Verify a dynamic grant of a channel to a role is inherited by a user with that role
(t *testing.T)
| 1033 | |
| 1034 | // Verify a dynamic grant of a channel to a role is inherited by a user with that role |
| 1035 | func TestRoleChannelGrantInheritance(t *testing.T) { |
| 1036 | |
| 1037 | base.SetUpTestLogging(t, base.LevelInfo, base.KeyAccess) |
| 1038 | |
| 1039 | rtConfig := RestTesterConfig{SyncFn: `function(doc) {if(doc.type == "setaccess") {channel(doc.channel); access(doc.owner, doc.channel);} else { channel(doc.channel)}}`} |
| 1040 | rt := NewRestTester(t, &rtConfig) |
| 1041 | defer rt.Close() |
| 1042 | |
| 1043 | ctx := rt.Context() |
| 1044 | a := rt.ServerContext().Database(ctx, "db").Authenticator(ctx) |
| 1045 | |
| 1046 | dataStore := rt.GetSingleDataStore() |
| 1047 | scopeName := dataStore.ScopeName() |
| 1048 | collectionName := dataStore.CollectionName() |
| 1049 | |
| 1050 | user, err := a.GetUser("") |
| 1051 | assert.NoError(t, err) |
| 1052 | user.SetDisabled(true) |
| 1053 | err = a.Save(user) |
| 1054 | require.NoError(t, err) |
| 1055 | |
| 1056 | // Create a role with admin grant of chan1 |
| 1057 | role, err := a.NewRole("role1", nil) |
| 1058 | role.SetCollectionExplicitChannels(scopeName, collectionName, channels.TimedSet{"chan1": channels.NewVbSimpleSequence(1)}, 1) |
| 1059 | require.NoError(t, err) |
| 1060 | require.NoError(t, a.Save(role)) |
| 1061 | |
| 1062 | // Create a test user with access to the role |
| 1063 | user, err = a.NewUser("user1", "letmein", nil) |
| 1064 | require.NoError(t, err) |
| 1065 | user.SetExplicitRoles(channels.TimedSet{"role1": channels.NewVbSimpleSequence(1)}, 1) |
| 1066 | require.NoError(t, a.Save(user)) |
| 1067 | |
| 1068 | // Create documents in channels chan1, chan2, chan3 |
| 1069 | response := rt.SendUserRequest("PUT", "/{{.keyspace}}/doc1", `{"channel":"chan1", "greeting":"hello"}`, "user1") |
| 1070 | RequireStatus(t, response, 201) |
| 1071 | response = rt.SendUserRequest("PUT", "/{{.keyspace}}/doc2", `{"channel":"chan2", "greeting":"hello"}`, "user1") |
| 1072 | RequireStatus(t, response, 201) |
| 1073 | response = rt.SendUserRequest("PUT", "/{{.keyspace}}/doc3", `{"channel":"chan3", "greeting":"hello"}`, "user1") |
| 1074 | RequireStatus(t, response, 201) |
| 1075 | |
| 1076 | // Verify user can access document in admin role channel (chan1) |
| 1077 | response = rt.SendUserRequest("GET", "/{{.keyspace}}/doc1", "", "user1") |
| 1078 | RequireStatus(t, response, 200) |
| 1079 | |
| 1080 | // Verify user cannot access other documents |
| 1081 | response = rt.SendUserRequest("GET", "/{{.keyspace}}/doc2", "", "user1") |
| 1082 | RequireStatus(t, response, 403) |
| 1083 | response = rt.SendUserRequest("GET", "/{{.keyspace}}/doc3", "", "user1") |
| 1084 | RequireStatus(t, response, 403) |
| 1085 | |
| 1086 | // Write access granting document (grants chan2 to role role1) |
| 1087 | response = rt.SendUserRequest("PUT", "/{{.keyspace}}/grant1", `{"type":"setaccess", "owner":"role:role1", "channel":"chan2"}`, "user1") |
| 1088 | RequireStatus(t, response, 201) |
| 1089 | grant1Version := DocVersionFromPutResponse(t, response) |
| 1090 | |
| 1091 | // Verify user can access document |
| 1092 | response = rt.SendUserRequest("GET", "/{{.keyspace}}/doc2", "", "user1") |
nothing calls this directly
no test coverage detected