MM-53098 Fix for checking bot and user permissions on shared endpoints (#23751)
* temp commit * update test to allow bot creation * add bot check to updateUser and deleteUser * add more unit tests * lint fixes * lint fix * update based on doc * add more unit tests * lint fixes * fix unit tests * fix unit tests --------- Co-authored-by: Mattermost Build <build@mattermost.com>
Этот коммит содержится в:
Scott Bishel
коммит произвёл
GitHub
GitHub
родитель
2abcdfe76a
Коммит
30140c0a27
@@ -258,14 +258,16 @@ func (a *App) SessionHasPermissionToUserOrBot(session model.Session, userID stri
|
||||
if session.IsUnrestricted() {
|
||||
return true
|
||||
}
|
||||
if a.SessionHasPermissionToUser(session, userID) {
|
||||
|
||||
err := a.SessionHasPermissionToManageBot(session, userID)
|
||||
if err == nil {
|
||||
return true
|
||||
}
|
||||
|
||||
if err := a.SessionHasPermissionToManageBot(session, userID); err == nil {
|
||||
return true
|
||||
if err.Id == "store.sql_bot.get.missing.app_error" && err.Unwrap() != nil {
|
||||
if a.SessionHasPermissionToUser(session, userID) {
|
||||
return true
|
||||
}
|
||||
}
|
||||
|
||||
return false
|
||||
}
|
||||
|
||||
|
||||
@@ -113,6 +113,184 @@ func TestSessionHasPermissionToChannel(t *testing.T) {
|
||||
})
|
||||
}
|
||||
|
||||
func TestHasPermissionToUser(t *testing.T) {
|
||||
th := Setup(t).InitBasic()
|
||||
defer th.TearDown()
|
||||
|
||||
assert.True(t, th.App.HasPermissionToUser(th.SystemAdminUser.Id, th.BasicUser.Id))
|
||||
assert.True(t, th.App.HasPermissionToUser(th.BasicUser.Id, th.BasicUser.Id))
|
||||
assert.False(t, th.App.HasPermissionToUser(th.BasicUser.Id, th.BasicUser2.Id))
|
||||
}
|
||||
|
||||
func TestSessionHasPermissionToManageBot(t *testing.T) {
|
||||
th := Setup(t).InitBasic()
|
||||
defer th.TearDown()
|
||||
|
||||
bot, err := th.App.CreateBot(th.Context, &model.Bot{
|
||||
Username: "username",
|
||||
Description: "a bot",
|
||||
OwnerId: th.BasicUser.Id,
|
||||
})
|
||||
require.Nil(t, err)
|
||||
defer th.App.PermanentDeleteBot(bot.UserId)
|
||||
assert.NotNil(t, bot)
|
||||
|
||||
t.Run("test my bot", func(t *testing.T) {
|
||||
session := model.Session{
|
||||
UserId: th.BasicUser.Id,
|
||||
Roles: model.SystemUserRoleId,
|
||||
}
|
||||
err = th.App.SessionHasPermissionToManageBot(session, bot.UserId)
|
||||
assert.NotNil(t, err)
|
||||
assert.Equal(t, "store.sql_bot.get.missing.app_error", err.Id)
|
||||
assert.NoError(t, err.Unwrap())
|
||||
|
||||
th.AddPermissionToRole(model.PermissionReadBots.Id, model.SystemUserRoleId)
|
||||
err = th.App.SessionHasPermissionToManageBot(session, bot.UserId)
|
||||
assert.NotNil(t, err)
|
||||
assert.Equal(t, "api.context.permissions.app_error", err.Id)
|
||||
assert.NoError(t, err.Unwrap())
|
||||
|
||||
th.AddPermissionToRole(model.PermissionManageBots.Id, model.SystemUserRoleId)
|
||||
err = th.App.SessionHasPermissionToManageBot(session, bot.UserId)
|
||||
assert.Nil(t, err)
|
||||
|
||||
th.RemovePermissionFromRole(model.PermissionReadBots.Id, model.SystemUserRoleId)
|
||||
th.RemovePermissionFromRole(model.PermissionManageBots.Id, model.SystemUserRoleId)
|
||||
})
|
||||
|
||||
t.Run("test others bot", func(t *testing.T) {
|
||||
session := model.Session{
|
||||
UserId: th.BasicUser2.Id,
|
||||
Roles: model.SystemUserRoleId,
|
||||
}
|
||||
err = th.App.SessionHasPermissionToManageBot(session, bot.UserId)
|
||||
assert.NotNil(t, err)
|
||||
assert.Equal(t, "store.sql_bot.get.missing.app_error", err.Id)
|
||||
assert.NoError(t, err.Unwrap())
|
||||
|
||||
th.AddPermissionToRole(model.PermissionReadOthersBots.Id, model.SystemUserRoleId)
|
||||
err = th.App.SessionHasPermissionToManageBot(session, bot.UserId)
|
||||
assert.NotNil(t, err)
|
||||
assert.Equal(t, "api.context.permissions.app_error", err.Id)
|
||||
assert.NoError(t, err.Unwrap())
|
||||
|
||||
th.AddPermissionToRole(model.PermissionManageOthersBots.Id, model.SystemUserRoleId)
|
||||
err = th.App.SessionHasPermissionToManageBot(session, bot.UserId)
|
||||
assert.Nil(t, err)
|
||||
|
||||
th.RemovePermissionFromRole(model.PermissionReadOthersBots.Id, model.SystemUserRoleId)
|
||||
th.RemovePermissionFromRole(model.PermissionManageOthersBots.Id, model.SystemUserRoleId)
|
||||
})
|
||||
|
||||
t.Run("test sysadmin role", func(t *testing.T) {
|
||||
session := model.Session{
|
||||
UserId: th.SystemAdminUser.Id,
|
||||
Roles: model.SystemAdminRoleId,
|
||||
}
|
||||
err = th.App.SessionHasPermissionToManageBot(session, bot.UserId)
|
||||
assert.Nil(t, err)
|
||||
})
|
||||
|
||||
t.Run("test non bot ", func(t *testing.T) {
|
||||
session := model.Session{
|
||||
UserId: th.SystemAdminUser.Id,
|
||||
Roles: model.SystemUserRoleId,
|
||||
}
|
||||
err = th.App.SessionHasPermissionToManageBot(session, "12345")
|
||||
assert.NotNil(t, err)
|
||||
assert.Equal(t, "store.sql_bot.get.missing.app_error", err.Id)
|
||||
assert.Error(t, err.Unwrap())
|
||||
})
|
||||
}
|
||||
|
||||
func TestSessionHasPermissionToUser(t *testing.T) {
|
||||
th := Setup(t).InitBasic()
|
||||
defer th.TearDown()
|
||||
|
||||
t.Run("test my user access", func(t *testing.T) {
|
||||
session := model.Session{
|
||||
UserId: th.BasicUser.Id,
|
||||
Roles: model.SystemUserRoleId,
|
||||
}
|
||||
assert.True(t, th.App.SessionHasPermissionToUser(session, th.BasicUser.Id))
|
||||
assert.False(t, th.App.SessionHasPermissionToUser(session, th.BasicUser2.Id))
|
||||
})
|
||||
|
||||
t.Run("test user manager access", func(t *testing.T) {
|
||||
session := model.Session{
|
||||
UserId: th.BasicUser.Id,
|
||||
Roles: model.SystemUserManagerRoleId,
|
||||
}
|
||||
assert.False(t, th.App.SessionHasPermissionToUser(session, th.BasicUser2.Id))
|
||||
|
||||
th.AddPermissionToRole(model.PermissionEditOtherUsers.Id, model.SystemUserManagerRoleId)
|
||||
assert.True(t, th.App.SessionHasPermissionToUser(session, th.BasicUser2.Id))
|
||||
th.RemovePermissionFromRole(model.PermissionEditOtherUsers.Id, model.SystemUserManagerRoleId)
|
||||
})
|
||||
|
||||
t.Run("test admin user access", func(t *testing.T) {
|
||||
session := model.Session{
|
||||
UserId: th.SystemAdminUser.Id,
|
||||
Roles: model.SystemAdminRoleId,
|
||||
}
|
||||
assert.True(t, th.App.SessionHasPermissionToUser(session, th.BasicUser.Id))
|
||||
assert.True(t, th.App.SessionHasPermissionToUser(session, th.BasicUser2.Id))
|
||||
})
|
||||
}
|
||||
|
||||
func TestSessionHasPermissionToManageUserOrBot(t *testing.T) {
|
||||
th := Setup(t).InitBasic()
|
||||
defer th.TearDown()
|
||||
|
||||
bot, err := th.App.CreateBot(th.Context, &model.Bot{
|
||||
Username: "username",
|
||||
Description: "a bot",
|
||||
OwnerId: th.BasicUser.Id,
|
||||
})
|
||||
require.Nil(t, err)
|
||||
defer th.App.PermanentDeleteBot(bot.UserId)
|
||||
|
||||
t.Run("test basic user access", func(t *testing.T) {
|
||||
session := model.Session{
|
||||
UserId: th.BasicUser.Id,
|
||||
Roles: model.SystemUserRoleId,
|
||||
}
|
||||
assert.True(t, th.App.SessionHasPermissionToUserOrBot(session, th.BasicUser.Id))
|
||||
assert.False(t, th.App.SessionHasPermissionToUserOrBot(session, bot.UserId))
|
||||
assert.False(t, th.App.SessionHasPermissionToUserOrBot(session, th.BasicUser2.Id))
|
||||
})
|
||||
|
||||
t.Run("test user manager access", func(t *testing.T) {
|
||||
session := model.Session{
|
||||
UserId: th.BasicUser2.Id,
|
||||
Roles: model.SystemUserManagerRoleId,
|
||||
}
|
||||
assert.False(t, th.App.SessionHasPermissionToUserOrBot(session, th.BasicUser.Id))
|
||||
assert.True(t, th.App.SessionHasPermissionToUserOrBot(session, th.BasicUser2.Id))
|
||||
assert.False(t, th.App.SessionHasPermissionToUserOrBot(session, bot.UserId))
|
||||
|
||||
th.AddPermissionToRole(model.PermissionEditOtherUsers.Id, model.SystemUserManagerRoleId)
|
||||
assert.True(t, th.App.SessionHasPermissionToUserOrBot(session, th.BasicUser.Id))
|
||||
assert.False(t, th.App.SessionHasPermissionToUserOrBot(session, bot.UserId))
|
||||
th.RemovePermissionFromRole(model.PermissionEditOtherUsers.Id, model.SystemUserManagerRoleId)
|
||||
|
||||
th.AddPermissionToRole(model.PermissionManageOthersBots.Id, model.SystemUserManagerRoleId)
|
||||
assert.False(t, th.App.SessionHasPermissionToUserOrBot(session, th.BasicUser.Id))
|
||||
assert.True(t, th.App.SessionHasPermissionToUserOrBot(session, bot.UserId))
|
||||
th.RemovePermissionFromRole(model.PermissionManageOthersBots.Id, model.SystemUserManagerRoleId)
|
||||
})
|
||||
|
||||
t.Run("test system admin access", func(t *testing.T) {
|
||||
session := model.Session{
|
||||
UserId: th.SystemAdminUser.Id,
|
||||
Roles: model.SystemAdminRoleId,
|
||||
}
|
||||
assert.True(t, th.App.SessionHasPermissionToUserOrBot(session, bot.UserId))
|
||||
assert.True(t, th.App.SessionHasPermissionToUserOrBot(session, th.BasicUser.Id))
|
||||
})
|
||||
}
|
||||
|
||||
func TestHasPermissionToCategory(t *testing.T) {
|
||||
th := Setup(t).InitBasic()
|
||||
defer th.TearDown()
|
||||
|
||||
Ссылка в новой задаче
Block a user