Function TestRevocationScenario10

auth/auth_test.go:2337–2393

Scenario 10 Initiate user and role Grant role channel and role, revoke role and role channel, re-grant role - Changes Request - Seq 70 - Doesn't have channel 1 access, no history Re-grant channel, re-revoke channel, re-revoke role - Changes Request - Seq 110 - Doesn't have channel 1 access

(t *testing.T)

//	Re-grant channel, re-revoke channel, re-revoke role
//	  - Changes Request - Seq 110 - Doesn't have channel 1 access, no history
func TestRevocationScenario10(t *testing.T) {
	ctx := base.TestCtx(t)
	testBucket := base.GetTestBucket(t)
	defer testBucket.Close(ctx)

	dataStore := testBucket.GetSingleDataStore()

	testMockComputer := mockComputerV2{
		roles:        map[string]ch.TimedSet{},
		channels:     map[string]ch.TimedSet{},
		roleChannels: map[string]ch.TimedSet{},
	}

	auth := NewTestAuthenticator(t, dataStore, &testMockComputer, DefaultAuthenticatorOptions(base.TestCtx(t)))
	initializeScenario(t, auth)

	testMockComputer.addRoleChannels(t, auth, "foo", "ch1", 5)
	testMockComputer.addRole(t, auth, "alice", "foo", 20)

	testMockComputer.removeRole(t, auth, "alice", "foo", 45)
	testMockComputer.removeRoleChannel(t, auth, "foo", "ch1", 55)

	testMockComputer.addRole(t, auth, "alice", "foo", 65)

	// Get Principals / Rebuild Seq 70
	aliceUserPrincipal, fooPrincipal := getPrincipals(t, auth)

	// Ensure user cannot see ch1 (via role)
	// Verify history
	requireCannotSeeChannels(t, aliceUserPrincipal, "ch1")
	assert.Len(t, aliceUserPrincipal.RoleHistory(), 0)
	assert.Len(t, aliceUserPrincipal.ChannelHistory(), 0)
	assert.Len(t, fooPrincipal.ChannelHistory(), 0)
	revokedChannelsCombined, err := aliceUserPrincipal.revokedChannels(5, 0, 0)
	require.NoError(t, err)
	assert.Len(t, revokedChannelsCombined, 0)

	testMockComputer.addRoleChannels(t, auth, "foo", "ch1", 75)

	testMockComputer.removeRoleChannel(t, auth, "foo", "ch1", 85)
	testMockComputer.removeRole(t, auth, "alice", "foo", 95)

	// Rebuild seq 110
	aliceUserPrincipal, fooPrincipal = getPrincipals(t, auth)

	// Ensure user cannot see ch1 (via role)
	// Verify history
	requireCannotSeeChannels(t, aliceUserPrincipal, "ch1")
	userRoleHistory, ok := aliceUserPrincipal.RoleHistory()["foo"]
	require.True(t, ok)
	assert.Equal(t, GrantHistorySequencePair{StartSeq: 65, EndSeq: 95}, userRoleHistory.Entries[0])
	assert.Len(t, aliceUserPrincipal.ChannelHistory(), 0)
	assert.Len(t, fooPrincipal.ChannelHistory(), 0)
	revokedChannelsCombined, err = aliceUserPrincipal.revokedChannels(70, 0, 0)
	require.NoError(t, err)
	assert.Len(t, revokedChannelsCombined, 0)
}