chore(scripts/rules.go): broaden scope of testingWithOwnerUser linter

johnstcn · johnstcn · commit cf14a92d5d2a · 2023-11-07T17:33:30.000Z
diff --git a/scripts/rules.go b/scripts/rules.go
@@ -52,7 +52,10 @@ func dbauthzAuthorizationContext(m dsl.Matcher) {
 func testingWithOwnerUser(m dsl.Matcher) {
 	m.Import("testing")
 	m.Import("github.com/coder/coder/v2/cli/clitest")
+	m.Import("github.com/coder/coder/v2/enterprise/coderd/coderenttest")
 
+	// For the AGPL code, we just check for SetupConfig being called with a
+	// client authenticated as the Owner user.
 	m.Match(`
 	$_ := coderdtest.CreateFirstUser($t, $client)
 	$*_
@@ -63,6 +66,30 @@ func testingWithOwnerUser(m dsl.Matcher) {
 			m.File().Name.Matches(`_test\.go$`)).
 		At(m["SetupConfig"]).
 		Report(`The CLI will be operating as the owner user, which has unrestricted permissions. Consider creating a different user.`)
+
+	// For the enterprise code, we check for any method called on the client.
+	// While we want to be a bit stricter here, some methods are known to require
+	// the owner user, so we exclude them.
+	m.Match(`
+		$client, $_ := coderdenttest.New($t, $*_)
+		$*_
+		$_, $_ := $client.$Method($*_)
+	`).Where(m["t"].Type.Implements("testing.TB") &&
+		m.File().Name.Matches(`_test\.go$`) &&
+		!m["Method"].Text.Matches(`^(UpdateAppearance|AddLicense|InsertLicense|DeleteLicense|CreateWorkspaceProxy|Replicas|Regions)$`)).
+		At(m["Method"]).
+		Report(`The CLI will be operating as the owner user, which has unrestricted permissions. Consider creating a different user.`)
+
+	// Sadly, we need to match both one- and two-valued assignments separately.
+	m.Match(`
+	$client, $_ := coderdenttest.New($t, $*_)
+	$*_
+	$_ := $client.$Method($*_)
+	`).Where(m["t"].Type.Implements("testing.TB") &&
+		m.File().Name.Matches(`_test\.go$`) &&
+		!m["Method"].Text.Matches(`^(UpdateAppearance|AddLicense|InsertLicense|DeleteLicense|CreateWorkspaceProxy|Replicas|Regions)$`)).
+		At(m["Method"]).
+		Report(`The CLI will be operating as the owner user, which has unrestricted permissions. Consider creating a different user.`)
 }
 
 // Use xerrors everywhere! It provides additional stacktrace info!
