Function TestUserCollectionAccess

auth/collection_access_test.go:40–169

(t *testing.T)

}

func TestUserCollectionAccess(t *testing.T) {

	ctx := base.TestCtx(t)
	// User with no access:
	bucket := base.GetTestBucket(t)
	defer bucket.Close(ctx)
	options := DefaultAuthenticatorOptions(base.TestCtx(t))
	options.Collections = map[string]map[string]struct{}{
		"scope1": {
			"collection1": struct{}{},
		},
	}
	auth := NewTestAuthenticator(t, bucket.GetSingleDataStore(), nil, options)
	user, _ := auth.NewUser("foo", "password", nil)
	scope := "scope1"
	collection := "collection1"
	otherScope := "scope2"
	otherCollection := "collection2"
	nonMatchingCollections := [][2]string{{base.DefaultScope, base.DefaultCollection}, {scope, otherCollection}, {otherScope, collection}, {otherScope, otherCollection}}
	// Default collection checks - should not have access based on authenticator
	requireExpandWildCardChannel(t, user, nil, []string{"*"})
	requireCannotSeeChannels(t, user, "x", "y", "!", "*")
	require.ErrorIs(t, user.authorizeAllChannels(ch.BaseSetOf(t, "*")), errNotAllowedChannels)
	require.ErrorIs(t, user.authorizeAnyChannel(ch.BaseSetOf(t, "x", "y")), errUnauthorized)
	require.ErrorIs(t, user.authorizeAnyChannel(ch.BaseSetOf(t)), errUnauthorized)
	// Named collection checks
	requireExpandCollectionWildCardChannels(t, user, scope, collection, []string{"!"}, []string{"*"})
	requireCannotSeeCollectionChannels(t, scope, collection, user, "x", "y", "*")
	require.ErrorIs(t, user.authorizeAllCollectionChannels(scope, collection, ch.BaseSetOf(t, "*")), errNotAllowedChannels)
	require.ErrorIs(t, user.AuthorizeAnyCollectionChannel(scope, collection, ch.BaseSetOf(t, "x", "y")), errUnauthorized)
	require.ErrorIs(t, user.AuthorizeAnyCollectionChannel(scope, collection, ch.BaseSetOf(t)), errUnauthorized)

	// User with access to one channel in named collection:
	user.setCollectionChannels(scope, collection, ch.AtSequence(ch.BaseSetOf(t, "x"), 1))
	// Matching named collection checks
	requireExpandCollectionWildCardChannels(t, user, scope, collection, []string{"x"}, []string{"*"})
	requireCanSeeCollectionChannels(t, scope, collection, user, "x")
	requireCannotSeeCollectionChannels(t, scope, collection, user, "y", "!", "*")
	require.ErrorIs(t, user.authorizeAllCollectionChannels(scope, collection, ch.BaseSetOf(t, "x", "y")), errNotAllowedChannels)
	require.ErrorIs(t, user.authorizeAllCollectionChannels(scope, collection, ch.BaseSetOf(t, "*")), errNotAllowedChannels)
	require.NoError(t, user.AuthorizeAnyCollectionChannel(scope, collection, ch.BaseSetOf(t, "x", "y")))
	require.ErrorIs(t, user.AuthorizeAnyCollectionChannel(scope, collection, ch.BaseSetOf(t, "y")), errUnauthorized)
	require.ErrorIs(t, user.AuthorizeAnyCollectionChannel(scope, collection, ch.BaseSetOf(t)), errUnauthorized)

	// Non-matching collection checks
	for _, pair := range nonMatchingCollections {
		s := pair[0]
		c := pair[1]
		requireExpandCollectionWildCardChannels(t, user, s, c, nil, []string{"*"})
		requireCannotSeeCollectionChannels(t, s, c, user, "x", "y", "!", "*")
		if base.IsDefaultCollection(s, c) {
			require.ErrorIs(t, user.authorizeAllCollectionChannels(s, c, ch.BaseSetOf(t, "x", "y")), errNotAllowedChannels, "for %s.%s", s, c)
			require.ErrorIs(t, user.authorizeAllCollectionChannels(s, c, ch.BaseSetOf(t, "*")), errNotAllowedChannels, "for %s.%s", s, c)
		} else {
			require.ErrorIs(t, user.authorizeAllCollectionChannels(s, c, ch.BaseSetOf(t, "x", "y")), errUnauthorizedChannels, "for %s.%s", s, c)
			require.ErrorIs(t, user.authorizeAllCollectionChannels(s, c, ch.BaseSetOf(t, "*")), errUnauthorizedChannels, "for %s.%s", s, c)
		}
		require.ErrorIs(t, user.AuthorizeAnyCollectionChannel(s, c, ch.BaseSetOf(t, "x", "y")), errUnauthorized)