Major changes: logic add to panel, local variables, panel histor, users management...

internal/panelacl/panelacl_test.go

@@ -0,0 +1,109 @@
+package panelacl
+
+import "testing"
+
+func newStore(t *testing.T) *Store {
+	t.Helper()
+	s, err := New(t.TempDir())
+	if err != nil {
+		t.Fatal("New:", err)
+	}
+	return s
+}
+
+func TestUnmanagedPanelIsOpen(t *testing.T) {
+	s := newStore(t)
+	if got := s.PanelPerm("legacy", "alice", nil); got != PermWrite {
+		t.Fatalf("unmanaged panel perm = %v, want write", got)
+	}
+}
+
+func TestOwnerAlwaysWrites(t *testing.T) {
+	s := newStore(t)
+	if err := s.CreatePanel("p1", "alice"); err != nil {
+		t.Fatal(err)
+	}
+	if got := s.PanelPerm("p1", "alice", nil); got != PermWrite {
+		t.Fatalf("owner perm = %v, want write", got)
+	}
+	// A freshly created panel is private to its owner.
+	if got := s.PanelPerm("p1", "bob", nil); got != PermNone {
+		t.Fatalf("non-owner perm on private panel = %v, want none", got)
+	}
+}
+
+func TestPublicAndGrants(t *testing.T) {
+	s := newStore(t)
+	if err := s.CreatePanel("p1", "alice"); err != nil {
+		t.Fatal(err)
+	}
+	grants := []Grant{
+		{Kind: "user", Name: "bob", Perm: "write"},
+		{Kind: "group", Name: "ops", Perm: "read"},
+	}
+	if err := s.SetPanel("p1", "alice", "", "read", grants); err != nil {
+		t.Fatal(err)
+	}
+	// Public read applies to anyone.
+	if got := s.PanelPerm("p1", "carol", nil); got != PermRead {
+		t.Fatalf("public perm = %v, want read", got)
+	}
+	// Direct user grant raises bob to write.
+	if got := s.PanelPerm("p1", "bob", nil); got != PermWrite {
+		t.Fatalf("granted user perm = %v, want write", got)
+	}
+	// Group membership grants read.
+	if got := s.PanelPerm("p1", "dave", []string{"ops"}); got != PermRead {
+		t.Fatalf("group perm = %v, want read", got)
+	}
+}
+
+func TestFolderInheritance(t *testing.T) {
+	s := newStore(t)
+	f, err := s.CreateFolder("f1", "Shared", "", "alice")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := s.UpdateFolder(f.ID, f.Name, "", "read", nil); err != nil {
+		t.Fatal(err)
+	}
+	if err := s.CreatePanel("p1", "alice"); err != nil {
+		t.Fatal(err)
+	}
+	if err := s.SetPanel("p1", "alice", f.ID, "", nil); err != nil {
+		t.Fatal(err)
+	}
+	// The panel inherits the folder's public-read level.
+	if got := s.PanelPerm("p1", "bob", nil); got != PermRead {
+		t.Fatalf("inherited perm = %v, want read", got)
+	}
+}
+
+func TestFolderCycleRejected(t *testing.T) {
+	s := newStore(t)
+	a, _ := s.CreateFolder("a", "A", "", "alice")
+	b, _ := s.CreateFolder("b", "B", a.ID, "alice")
+	// Re-parenting A under its own descendant B must be rejected.
+	if err := s.UpdateFolder(a.ID, a.Name, b.ID, "", nil); err == nil {
+		t.Fatal("expected cycle rejection, got nil")
+	}
+}
+
+func TestDeleteFolderReparents(t *testing.T) {
+	s := newStore(t)
+	a, _ := s.CreateFolder("a", "A", "", "alice")
+	b, _ := s.CreateFolder("b", "B", a.ID, "alice")
+	if err := s.CreatePanel("p1", "alice"); err != nil {
+		t.Fatal(err)
+	}
+	if err := s.SetPanel("p1", "alice", b.ID, "", nil); err != nil {
+		t.Fatal(err)
+	}
+	if err := s.DeleteFolder(b.ID); err != nil {
+		t.Fatal(err)
+	}
+	// B's panel should reparent to A (B's former parent), not orphan.
+	if acl := s.GetPanel("p1"); acl == nil || acl.Folder != a.ID {
+		t.Fatalf("panel folder after delete = %+v, want %s", acl, a.ID)
+	}
+}