()
| 547 | /// Adding a 9th ancestor must be rejected with `RoleInheritanceDepthExceeded`. |
| 548 | #[test] |
| 549 | fn role_inheritance_depth_9_rejected() { |
| 550 | let store = RoleStore::new(); |
| 551 | store |
| 552 | .create_role("r1", TenantId::new(1), None, None) |
| 553 | .unwrap(); |
| 554 | for i in 2..=8usize { |
| 555 | let name = format!("r{i}"); |
| 556 | let parent = format!("r{}", i - 1); |
| 557 | store |
| 558 | .create_role(&name, TenantId::new(1), Some(&parent), None) |
| 559 | .unwrap(); |
| 560 | } |
| 561 | // r9 → r8 would create a 9-node chain — must be rejected. |
| 562 | let err = store |
| 563 | .create_role("r9", TenantId::new(1), Some("r8"), None) |
| 564 | .unwrap_err(); |
| 565 | assert!( |
| 566 | matches!(err, crate::Error::RoleInheritanceDepthExceeded { .. }), |
| 567 | "expected RoleInheritanceDepthExceeded, got: {err:?}" |
| 568 | ); |
| 569 | } |
| 570 | |
| 571 | /// A→B→C, then attempting to grant C a parent of A must return |
| 572 | /// `RoleInheritanceCycle`. |
nothing calls this directly
no test coverage detected