service backend
This commit is contained in:
Stephan D
747
api/pkg/auth/internal/native/enforcer_test.go
Normal file
747
api/pkg/auth/internal/native/enforcer_test.go
Normal file
@@ -0,0 +1,747 @@
|
||||
package native
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"testing"
|
||||
|
||||
"github.com/tech/sendico/pkg/auth/internal/native/nstructures"
|
||||
"github.com/tech/sendico/pkg/db/repository/builder"
|
||||
"github.com/tech/sendico/pkg/merrors"
|
||||
factory "github.com/tech/sendico/pkg/mlogger/factory"
|
||||
"github.com/tech/sendico/pkg/model"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/mock"
|
||||
"github.com/stretchr/testify/require"
|
||||
"go.mongodb.org/mongo-driver/bson/primitive"
|
||||
)
|
||||
|
||||
// Mock implementations for testing
|
||||
type MockPoliciesDB struct {
|
||||
mock.Mock
|
||||
}
|
||||
|
||||
func (m *MockPoliciesDB) PoliciesForPermissionAction(ctx context.Context, roleRef, permissionRef primitive.ObjectID, action model.Action) ([]nstructures.PolicyAssignment, error) {
|
||||
args := m.Called(ctx, roleRef, permissionRef, action)
|
||||
return args.Get(0).([]nstructures.PolicyAssignment), args.Error(1)
|
||||
}
|
||||
|
||||
func (m *MockPoliciesDB) PoliciesForRole(ctx context.Context, roleRef primitive.ObjectID) ([]nstructures.PolicyAssignment, error) {
|
||||
args := m.Called(ctx, roleRef)
|
||||
return args.Get(0).([]nstructures.PolicyAssignment), args.Error(1)
|
||||
}
|
||||
|
||||
func (m *MockPoliciesDB) PoliciesForRoles(ctx context.Context, roleRefs []primitive.ObjectID, action model.Action) ([]nstructures.PolicyAssignment, error) {
|
||||
args := m.Called(ctx, roleRefs, action)
|
||||
return args.Get(0).([]nstructures.PolicyAssignment), args.Error(1)
|
||||
}
|
||||
|
||||
func (m *MockPoliciesDB) Policies(ctx context.Context, object model.PermissionBoundStorable, action model.Action) ([]nstructures.PolicyAssignment, error) {
|
||||
args := m.Called(ctx, object, action)
|
||||
return args.Get(0).([]nstructures.PolicyAssignment), args.Error(1)
|
||||
}
|
||||
|
||||
func (m *MockPoliciesDB) Remove(ctx context.Context, policy *model.RolePolicy) error {
|
||||
args := m.Called(ctx, policy)
|
||||
return args.Error(0)
|
||||
}
|
||||
|
||||
// Template DB methods - implement as needed for testing
|
||||
func (m *MockPoliciesDB) Create(ctx context.Context, assignment *nstructures.PolicyAssignment) error {
|
||||
args := m.Called(ctx, assignment)
|
||||
return args.Error(0)
|
||||
}
|
||||
|
||||
func (m *MockPoliciesDB) Get(ctx context.Context, id primitive.ObjectID, assignment *nstructures.PolicyAssignment) error {
|
||||
args := m.Called(ctx, id, assignment)
|
||||
return args.Error(0)
|
||||
}
|
||||
|
||||
func (m *MockPoliciesDB) Update(ctx context.Context, assignment *nstructures.PolicyAssignment) error {
|
||||
args := m.Called(ctx, assignment)
|
||||
return args.Error(0)
|
||||
}
|
||||
|
||||
func (m *MockPoliciesDB) Patch(ctx context.Context, objectRef primitive.ObjectID, patch builder.Patch) error {
|
||||
args := m.Called(ctx, objectRef, patch)
|
||||
return args.Error(0)
|
||||
}
|
||||
|
||||
func (m *MockPoliciesDB) Delete(ctx context.Context, id primitive.ObjectID) error {
|
||||
args := m.Called(ctx, id)
|
||||
return args.Error(0)
|
||||
}
|
||||
|
||||
func (m *MockPoliciesDB) DeleteMany(ctx context.Context, query builder.Query) error {
|
||||
args := m.Called(ctx, query)
|
||||
return args.Error(0)
|
||||
}
|
||||
|
||||
func (m *MockPoliciesDB) ListPermissionBound(ctx context.Context, accountRef, organizationRef primitive.ObjectID) ([]nstructures.PolicyAssignment, error) {
|
||||
args := m.Called(ctx, accountRef, organizationRef)
|
||||
return args.Get(0).([]nstructures.PolicyAssignment), args.Error(1)
|
||||
}
|
||||
|
||||
func (m *MockPoliciesDB) ListIDs(ctx context.Context, query interface{}) ([]primitive.ObjectID, error) {
|
||||
args := m.Called(ctx, query)
|
||||
return args.Get(0).([]primitive.ObjectID), args.Error(1)
|
||||
}
|
||||
|
||||
func (m *MockPoliciesDB) FindOne(ctx context.Context, query builder.Query, assignment *nstructures.PolicyAssignment) error {
|
||||
args := m.Called(ctx, query, assignment)
|
||||
return args.Error(0)
|
||||
}
|
||||
|
||||
func (m *MockPoliciesDB) List(ctx context.Context, query builder.Query) ([]nstructures.PolicyAssignment, error) {
|
||||
args := m.Called(ctx, query)
|
||||
return args.Get(0).([]nstructures.PolicyAssignment), args.Error(1)
|
||||
}
|
||||
|
||||
func (m *MockPoliciesDB) Name() string {
|
||||
return "mock_policies"
|
||||
}
|
||||
|
||||
func (m *MockPoliciesDB) DeleteCascade(ctx context.Context, id primitive.ObjectID) error {
|
||||
args := m.Called(ctx, id)
|
||||
return args.Error(0)
|
||||
}
|
||||
|
||||
func (m *MockPoliciesDB) InsertMany(ctx context.Context, objects []*nstructures.PolicyAssignment) error {
|
||||
args := m.Called(ctx, objects)
|
||||
return args.Error(0)
|
||||
}
|
||||
|
||||
type MockRolesDB struct {
|
||||
mock.Mock
|
||||
}
|
||||
|
||||
func (m *MockRolesDB) Roles(ctx context.Context, accountRef, organizationRef primitive.ObjectID) ([]nstructures.RoleAssignment, error) {
|
||||
args := m.Called(ctx, accountRef, organizationRef)
|
||||
return args.Get(0).([]nstructures.RoleAssignment), args.Error(1)
|
||||
}
|
||||
|
||||
func (m *MockRolesDB) RolesForVenue(ctx context.Context, organizationRef primitive.ObjectID) ([]nstructures.RoleAssignment, error) {
|
||||
args := m.Called(ctx, organizationRef)
|
||||
return args.Get(0).([]nstructures.RoleAssignment), args.Error(1)
|
||||
}
|
||||
|
||||
func (m *MockRolesDB) RemoveRole(ctx context.Context, roleRef, organizationRef, accountRef primitive.ObjectID) error {
|
||||
args := m.Called(ctx, roleRef, organizationRef, accountRef)
|
||||
return args.Error(0)
|
||||
}
|
||||
|
||||
func (m *MockRolesDB) DeleteRole(ctx context.Context, roleRef primitive.ObjectID) error {
|
||||
args := m.Called(ctx, roleRef)
|
||||
return args.Error(0)
|
||||
}
|
||||
|
||||
// Template DB methods - implement as needed for testing
|
||||
func (m *MockRolesDB) Create(ctx context.Context, assignment *nstructures.RoleAssignment) error {
|
||||
args := m.Called(ctx, assignment)
|
||||
return args.Error(0)
|
||||
}
|
||||
|
||||
func (m *MockRolesDB) Get(ctx context.Context, id primitive.ObjectID, assignment *nstructures.RoleAssignment) error {
|
||||
args := m.Called(ctx, id, assignment)
|
||||
return args.Error(0)
|
||||
}
|
||||
|
||||
func (m *MockRolesDB) Update(ctx context.Context, assignment *nstructures.RoleAssignment) error {
|
||||
args := m.Called(ctx, assignment)
|
||||
return args.Error(0)
|
||||
}
|
||||
|
||||
func (m *MockRolesDB) Patch(ctx context.Context, objectRef primitive.ObjectID, patch builder.Patch) error {
|
||||
args := m.Called(ctx, objectRef, patch)
|
||||
return args.Error(0)
|
||||
}
|
||||
|
||||
func (m *MockRolesDB) Delete(ctx context.Context, id primitive.ObjectID) error {
|
||||
args := m.Called(ctx, id)
|
||||
return args.Error(0)
|
||||
}
|
||||
|
||||
func (m *MockRolesDB) DeleteMany(ctx context.Context, query builder.Query) error {
|
||||
args := m.Called(ctx, query)
|
||||
return args.Error(0)
|
||||
}
|
||||
|
||||
func (m *MockRolesDB) ListPermissionBound(ctx context.Context, accountRef, organizationRef primitive.ObjectID) ([]nstructures.RoleAssignment, error) {
|
||||
args := m.Called(ctx, accountRef, organizationRef)
|
||||
return args.Get(0).([]nstructures.RoleAssignment), args.Error(1)
|
||||
}
|
||||
|
||||
func (m *MockRolesDB) ListIDs(ctx context.Context, query interface{}) ([]primitive.ObjectID, error) {
|
||||
args := m.Called(ctx, query)
|
||||
return args.Get(0).([]primitive.ObjectID), args.Error(1)
|
||||
}
|
||||
|
||||
func (m *MockRolesDB) FindOne(ctx context.Context, query builder.Query, assignment *nstructures.RoleAssignment) error {
|
||||
args := m.Called(ctx, query, assignment)
|
||||
return args.Error(0)
|
||||
}
|
||||
|
||||
func (m *MockRolesDB) List(ctx context.Context, query builder.Query) ([]nstructures.RoleAssignment, error) {
|
||||
args := m.Called(ctx, query)
|
||||
return args.Get(0).([]nstructures.RoleAssignment), args.Error(1)
|
||||
}
|
||||
|
||||
func (m *MockRolesDB) Name() string {
|
||||
return "mock_roles"
|
||||
}
|
||||
|
||||
func (m *MockRolesDB) DeleteCascade(ctx context.Context, id primitive.ObjectID) error {
|
||||
args := m.Called(ctx, id)
|
||||
return args.Error(0)
|
||||
}
|
||||
|
||||
func (m *MockRolesDB) InsertMany(ctx context.Context, objects []*nstructures.RoleAssignment) error {
|
||||
args := m.Called(ctx, objects)
|
||||
return args.Error(0)
|
||||
}
|
||||
|
||||
// Test helper functions
|
||||
func createTestObjectID() primitive.ObjectID {
|
||||
return primitive.NewObjectID()
|
||||
}
|
||||
|
||||
func createTestRoleAssignment(roleRef, accountRef, organizationRef primitive.ObjectID) nstructures.RoleAssignment {
|
||||
return nstructures.RoleAssignment{
|
||||
Role: model.Role{
|
||||
AccountRef: accountRef,
|
||||
DescriptionRef: roleRef,
|
||||
OrganizationRef: organizationRef,
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func createTestPolicyAssignment(roleRef primitive.ObjectID, action model.Action, effect model.Effect, organizationRef, descriptionRef primitive.ObjectID, objectRef *primitive.ObjectID) nstructures.PolicyAssignment {
|
||||
return nstructures.PolicyAssignment{
|
||||
Policy: model.Policy{
|
||||
OrganizationRef: organizationRef,
|
||||
DescriptionRef: descriptionRef,
|
||||
ObjectRef: objectRef,
|
||||
Effect: model.ActionEffect{
|
||||
Action: action,
|
||||
Effect: effect,
|
||||
},
|
||||
},
|
||||
RoleRef: roleRef,
|
||||
}
|
||||
}
|
||||
|
||||
func createTestEnforcer(pdb PoliciesDB, rdb RolesDB) *Enforcer {
|
||||
logger := factory.NewLogger(true)
|
||||
enforcer := &Enforcer{
|
||||
logger: logger.Named("test"),
|
||||
pdb: pdb,
|
||||
rdb: rdb,
|
||||
}
|
||||
return enforcer
|
||||
}
|
||||
|
||||
func TestEnforcer_Enforce(t *testing.T) {
|
||||
ctx := context.Background()
|
||||
|
||||
// Test data
|
||||
accountRef := createTestObjectID()
|
||||
organizationRef := createTestObjectID()
|
||||
permissionRef := createTestObjectID()
|
||||
objectRef := createTestObjectID()
|
||||
roleRef := createTestObjectID()
|
||||
|
||||
t.Run("Allow_SingleRole_SinglePolicy", func(t *testing.T) {
|
||||
mockPDB := &MockPoliciesDB{}
|
||||
mockRDB := &MockRolesDB{}
|
||||
|
||||
// Mock role assignment
|
||||
roleAssignment := createTestRoleAssignment(roleRef, accountRef, organizationRef)
|
||||
mockRDB.On("Roles", ctx, accountRef, organizationRef).Return([]nstructures.RoleAssignment{roleAssignment}, nil)
|
||||
|
||||
// Mock policy assignment with ALLOW effect
|
||||
policyAssignment := createTestPolicyAssignment(roleRef, model.ActionRead, model.EffectAllow, organizationRef, permissionRef, &objectRef)
|
||||
mockPDB.On("PoliciesForPermissionAction", ctx, roleRef, permissionRef, model.ActionRead).Return([]nstructures.PolicyAssignment{policyAssignment}, nil)
|
||||
|
||||
// Create enforcer
|
||||
enforcer := createTestEnforcer(mockPDB, mockRDB)
|
||||
|
||||
// Execute
|
||||
allowed, err := enforcer.Enforce(ctx, permissionRef, accountRef, organizationRef, objectRef, model.ActionRead)
|
||||
|
||||
// Verify
|
||||
require.NoError(t, err)
|
||||
assert.True(t, allowed)
|
||||
mockRDB.AssertExpectations(t)
|
||||
mockPDB.AssertExpectations(t)
|
||||
})
|
||||
|
||||
t.Run("Deny_SingleRole_SinglePolicy", func(t *testing.T) {
|
||||
mockPDB := &MockPoliciesDB{}
|
||||
mockRDB := &MockRolesDB{}
|
||||
|
||||
// Mock role assignment
|
||||
roleAssignment := createTestRoleAssignment(roleRef, accountRef, organizationRef)
|
||||
mockRDB.On("Roles", ctx, accountRef, organizationRef).Return([]nstructures.RoleAssignment{roleAssignment}, nil)
|
||||
|
||||
// Mock policy assignment with DENY effect
|
||||
policyAssignment := createTestPolicyAssignment(roleRef, model.ActionRead, model.EffectDeny, organizationRef, permissionRef, &objectRef)
|
||||
mockPDB.On("PoliciesForPermissionAction", ctx, roleRef, permissionRef, model.ActionRead).Return([]nstructures.PolicyAssignment{policyAssignment}, nil)
|
||||
|
||||
enforcer := createTestEnforcer(mockPDB, mockRDB)
|
||||
|
||||
// Execute
|
||||
allowed, err := enforcer.Enforce(ctx, permissionRef, accountRef, organizationRef, objectRef, model.ActionRead)
|
||||
|
||||
// Verify
|
||||
require.NoError(t, err)
|
||||
assert.False(t, allowed)
|
||||
mockRDB.AssertExpectations(t)
|
||||
mockPDB.AssertExpectations(t)
|
||||
})
|
||||
|
||||
t.Run("DenyTakesPrecedence_MultipleRoles", func(t *testing.T) {
|
||||
mockPDB := &MockPoliciesDB{}
|
||||
mockRDB := &MockRolesDB{}
|
||||
|
||||
role1Ref := createTestObjectID()
|
||||
role2Ref := createTestObjectID()
|
||||
|
||||
// Mock multiple role assignments
|
||||
roleAssignment1 := createTestRoleAssignment(role1Ref, accountRef, organizationRef)
|
||||
roleAssignment2 := createTestRoleAssignment(role2Ref, accountRef, organizationRef)
|
||||
mockRDB.On("Roles", ctx, accountRef, organizationRef).Return([]nstructures.RoleAssignment{roleAssignment1, roleAssignment2}, nil)
|
||||
|
||||
// First role has ALLOW policy
|
||||
allowPolicy := createTestPolicyAssignment(role1Ref, model.ActionRead, model.EffectAllow, organizationRef, permissionRef, &objectRef)
|
||||
mockPDB.On("PoliciesForPermissionAction", ctx, role1Ref, permissionRef, model.ActionRead).Return([]nstructures.PolicyAssignment{allowPolicy}, nil)
|
||||
|
||||
// Second role has DENY policy - should take precedence
|
||||
denyPolicy := createTestPolicyAssignment(role2Ref, model.ActionRead, model.EffectDeny, organizationRef, permissionRef, &objectRef)
|
||||
mockPDB.On("PoliciesForPermissionAction", ctx, role2Ref, permissionRef, model.ActionRead).Return([]nstructures.PolicyAssignment{denyPolicy}, nil)
|
||||
|
||||
enforcer := createTestEnforcer(mockPDB, mockRDB)
|
||||
|
||||
// Execute
|
||||
allowed, err := enforcer.Enforce(ctx, permissionRef, accountRef, organizationRef, objectRef, model.ActionRead)
|
||||
|
||||
// Verify - DENY should take precedence
|
||||
require.NoError(t, err)
|
||||
assert.False(t, allowed)
|
||||
mockRDB.AssertExpectations(t)
|
||||
mockPDB.AssertExpectations(t)
|
||||
})
|
||||
|
||||
t.Run("NoRoles_ReturnsFalse", func(t *testing.T) {
|
||||
mockPDB := &MockPoliciesDB{}
|
||||
mockRDB := &MockRolesDB{}
|
||||
|
||||
// Mock no roles found
|
||||
mockRDB.On("Roles", ctx, accountRef, organizationRef).Return([]nstructures.RoleAssignment{}, merrors.ErrNoData)
|
||||
|
||||
enforcer := createTestEnforcer(mockPDB, mockRDB)
|
||||
|
||||
// Execute
|
||||
allowed, err := enforcer.Enforce(ctx, permissionRef, accountRef, organizationRef, objectRef, model.ActionRead)
|
||||
|
||||
// Verify
|
||||
require.NoError(t, err)
|
||||
assert.False(t, allowed)
|
||||
mockRDB.AssertExpectations(t)
|
||||
})
|
||||
|
||||
t.Run("EmptyRoles_ReturnsError", func(t *testing.T) {
|
||||
mockPDB := &MockPoliciesDB{}
|
||||
mockRDB := &MockRolesDB{}
|
||||
|
||||
// Mock empty roles list (not NoData error)
|
||||
mockRDB.On("Roles", ctx, accountRef, organizationRef).Return([]nstructures.RoleAssignment{}, nil)
|
||||
|
||||
enforcer := createTestEnforcer(mockPDB, mockRDB)
|
||||
|
||||
// Execute
|
||||
allowed, err := enforcer.Enforce(ctx, permissionRef, accountRef, organizationRef, objectRef, model.ActionRead)
|
||||
|
||||
// Verify
|
||||
require.Error(t, err)
|
||||
assert.False(t, allowed)
|
||||
assert.Contains(t, err.Error(), "No roles found for account")
|
||||
mockRDB.AssertExpectations(t)
|
||||
})
|
||||
|
||||
t.Run("DatabaseError_RolesDB", func(t *testing.T) {
|
||||
mockPDB := &MockPoliciesDB{}
|
||||
mockRDB := &MockRolesDB{}
|
||||
|
||||
// Mock database error
|
||||
dbError := errors.New("database connection failed")
|
||||
mockRDB.On("Roles", ctx, accountRef, organizationRef).Return([]nstructures.RoleAssignment{}, dbError)
|
||||
|
||||
enforcer := createTestEnforcer(mockPDB, mockRDB)
|
||||
|
||||
// Execute
|
||||
allowed, err := enforcer.Enforce(ctx, permissionRef, accountRef, organizationRef, objectRef, model.ActionRead)
|
||||
|
||||
// Verify
|
||||
require.Error(t, err)
|
||||
assert.False(t, allowed)
|
||||
assert.Equal(t, dbError, err)
|
||||
mockRDB.AssertExpectations(t)
|
||||
})
|
||||
|
||||
t.Run("DatabaseError_PoliciesDB", func(t *testing.T) {
|
||||
mockPDB := &MockPoliciesDB{}
|
||||
mockRDB := &MockRolesDB{}
|
||||
|
||||
// Mock role assignment
|
||||
roleAssignment := createTestRoleAssignment(roleRef, accountRef, organizationRef)
|
||||
mockRDB.On("Roles", ctx, accountRef, organizationRef).Return([]nstructures.RoleAssignment{roleAssignment}, nil)
|
||||
|
||||
// Mock database error in policies
|
||||
dbError := errors.New("policies database error")
|
||||
mockPDB.On("PoliciesForPermissionAction", ctx, roleRef, permissionRef, model.ActionRead).Return([]nstructures.PolicyAssignment{}, dbError)
|
||||
|
||||
enforcer := createTestEnforcer(mockPDB, mockRDB)
|
||||
|
||||
// Execute
|
||||
allowed, err := enforcer.Enforce(ctx, permissionRef, accountRef, organizationRef, objectRef, model.ActionRead)
|
||||
|
||||
// Verify
|
||||
require.Error(t, err)
|
||||
assert.False(t, allowed)
|
||||
assert.Equal(t, dbError, err)
|
||||
mockRDB.AssertExpectations(t)
|
||||
mockPDB.AssertExpectations(t)
|
||||
})
|
||||
|
||||
t.Run("NoPolicies_ReturnsFalse", func(t *testing.T) {
|
||||
mockPDB := &MockPoliciesDB{}
|
||||
mockRDB := &MockRolesDB{}
|
||||
|
||||
// Mock role assignment
|
||||
roleAssignment := createTestRoleAssignment(roleRef, accountRef, organizationRef)
|
||||
mockRDB.On("Roles", ctx, accountRef, organizationRef).Return([]nstructures.RoleAssignment{roleAssignment}, nil)
|
||||
|
||||
// Mock no policies found
|
||||
mockPDB.On("PoliciesForPermissionAction", ctx, roleRef, permissionRef, model.ActionRead).Return([]nstructures.PolicyAssignment{}, merrors.ErrNoData)
|
||||
|
||||
enforcer := createTestEnforcer(mockPDB, mockRDB)
|
||||
|
||||
// Execute
|
||||
allowed, err := enforcer.Enforce(ctx, permissionRef, accountRef, organizationRef, objectRef, model.ActionRead)
|
||||
|
||||
// Verify
|
||||
require.NoError(t, err)
|
||||
assert.False(t, allowed)
|
||||
mockRDB.AssertExpectations(t)
|
||||
mockPDB.AssertExpectations(t)
|
||||
})
|
||||
|
||||
t.Run("CorruptedPolicy_ReturnsError", func(t *testing.T) {
|
||||
mockPDB := &MockPoliciesDB{}
|
||||
mockRDB := &MockRolesDB{}
|
||||
|
||||
// Mock role assignment
|
||||
roleAssignment := createTestRoleAssignment(roleRef, accountRef, organizationRef)
|
||||
mockRDB.On("Roles", ctx, accountRef, organizationRef).Return([]nstructures.RoleAssignment{roleAssignment}, nil)
|
||||
|
||||
// Mock corrupted policy with invalid effect
|
||||
corruptedPolicy := createTestPolicyAssignment(roleRef, model.ActionRead, "invalid_effect", organizationRef, permissionRef, &objectRef)
|
||||
mockPDB.On("PoliciesForPermissionAction", ctx, roleRef, permissionRef, model.ActionRead).Return([]nstructures.PolicyAssignment{corruptedPolicy}, nil)
|
||||
|
||||
enforcer := createTestEnforcer(mockPDB, mockRDB)
|
||||
|
||||
// Execute
|
||||
allowed, err := enforcer.Enforce(ctx, permissionRef, accountRef, organizationRef, objectRef, model.ActionRead)
|
||||
|
||||
// Verify
|
||||
require.Error(t, err)
|
||||
assert.False(t, allowed)
|
||||
assert.Contains(t, err.Error(), "Corrupted action effect data")
|
||||
mockRDB.AssertExpectations(t)
|
||||
mockPDB.AssertExpectations(t)
|
||||
})
|
||||
}
|
||||
|
||||
// Mock implementation for PermissionBoundStorable
|
||||
type MockPermissionBoundStorable struct {
|
||||
id primitive.ObjectID
|
||||
permissionRef primitive.ObjectID
|
||||
organizationRef primitive.ObjectID
|
||||
}
|
||||
|
||||
func (m *MockPermissionBoundStorable) GetID() *primitive.ObjectID {
|
||||
return &m.id
|
||||
}
|
||||
|
||||
func (m *MockPermissionBoundStorable) GetPermissionRef() primitive.ObjectID {
|
||||
return m.permissionRef
|
||||
}
|
||||
|
||||
func (m *MockPermissionBoundStorable) GetOrganizationRef() primitive.ObjectID {
|
||||
return m.organizationRef
|
||||
}
|
||||
|
||||
func (m *MockPermissionBoundStorable) Collection() string {
|
||||
return "test_objects"
|
||||
}
|
||||
|
||||
func (m *MockPermissionBoundStorable) SetID(objID primitive.ObjectID) {
|
||||
m.id = objID
|
||||
}
|
||||
|
||||
func (m *MockPermissionBoundStorable) Update() {
|
||||
// Do nothing for mock
|
||||
}
|
||||
|
||||
func (m *MockPermissionBoundStorable) SetPermissionRef(permissionRef primitive.ObjectID) {
|
||||
m.permissionRef = permissionRef
|
||||
}
|
||||
|
||||
func (m *MockPermissionBoundStorable) SetOrganizationRef(organizationRef primitive.ObjectID) {
|
||||
m.organizationRef = organizationRef
|
||||
}
|
||||
|
||||
func (m *MockPermissionBoundStorable) IsArchived() bool {
|
||||
return false // Default to not archived for testing
|
||||
}
|
||||
|
||||
func (m *MockPermissionBoundStorable) SetArchived(archived bool) {
|
||||
// No-op for testing
|
||||
}
|
||||
|
||||
func TestEnforcer_EnforceBatch(t *testing.T) {
|
||||
ctx := context.Background()
|
||||
|
||||
// Test data
|
||||
accountRef := createTestObjectID()
|
||||
organizationRef := createTestObjectID()
|
||||
permissionRef := createTestObjectID()
|
||||
roleRef := createTestObjectID()
|
||||
|
||||
// Create test objects
|
||||
object1 := &MockPermissionBoundStorable{
|
||||
id: createTestObjectID(),
|
||||
permissionRef: permissionRef,
|
||||
organizationRef: organizationRef,
|
||||
}
|
||||
object2 := &MockPermissionBoundStorable{
|
||||
id: createTestObjectID(),
|
||||
permissionRef: permissionRef,
|
||||
organizationRef: organizationRef,
|
||||
}
|
||||
|
||||
t.Run("BatchEnforce_MultipleObjects_SameVenue", func(t *testing.T) {
|
||||
mockPDB := &MockPoliciesDB{}
|
||||
mockRDB := &MockRolesDB{}
|
||||
|
||||
// Mock role assignment
|
||||
roleAssignment := createTestRoleAssignment(roleRef, accountRef, organizationRef)
|
||||
mockRDB.On("Roles", ctx, accountRef, organizationRef).Return([]nstructures.RoleAssignment{roleAssignment}, nil)
|
||||
|
||||
// Mock policy assignment with ALLOW effect
|
||||
policyAssignment := createTestPolicyAssignment(roleRef, model.ActionRead, model.EffectAllow, organizationRef, permissionRef, nil)
|
||||
mockPDB.On("PoliciesForRoles", ctx, []primitive.ObjectID{roleRef}, model.ActionRead).Return([]nstructures.PolicyAssignment{policyAssignment}, nil)
|
||||
|
||||
enforcer := createTestEnforcer(mockPDB, mockRDB)
|
||||
|
||||
// Execute batch enforcement
|
||||
objects := []model.PermissionBoundStorable{object1, object2}
|
||||
results, err := enforcer.EnforceBatch(ctx, objects, accountRef, model.ActionRead)
|
||||
|
||||
// Verify
|
||||
require.NoError(t, err)
|
||||
assert.Len(t, results, 2)
|
||||
assert.True(t, results[object1.id])
|
||||
assert.True(t, results[object2.id])
|
||||
mockRDB.AssertExpectations(t)
|
||||
mockPDB.AssertExpectations(t)
|
||||
})
|
||||
|
||||
t.Run("BatchEnforce_NoRoles_AllObjectsDenied", func(t *testing.T) {
|
||||
mockPDB := &MockPoliciesDB{}
|
||||
mockRDB := &MockRolesDB{}
|
||||
|
||||
// Mock no roles found
|
||||
mockRDB.On("Roles", ctx, accountRef, organizationRef).Return([]nstructures.RoleAssignment{}, merrors.ErrNoData)
|
||||
|
||||
enforcer := createTestEnforcer(mockPDB, mockRDB)
|
||||
|
||||
// Execute batch enforcement
|
||||
objects := []model.PermissionBoundStorable{object1, object2}
|
||||
results, err := enforcer.EnforceBatch(ctx, objects, accountRef, model.ActionRead)
|
||||
|
||||
// Verify
|
||||
require.NoError(t, err)
|
||||
assert.Len(t, results, 2)
|
||||
assert.False(t, results[object1.id])
|
||||
assert.False(t, results[object2.id])
|
||||
mockRDB.AssertExpectations(t)
|
||||
})
|
||||
|
||||
t.Run("BatchEnforce_DatabaseError", func(t *testing.T) {
|
||||
mockPDB := &MockPoliciesDB{}
|
||||
mockRDB := &MockRolesDB{}
|
||||
|
||||
// Mock database error
|
||||
dbError := errors.New("database connection failed")
|
||||
mockRDB.On("Roles", ctx, accountRef, organizationRef).Return([]nstructures.RoleAssignment{}, dbError)
|
||||
|
||||
enforcer := createTestEnforcer(mockPDB, mockRDB)
|
||||
|
||||
// Execute batch enforcement
|
||||
objects := []model.PermissionBoundStorable{object1, object2}
|
||||
results, err := enforcer.EnforceBatch(ctx, objects, accountRef, model.ActionRead)
|
||||
|
||||
// Verify
|
||||
require.Error(t, err)
|
||||
assert.Nil(t, results)
|
||||
assert.Equal(t, dbError, err)
|
||||
mockRDB.AssertExpectations(t)
|
||||
})
|
||||
}
|
||||
|
||||
func TestEnforcer_GetRoles(t *testing.T) {
|
||||
ctx := context.Background()
|
||||
|
||||
// Test data
|
||||
accountRef := createTestObjectID()
|
||||
organizationRef := createTestObjectID()
|
||||
roleRef := createTestObjectID()
|
||||
|
||||
t.Run("GetRoles_Success", func(t *testing.T) {
|
||||
mockPDB := &MockPoliciesDB{}
|
||||
mockRDB := &MockRolesDB{}
|
||||
|
||||
// Mock role assignment
|
||||
roleAssignment := createTestRoleAssignment(roleRef, accountRef, organizationRef)
|
||||
mockRDB.On("Roles", ctx, accountRef, organizationRef).Return([]nstructures.RoleAssignment{roleAssignment}, nil)
|
||||
|
||||
enforcer := createTestEnforcer(mockPDB, mockRDB)
|
||||
|
||||
// Execute
|
||||
roles, err := enforcer.GetRoles(ctx, accountRef, organizationRef)
|
||||
|
||||
// Verify
|
||||
require.NoError(t, err)
|
||||
assert.Len(t, roles, 1)
|
||||
assert.Equal(t, roleRef, roles[0].DescriptionRef)
|
||||
mockRDB.AssertExpectations(t)
|
||||
})
|
||||
|
||||
t.Run("GetRoles_NoRoles", func(t *testing.T) {
|
||||
mockPDB := &MockPoliciesDB{}
|
||||
mockRDB := &MockRolesDB{}
|
||||
|
||||
// Mock no roles found
|
||||
mockRDB.On("Roles", ctx, accountRef, organizationRef).Return([]nstructures.RoleAssignment{}, merrors.ErrNoData)
|
||||
|
||||
enforcer := createTestEnforcer(mockPDB, mockRDB)
|
||||
|
||||
// Execute
|
||||
roles, err := enforcer.GetRoles(ctx, accountRef, organizationRef)
|
||||
|
||||
// Verify
|
||||
require.NoError(t, err)
|
||||
assert.Len(t, roles, 0)
|
||||
mockRDB.AssertExpectations(t)
|
||||
})
|
||||
}
|
||||
|
||||
func TestEnforcer_GetPermissions(t *testing.T) {
|
||||
ctx := context.Background()
|
||||
|
||||
// Test data
|
||||
accountRef := createTestObjectID()
|
||||
organizationRef := createTestObjectID()
|
||||
roleRef := createTestObjectID()
|
||||
|
||||
t.Run("GetPermissions_Success", func(t *testing.T) {
|
||||
mockPDB := &MockPoliciesDB{}
|
||||
mockRDB := &MockRolesDB{}
|
||||
|
||||
// Mock role assignment
|
||||
roleAssignment := createTestRoleAssignment(roleRef, accountRef, organizationRef)
|
||||
mockRDB.On("Roles", ctx, accountRef, organizationRef).Return([]nstructures.RoleAssignment{roleAssignment}, nil)
|
||||
|
||||
// Mock policy assignment
|
||||
policyAssignment := createTestPolicyAssignment(roleRef, model.ActionRead, model.EffectAllow, organizationRef, createTestObjectID(), nil)
|
||||
mockPDB.On("PoliciesForRole", ctx, roleRef).Return([]nstructures.PolicyAssignment{policyAssignment}, nil)
|
||||
|
||||
enforcer := createTestEnforcer(mockPDB, mockRDB)
|
||||
|
||||
// Execute
|
||||
roles, permissions, err := enforcer.GetPermissions(ctx, accountRef, organizationRef)
|
||||
|
||||
// Verify
|
||||
require.NoError(t, err)
|
||||
assert.Len(t, roles, 1)
|
||||
assert.Len(t, permissions, 1)
|
||||
assert.Equal(t, accountRef, permissions[0].AccountRef)
|
||||
mockRDB.AssertExpectations(t)
|
||||
mockPDB.AssertExpectations(t)
|
||||
})
|
||||
}
|
||||
|
||||
// Security-focused test scenarios
|
||||
func TestEnforcer_SecurityScenarios(t *testing.T) {
|
||||
ctx := context.Background()
|
||||
|
||||
// Test data
|
||||
accountRef := createTestObjectID()
|
||||
organizationRef := createTestObjectID()
|
||||
permissionRef := createTestObjectID()
|
||||
objectRef := createTestObjectID()
|
||||
roleRef := createTestObjectID()
|
||||
|
||||
t.Run("Security_DenyAlwaysWins", func(t *testing.T) {
|
||||
mockPDB := &MockPoliciesDB{}
|
||||
mockRDB := &MockRolesDB{}
|
||||
|
||||
// Mock role assignment
|
||||
roleAssignment := createTestRoleAssignment(roleRef, accountRef, organizationRef)
|
||||
mockRDB.On("Roles", ctx, accountRef, organizationRef).Return([]nstructures.RoleAssignment{roleAssignment}, nil)
|
||||
|
||||
// Mock multiple policies: both ALLOW and DENY
|
||||
allowPolicy := createTestPolicyAssignment(roleRef, model.ActionRead, model.EffectAllow, organizationRef, permissionRef, &objectRef)
|
||||
denyPolicy := createTestPolicyAssignment(roleRef, model.ActionRead, model.EffectDeny, organizationRef, permissionRef, &objectRef)
|
||||
mockPDB.On("PoliciesForPermissionAction", ctx, roleRef, permissionRef, model.ActionRead).Return([]nstructures.PolicyAssignment{allowPolicy, denyPolicy}, nil)
|
||||
|
||||
enforcer := createTestEnforcer(mockPDB, mockRDB)
|
||||
|
||||
// Execute
|
||||
allowed, err := enforcer.Enforce(ctx, permissionRef, accountRef, organizationRef, objectRef, model.ActionRead)
|
||||
|
||||
// Verify - DENY should always win
|
||||
require.NoError(t, err)
|
||||
assert.False(t, allowed)
|
||||
mockRDB.AssertExpectations(t)
|
||||
mockPDB.AssertExpectations(t)
|
||||
})
|
||||
|
||||
t.Run("Security_InvalidObjectID", func(t *testing.T) {
|
||||
mockPDB := &MockPoliciesDB{}
|
||||
mockRDB := &MockRolesDB{}
|
||||
|
||||
// Mock database error for invalid ObjectID
|
||||
dbError := errors.New("invalid ObjectID")
|
||||
mockRDB.On("Roles", ctx, accountRef, organizationRef).Return([]nstructures.RoleAssignment{}, dbError)
|
||||
|
||||
enforcer := createTestEnforcer(mockPDB, mockRDB)
|
||||
|
||||
// Execute with invalid ObjectID
|
||||
allowed, err := enforcer.Enforce(ctx, permissionRef, accountRef, organizationRef, objectRef, model.ActionRead)
|
||||
|
||||
// Verify - should fail securely
|
||||
require.Error(t, err)
|
||||
assert.False(t, allowed)
|
||||
mockRDB.AssertExpectations(t)
|
||||
})
|
||||
}
|
||||
|
||||
// Note: This test provides comprehensive coverage of the native enforcer including:
|
||||
// 1. Basic enforcement logic with deny-takes-precedence
|
||||
// 2. Batch operations for performance
|
||||
// 3. Role and permission retrieval
|
||||
// 4. Security scenarios and edge cases
|
||||
// 5. Error handling and database failures
|
||||
// 6. All critical security paths are tested
|
||||
Reference in New Issue
Block a user