Scenario 6 Initiate user and role Grant role channel and role - Changes Request - Seq 25 - Has channel 1 access, no history Revoke role, revoke role channel, re-grant role, re-grant channel, re-revoke channel - Changes Request - Seq 90 - Doesn't have channel 1 access, history added for rol
(t *testing.T)
| 2035 | // Revoke role |
| 2036 | // - Changes Request - Seq 110 - Doesn't have channel access, history added for role |
| 2037 | func TestRevocationScenario6(t *testing.T) { |
| 2038 | ctx := base.TestCtx(t) |
| 2039 | testBucket := base.GetTestBucket(t) |
| 2040 | defer testBucket.Close(ctx) |
| 2041 | |
| 2042 | dataStore := testBucket.GetSingleDataStore() |
| 2043 | |
| 2044 | testMockComputer := mockComputerV2{ |
| 2045 | roles: map[string]ch.TimedSet{}, |
| 2046 | channels: map[string]ch.TimedSet{}, |
| 2047 | roleChannels: map[string]ch.TimedSet{}, |
| 2048 | } |
| 2049 | |
| 2050 | auth := NewTestAuthenticator(t, dataStore, &testMockComputer, DefaultAuthenticatorOptions(base.TestCtx(t))) |
| 2051 | initializeScenario(t, auth) |
| 2052 | |
| 2053 | testMockComputer.addRoleChannels(t, auth, "foo", "ch1", 5) |
| 2054 | testMockComputer.addRole(t, auth, "alice", "foo", 20) |
| 2055 | |
| 2056 | // Get Principals / Rebuild Seq 25 |
| 2057 | aliceUserPrincipal, fooPrincipal := getPrincipals(t, auth) |
| 2058 | |
| 2059 | // Ensure user can see ch1 (via role) |
| 2060 | // Verify history |
| 2061 | assert.ElementsMatch(t, []string{"!", "ch1"}, fooPrincipal.Channels().AllKeys()) |
| 2062 | requireCanSeeChannels(t, aliceUserPrincipal, "ch1") |
| 2063 | assert.Len(t, aliceUserPrincipal.RoleHistory(), 0) |
| 2064 | assert.Len(t, aliceUserPrincipal.ChannelHistory(), 0) |
| 2065 | assert.Len(t, fooPrincipal.ChannelHistory(), 0) |
| 2066 | revokedChannelsCombined, err := aliceUserPrincipal.revokedChannels(5, 0, 0) |
| 2067 | require.NoError(t, err) |
| 2068 | require.Len(t, revokedChannelsCombined, 0) |
| 2069 | |
| 2070 | testMockComputer.removeRole(t, auth, "alice", "foo", 45) |
| 2071 | testMockComputer.removeRoleChannel(t, auth, "foo", "ch1", 55) |
| 2072 | |
| 2073 | testMockComputer.addRole(t, auth, "alice", "foo", 65) |
| 2074 | testMockComputer.addRoleChannels(t, auth, "foo", "ch1", 75) |
| 2075 | |
| 2076 | testMockComputer.removeRoleChannel(t, auth, "foo", "ch1", 85) |
| 2077 | |
| 2078 | // Rebuild seq 90 |
| 2079 | aliceUserPrincipal, fooPrincipal = getPrincipals(t, auth) |
| 2080 | |
| 2081 | // Ensure user cannot see ch1 (via role) |
| 2082 | // Verify history |
| 2083 | requireCannotSeeChannels(t, aliceUserPrincipal, "ch1") |
| 2084 | channelHistory, ok := fooPrincipal.ChannelHistory()["ch1"] |
| 2085 | require.True(t, ok) |
| 2086 | assert.Equal(t, GrantHistorySequencePair{StartSeq: 5, EndSeq: 55}, channelHistory.Entries[0]) |
| 2087 | assert.Len(t, aliceUserPrincipal.RoleHistory(), 0) |
| 2088 | assert.Len(t, aliceUserPrincipal.ChannelHistory(), 0) |
| 2089 | revokedChannelsCombined, err = aliceUserPrincipal.revokedChannels(25, 0, 0) |
| 2090 | require.NoError(t, err) |
| 2091 | require.Contains(t, revokedChannelsCombined, "ch1") |
| 2092 | assert.Equal(t, uint64(55), revokedChannelsCombined["ch1"]) |
| 2093 | |
| 2094 | testMockComputer.removeRole(t, auth, "alice", "foo", 95) |
nothing calls this directly
no test coverage detected