()
| 371 | |
| 372 | #[test] |
| 373 | fn scoped_access_denied() { |
| 374 | let id = identity_with_roles_and_scopes(&["openshell-user"], &["sandbox:read"]); |
| 375 | let policy = scoped_policy(); |
| 376 | assert!( |
| 377 | policy |
| 378 | .check(&id, "/openshell.v1.OpenShell/ListSandboxes") |
| 379 | .is_ok() |
| 380 | ); |
| 381 | assert!( |
| 382 | policy |
| 383 | .check(&id, "/openshell.v1.OpenShell/ListServices") |
| 384 | .is_ok() |
| 385 | ); |
| 386 | assert!( |
| 387 | policy |
| 388 | .check(&id, "/openshell.v1.OpenShell/GetService") |
| 389 | .is_ok() |
| 390 | ); |
| 391 | let err = policy |
| 392 | .check(&id, "/openshell.v1.OpenShell/AttachSandboxProvider") |
| 393 | .unwrap_err(); |
| 394 | assert_eq!(err.code(), tonic::Code::PermissionDenied); |
| 395 | assert!(err.message().contains("sandbox:write")); |
| 396 | |
| 397 | let err = policy |
| 398 | .check(&id, "/openshell.v1.OpenShell/ExposeService") |
| 399 | .unwrap_err(); |
| 400 | assert_eq!(err.code(), tonic::Code::PermissionDenied); |
| 401 | assert!(err.message().contains("sandbox:write")); |
| 402 | |
| 403 | let err = policy |
| 404 | .check(&id, "/openshell.v1.OpenShell/DeleteService") |
| 405 | .unwrap_err(); |
| 406 | assert_eq!(err.code(), tonic::Code::PermissionDenied); |
| 407 | assert!(err.message().contains("sandbox:write")); |
| 408 | } |
| 409 | |
| 410 | #[test] |
| 411 | fn provider_refresh_methods_require_provider_scopes_and_admin_for_writes() { |
nothing calls this directly
no test coverage detected