(t *testing.T)
| 194 | } |
| 195 | |
| 196 | func TestUserAccess(t *testing.T) { |
| 197 | |
| 198 | ctx := base.TestCtx(t) |
| 199 | // User with no access: |
| 200 | bucket := base.GetTestBucket(t) |
| 201 | defer bucket.Close(ctx) |
| 202 | dataStore := bucket.GetSingleDataStore() |
| 203 | auth := NewTestAuthenticator(t, dataStore, nil, DefaultAuthenticatorOptions(ctx)) |
| 204 | user, err := auth.NewUser("foo", "password", nil) |
| 205 | require.NoError(t, err) |
| 206 | requireExpandWildCardChannel(t, user, []string{"!"}, []string{"*"}) |
| 207 | requireCannotSeeChannels(t, user, "x", "y", "*") |
| 208 | require.ErrorIs(t, user.authorizeAllChannels(ch.BaseSetOf(t, "*")), errNotAllowedChannels) |
| 209 | require.ErrorIs(t, user.authorizeAnyChannel(ch.BaseSetOf(t, "x", "y")), errUnauthorized) |
| 210 | require.ErrorIs(t, user.authorizeAnyChannel(ch.BaseSetOf(t)), errUnauthorized) |
| 211 | |
| 212 | // User with access to one channel: |
| 213 | user.setChannels(ch.AtSequence(ch.BaseSetOf(t, "x"), 1)) |
| 214 | requireExpandWildCardChannel(t, user, []string{"x"}, []string{"*"}) |
| 215 | requireCanSeeChannels(t, user, "x") |
| 216 | requireCannotSeeChannels(t, user, "y", "*") |
| 217 | require.NoError(t, user.authorizeAnyChannel(ch.BaseSetOf(t, "x", "y"))) |
| 218 | require.ErrorIs(t, user.authorizeAnyChannel(ch.BaseSetOf(t, "y")), errUnauthorized) |
| 219 | require.ErrorIs(t, user.authorizeAnyChannel(ch.BaseSetOf(t)), errUnauthorized) |
| 220 | |
| 221 | // User with access to one channel and one derived channel: |
| 222 | user.setChannels(ch.AtSequence(ch.BaseSetOf(t, "x", "z"), 1)) |
| 223 | requireExpandWildCardChannel(t, user, []string{"x", "z"}, []string{"*"}) |
| 224 | requireExpandWildCardChannel(t, user, []string{"x"}, []string{"x"}) |
| 225 | requireCanSeeChannels(t, user, "x", "z") |
| 226 | requireCannotSeeChannels(t, user, "y", "*") |
| 227 | require.ErrorIs(t, user.authorizeAllChannels(ch.BaseSetOf(t, "x", "y")), errNotAllowedChannels) |
| 228 | require.ErrorIs(t, user.authorizeAllChannels(ch.BaseSetOf(t, "*")), errNotAllowedChannels) |
| 229 | |
| 230 | // User with access to two channels: |
| 231 | user.setChannels(ch.AtSequence(ch.BaseSetOf(t, "x", "z"), 1)) |
| 232 | requireExpandWildCardChannel(t, user, []string{"x", "z"}, []string{"*"}) |
| 233 | requireExpandWildCardChannel(t, user, []string{"x"}, []string{"x"}) |
| 234 | requireCanSeeChannels(t, user, "x", "z") |
| 235 | requireCannotSeeChannels(t, user, "y", "*") |
| 236 | require.ErrorIs(t, user.authorizeAllChannels(ch.BaseSetOf(t, "x", "y")), errNotAllowedChannels) |
| 237 | require.ErrorIs(t, user.authorizeAllChannels(ch.BaseSetOf(t, "*")), errNotAllowedChannels) |
| 238 | |
| 239 | user.setChannels(ch.AtSequence(ch.BaseSetOf(t, "x", "y"), 1)) |
| 240 | requireExpandWildCardChannel(t, user, []string{"x", "y"}, []string{"*"}) |
| 241 | requireCanSeeChannels(t, user, "x", "y") |
| 242 | requireCannotSeeChannels(t, user, "z", "*") |
| 243 | require.NoError(t, user.authorizeAllChannels(ch.BaseSetOf(t, "x", "y"))) |
| 244 | require.ErrorIs(t, user.authorizeAllChannels(ch.BaseSetOf(t, "*")), errNotAllowedChannels) |
| 245 | |
| 246 | // User with wildcard access: |
| 247 | user.setChannels(ch.AtSequence(ch.BaseSetOf(t, "*", "q"), 1)) |
| 248 | requireExpandWildCardChannel(t, user, []string{"*", "q"}, []string{"*"}) |
| 249 | requireCanSeeChannels(t, user, "*", "q", "x", "y") |
| 250 | require.NoError(t, user.authorizeAllChannels(ch.BaseSetOf(t, "x", "y"))) |
| 251 | require.NoError(t, user.authorizeAllChannels(ch.BaseSetOf(t, "*"))) |
| 252 | require.NoError(t, user.authorizeAnyChannel(ch.BaseSetOf(t, "x"))) |
| 253 | require.NoError(t, user.authorizeAnyChannel(ch.BaseSetOf(t, "*"))) |
nothing calls this directly
no test coverage detected