Scenario 2 Initiate user and role Grant role channel and role - Changes Request - Seq 25 - Has channel 1 access, no history Revoke role - Changes Request - Seq 50 - Doesn't have channel access, role history added Revoke channel, re-grant role, re-grant channel - Changes Request - Seq 80 -
(t *testing.T)
| 1631 | // Role revoke, role channel revoke |
| 1632 | // - Changes Request - Seq 110 - Doesn't have channel access, history added for both role and channel |
| 1633 | func TestRevocationScenario2(t *testing.T) { |
| 1634 | ctx := base.TestCtx(t) |
| 1635 | testBucket := base.GetTestBucket(t) |
| 1636 | defer testBucket.Close(ctx) |
| 1637 | |
| 1638 | dataStore := testBucket.GetSingleDataStore() |
| 1639 | |
| 1640 | testMockComputer := mockComputerV2{ |
| 1641 | roles: map[string]ch.TimedSet{}, |
| 1642 | channels: map[string]ch.TimedSet{}, |
| 1643 | roleChannels: map[string]ch.TimedSet{}, |
| 1644 | } |
| 1645 | |
| 1646 | auth := NewTestAuthenticator(t, dataStore, &testMockComputer, DefaultAuthenticatorOptions(base.TestCtx(t))) |
| 1647 | initializeScenario(t, auth) |
| 1648 | |
| 1649 | testMockComputer.addRoleChannels(t, auth, "foo", "ch1", 5) |
| 1650 | testMockComputer.addRole(t, auth, "alice", "foo", 20) |
| 1651 | |
| 1652 | // Get Principals / Rebuild Seq 25 |
| 1653 | aliceUserPrincipal, fooPrincipal := getPrincipals(t, auth) |
| 1654 | |
| 1655 | // Ensure user can see ch1 (via role) |
| 1656 | // Verify history |
| 1657 | assert.ElementsMatch(t, []string{"!", "ch1"}, fooPrincipal.Channels().AllKeys()) |
| 1658 | requireCanSeeChannels(t, aliceUserPrincipal, "ch1") |
| 1659 | assert.Len(t, aliceUserPrincipal.RoleHistory(), 0) |
| 1660 | assert.Len(t, aliceUserPrincipal.ChannelHistory(), 0) |
| 1661 | assert.Len(t, fooPrincipal.ChannelHistory(), 0) |
| 1662 | revokedChannelsCombined, err := aliceUserPrincipal.revokedChannels(5, 0, 0) |
| 1663 | require.NoError(t, err) |
| 1664 | assert.Len(t, revokedChannelsCombined, 0) |
| 1665 | |
| 1666 | testMockComputer.removeRole(t, auth, "alice", "foo", 45) |
| 1667 | |
| 1668 | // Get Principals / Rebuild Seq 50 |
| 1669 | aliceUserPrincipal, fooPrincipal = getPrincipals(t, auth) |
| 1670 | |
| 1671 | // Ensure user cannot see ch1 (via role) |
| 1672 | // Verify history |
| 1673 | requireCannotSeeChannels(t, aliceUserPrincipal, "ch1") |
| 1674 | userRoleHistory, ok := aliceUserPrincipal.RoleHistory()["foo"] |
| 1675 | require.True(t, ok) |
| 1676 | assert.Equal(t, GrantHistorySequencePair{StartSeq: 20, EndSeq: 45}, userRoleHistory.Entries[0]) |
| 1677 | assert.Len(t, aliceUserPrincipal.ChannelHistory(), 0) |
| 1678 | assert.Len(t, fooPrincipal.ChannelHistory(), 0) |
| 1679 | revokedChannelsCombined, err = aliceUserPrincipal.revokedChannels(25, 0, 0) |
| 1680 | require.NoError(t, err) |
| 1681 | require.Contains(t, revokedChannelsCombined, "ch1") |
| 1682 | assert.Equal(t, uint64(45), revokedChannelsCombined["ch1"]) |
| 1683 | |
| 1684 | testMockComputer.removeRoleChannel(t, auth, "foo", "ch1", 55) |
| 1685 | testMockComputer.addRole(t, auth, "alice", "foo", 65) |
| 1686 | testMockComputer.addRoleChannels(t, auth, "foo", "ch1", 75) |
| 1687 | |
| 1688 | // Get Principals / Rebuild Seq 80 |
| 1689 | aliceUserPrincipal, fooPrincipal = getPrincipals(t, auth) |
| 1690 |
nothing calls this directly
no test coverage detected