Fix user unit tests

Emyrk · Emyrk · commit 102af8a30058 · 2023-02-02T21:42:57.000-06:00
diff --git a/coderd/authzquery/user.go b/coderd/authzquery/user.go
@@ -15,8 +15,9 @@ import (
 // which is problematic since we don't want to leak information about users.
 
 func (q *AuthzQuerier) DeleteAPIKeysByUserID(ctx context.Context, userID uuid.UUID) error {
-	err := q.authorizeContext(ctx, rbac.ActionUpdate,
-		rbac.ResourceUserData.WithOwner(userID.String()).WithID(userID))
+	// TODO: This is not 100% correct because it omits apikey IDs.
+	err := q.authorizeContext(ctx, rbac.ActionDelete,
+		rbac.ResourceAPIKey.WithOwner(userID.String()))
 	if err != nil {
 		return err
 	}
@@ -158,7 +159,7 @@ func (q *AuthzQuerier) UpdateUserLastSeenAt(ctx context.Context, arg database.Up
 }
 
 func (q *AuthzQuerier) UpdateUserProfile(ctx context.Context, arg database.UpdateUserProfileParams) (database.User, error) {
-	u, err := q.GetUserByID(ctx, arg.ID)
+	u, err := q.database.GetUserByID(ctx, arg.ID)
 	if err != nil {
 		return database.User{}, err
 	}
diff --git a/coderd/authzquery/user_test.go b/coderd/authzquery/user_test.go
@@ -14,7 +14,7 @@ func (s *MethodTestSuite) TestUser() {
 	s.Run("DeleteAPIKeysByUserID", func() {
 		s.RunMethodTest(func(t *testing.T, db database.Store) MethodCase {
 			u := dbgen.User(t, db, database.User{})
-			return methodCase(inputs(u.ID), asserts(u.UserDataRBACObject(), rbac.ActionUpdate))
+			return methodCase(inputs(u.ID), asserts(rbac.ResourceAPIKey.WithOwner(u.ID.String()), rbac.ActionDelete))
 		})
 	})
 	s.Run("GetQuotaAllowanceForUser", func() {
@@ -82,7 +82,7 @@ func (s *MethodTestSuite) TestUser() {
 			return methodCase(inputs(database.InsertUserParams{
 				ID:        uuid.New(),
 				LoginType: database.LoginTypePassword,
-			}), asserts(rbac.ResourceUser, rbac.ActionCreate))
+			}), asserts(rbac.ResourceRoleAssignment, rbac.ActionCreate, rbac.ResourceUser, rbac.ActionCreate))
 		})
 	})
 	s.Run("InsertUserLink", func() {
@@ -114,7 +114,7 @@ func (s *MethodTestSuite) TestUser() {
 			u := dbgen.User(t, db, database.User{})
 			return methodCase(inputs(database.UpdateUserHashedPasswordParams{
 				ID: u.ID,
-			}), asserts(u, rbac.ActionUpdate))
+			}), asserts(u.UserDataRBACObject(), rbac.ActionUpdate))
 		})
 	})
 	s.Run("UpdateUserLastSeenAt", func() {
@@ -185,14 +185,14 @@ func (s *MethodTestSuite) TestUser() {
 			return methodCase(inputs(database.InsertGitAuthLinkParams{
 				ProviderID: uuid.NewString(),
 				UserID:     u.ID,
-			}), asserts(rbac.ResourceUserData.WithOwner(u.ID.String()).WithID(u.ID), rbac.ActionRead))
+			}), asserts(rbac.ResourceUserData.WithOwner(u.ID.String()).WithID(u.ID), rbac.ActionCreate))
 		})
 	})
 	s.Run("UpdateGitAuthLink", func() {
 		s.RunMethodTest(func(t *testing.T, db database.Store) MethodCase {
 			link := dbgen.GitAuthLink(t, db, database.GitAuthLink{})
 			return methodCase(inputs(database.UpdateGitAuthLinkParams{
-				ProviderID: uuid.NewString(),
+				ProviderID: link.ProviderID,
 				UserID:     link.UserID,
 			}), asserts(link, rbac.ActionUpdate))
 		})

Original file line number	Diff line number	Diff line change
`@@ -15,8 +15,9 @@ import (`
`15`	`15`	`// which is problematic since we don't want to leak information about users.`
`16`	`16`
`17`	`17`	`func (q *AuthzQuerier) DeleteAPIKeysByUserID(ctx context.Context, userID uuid.UUID) error {`
`18`		`- err := q.authorizeContext(ctx, rbac.ActionUpdate,`
`19`		`- rbac.ResourceUserData.WithOwner(userID.String()).WithID(userID))`
	`18`	`+ // TODO: This is not 100% correct because it omits apikey IDs.`
	`19`	`+ err := q.authorizeContext(ctx, rbac.ActionDelete,`
	`20`	`+ rbac.ResourceAPIKey.WithOwner(userID.String()))`
`20`	`21`	`if err != nil {`
`21`	`22`	`return err`
`22`	`23`	`}`
`@@ -158,7 +159,7 @@ func (q *AuthzQuerier) UpdateUserLastSeenAt(ctx context.Context, arg database.Up`
`158`	`159`	`}`
`159`	`160`
`160`	`161`	`func (q *AuthzQuerier) UpdateUserProfile(ctx context.Context, arg database.UpdateUserProfileParams) (database.User, error) {`
`161`		`- u, err := q.GetUserByID(ctx, arg.ID)`
	`162`	`+ u, err := q.database.GetUserByID(ctx, arg.ID)`
`162`	`163`	`if err != nil {`
`163`	`164`	`return database.User{}, err`
`164`	`165`	`}`