContentType.JSON).when().post("/Resolve_Case").then()
160-
.statusCode(200).body("supportCase.state", is(State.RESOLVED.name()));
162+
given()
163+
.basePath(BASE_PATH)
164+
.contentType(ContentType.JSON)
165+
.when()
166+
.post("/{id}/Resolve_Case", id)
167+
.then()
168+
.statusCode(200)
169+
.body("supportCase.state", is(State.RESOLVED.name()));
161170
}
162171

163172
private void sendQuestionnaire(String id) {
164173
String taskId = given()
165-
.basePath(BASE_PATH + "/" + id)
174+
.basePath(BASE_PATH)
166175
.contentType(ContentType.JSON)
176+
.queryParam("group", "customer")
167177
.when()
168-
.get("/tasks")
178+
.get("/{id}/tasks", id)
169179
.then()
170180
.statusCode(200)
171181
.body("size()", is(1))
@@ -177,13 +187,13 @@ private void sendQuestionnaire(String id) {
177187
params.put("evaluation", 10);
178188

179189
given()
180-
.basePath(BASE_PATH + "/" + id)
190+
.basePath(BASE_PATH)
181191
.queryParam("user", "Paco")
182192
.queryParam("group", "customer")
183193
.contentType(ContentType.JSON)
184194
.when()
185195
.body(params)
186-
.post("/Questionnaire/" + taskId)
196+
.post("/{id}/Questionnaire/{taskId}/", id, taskId)
187197
.then()
188198
.statusCode(200)
189199
.body("supportCase.state", is(State.CLOSED.name()))

‎kogito-springboot-examples/flexible-process-springboot/src/main/resources/service-desk.bpmn

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
<bpmn2:definitions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:bpmn2="http://www.omg.org/spec/BPMN/20100524/MODEL" xmlns:bpmndi="http://www.omg.org/spec/BPMN/20100524/DI" xmlns:bpsim="http://www.bpsim.org/schemas/1.0" xmlns:dc="http://www.omg.org/spec/DD/20100524/DC" xmlns:di="http://www.omg.org/spec/DD/20100524/DI" xmlns:drools="http://www.jboss.org/drools" id="_fswpMKJxEDiZN4UVlvQdCA" exporter="jBPM Process Modeler" exporterVersion="2.0" targetNamespace="http://www.omg.org/bpmn20">
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<bpmn2:definitions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:bpmn2="http://www.omg.org/spec/BPMN/20100524/MODEL" xmlns:bpmndi="http://www.omg.org/spec/BPMN/20100524/DI" xmlns:bpsim="http://www.bpsim.org/schemas/1.0" xmlns:dc="http://www.omg.org/spec/DD/20100524/DC" xmlns:di="http://www.omg.org/spec/DD/20100524/DI" xmlns:drools="http://www.jboss.org/drools" id="_pNgJkCgBED20EbaiDTNDeg" xsi:schemaLocation="http://www.omg.org/spec/BPMN/20100524/MODEL BPMN20.xsd http://www.jboss.org/drools drools.xsd http://www.bpsim.org/schemas/1.0 bpsim.xsd http://www.omg.org/spec/DD/20100524/DC DC.xsd http://www.omg.org/spec/DD/20100524/DI DI.xsd " exporter="jBPM Process Modeler" exporterVersion="2.0" targetNamespace="http://www.omg.org/bpmn20">
23
<bpmn2:itemDefinition id="_supportCaseItem" structureRef="org.kie.kogito.flexible.example.model.SupportCase"/>
34
<bpmn2:itemDefinition id="_supportGroupItem" structureRef="String"/>
45
<bpmn2:itemDefinition id="_commentItem" structureRef="org.kie.kogito.flexible.example.model.Comment"/>
@@ -499,11 +500,13 @@
499500
<bpmn2:ioSpecification>
500501
<bpmn2:dataInput id="_AD768963-CBF7-4269-9D43-51FE0D5D2556_TaskNameInputX" drools:dtype="Object" itemSubjectRef="__AD768963-CBF7-4269-9D43-51FE0D5D2556_TaskNameInputXItem" name="TaskName"/>
501502
<bpmn2:dataInput id="_AD768963-CBF7-4269-9D43-51FE0D5D2556_SkippableInputX" drools:dtype="Object" itemSubjectRef="__AD768963-CBF7-4269-9D43-51FE0D5D2556_SkippableInputXItem" name="Skippable"/>
503+
<bpmn2:dataInput id="_AD768963-CBF7-4269-9D43-51FE0D5D2556_GroupIdInputX" drools:dtype="Object" itemSubjectRef="__AD768963-CBF7-4269-9D43-51FE0D5D2556_GroupIdInputXItem" name="GroupId"/>
502504
<bpmn2:dataOutput id="_AD768963-CBF7-4269-9D43-51FE0D5D2556_evaluationOutputX" drools:dtype="Integer" itemSubjectRef="__AD768963-CBF7-4269-9D43-51FE0D5D2556_evaluationOutputXItem" name="evaluation"/>
503505
<bpmn2:dataOutput id="_AD768963-CBF7-4269-9D43-51FE0D5D2556_commentOutputX" drools:dtype="String" itemSubjectRef="__AD768963-CBF7-4269-9D43-51FE0D5D2556_commentOutputXItem" name="comment"/>
504506
<bpmn2:inputSet>
505507
<bpmn2:dataInputRefs>_AD768963-CBF7-4269-9D43-51FE0D5D2556_TaskNameInputX</bpmn2:dataInputRefs>
506508
<bpmn2:dataInputRefs>_AD768963-CBF7-4269-9D43-51FE0D5D2556_SkippableInputX</bpmn2:dataInputRefs>
509+
<bpmn2:dataInputRefs>_AD768963-CBF7-4269-9D43-51FE0D5D2556_GroupIdInputX</bpmn2:dataInputRefs>
507510
</bpmn2:inputSet>
508511
<bpmn2:outputSet>
509512
<bpmn2:dataOutputRefs>_AD768963-CBF7-4269-9D43-51FE0D5D2556_evaluationOutputX</bpmn2:dataOutputRefs>
@@ -524,6 +527,13 @@
524527
<bpmn2:to xsi:type="bpmn2:tFormalExpression"><![CDATA[_AD768963-CBF7-4269-9D43-51FE0D5D2556_SkippableInputX]]></bpmn2:to>
525528
</bpmn2:assignment>
526529
</bpmn2:dataInputAssociation>
530+
<bpmn2:dataInputAssociation>
531+
<bpmn2:targetRef>_AD768963-CBF7-4269-9D43-51FE0D5D2556_GroupIdInputX</bpmn2:targetRef>
532+
<bpmn2:assignment>
533+
<bpmn2:from xsi:type="bpmn2:tFormalExpression"><![CDATA[customer]]></bpmn2:from>
534+
<bpmn2:to xsi:type="bpmn2:tFormalExpression"><![CDATA[_AD768963-CBF7-4269-9D43-51FE0D5D2556_GroupIdInputX]]></bpmn2:to>
535+
</bpmn2:assignment>
536+
</bpmn2:dataInputAssociation>
527537
<bpmn2:dataOutputAssociation>
528538
<bpmn2:sourceRef>_AD768963-CBF7-4269-9D43-51FE0D5D2556_evaluationOutputX</bpmn2:sourceRef>
529539
<bpmn2:targetRef>evaluation</bpmn2:targetRef>
@@ -902,4 +912,4 @@
902912
<bpmn2:source>_fswpMKJxEDiZN4UVlvQdCA</bpmn2:source>
903913
<bpmn2:target>_fswpMKJxEDiZN4UVlvQdCA</bpmn2:target>
904914
</bpmn2:relationship>
905-
</bpmn2:definitions>
915+
</bpmn2:definitions>

‎kogito-springboot-examples/flexible-process-springboot/src/test/java/org/kie/kogito/flexible/example/springboot/ServiceDeskProcessTest.java

Lines changed: 21 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,8 @@ private void addSupportComment(String id) {
109109
String location = given()
110110
.basePath(BASE_PATH)
111111
.contentType(ContentType.JSON)
112+
.queryParam("user", "kelly")
113+
.queryParam("group", "support")
112114
.when()
113115
.post("/{id}/ReceiveSupportComment", id)
114116
.then()
@@ -140,9 +142,12 @@ private void addSupportComment(String id) {
140142

141143
private void addCustomerComment(String id) {
142144
String location = given()
143-
.basePath(BASE_PATH + "/" + id).contentType(ContentType.JSON)
145+
.basePath(BASE_PATH)
146+
.contentType(ContentType.JSON)
147+
.queryParam("user", "Paco")
148+
.queryParam("group", "customer")
144149
.when()
145-
.post("/ReceiveCustomerComment")
150+
.post("/{id}/ReceiveCustomerComment", id)
146151
.then()
147152
.statusCode(201)
148153
.header("Location", notNullValue())
@@ -171,17 +176,25 @@ private void addCustomerComment(String id) {
171176
}
172177

173178
private void resolveCase(String id) {
174-
given().basePath(BASE_PATH + "/" + id).contentType(ContentType.JSON).when().post("/Resolve_Case").then()
175-
.statusCode(200).body("supportCase.state", is(State.RESOLVED.name()));
179+
given()
180+
.basePath(BASE_PATH)
181+
.contentType(ContentType.JSON)
182+
.when()
183+
.post("/{id}/Resolve_Case", id)
184+
.then()
185+
.statusCode(200)
186+
.body("supportCase.state", is(State.RESOLVED.name()));
176187
}
177188

178189
@SuppressWarnings("unchecked")
179190
private void sendQuestionnaire(String id) {
180191
String taskId = given()
181-
.basePath(BASE_PATH + "/" + id)
192+
.basePath(BASE_PATH)
182193
.contentType(ContentType.JSON)
194+
.queryParam("user", "Paco")
195+
.queryParam("group", "customer")
183196
.when()
184-
.get("/tasks")
197+
.get("/{id}/tasks", id)
185198
.then()
186199
.statusCode(200)
187200
.body("size()", is(1))
@@ -195,13 +208,13 @@ private void sendQuestionnaire(String id) {
195208
params.put("evaluation", 10);
196209

197210
given()
198-
.basePath(BASE_PATH + "/" + id)
211+
.basePath(BASE_PATH)
199212
.queryParam("user", "Paco")
200213
.queryParam("group", "customer")
201214
.contentType(ContentType.JSON)
202215
.when()
203216
.body(params)
204-
.post("/Questionnaire/" + taskId)
217+
.post("/{id}/Questionnaire/{taskId}", id, taskId)
205218
.then()
206219
.statusCode(200)
207220
.body("supportCase.state", is(State.CLOSED.name()))

0 commit comments

Comments
 (0)