XYZ-37: Advanced Permissions Phase 1 Backend. (#8159)
* XYZ-13: Update Permission and Role structs to new design. * XYZ-10: Role store. * XYZ-9/XYZ-44: Roles API endpoints and WebSocket message. * XYZ-8: Switch server permissions checks to store backed roles. * XYZ-58: Proper validation of roles where required. * XYZ-11/XYZ-55: Migration to store backed roles from policy config. * XYZ-37: Update unit tests to work with database roles. * XYZ-56: Remove the "guest" role. * Changes to SetDefaultRolesFromConfig. * Short-circuit the store if nothing has changed. * Address first round of review comments. * Address second round of review comments.
Этот коммит содержится в:
George Goldberg
коммит произвёл
GitHub
GitHub
родитель
1c7f25773a
Коммит
e1cd646135
184
api4/role_test.go
Обычный файл
184
api4/role_test.go
Обычный файл
@@ -0,0 +1,184 @@
|
||||
// Copyright (c) 2018-present Mattermost, Inc. All Rights Reserved.
|
||||
// See License.txt for license information.
|
||||
|
||||
package api4
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
|
||||
"github.com/mattermost/mattermost-server/model"
|
||||
)
|
||||
|
||||
func TestGetRole(t *testing.T) {
|
||||
th := Setup().InitBasic().InitSystemAdmin()
|
||||
defer th.TearDown()
|
||||
|
||||
role := &model.Role{
|
||||
Name: model.NewId(),
|
||||
DisplayName: model.NewId(),
|
||||
Description: model.NewId(),
|
||||
Permissions: []string{"manage_system", "create_public_channel"},
|
||||
SchemeManaged: true,
|
||||
}
|
||||
|
||||
res1 := <-th.App.Srv.Store.Role().Save(role)
|
||||
assert.Nil(t, res1.Err)
|
||||
role = res1.Data.(*model.Role)
|
||||
defer th.App.Srv.Store.Job().Delete(role.Id)
|
||||
|
||||
received, resp := th.Client.GetRole(role.Id)
|
||||
CheckNoError(t, resp)
|
||||
|
||||
assert.Equal(t, received.Id, role.Id)
|
||||
assert.Equal(t, received.Name, role.Name)
|
||||
assert.Equal(t, received.DisplayName, role.DisplayName)
|
||||
assert.Equal(t, received.Description, role.Description)
|
||||
assert.EqualValues(t, received.Permissions, role.Permissions)
|
||||
assert.Equal(t, received.SchemeManaged, role.SchemeManaged)
|
||||
|
||||
_, resp = th.SystemAdminClient.GetRole("1234")
|
||||
CheckBadRequestStatus(t, resp)
|
||||
|
||||
_, resp = th.SystemAdminClient.GetRole(model.NewId())
|
||||
CheckNotFoundStatus(t, resp)
|
||||
}
|
||||
|
||||
func TestGetRoleByName(t *testing.T) {
|
||||
th := Setup().InitBasic().InitSystemAdmin()
|
||||
defer th.TearDown()
|
||||
|
||||
role := &model.Role{
|
||||
Name: model.NewId(),
|
||||
DisplayName: model.NewId(),
|
||||
Description: model.NewId(),
|
||||
Permissions: []string{"manage_system", "create_public_channel"},
|
||||
SchemeManaged: true,
|
||||
}
|
||||
|
||||
res1 := <-th.App.Srv.Store.Role().Save(role)
|
||||
assert.Nil(t, res1.Err)
|
||||
role = res1.Data.(*model.Role)
|
||||
defer th.App.Srv.Store.Job().Delete(role.Id)
|
||||
|
||||
received, resp := th.Client.GetRoleByName(role.Name)
|
||||
CheckNoError(t, resp)
|
||||
|
||||
assert.Equal(t, received.Id, role.Id)
|
||||
assert.Equal(t, received.Name, role.Name)
|
||||
assert.Equal(t, received.DisplayName, role.DisplayName)
|
||||
assert.Equal(t, received.Description, role.Description)
|
||||
assert.EqualValues(t, received.Permissions, role.Permissions)
|
||||
assert.Equal(t, received.SchemeManaged, role.SchemeManaged)
|
||||
|
||||
_, resp = th.SystemAdminClient.GetRoleByName(strings.Repeat("abcdefghij", 10))
|
||||
CheckBadRequestStatus(t, resp)
|
||||
|
||||
_, resp = th.SystemAdminClient.GetRoleByName(model.NewId())
|
||||
CheckNotFoundStatus(t, resp)
|
||||
}
|
||||
|
||||
func TestGetRolesByNames(t *testing.T) {
|
||||
th := Setup().InitBasic().InitSystemAdmin()
|
||||
defer th.TearDown()
|
||||
|
||||
role1 := &model.Role{
|
||||
Name: model.NewId(),
|
||||
DisplayName: model.NewId(),
|
||||
Description: model.NewId(),
|
||||
Permissions: []string{"manage_system", "create_public_channel"},
|
||||
SchemeManaged: true,
|
||||
}
|
||||
role2 := &model.Role{
|
||||
Name: model.NewId(),
|
||||
DisplayName: model.NewId(),
|
||||
Description: model.NewId(),
|
||||
Permissions: []string{"manage_system", "delete_private_channel"},
|
||||
SchemeManaged: true,
|
||||
}
|
||||
role3 := &model.Role{
|
||||
Name: model.NewId(),
|
||||
DisplayName: model.NewId(),
|
||||
Description: model.NewId(),
|
||||
Permissions: []string{"manage_system", "manage_public_channel_properties"},
|
||||
SchemeManaged: true,
|
||||
}
|
||||
|
||||
res1 := <-th.App.Srv.Store.Role().Save(role1)
|
||||
assert.Nil(t, res1.Err)
|
||||
role1 = res1.Data.(*model.Role)
|
||||
defer th.App.Srv.Store.Job().Delete(role1.Id)
|
||||
|
||||
res2 := <-th.App.Srv.Store.Role().Save(role2)
|
||||
assert.Nil(t, res2.Err)
|
||||
role2 = res2.Data.(*model.Role)
|
||||
defer th.App.Srv.Store.Job().Delete(role2.Id)
|
||||
|
||||
res3 := <-th.App.Srv.Store.Role().Save(role3)
|
||||
assert.Nil(t, res3.Err)
|
||||
role3 = res3.Data.(*model.Role)
|
||||
defer th.App.Srv.Store.Job().Delete(role3.Id)
|
||||
|
||||
// Check all three roles can be found.
|
||||
received, resp := th.Client.GetRolesByNames([]string{role1.Name, role2.Name, role3.Name})
|
||||
CheckNoError(t, resp)
|
||||
|
||||
assert.Contains(t, received, role1)
|
||||
assert.Contains(t, received, role2)
|
||||
assert.Contains(t, received, role3)
|
||||
|
||||
// Check a list of invalid roles.
|
||||
// TODO: Confirm whether no error for invalid role names is intended.
|
||||
received, resp = th.Client.GetRolesByNames([]string{model.NewId(), model.NewId()})
|
||||
CheckNoError(t, resp)
|
||||
|
||||
_, resp = th.SystemAdminClient.GetRolesByNames([]string{})
|
||||
CheckBadRequestStatus(t, resp)
|
||||
}
|
||||
|
||||
func TestPatchRole(t *testing.T) {
|
||||
th := Setup().InitBasic().InitSystemAdmin()
|
||||
defer th.TearDown()
|
||||
|
||||
role := &model.Role{
|
||||
Name: model.NewId(),
|
||||
DisplayName: model.NewId(),
|
||||
Description: model.NewId(),
|
||||
Permissions: []string{"manage_system", "create_public_channel"},
|
||||
SchemeManaged: true,
|
||||
}
|
||||
|
||||
res1 := <-th.App.Srv.Store.Role().Save(role)
|
||||
assert.Nil(t, res1.Err)
|
||||
role = res1.Data.(*model.Role)
|
||||
defer th.App.Srv.Store.Job().Delete(role.Id)
|
||||
|
||||
patch := &model.RolePatch{
|
||||
Permissions: &[]string{"manage_system", "delete_public_channel"},
|
||||
}
|
||||
|
||||
received, resp := th.SystemAdminClient.PatchRole(role.Id, patch)
|
||||
CheckNoError(t, resp)
|
||||
|
||||
assert.Equal(t, received.Id, role.Id)
|
||||
assert.Equal(t, received.Name, role.Name)
|
||||
assert.Equal(t, received.DisplayName, role.DisplayName)
|
||||
assert.Equal(t, received.Description, role.Description)
|
||||
assert.EqualValues(t, received.Permissions, []string{"manage_system", "delete_public_channel"})
|
||||
assert.Equal(t, received.SchemeManaged, role.SchemeManaged)
|
||||
|
||||
// Check a no-op patch succeeds.
|
||||
received, resp = th.SystemAdminClient.PatchRole(role.Id, patch)
|
||||
CheckNoError(t, resp)
|
||||
|
||||
received, resp = th.SystemAdminClient.PatchRole("junk", patch)
|
||||
CheckBadRequestStatus(t, resp)
|
||||
|
||||
received, resp = th.Client.PatchRole(model.NewId(), patch)
|
||||
CheckNotFoundStatus(t, resp)
|
||||
|
||||
received, resp = th.Client.PatchRole(role.Id, patch)
|
||||
CheckForbiddenStatus(t, resp)
|
||||
}
|
||||
Ссылка в новой задаче
Block a user