| 180 | } |
| 181 | |
| 182 | func TestCanRead(t *testing.T) { |
| 183 | tests := []struct { |
| 184 | name string |
| 185 | user *model.User |
| 186 | meta *model.Meta |
| 187 | path string |
| 188 | want bool |
| 189 | reason string |
| 190 | }{ |
| 191 | { |
| 192 | name: "nil user should allow access", |
| 193 | user: nil, |
| 194 | meta: nil, |
| 195 | path: "/any", |
| 196 | want: true, |
| 197 | reason: "nil user represents internal/system context and bypasses per-user read restrictions", |
| 198 | }, |
| 199 | { |
| 200 | name: "nil meta should allow access", |
| 201 | user: &model.User{ |
| 202 | ID: 1, |
| 203 | }, |
| 204 | meta: nil, |
| 205 | path: "/any", |
| 206 | want: true, |
| 207 | reason: "nil meta means no restrictions", |
| 208 | }, |
| 209 | { |
| 210 | name: "empty ReadUsers list should allow access", |
| 211 | user: &model.User{ |
| 212 | ID: 1, |
| 213 | }, |
| 214 | meta: &model.Meta{ |
| 215 | Path: "/folder", |
| 216 | ReadUsers: []uint{}, |
| 217 | }, |
| 218 | path: "/folder", |
| 219 | want: true, |
| 220 | reason: "empty ReadUsers means no user-level restrictions", |
| 221 | }, |
| 222 | { |
| 223 | name: "user in ReadUsers list with exact path match", |
| 224 | user: &model.User{ |
| 225 | ID: 1, |
| 226 | }, |
| 227 | meta: &model.Meta{ |
| 228 | Path: "/folder", |
| 229 | ReadUsers: []uint{1, 2, 3}, |
| 230 | ReadUsersSub: false, |
| 231 | }, |
| 232 | path: "/folder", |
| 233 | want: true, |
| 234 | reason: "user ID 1 is in ReadUsers list", |
| 235 | }, |
| 236 | { |
| 237 | name: "user not in ReadUsers list with exact path match", |
| 238 | user: &model.User{ |
| 239 | ID: 5, |