66 lines
3.1 KiB
Go
66 lines
3.1 KiB
Go
package mysql
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"git.yuntuo.hk/k2safe/orbit/internal/consoleauth"
|
|
"git.yuntuo.hk/k2safe/orbit/internal/fault"
|
|
"git.yuntuo.hk/k2safe/orbit/platform/auth"
|
|
)
|
|
|
|
func TestConsolePermissionInputAndFixedVersion(t *testing.T) {
|
|
base := consoleauth.ApplicationInput{Kind: "SET_PERMISSIONS", NamespaceID: testID(t), CredentialID: testID(t), ExpectedRevision: 4, Reason: "enable scheduled tasks", Actions: []string{"tasks:submit", "schedules:read", "schedules:manage"}}
|
|
if err := validateApplicationInput(base); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for _, tc := range []struct {
|
|
name string
|
|
mutate func(*consoleauth.ApplicationInput)
|
|
}{
|
|
{"missing actions", func(in *consoleauth.ApplicationInput) { in.Actions = nil }},
|
|
{"empty actions", func(in *consoleauth.ApplicationInput) { in.Actions = []string{} }},
|
|
{"duplicate", func(in *consoleauth.ApplicationInput) { in.Actions = []string{"tasks:read", "tasks:read"} }},
|
|
{"unknown", func(in *consoleauth.ApplicationInput) { in.Actions = []string{"unknown:action"} }},
|
|
{"wildcard", func(in *consoleauth.ApplicationInput) { in.Actions = []string{"*"} }},
|
|
{"expiry", func(in *consoleauth.ApplicationInput) { in.ValidDays = 7 }},
|
|
{"grace", func(in *consoleauth.ApplicationInput) { in.GraceDays = 7 }},
|
|
{"capability", func(in *consoleauth.ApplicationInput) { in.Capabilities = []string{"schedules"} }},
|
|
{"queue", func(in *consoleauth.ApplicationInput) { in.Queue = "changed" }},
|
|
{"missing version", func(in *consoleauth.ApplicationInput) { in.ExpectedRevision = 0 }},
|
|
{"missing reason", func(in *consoleauth.ApplicationInput) { in.Reason = "" }},
|
|
} {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
in := base
|
|
tc.mutate(&in)
|
|
if fault.Code(validateApplicationInput(in)) != "INVALID_ARGUMENT" {
|
|
t.Fatal("invalid permission request accepted")
|
|
}
|
|
})
|
|
}
|
|
for _, kind := range []string{"CREATE", "ROTATE", "SET_EXPIRY", "FINALIZE"} {
|
|
in := base
|
|
in.Kind = kind
|
|
for _, actions := range [][]string{{"tasks:read"}, {}} {
|
|
in.Actions = actions
|
|
if fault.Code(validateApplicationInput(in)) != "INVALID_ARGUMENT" {
|
|
t.Fatalf("%s accepted actions", kind)
|
|
}
|
|
}
|
|
}
|
|
// 拒绝旧格式携带新语义及新格式冒充旧操作；这里不得访问数据库。
|
|
for _, version := range []int{0, 1, 2, 4} {
|
|
op := consoleauth.ApplicationOperation{Version: version, Input: base, OperationID: testID(t), ApplicationID: testID(t), NamespaceID: base.NamespaceID, CredentialID: base.CredentialID}
|
|
if _, err := NewConsoleApplicationStore(nil, "admin").ApplyApplication(context.Background(), auth.Token{}, op); fault.Code(err) != "INVALID_ARGUMENT" {
|
|
t.Fatalf("permission version %d accepted: %v", version, err)
|
|
}
|
|
}
|
|
in := base
|
|
in.Kind = "SET_EXPIRY"
|
|
in.Actions = nil
|
|
op := consoleauth.ApplicationOperation{Version: 3, Input: in, OperationID: testID(t), ApplicationID: testID(t), NamespaceID: in.NamespaceID, CredentialID: in.CredentialID}
|
|
if _, err := NewConsoleApplicationStore(nil, "admin").ApplyApplication(context.Background(), auth.Token{}, op); fault.Code(err) != "INVALID_ARGUMENT" {
|
|
t.Fatal("v3 accepted legacy action", err)
|
|
}
|
|
}
|