@@ -54,6 +54,8 @@ func testingWithOwnerUser(m dsl.Matcher) {
5454 m .Import ("github.com/coder/coder/v2/cli/clitest" )
5555 m .Import ("github.com/coder/coder/v2/enterprise/coderd/coderenttest" )
5656
57+ // For the AGPL code, we just check for SetupConfig being called with a
58+ // client authenticated as the Owner user.
5759 m .Match (`
5860 $_ := coderdtest.CreateFirstUser($t, $client)
5961 $*_
@@ -65,13 +67,28 @@ func testingWithOwnerUser(m dsl.Matcher) {
6567 At (m ["SetupConfig" ]).
6668 Report (`The CLI will be operating as the owner user, which has unrestricted permissions. Consider creating a different user.` )
6769
70+ // For the enterprise code, we check for any method called on the client.
71+ // While we want to be a bit stricter here, some methods are known to require
72+ // the owner user, so we exclude them.
6873 m .Match (`
6974 $client, $_ := coderdenttest.New($t, $*_)
7075 $*_
7176 $_, $_ := $client.$Method($*_)
7277 ` ).Where (m ["t" ].Type .Implements ("testing.TB" ) &&
73- m .File ().Name .Matches (`_test\.go$` )).
74- At (m ["client" ]).
78+ m .File ().Name .Matches (`_test\.go$` ) &&
79+ ! m ["Method" ].Text .Matches (`^(UpdateAppearance|AddLicense|InsertLicense|DeleteLicense|CreateWorkspaceProxy|Replicas|Regions)$` )).
80+ At (m ["Method" ]).
81+ Report (`The CLI will be operating as the owner user, which has unrestricted permissions. Consider creating a different user.` )
82+
83+ // Sadly, we need to match both one- and two-valued assignments separately.
84+ m .Match (`
85+ $client, $_ := coderdenttest.New($t, $*_)
86+ $*_
87+ $_ := $client.$Method($*_)
88+ ` ).Where (m ["t" ].Type .Implements ("testing.TB" ) &&
89+ m .File ().Name .Matches (`_test\.go$` ) &&
90+ ! m ["Method" ].Text .Matches (`^(UpdateAppearance|AddLicense|InsertLicense|DeleteLicense|CreateWorkspaceProxy|Replicas|Regions)$` )).
91+ At (m ["Method" ]).
7592 Report (`The CLI will be operating as the owner user, which has unrestricted permissions. Consider creating a different user.` )
7693}
7794
0 commit comments