Test _all_docs API call under different security scenarios
(t *testing.T)
| 543 | |
| 544 | // Test _all_docs API call under different security scenarios |
| 545 | func TestAllDocsAccessControl(t *testing.T) { |
| 546 | rt := NewRestTester(t, &RestTesterConfig{SyncFn: channels.DocChannelsSyncFunction}) |
| 547 | defer rt.Close() |
| 548 | |
| 549 | // Create some docs: |
| 550 | a := auth.NewAuthenticator(rt.MetadataStore(), nil, rt.GetDatabase().AuthenticatorOptions(rt.Context())) |
| 551 | a.Collections = rt.GetDatabase().CollectionNames |
| 552 | guest, err := a.GetUser("") |
| 553 | assert.NoError(t, err) |
| 554 | guest.SetDisabled(false) |
| 555 | err = a.Save(guest) |
| 556 | assert.NoError(t, err) |
| 557 | |
| 558 | RequireStatus(t, rt.SendRequest("PUT", "/{{.keyspace}}/doc5", `{"channels":"Cinemax"}`), 201) |
| 559 | RequireStatus(t, rt.SendRequest("PUT", "/{{.keyspace}}/doc4", `{"channels":["WB", "Cinemax"]}`), 201) |
| 560 | RequireStatus(t, rt.SendRequest("PUT", "/{{.keyspace}}/doc3", `{"channels":["CBS", "Cinemax"]}`), 201) |
| 561 | RequireStatus(t, rt.SendRequest("PUT", "/{{.keyspace}}/doc2", `{"channels":["CBS"]}`), 201) |
| 562 | RequireStatus(t, rt.SendRequest("PUT", "/{{.keyspace}}/doc1", `{"channels":[]}`), 201) |
| 563 | |
| 564 | guest, err = a.GetUser("") |
| 565 | assert.NoError(t, err) |
| 566 | guest.SetDisabled(true) |
| 567 | err = a.Save(guest) |
| 568 | assert.NoError(t, err) |
| 569 | |
| 570 | // Create a user: |
| 571 | alice, err := a.NewUser("alice", "letmein", channels.BaseSetOf(t, "Cinemax")) |
| 572 | require.NoError(t, err) |
| 573 | assert.NoError(t, a.Save(alice)) |
| 574 | |
| 575 | // Get a single doc the user has access to: |
| 576 | response := rt.SendUserRequest(http.MethodGet, "/{{.keyspace}}/doc3", "", "alice") |
| 577 | RequireStatus(t, response, 200) |
| 578 | |
| 579 | // Get a single doc the user doesn't have access to: |
| 580 | response = rt.SendUserRequest(http.MethodGet, "/{{.keyspace}}/doc2", "", "alice") |
| 581 | RequireStatus(t, response, 403) |
| 582 | |
| 583 | // Check that _all_docs only returns the docs the user has access to: |
| 584 | response = rt.SendUserRequest(http.MethodGet, "/{{.keyspace}}/_all_docs?channels=true", "", "alice") |
| 585 | RequireStatus(t, response, 200) |
| 586 | |
| 587 | allDocsResult := allDocsResponse{} |
| 588 | log.Printf("Response = %s", response.Body.Bytes()) |
| 589 | err = base.JSONUnmarshal(response.Body.Bytes(), &allDocsResult) |
| 590 | require.NoError(t, err) |
| 591 | require.Len(t, allDocsResult.Rows, 3) |
| 592 | assert.Equal(t, "doc3", allDocsResult.Rows[0].ID) |
| 593 | require.NotNil(t, allDocsResult.Rows[0].Value.Channels) |
| 594 | assert.Equal(t, []string{"Cinemax"}, allDocsResult.Rows[0].Value.Channels) |
| 595 | assert.Equal(t, "doc4", allDocsResult.Rows[1].ID) |
| 596 | require.NotNil(t, allDocsResult.Rows[1].Value.Channels) |
| 597 | assert.Equal(t, []string{"Cinemax"}, allDocsResult.Rows[1].Value.Channels) |
| 598 | assert.Equal(t, "doc5", allDocsResult.Rows[2].ID) |
| 599 | require.NotNil(t, allDocsResult.Rows[2].Value.Channels) |
| 600 | assert.Equal(t, []string{"Cinemax"}, allDocsResult.Rows[2].Value.Channels) |
| 601 | |
| 602 | // Check all docs limit option |
nothing calls this directly
no test coverage detected