Problem/Motivation
In #540008: Add a container parameter that can remove the special behavior of UID#1 an approach was taken where we can simply flag tests that are failing if we turn off user 1's super user powers, so that they can be taken care of in a followup. This issue is to collect all of these followups.
The goal is to have no tests in Drupal core that rely on UID1's special privileges so that we:
- Know these tests are correctly assigning the necessary permissions to run
- Can turn off the super user access policy in D11, knowing it won't break core
- Can remove the super user access policy in D12, providing an admin account recovery tool to replace it
Steps to reproduce
Go into any of the tests flagged with:
/**
* {@inheritdoc}
*
* @todo Remove and fix test to not rely on super user.
* @see https://www.drupal.org/project/drupal/issues/3437620
*/
And:
- Remove the code below that sets the usesSuperUserAccessPolicy to TRUE.
- Run the test to see which test methods are failing:
-
core/modules/file/tests
- src/Kernel/SaveTest.php
Proposed resolution
Assign the right permissions to make the test go green without the super user access policy. Those few tests that specifically test said policy can obviously stay, but will be removed along with the policy in D12.
Remaining tasks
MR to commit
MR 8651
Issue fork drupal-3439836
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
- 3439836-file-tests-fix
changes, plain diff MR !8651
- 3439836-fix-file-tests
changes, plain diff MR !7428
Comments
Comment #2
vensiresComment #3
vensiresComment #6
thebumik commentedFixed test, and removed deprecations.
Comment #7
smustgrave commentedAppears to have some test failures.
Comment #10
pooja_sharma commentedAddressed the mentioned changes in issue summary.
Comment #11
pooja_sharma commentedComment #12
pooja_sharma commentedAddressed the superuser code needs to remove & added relevant code for test.
Please review MR 8651, move NR
Comment #13
feyp commentedThanks for working on this issue!
Okay, so this was interesting. The test fails, because we validate the file in two cases and the default user created in the base test with the uid 1 is not active (status != 1), so it can't be referenced, which triggers an extra violation that we're not expecting. The UserCreationTrait on the other hand always creates the user with status = 1, so it is not affected by this.
Of course it is probably not a good idea to just add status = 1 to the base test. So I think creating a new active user as it is implemented in the MR is the correct fix. Technically, it would have been enough to just use this new user id for the two files where we call
validate()later and leave the rest as is, but I think it doesn't hurt here to use the active users to create the other files as well, so I won't block on this minor nit.The IS looks good. Updating remaining tasks and adding MR to commit as we have multiple. The issue scope seems appropriate. The issue title could be improved, but it seems acceptable as a git message and I guess it makes sense to keep that in line with the other similar issues that have already been committed, so going along with that.
Code review looks good. Tests pass with the changes. No further tests requiring super user in file module left.
The issue is RTBC 🎉.
Comment #14
feyp commentedForgot to add the tag, sorry for the noise.
Comment #16
pooja_sharma commentedRebased MR with latest code, seems working fine.
Comment #17
kim.pepperI found a lot of other examples in file module where we are using
uid => 1Are we sure we can't remove these special behaviours either?Comment #18
pooja_sharma commentedThis issue is specifically related to the remove the superuser dependency code, so there is only one file detect where with superuser code exist:
protected bool $usesSuperUserAccessPolicy = TRUE;After removing the superuser code, this further leads to test failure for uid attribute in
File::create()API, so updated uid variable only in the :file/tests/src/Kernel/SaveTest.phpsetting back to RTBC
Comment #19
feyp commentedWithout using the super user policy, these tests don't use any special behavior for user 1 so the UID does not need to be changed. User 1 is then just a regular user without any special access. That's also why those tests didn't have the flag added in the first place and why I said in my review in #13 that it would have been enough to change the user in just one place basically to complete this issue.
So yes, we could change the UID for the sake of not using UID 1, but it is not required (edit to clarify: and also not in scope, so it shouldn't be done).
Setting back to Needs review, because the MR was rebased.
Comment #20
kim.pepperOK thanks for clarifying @FeyP. Going to mark this RTBC.
Comment #21
feyp commented@kim.pepper Thanks for taking the extra review off my list, I appreciate it :)
@pooja_sharma Unless I'm missing something here, I think the last rebase was not really required. So for next time: When you rebase an MR, the issue needs to go back to Needs Review. A second review is usually quicker than the first one, because the reviewer is already familiar with the issue and your changes, but it still takes time for you to do the rebase and for the reviewer to (re-)review. So once an issue is RTBC (or even Needs Review, you don't want to rebase while someone is in the middle of reviewing your issue and then they have to start all over again from scratch) you want to rebase only, if it is really necessary. As long as there are no merge conflicts, GitLab will do a rebase automatically, once a core committer merges the MR. A merge conflict usually happens, if there are more recent changes in the main branch that modify one or more of the same files that you are modifying in the MR. GitLab will usually also show you, if there is a merge conflict and a rebase is required. You can see this by looking at the overview page of the MR. So if you are unsure whether a rebase is really needed, it is usually enough to open the overview page of the MR in GitLab and it will tell you: Instead of "Ready to merge by members who can write to the target branch." there will be a message "Merge blocked: 1 check failed" and "Merge conflicts must be resolved.". Note that you must have access to the issue fork for this to work, so if you don't have access yet, you need to request it via the issue.
Comment #22
pooja_sharma commented@FeyP Thanks for reviewing, there is already displaying conflicts errors on MR with error message: need to resolve conflicts locally, due to which I have resolved the conflicts & updated MR as well , not aware about someone is in-between of reviewing the MR.
I believe need to Update IS as well that includes the file names which are updating in it, so updated IS as well for clarity
I keep it in RTBC as it only included rebased code, no any additional changes added. however thanks for highlighting your concerns , 'll keep address those things as well while looking in to issues.
Comment #23
pooja_sharma commentedComment #24
pooja_sharma commentedComment #25
feyp commented@pooja_sharma Alright. Then I missed something in the upstream changes that caused the conflict. Sorry for that. But why did you now update the remaining tasks again? You completed the update for this file, so this is not a remaining task, it is done now. Can you please change back the IS?
Comment #26
pooja_sharma commentedAh, about to add files name under the steps , by mistaken included in remaining tasks.
thanks for flagging it out & updated IS back.
Comment #27
quietone commentedI read the issue summary, comments and the MR. The issue summary is up to to date, thank you, that is real help to reviews and committers. Also, thanks to @FeyP, for the detailed comment in #13 and for mentoring on this issue.
All questions are answered here, #13 was a great help with that. Leaving at RTBC.
Comment #33
nod_Committed and pushed 35dbb2d498 to 11.x and dd994edd20 to 11.0.x and ea6a45edd6 to 10.4.x and 9eb5ee79eb to 10.3.x. Thanks!