Martino Ferrari
48 lines
2.0 KiB
Go
48 lines
2.0 KiB
Go
package access
|
|
|
|
import "testing"
|
|
|
|
func TestCanSee(t *testing.T) {
|
|
cases := []struct {
|
|
name string
|
|
user string
|
|
owner string
|
|
scope string
|
|
itemGroups []string
|
|
userGroups []string
|
|
want bool
|
|
}{
|
|
{"global visible to anyone", "bob", "alice", ScopeGlobal, nil, nil, true},
|
|
{"empty scope = global", "bob", "alice", "", nil, nil, true},
|
|
{"unknown scope = global", "bob", "alice", "weird", nil, nil, true},
|
|
{"private hidden from others", "bob", "alice", ScopePrivate, nil, nil, false},
|
|
{"private visible to owner", "alice", "alice", ScopePrivate, nil, nil, true},
|
|
{"private with empty owner hidden", "bob", "", ScopePrivate, nil, nil, false},
|
|
{"group visible to member", "bob", "alice", ScopeGroup, []string{"ops"}, []string{"ops"}, true},
|
|
{"group hidden from non-member", "bob", "alice", ScopeGroup, []string{"ops"}, []string{"eng"}, false},
|
|
{"group visible to owner even if not a member", "alice", "alice", ScopeGroup, []string{"ops"}, nil, true},
|
|
{"group with multiple item groups", "bob", "alice", ScopeGroup, []string{"ops", "eng"}, []string{"eng"}, true},
|
|
{"case-insensitive scope token", "bob", "alice", "PRIVATE", nil, nil, false},
|
|
}
|
|
for _, c := range cases {
|
|
t.Run(c.name, func(t *testing.T) {
|
|
if got := CanSee(c.user, c.owner, c.scope, c.itemGroups, c.userGroups); got != c.want {
|
|
t.Errorf("CanSee(%q,%q,%q,%v,%v) = %v, want %v",
|
|
c.user, c.owner, c.scope, c.itemGroups, c.userGroups, got, c.want)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestPolicyCanSeeResolvesGroups(t *testing.T) {
|
|
p := New("", []GroupSpec{{Name: "ops", Members: map[string]Role{"bob": RoleOperator}}})
|
|
// bob is a member of ops; a group-scoped item shared with ops is visible.
|
|
if !p.CanSee("bob", "alice", ScopeGroup, []string{"ops"}) {
|
|
t.Errorf("expected bob to see an ops-scoped item")
|
|
}
|
|
// carol is in no group; the same item is hidden.
|
|
if p.CanSee("carol", "alice", ScopeGroup, []string{"ops"}) {
|
|
t.Errorf("expected carol not to see an ops-scoped item")
|
|
}
|
|
}
|