Skip to content

Answer 404 from the permission actions popup for an unknown group or permission #1011

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
KrzysztofPajak merged 2 commits into from
Nov 2, 2026
Merged

Answer 404 from the permission actions popup for an unknown group or permission #1011

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
22461c5
Answer 404 from the permission actions popup for an unknown group or …
Nov 1, 2026
9f2c0f9
Tell the admin when the permission actions popup cannot save
Nov 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
151 changes: 151 additions & 0 deletions src/Tests/Grand.Web.Admin.Tests/Controllers/PermissionControllerTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,151 @@
using Grand.Business.Core.Interfaces.Common.Directory;
using Grand.Business.Core.Interfaces.Common.Security;
using Grand.Domain.Customers;
using Grand.Domain.Localization;
using Grand.Domain.Permissions;
using Grand.Infrastructure;
using Grand.Web.Admin.Controllers;
using Grand.Web.AdminShared.Models.Permissions;
using Grand.Web.Common.Localization;
using Microsoft.AspNetCore.Mvc;
using Microsoft.VisualStudio.TestTools.UnitTesting;
using Moq;

namespace Grand.Web.Admin.Tests.Controllers;

[TestClass]
public class PermissionControllerTests
{
private const string GroupId = "group-1";
private const string SystemName = "ManageProducts";

private readonly Mock<IPermissionService> _permissionServiceMock = new();
private readonly Mock<IGroupService> _groupServiceMock = new();
private PermissionController _controller;

[TestInitialize]
public void Init()
{
var workContextMock = new Mock<IWorkContext>();
workContextMock.Setup(w => w.WorkingLanguage).Returns(new Language { Id = "lang-1" });
var contextAccessorMock = new Mock<IContextAccessor>();
contextAccessorMock.Setup(c => c.WorkContext).Returns(workContextMock.Object);

_permissionServiceMock.Setup(p => p.GetPermissionActions(SystemName, GroupId))
.ReturnsAsync(new List<PermissionAction>());

_controller = new PermissionController(contextAccessorMock.Object, _permissionServiceMock.Object,
_groupServiceMock.Object, new Mock<IRequestTranslationService>().Object);
}

private void GroupExists() =>
_groupServiceMock.Setup(g => g.GetCustomerGroupById(GroupId))
.ReturnsAsync(new CustomerGroup { Id = GroupId, Name = "Group" });

private void PermissionExists() =>
_permissionServiceMock.Setup(p => p.GetPermissionBySystemName(SystemName))
.ReturnsAsync(new Permission { SystemName = SystemName, Actions = new List<string> { "List", "Edit" } });

private void VerifyNothingWritten()
{
_permissionServiceMock.Verify(p => p.DeletePermissionAction(It.IsAny<PermissionAction>()), Times.Never);
_permissionServiceMock.Verify(p => p.InsertPermissionAction(It.IsAny<PermissionAction>()), Times.Never);
}

[TestMethod]
public async Task PermissionsActionGet_ShowsTheActionsOfAKnownGroupAndPermission()
{
GroupExists();
PermissionExists();

var result = await _controller.PermissionsAction(SystemName, GroupId);

var model = (PermissionActionModel)((ViewResult)result).Model;
Assert.AreEqual("Group", model.CustomerGroupName);
CollectionAssert.AreEqual(new List<string> { "List", "Edit" }, model.AvailableActions.ToList());
}

[TestMethod]
public async Task PermissionsActionGet_UnknownGroup_IsNotFound()
{
PermissionExists();

var result = await _controller.PermissionsAction(SystemName, GroupId);

Assert.IsInstanceOfType<NotFoundResult>(result);
}

[TestMethod]
public async Task PermissionsActionGet_UnknownPermission_IsNotFound()
{
GroupExists();

var result = await _controller.PermissionsAction(SystemName, GroupId);

Assert.IsInstanceOfType<NotFoundResult>(result);
}

[TestMethod]
public async Task PermissionsActionPost_DeniesTheActionsNotSelected()
{
GroupExists();
PermissionExists();

var result = await _controller.PermissionsAction(new PermissionActionSaveModel(SystemName, GroupId, new List<string> { "List" }));

Assert.IsInstanceOfType<ViewResult>(result);
_permissionServiceMock.Verify(p => p.InsertPermissionAction(It.Is<PermissionAction>(a =>
a.Action == "Edit" && a.CustomerGroupId == GroupId && a.SystemName == SystemName)), Times.Once);
_permissionServiceMock.Verify(p => p.InsertPermissionAction(It.IsAny<PermissionAction>()), Times.Once);
}

[TestMethod]
public async Task PermissionsActionPost_RemovesTheDenialsOfTheActionsSelected()
{
GroupExists();
PermissionExists();
var denied = new PermissionAction { Action = "Edit" };
_permissionServiceMock.Setup(p => p.GetPermissionActions(SystemName, GroupId))
.ReturnsAsync(new List<PermissionAction> { denied });

await _controller.PermissionsAction(new PermissionActionSaveModel(SystemName, GroupId, new List<string> { "List", "Edit" }));

_permissionServiceMock.Verify(p => p.DeletePermissionAction(denied), Times.Once);
_permissionServiceMock.Verify(p => p.InsertPermissionAction(It.IsAny<PermissionAction>()), Times.Never);
}

[TestMethod]
public async Task PermissionsActionPost_NothingSelected_DeniesEveryAction()
{
GroupExists();
PermissionExists();

await _controller.PermissionsAction(new PermissionActionSaveModel(SystemName, GroupId, null));

_permissionServiceMock.Verify(p => p.InsertPermissionAction(It.IsAny<PermissionAction>()), Times.Exactly(2));
}

[TestMethod]
public async Task PermissionsActionPost_UnknownGroup_IsNotFoundAndWritesNothing()
{
PermissionExists();

var result = await _controller.PermissionsAction(new PermissionActionSaveModel(SystemName, GroupId, null));

Assert.IsInstanceOfType<NotFoundObjectResult>(result);
VerifyNothingWritten();
}

[TestMethod]
public async Task PermissionsActionPost_UnknownPermission_IsNotFoundAndWritesNothing()
{
GroupExists();
_permissionServiceMock.Setup(p => p.GetPermissionActions(SystemName, GroupId))
.ReturnsAsync(new List<PermissionAction> { new() { Action = "Edit" } });

var result = await _controller.PermissionsAction(new PermissionActionSaveModel(SystemName, GroupId, null));

Assert.IsInstanceOfType<NotFoundObjectResult>(result);
VerifyNothingWritten();
}
}
3 changes: 3 additions & 0 deletions src/Web/Grand.Web.Admin/Areas/Admin/Views/Permission/PermissionsAction.cshtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,9 @@
data: form.serialize(),
success: function (data) {
mfp.close();
},
error: function (xhr, ajaxOptions, thrownError) {
alert(xhr.status === 404 ? xhr.responseText : thrownError);
}
});
});
Expand Down
31 changes: 10 additions & 21 deletions src/Web/Grand.Web.Admin/Controllers/PermissionController.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,27 +155,13 @@ public async Task<IActionResult> PermissionsAction(string systemName, string cus
};

var customerGroup = await _groupService.GetCustomerGroupById(customeGroupId);
if (customerGroup != null)
{
model.CustomerGroupName = customerGroup.Name;
}
else
{
ViewBag.ClosePage = true;
return await PermissionsAction(systemName, customeGroupId);
}
if (customerGroup == null) return NotFound();
model.CustomerGroupName = customerGroup.Name;

var permissionRecord = await _permissionService.GetPermissionBySystemName(systemName);
if (permissionRecord != null)
{
model.AvailableActions = permissionRecord.Actions.ToList();
model.PermissionName = _translationService.GetResource(permissionRecord.GetTranslationPermissionName(), _contextAccessor.WorkContext.WorkingLanguage.Id);
}
else
{
ViewBag.ClosePage = true;
return await PermissionsAction(systemName, customeGroupId);
}
if (permissionRecord == null) return NotFound();
model.AvailableActions = permissionRecord.Actions.ToList();
model.PermissionName = _translationService.GetResource(permissionRecord.GetTranslationPermissionName(), _contextAccessor.WorkContext.WorkingLanguage.Id);

model.DeniedActions = (await _permissionService.GetPermissionActions(systemName, customeGroupId))
.Select(x => x.Action).ToList();
Expand All @@ -186,12 +172,16 @@ public async Task<IActionResult> PermissionsAction(string systemName, string cus
[HttpPost]
public async Task<IActionResult> PermissionsAction(PermissionActionSaveModel model)
{
//a 404 without a body would be re-executed as a POST on the storefront
var permissionRecord = await _permissionService.GetPermissionBySystemName(model.SystemName);
if (permissionRecord == null) return NotFound("Permission not found");
if (await _groupService.GetCustomerGroupById(model.CustomerGroupId) == null) return NotFound("Customer group not found");

//remove denied actions
var deniedActions = await _permissionService.GetPermissionActions(model.SystemName, model.CustomerGroupId);
foreach (var action in deniedActions) await _permissionService.DeletePermissionAction(action);

//insert denied actions
var permissionRecord = await _permissionService.GetPermissionBySystemName(model.SystemName);
var insertActions = permissionRecord.Actions.Except(model.SelectedActions ?? new List<string>());

foreach (var item in insertActions)
Expand All @@ -201,7 +191,6 @@ await _permissionService.InsertPermissionAction(new PermissionAction {
SystemName = model.SystemName
});

ViewBag.ClosePage = true;
return await PermissionsAction(model.SystemName, model.CustomerGroupId);
}

Expand Down
Loading