(t *testing.T)
| 33 | ) |
| 34 | |
| 35 | func TestEntityAccess(t *testing.T) { |
| 36 | t.Parallel() |
| 37 | |
| 38 | p := &storetest.Population{} |
| 39 | |
| 40 | newUsr := p.NewUser() |
| 41 | newUsr.State = ttnpb.State_STATE_REQUESTED |
| 42 | newUsr.PrimaryEmailAddressValidatedAt = nil |
| 43 | newUsrKey, _ := p.NewAPIKey(newUsr.GetEntityIdentifiers(), ttnpb.Right_RIGHT_ALL) |
| 44 | newUsrCreds := rpcCreds(newUsrKey) |
| 45 | |
| 46 | rejectedUsr := p.NewUser() |
| 47 | rejectedUsr.State = ttnpb.State_STATE_REJECTED |
| 48 | rejectedUsrKey, _ := p.NewAPIKey(rejectedUsr.GetEntityIdentifiers(), ttnpb.Right_RIGHT_ALL) |
| 49 | rejectedUsrCreds := rpcCreds(rejectedUsrKey) |
| 50 | |
| 51 | suspendedUsr := p.NewUser() |
| 52 | suspendedUsr.State = ttnpb.State_STATE_SUSPENDED |
| 53 | suspendedUsrKey, _ := p.NewAPIKey(suspendedUsr.GetEntityIdentifiers(), ttnpb.Right_RIGHT_ALL) |
| 54 | suspendedUsrCreds := rpcCreds(suspendedUsrKey) |
| 55 | |
| 56 | adminUsr := p.NewUser() |
| 57 | adminUsr.Admin = true |
| 58 | adminUsrKey, _ := p.NewAPIKey(adminUsr.GetEntityIdentifiers(), ttnpb.Right_RIGHT_ALL) |
| 59 | adminUsrCreds := rpcCreds(adminUsrKey) |
| 60 | |
| 61 | readOnlyAdmin := p.NewUser() |
| 62 | readOnlyAdmin.Admin = true |
| 63 | readOnlyAdmin.UniversalRights = ttnpb.AllReadAdminRights.GetRights() |
| 64 | readOnlyAdminKey, _ := p.NewAPIKey(readOnlyAdmin.GetEntityIdentifiers(), ttnpb.Right_RIGHT_ALL) |
| 65 | readOnlyAdminKeyCreds := rpcCreds(readOnlyAdminKey) |
| 66 | |
| 67 | expiredKey, storedKey := p.NewAPIKey(adminUsr.GetEntityIdentifiers(), ttnpb.Right_RIGHT_ALL) |
| 68 | storedKey.ExpiresAt = timestamppb.New(time.Now().Add(-10 * time.Minute)) |
| 69 | expiredCreds := rpcCreds(expiredKey) |
| 70 | |
| 71 | oauthUsr := p.NewUser() |
| 72 | oauthClient := p.NewClient(oauthUsr.GetOrganizationOrUserIdentifiers()) |
| 73 | oauthClient.Rights = []ttnpb.Right{ttnpb.Right_RIGHT_USER_ALL} |
| 74 | |
| 75 | // Session that is already expired. CreateSession assigns the session ID, |
| 76 | // so we reference the population slice entry to read the actual ID after |
| 77 | // Populate runs. |
| 78 | p.NewUserSession(oauthUsr.GetIds()) |
| 79 | expiredSession := p.UserSessions[len(p.UserSessions)-1] |
| 80 | expiredSession.ExpiresAt = timestamppb.New(time.Now().Add(-10 * time.Minute)) |
| 81 | |
| 82 | // Session that is still valid. |
| 83 | p.NewUserSession(oauthUsr.GetIds()) |
| 84 | validSession := p.UserSessions[len(p.UserSessions)-1] |
| 85 | validSession.ExpiresAt = timestamppb.New(time.Now().Add(10 * time.Minute)) |
| 86 | |
| 87 | // Generate access token bearer strings. The stored AccessToken is the hashed key. |
| 88 | newBearerAccessToken := func() (bearer, tokenID, hashed string) { |
| 89 | t.Helper() |
| 90 | raw, err := auth.AccessToken.Generate(context.Background(), "") |
| 91 | if err != nil { |
| 92 | t.Fatal(err) |
nothing calls this directly
no test coverage detected