Function TestRevocationScenario7

auth/auth_test.go:2125–2201

Scenario 7 Initiate user and role Grant role channel and role - Changes Request - Seq 25 - Has channel 1 access, no history Revoke role, revoke role channel, re-grant role, re-grant channel, re-revoke channel, re-revoke role - Changes Request - Seq 100 - Doesn't have channel 1 access, hist

(t *testing.T)

//	No Change
//	  - Changes Request - Seq 110 - Doesn't have channel access, history retained
func TestRevocationScenario7(t *testing.T) {
	ctx := base.TestCtx(t)
	testBucket := base.GetTestBucket(t)
	defer testBucket.Close(ctx)

	dataStore := testBucket.GetSingleDataStore()

	testMockComputer := mockComputerV2{
		roles:        map[string]ch.TimedSet{},
		channels:     map[string]ch.TimedSet{},
		roleChannels: map[string]ch.TimedSet{},
	}

	auth := NewTestAuthenticator(t, dataStore, &testMockComputer, DefaultAuthenticatorOptions(base.TestCtx(t)))
	initializeScenario(t, auth)

	testMockComputer.addRoleChannels(t, auth, "foo", "ch1", 5)
	testMockComputer.addRole(t, auth, "alice", "foo", 20)

	// Get Principals / Rebuild Seq 25
	aliceUserPrincipal, fooPrincipal := getPrincipals(t, auth)

	// Ensure user can see ch1 (via role)
	// Verify history
	assert.ElementsMatch(t, []string{"!", "ch1"}, fooPrincipal.Channels().AllKeys())
	requireCanSeeChannels(t, aliceUserPrincipal, "ch1")
	assert.Len(t, aliceUserPrincipal.RoleHistory(), 0)
	assert.Len(t, aliceUserPrincipal.ChannelHistory(), 0)
	assert.Len(t, fooPrincipal.ChannelHistory(), 0)
	revokedChannelsCombined, err := aliceUserPrincipal.revokedChannels(5, 0, 0)
	require.NoError(t, err)
	assert.Len(t, revokedChannelsCombined, 0)

	testMockComputer.removeRole(t, auth, "alice", "foo", 45)
	testMockComputer.removeRoleChannel(t, auth, "foo", "ch1", 55)

	testMockComputer.addRole(t, auth, "alice", "foo", 65)
	testMockComputer.addRoleChannels(t, auth, "foo", "ch1", 75)

	testMockComputer.removeRoleChannel(t, auth, "foo", "ch1", 85)
	testMockComputer.removeRole(t, auth, "alice", "foo", 95)

	// Get Principals / Rebuild Seq 100
	aliceUserPrincipal, fooPrincipal = getPrincipals(t, auth)

	// Ensure user cannot see ch1 (via role)
	// Verify history
	requireCannotSeeChannels(t, aliceUserPrincipal, "ch1")
	userRoleHistory, ok := aliceUserPrincipal.RoleHistory()["foo"]
	require.True(t, ok)
	assert.Equal(t, GrantHistorySequencePair{StartSeq: 20, EndSeq: 45}, userRoleHistory.Entries[0])

	channelHistory, ok := fooPrincipal.ChannelHistory()["ch1"]
	require.True(t, ok)
	assert.Equal(t, GrantHistorySequencePair{StartSeq: 5, EndSeq: 55}, channelHistory.Entries[0])

	assert.Len(t, aliceUserPrincipal.ChannelHistory(), 0)