chore: add linter to detect potential spurious usage of owner user in tests

johnstcn · johnstcn · commit d3114cdbab02 · 2023-10-08T23:01:57.000+01:00
diff --git a/scripts/rules.go b/scripts/rules.go
@@ -43,6 +43,33 @@ func dbauthzAuthorizationContext(m dsl.Matcher) {
 		Report("Using '$f' is dangerous and should be accompanied by a comment explaining why it's ok and a nolint.")
 }
 
+// testingWithOwnerUser is a lint rule that detects potential permission bugs.
+// Calling CreateFirstUser in a test is fine, but we should avoid
+// using the the methods of the client passed to it.
+// However, using it in coderdtest.* methods is generally OK since
+// these are used to setup the test environment.
+//
+// Similarly, calling clitest.SetupConfig with a client authenticated
+// as the Owner user can be a problem, since the CLI will be operating
+// as the owner user and we may miss permission bugs.
+//
+//nolint:unused,deadcode,varnamelen
+func testingWithOwnerUser(m dsl.Matcher) {
+	m.Import("testing")
+	m.Import("github.com/coder/coder/v2/cli/clitest")
+
+	m.Match(`
+	$_ := coderdtest.CreateFirstUser($t, $client)
+	$*_
+	clitest.$SetupConfig($t, $client, $_)
+	`).
+		Where(m["t"].Type.Implements("testing.TB") &&
+			m["SetupConfig"].Text.Matches("^SetupConfig$") &&
+			m.File().Name.Matches(`_test\.go$`)).
+		At(m["SetupConfig"]).
+		Report(`The CLI will be operating as the owner user, which has unrestricted permissions. Consider creating a different user.`)
+}
+
 // Use xerrors everywhere! It provides additional stacktrace info!
 //
 //nolint:unused,deadcode,varnamelen
