Club Drupal

    $user = $this->drupalCreateUser(array('administer file types', 'administer fields'));

  /**

   * @param EntityFieldQuery $query

   * @param $expected

   *   An associative array of expected result. Keys are file ids, values are

   *   booleans to indicate if the result should include the file.

   */

  function assertEntityFieldQueryAccess(EntityFieldQuery $query, $expected, $account = NULL, $query_name = 'unnamed') {

    if ($account) {

      $query->addMetaData('account', $account);

    }

    $query->addTag('entity_field_access');

    $results = $query->execute();

    $fids = isset($results['file']) ? array_keys($results['file']) : array();

    foreach ($expected as $fid => $in_result) {

      if ($in_result) {

        $this->assertTrue(in_array($fid, $fids), format_string("For the %name query, the result should contain %fid", array('%name' => $query_name, '%fid' => $fid)));

      }

      else {

        $this->assertFalse(in_array($fid, $fids), format_string("For the %name query, the result should not contain %fid", array('%name' => $query_name, '%fid' => $fid)));

      }

    }

  }

  /**

   * Test file entity access for entity field queries.

   */

  function testEntityFieldQueryAccess() {

    // Attach a text field to the default image file type.

    $field = array(

      'field_name' => drupal_strtolower($this->randomName()),

      'type' => 'text',

      'settings' => array(

        'max_length' => 255,

      )

    );

    field_create_field($field);

    $instance = array(

      'field_name' => $field['field_name'],

      'entity_type' => 'file',

      'bundle' => 'document',

      'widget' => array(

        'type' => 'text_textfield',

      ),

      'display' => array(

        'default' => array(

          'type' => 'text_default',

        ),

      ),

    );

    field_create_instance($instance);

    // Create test files.

    $file_owner = $this->drupalCreateUser(array('view own files', 'view own private files'));

    $public_file = $this->createFileEntity(array(

      'status' => 0,

    ));

    $private_file = $this->createFileEntity(array('scheme' => 'private'));

    $owned_public_file = $this->createFileEntity(array(

      'uid' => $file_owner->uid,

      'scheme' => 'public',

    ));

    $owned_private_file = $this->createFileEntity(array(

      'uid' => $file_owner->uid,

      'scheme' => 'private',

    ));

    $fids = array(

      $public_file->fid,

      $private_file->fid,

      $owned_public_file->fid,

      $owned_private_file->fid,

    );

    foreach (file_load_multiple($fids) as $file) {

      $file->{$field['field_name']}[LANGUAGE_NONE][0] = array('value' => 'find me');

      file_save($file);

    }

    $efq_fids = new EntityFieldQuery();

    $queries['entity type and id conditions'] = $efq_fids

      ->entityCondition('entity_type', 'file')

      ->entityCondition('entity_id', $fids);

    $efq_field_name = new EntityFieldQuery();

    $queries['single field condition'] = $efq_field_name

      ->fieldCondition($field['field_name'], 'value', 'find me');

    foreach($queries as $name => $query) {

      $message = format_string('');

      // User should not see private files, only his own public files.

      $this->assertEntityFieldQueryAccess(clone $query, array(

        $public_file->fid => TRUE,

        $private_file->fid => FALSE,

        $owned_public_file->fid => TRUE,

        $owned_private_file->fid => FALSE,

      ), $this->drupalCreateUser(array('create files')), $name);

      // A user with the 'view own files' and 'view own private files' permissions should only see owned files and public files.

      $this->drupalLogin($file_owner);

      $this->assertEntityFieldQueryAccess(clone $query, array(

        $public_file->fid => TRUE,

        $private_file->fid => FALSE,

        $owned_public_file->fid => TRUE,

        $owned_private_file->fid => TRUE,

      ), $file_owner, $name);

      // User with the 'view files' permission should only see public files but cannot create files.

      $this->assertEntityFieldQueryAccess(clone $query, array(

        $public_file->fid => TRUE,

        $private_file->fid => FALSE,

        $owned_public_file->fid => TRUE,

        $owned_private_file->fid => FALSE,

      ), $this->drupalCreateUser(array('view files')), $name);

      // User with the 'view files' and 'view private files' permissions should only see all files.

      $this->assertEntityFieldQueryAccess(clone $query, array(

        $public_file->fid => TRUE,

        $private_file->fid => TRUE,

        $owned_public_file->fid => TRUE,

        $owned_private_file->fid => TRUE,

      ), $this->drupalCreateUser(array('view files', 'view private files')), $name);

      // User with the 'bypass file access' permissions should only see all files.

      $this->assertEntityFieldQueryAccess(clone $query, array(

        $public_file->fid => TRUE,

        $private_file->fid => TRUE,

        $owned_public_file->fid => TRUE,

        $owned_private_file->fid => TRUE,

      ), $this->drupalCreateUser(array('bypass file access')), $name);

    }

  }