Function TestPermissionsAllKeyValidation

pkg/workflow/permissions_enum_test.go:302–357

TestPermissionsAllKeyValidation tests the special 'all' key validation

(t *testing.T)

// TestPermissionsAllKeyValidation tests the special 'all' key validation
func TestPermissionsAllKeyValidation(t *testing.T) {
	tests := []struct {
		name        string
		permissions string
		expectValid bool
		description string
	}{
		{
			name:        "all: read is valid",
			permissions: "permissions:\n  all: read",
			expectValid: true,
			description: "all: read grants read access to all scopes",
		},
		{
			name:        "all: write is invalid",
			permissions: "permissions:\n  all: write",
			expectValid: false,
			description: "all: write is not allowed for security reasons",
		},
		{
			name:        "all: read with other read permissions",
			permissions: "permissions:\n  all: read\n  contents: read",
			expectValid: true,
			description: "all: read can be combined with other read permissions",
		},
		{
			name:        "all: read with none permission is invalid",
			permissions: "permissions:\n  all: read\n  contents: none",
			expectValid: false,
			description: "all: read cannot be combined with : none",
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			parser := NewPermissionsParser(tt.permissions)

			if tt.expectValid {
				// For valid cases, check that parser processed them correctly
				if parser.hasAll && parser.allLevel != "read" {
					t.Errorf("%s: expected hasAll with level 'read', got level %q", tt.description, parser.allLevel)
				}
			} else {
				// For invalid cases, the parser should not set hasAll for 'all: write'
				// or should have empty parsedPerms for 'all: read' + ': none' combination
				if parser.hasAll && len(parser.parsedPerms) == 0 {
					// This might indicate the combination was rejected
					return
				}
				if strings.Contains(tt.permissions, "all: write") && parser.hasAll {
					t.Errorf("%s: 'all: write' should not be accepted", tt.description)
				}
			}
		})
	}
}

// TestPermissionsScopeEnumValidation tests valid permission scope names