Function role_inheritance_cycle_rejected

nodedb/src/control/security/role.rs:574–625

()

    /// `RoleInheritanceCycle`.
    #[test]
    fn role_inheritance_cycle_rejected() {
        let store = RoleStore::new();
        store
            .create_role("a", TenantId::new(1), None, None)
            .unwrap();
        store
            .create_role("b", TenantId::new(1), Some("a"), None)
            .unwrap();
        store
            .create_role("c", TenantId::new(1), Some("b"), None)
            .unwrap();
        // Now try to create a new role "d" with parent "c" that would make a→b→c→d and
        // then try to make "a" a child of "c" (a cycle): create_role("a2", parent=c)
        // won't cycle, but creating any role with parent chain looping back is what we test.
        // Simulate by directly trying to insert a role whose parent chain leads back to itself.
        // The simplest test: try to create role "loop" with parent "c" AND
        // separately verify we can't create a role whose ancestor is itself.
        // Direct cycle: create role "x" with parent "x" is caught by existence check first.
        // Real test: A→B→C exists. Now drop C and re-create with parent A (not a cycle).
        // The canonical test: A inherits B, B inherits C. Try to make C's parent = A.
        // We can't mutate existing parents in this API, so test via prepare_role:
        // a has no parent, b→a, c→b. Making a role "d" with parent "c" is fine.
        // Cycle test: simulate A→B→C and try making A's chain go through C by
        // adding role "cycle_root" with parent="c" where "cycle_root" is also
        // somewhere above c — but since parents are immutable after creation,
        // we use check_inheritance_chain directly.
        //
        // Real observable cycle via public API: create roles in reverse to force a
        // cycle attempt at write time.
        let store2 = RoleStore::new();
        store2
            .create_role("roleA", TenantId::new(1), None, None)
            .unwrap();
        store2
            .create_role("roleB", TenantId::new(1), Some("roleA"), None)
            .unwrap();
        store2
            .create_role("roleC", TenantId::new(1), Some("roleB"), None)
            .unwrap();
        // Now try to create "roleA_child" with parent "roleC" — no cycle.
        store2
            .create_role("roleA_child", TenantId::new(1), Some("roleC"), None)
            .unwrap();
        // Cycle: call check_inheritance_chain directly for roleA → roleC (roleA is ancestor).
        let roles_guard = store2.roles.read().unwrap();
        let err = check_inheritance_chain("roleA", "roleC", &roles_guard).unwrap_err();
        drop(roles_guard);
        assert!(
            matches!(err, crate::Error::RoleInheritanceCycle { .. }),
            "expected RoleInheritanceCycle, got: {err:?}"
        );
    }

    /// `resolve_inheritance` must return at most `MAX_ROLE_INHERITANCE_DEPTH`
    /// entries and never spin infinitely.