Function verifyLegacyAuthorizer

internal/auth/authz_test.go:119–189

nolint:thelper

(ctx context.Context, t *testing.T, rep repo.Repository, authorizer auth.Authorizer)

//nolint:thelper
func verifyLegacyAuthorizer(ctx context.Context, t *testing.T, rep repo.Repository, authorizer auth.Authorizer) {
	cases := []struct {
		usernameAtHost           string
		globalPolicyAccess       auth.AccessLevel
		fooAtBarPathPolicyAccess auth.AccessLevel
		fooAtBazPathPolicyAccess auth.AccessLevel
		fooAtBarPolicyAccess     auth.AccessLevel
		fooAtBazPolicyAccess     auth.AccessLevel
		barPolicyAccess          auth.AccessLevel
		bazPolicyAccess          auth.AccessLevel
		fooAtBarSnapshotAccess   auth.AccessLevel
		fooAtBazSnapshotAccess   auth.AccessLevel
	}{
		{
			usernameAtHost:           "foo@bar",
			globalPolicyAccess:       auth.AccessLevelRead,
			fooAtBarPathPolicyAccess: auth.AccessLevelFull, // full access to own path policies
			fooAtBazPathPolicyAccess: auth.AccessLevelNone,
			fooAtBarPolicyAccess:     auth.AccessLevelFull, // full access to own user policy
			fooAtBazPolicyAccess:     auth.AccessLevelNone,
			barPolicyAccess:          auth.AccessLevelRead, // read access to own host policy
			bazPolicyAccess:          auth.AccessLevelNone,
			fooAtBarSnapshotAccess:   auth.AccessLevelFull, // full access to own snapshot
			fooAtBazSnapshotAccess:   auth.AccessLevelNone,
		},
		{
			usernameAtHost:           "evil@bar",
			globalPolicyAccess:       auth.AccessLevelRead,
			fooAtBarPathPolicyAccess: auth.AccessLevelNone,
			fooAtBazPathPolicyAccess: auth.AccessLevelNone,
			fooAtBarPolicyAccess:     auth.AccessLevelNone,
			fooAtBazPolicyAccess:     auth.AccessLevelNone,
			barPolicyAccess:          auth.AccessLevelRead,
			bazPolicyAccess:          auth.AccessLevelNone,
			fooAtBarSnapshotAccess:   auth.AccessLevelNone,
			fooAtBazSnapshotAccess:   auth.AccessLevelNone,
		},
		{
			usernameAtHost:           "evil@elsewhere",
			globalPolicyAccess:       auth.AccessLevelRead,
			fooAtBarPathPolicyAccess: auth.AccessLevelNone,
			fooAtBazPathPolicyAccess: auth.AccessLevelNone,
			fooAtBarPolicyAccess:     auth.AccessLevelNone,
			fooAtBazPolicyAccess:     auth.AccessLevelNone,
			barPolicyAccess:          auth.AccessLevelNone,
			bazPolicyAccess:          auth.AccessLevelNone,
			fooAtBarSnapshotAccess:   auth.AccessLevelNone,
			fooAtBazSnapshotAccess:   auth.AccessLevelNone,
		},
	}

	for _, tc := range cases {
		t.Run(tc.usernameAtHost, func(t *testing.T) {
			a := authorizer.Authorize(ctx, rep, tc.usernameAtHost)

			if got, want := a.ContentAccessLevel(), auth.AccessLevelFull; got != want {
				t.Errorf("invalid content access level: %v, want %v", got, want)
			}