Add group ACL unit test

Emyrk · Emyrk · commit d50a0c599e52 · 2022-09-26T14:10:12.000-04:00
diff --git a/coderd/rbac/authz_internal_test.go b/coderd/rbac/authz_internal_test.go
@@ -198,17 +198,19 @@ func TestAuthorizeDomain(t *testing.T) {
 	t.Parallel()
 	defOrg := uuid.New()
 	unuseID := uuid.New()
+	allUsersGroup := "all_users"
 
 	user := subject{
 		UserID: "me",
 		Scope:  must(ScopeRole(ScopeAll)),
+		Groups: []string{allUsersGroup},
 		Roles: []Role{
 			must(RoleByName(RoleMember())),
 			must(RoleByName(RoleOrgMember(defOrg))),
 		},
 	}
 
-	testAuthorize(t, "ACLList", user, []authTestCase{
+	testAuthorize(t, "UserACLList", user, []authTestCase{
 		{
 			resource: ResourceWorkspace.WithOwner(unuseID.String()).InOrg(unuseID).WithACLUserList(map[string][]Action{
 				user.UserID: allActions(),
@@ -240,6 +242,38 @@ func TestAuthorizeDomain(t *testing.T) {
 		},
 	})
 
+	testAuthorize(t, "GroupACLList", user, []authTestCase{
+		{
+			resource: ResourceWorkspace.WithOwner(unuseID.String()).InOrg(unuseID).WithGroups(map[string][]Action{
+				allUsersGroup: allActions(),
+			}),
+			actions: allActions(),
+			allow:   true,
+		},
+		{
+			resource: ResourceWorkspace.WithOwner(unuseID.String()).InOrg(unuseID).WithGroups(map[string][]Action{
+				allUsersGroup: {WildcardSymbol},
+			}),
+			actions: allActions(),
+			allow:   true,
+		},
+		{
+			resource: ResourceWorkspace.WithOwner(unuseID.String()).InOrg(unuseID).WithGroups(map[string][]Action{
+				allUsersGroup: {ActionRead, ActionUpdate},
+			}),
+			actions: []Action{ActionCreate, ActionDelete},
+			allow:   false,
+		},
+		{
+			// By default users cannot update templates
+			resource: ResourceTemplate.InOrg(defOrg).WithGroups(map[string][]Action{
+				allUsersGroup: {ActionUpdate},
+			}),
+			actions: []Action{ActionRead, ActionUpdate},
+			allow:   true,
+		},
+	})
+
 	testAuthorize(t, "Member", user, []authTestCase{
 		// Org + me
 		{resource: ResourceWorkspace.InOrg(defOrg).WithOwner(user.UserID), actions: allActions(), allow: true},
@@ -790,21 +824,19 @@ func testAuthorize(t *testing.T, name string, subject subject, sets ...[]authTes
 
 					authError := authorizer.Authorize(ctx, subject.UserID, subject.Roles, subject.Scope, subject.Groups, a, c.resource)
 
+					d, _ := json.Marshal(map[string]interface{}{
+						"subject": subject,
+						"object":  c.resource,
+						"action":  a,
+					})
+
 					// Logging only
+					t.Logf("input: %s", string(d))
 					if authError != nil {
 						var uerr *UnauthorizedError
 						xerrors.As(authError, &uerr)
-						d, _ := json.Marshal(uerr.Input())
-						t.Logf("input: %s", string(d))
 						t.Logf("internal error: %+v", uerr.Internal().Error())
 						t.Logf("output: %+v", uerr.Output())
-					} else {
-						d, _ := json.Marshal(map[string]interface{}{
-							"subject": subject,
-							"object":  c.resource,
-							"action":  a,
-						})
-						t.Log(string(d))
 					}
 
 					if c.allow {
@@ -819,8 +851,6 @@ func testAuthorize(t *testing.T, name string, subject subject, sets ...[]authTes
 					// Also check the rego policy can form a valid partial query result.
 					// This ensures we can convert the queries into SQL WHERE clauses in the future.
 					// If this function returns 'Support' sections, then we cannot convert the query into SQL.
-					d, _ := json.Marshal(partialAuthz.input)
-					t.Logf("input: %s", string(d))
 					for _, q := range partialAuthz.partialQueries.Queries {
 						t.Logf("query: %+v", q.String())
 					}
diff --git a/coderd/rbac/policy.rego b/coderd/rbac/policy.rego
@@ -217,6 +217,11 @@ acl_allow {
 	[input.action, "*"][_] in perms
 }
 
+###############
+# Final Allow
+# The role or the ACL must allow the action. Scopes can be used to limit,
+# so scope_allow must always be true.
+
 allow {
 	role_allow
 	scope_allow
@@ -227,5 +232,3 @@ allow {
 	acl_allow
 	scope_allow
 }
-
-
