Function TestFallbackRuleValidation

backend/tests/approval_test.go:433–497

TestFallbackRuleValidation tests that SOURCE_UNSPECIFIED rules can only use resource.project_id in conditions.

(t *testing.T)

// TestFallbackRuleValidation tests that SOURCE_UNSPECIFIED rules
// can only use resource.project_id in conditions.
func TestFallbackRuleValidation(t *testing.T) {
	t.Parallel()
	a := require.New(t)
	ctx := context.Background()
	ctl := &controller{}

	ctx, err := ctl.StartServerWithExternalPg(ctx)
	a.NoError(err)
	defer ctl.Close(ctx)

	// Test 1: Valid fallback rule with project_id should succeed
	_, err = ctl.settingServiceClient.UpdateSetting(ctx, connect.NewRequest(&v1pb.UpdateSettingRequest{
		AllowMissing: true,
		Setting: &v1pb.Setting{
			Name: "settings/WORKSPACE_APPROVAL",
			Value: &v1pb.SettingValue{
				Value: &v1pb.SettingValue_WorkspaceApproval{
					WorkspaceApproval: &v1pb.WorkspaceApprovalSetting{
						Rules: []*v1pb.WorkspaceApprovalSetting_Rule{
							{
								Source: v1pb.WorkspaceApprovalSetting_Rule_SOURCE_UNSPECIFIED,
								Condition: &expr.Expr{
									Expression: `resource.project_id == "proj-123"`,
								},
								Template: &v1pb.ApprovalTemplate{
									Title: "Valid Fallback Rule",
									Flow:  &v1pb.ApprovalFlow{Roles: []string{"roles/workspaceOwner"}},
								},
							},
						},
					},
				},
			},
		},
	}))
	a.NoError(err, "Fallback rule with project_id should be valid")

	// Test 2: Invalid fallback rule with environment_id should fail
	_, err = ctl.settingServiceClient.UpdateSetting(ctx, connect.NewRequest(&v1pb.UpdateSettingRequest{
		AllowMissing: true,
		Setting: &v1pb.Setting{
			Name: "settings/WORKSPACE_APPROVAL",
			Value: &v1pb.SettingValue{
				Value: &v1pb.SettingValue_WorkspaceApproval{
					WorkspaceApproval: &v1pb.WorkspaceApprovalSetting{
						Rules: []*v1pb.WorkspaceApprovalSetting_Rule{
							{
								Source: v1pb.WorkspaceApprovalSetting_Rule_SOURCE_UNSPECIFIED,
								Condition: &expr.Expr{
									Expression: `resource.environment_id == "prod"`,
								},
								Template: &v1pb.ApprovalTemplate{
									Title: "Invalid Fallback Rule",
									Flow:  &v1pb.ApprovalFlow{Roles: []string{"roles/workspaceOwner"}},
								},
							},
						},
					},