Skip to content

test: Add unit test for rbac Authorize() function #853

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 44 commits into from
Closed

test: Add unit test for rbac Authorize() function #853

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
44 commits
Select commit Hold shift + click to select a range
ab61328
WIP: This is a massive WIP
Emyrk Mar 26, 2022
03e4d0f
More info in the print
Emyrk Mar 26, 2022
9981291
Fix all()
Emyrk Mar 27, 2022
3ab32da
reduce the amount of memoery allocated
Emyrk Mar 27, 2022
e1d5893
Reuse a buffer
Emyrk Mar 28, 2022
84a90f3
fix: use return size over size
Emyrk Mar 29, 2022
1fac0d9
WIP: don't look at this
Emyrk Mar 29, 2022
1e3aac0
WIP: 🍐 auth-> testdata, refactoring and restructuring
johnstcn Mar 30, 2022
e977e84
testdata -> authztest
johnstcn Mar 30, 2022
00a7c3f
WIP: start work on SVO
johnstcn Mar 30, 2022
1f04c01
reduce allocations for union sets
Emyrk Mar 31, 2022
fbf4db1
fix: Fix nil permissions as Strings()
Emyrk Mar 31, 2022
4946897
chore: Make all permission variant levels
Emyrk Mar 31, 2022
7e6cc66
First full draft of the authz authorize test
Emyrk Mar 31, 2022
a0017e5
Tally up failed tests
Emyrk Mar 31, 2022
4b110b3
Change test pkg
Emyrk Mar 31, 2022
65ef4e3
Use an interface for the object
Emyrk Mar 31, 2022
d294786
fix: make authztest.Objects return correct type
johnstcn Apr 1, 2022
c1f8945
refactor: rename consts {Read,Write,Modify,Delete}Action to Action$1
johnstcn Apr 1, 2022
01f3d40
chore: Define object interface
Emyrk Apr 1, 2022
de7de6e
test: Unit test extra properties
Emyrk Apr 1, 2022
4c86e44
Merge remote-tracking branch 'origin/stevenmasley/rbac' into stevenma…
Emyrk Apr 1, 2022
30c6568
put back interface assertion
Emyrk Apr 1, 2022
a419a65
Fix some compile errors from merge
Emyrk Apr 1, 2022
bbd1c4c
test: Roles, sets, permissions, iterators
Emyrk Apr 1, 2022
def010f
Test string functions
Emyrk Apr 1, 2022
c4ee590
test: Unit test permission string
Emyrk Apr 4, 2022
84e3ab9
Add A+ and A-
Emyrk Apr 4, 2022
c2eec18
Parallelize tests
Emyrk Apr 4, 2022
5a2834a
fix code line in readme
Emyrk Apr 4, 2022
913d141
Merge remote-tracking branch 'origin/main' into stevenmasley/rbac
Emyrk Apr 4, 2022
2804b92
test: ParsePermissions from strings
Emyrk Apr 4, 2022
5698938
use fmt over str builder for easier to read
Emyrk Apr 4, 2022
75ed8ef
Linting
Emyrk Apr 4, 2022
b2db661
authz: README.md: update table formatting
johnstcn Apr 5, 2022
26ef1e6
Make action CRUD
Emyrk Apr 5, 2022
19aba30
LevelID -> OrganizationID
Emyrk Apr 5, 2022
ceee9cd
feat: authztest: categorize test failures by test name
johnstcn Apr 5, 2022
ee8bf04
fixup! feat: authztest: categorize test failures by test name
johnstcn Apr 5, 2022
44c02a1
chore: add documentation for authz and authztest
johnstcn Apr 6, 2022
dfb9ad1
fixup! chore: add documentation for authz and authztest
johnstcn Apr 6, 2022
e482d2c
chore: more authz/authztest docs
johnstcn Apr 6, 2022
a4e038f
Remove underscore from test names
Emyrk Apr 6, 2022
9918c16
zObject does not need exported fields
Emyrk Apr 6, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
LevelID -> OrganizationID
  • Loading branch information
@Emyrk
Emyrk committed Apr 5, 2022
commit 19aba30b35ffb18864a56b74bcf08e0fdfd608ee
12 changes: 6 additions & 6 deletions coderd/authz/authztest/iterator_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,12 +59,12 @@ func RandomPermission() authz.Permission {
authz.ActionDelete,
}
return authz.Permission{
Negate: must(crand.Intn(2))%2 == 0,
Level: authz.PermissionLevels[must(crand.Intn(len(authz.PermissionLevels)))],
LevelID: uuid.New().String(),
ResourceType: authz.ResourceWorkspace,
ResourceID: uuid.New().String(),
Action: actions[must(crand.Intn(len(actions)))],
Negate: must(crand.Intn(2))%2 == 0,
Level: authz.PermissionLevels[must(crand.Intn(len(authz.PermissionLevels)))],
OrganizationID: uuid.New().String(),
ResourceType: authz.ResourceWorkspace,
ResourceID: uuid.New().String(),
Action: actions[must(crand.Intn(len(actions)))],
}
}

Expand Down
2 changes: 1 addition & 1 deletion coderd/authz/authztest/level.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@ func GroupedPermissions(perms Set) SetGroup {
groups[LevelSiteKey][m] = append(groups[LevelSiteKey][m], p)
case p.Level == authz.LevelOrg:
groups[LevelOrgAllKey][m] = append(groups[LevelOrgAllKey][m], p)
if p.LevelID == "" || p.LevelID == "*" {
if p.OrganizationID == "" || p.OrganizationID == "*" {
groups[LevelOrgKey][m] = append(groups[LevelOrgKey][m], p)
} else {
groups[LevelOrgMemKey][m] = append(groups[LevelOrgMemKey][m], p)
Expand Down
10 changes: 5 additions & 5 deletions coderd/authz/authztest/level_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,11 +19,11 @@ func Test_GroupedPermissions(t *testing.T) {
for _, a := range []authz.Action{authz.ActionRead, authztest.OtherOption} {
if lvl == authz.LevelOrg {
set = append(set, &authz.Permission{
Negate: s,
Level: lvl,
LevelID: "mem",
ResourceType: authz.ResourceWorkspace,
Action: a,
Negate: s,
Level: lvl,
OrganizationID: "mem",
ResourceType: authz.ResourceWorkspace,
Action: a,
})
total++
}
Expand Down
24 changes: 12 additions & 12 deletions coderd/authz/authztest/permissions.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,21 +31,21 @@ func AllPermissions() Set {
for _, a := range actions {
if l == authz.LevelOrg {
all = append(all, &authz.Permission{
Negate: s,
Level: l,
LevelID: PermOrgID,
ResourceType: t,
ResourceID: i,
Action: a,
Negate: s,
Level: l,
OrganizationID: PermOrgID,
ResourceType: t,
ResourceID: i,
Action: a,
})
}
all = append(all, &authz.Permission{
Negate: s,
Level: l,
LevelID: "",
ResourceType: t,
ResourceID: i,
Action: a,
Negate: s,
Level: l,
OrganizationID: "",
ResourceType: t,
ResourceID: i,
Action: a,
})
}
}
Expand Down
24 changes: 12 additions & 12 deletions coderd/authz/authztest/set_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,21 +49,21 @@ func Test_Set(t *testing.T) {

set := authztest.Set{
&authz.Permission{
Negate: false,
Level: authz.LevelOrg,
LevelID: "1234",
ResourceType: authz.ResourceWorkspace,
ResourceID: "1234",
Action: authz.ActionRead,
Negate: false,
Level: authz.LevelOrg,
OrganizationID: "1234",
ResourceType: authz.ResourceWorkspace,
ResourceID: "1234",
Action: authz.ActionRead,
},
nil,
&authz.Permission{
Negate: true,
Level: authz.LevelSite,
LevelID: "",
ResourceType: authz.ResourceWorkspace,
ResourceID: "*",
Action: authz.ActionRead,
Negate: true,
Level: authz.LevelSite,
OrganizationID: "",
ResourceType: authz.ResourceWorkspace,
ResourceID: "*",
Action: authz.ActionRead,
},
}

Expand Down
10 changes: 5 additions & 5 deletions coderd/authz/permission.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,9 +22,9 @@ type Permission struct {
// Negate makes this a negative permission
Negate bool
Level PermLevel
// LevelID is used for identifying a particular org.
// OrganizationID is used for identifying a particular org.
// org:1234
LevelID string
OrganizationID string

ResourceType ResourceType
ResourceID string
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All of our resource identifiers are UUIDs, can this be one too?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I thought some ids from v1 are still strings. I would like uuid yes, I can change if this is true

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is true! All v1 IDs have been converted to UUIDs.

Expand All @@ -38,8 +38,8 @@ func (p Permission) String() string {
sign = "-"
}
levelID := ""
if p.LevelID != "" {
levelID = ":" + p.LevelID
if p.OrganizationID != "" {
levelID = ":" + p.OrganizationID
}

return fmt.Sprintf("%s%s%s.%s.%s.%s",
Expand Down Expand Up @@ -100,7 +100,7 @@ func ParsePermission(perm string) (Permission, error) {
}

if len(levelParts) > 1 {
permission.LevelID = levelParts[1]
permission.OrganizationID = levelParts[1]
}

// might want to check if these are valid resource types and actions.
Expand Down
60 changes: 30 additions & 30 deletions coderd/authz/permission_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,36 +19,36 @@ func Test_PermissionString(t *testing.T) {
{
Name: "BasicPositive",
Permission: authz.Permission{
Negate: false,
Level: authz.LevelSite,
LevelID: "",
ResourceType: authz.ResourceWorkspace,
ResourceID: "*",
Action: authz.ActionRead,
Negate: false,
Level: authz.LevelSite,
OrganizationID: "",
ResourceType: authz.ResourceWorkspace,
ResourceID: "*",
Action: authz.ActionRead,
},
Expected: "+site.workspace.*.read",
},
{
Name: "BasicNegative",
Permission: authz.Permission{
Negate: true,
Level: authz.LevelUser,
LevelID: "",
ResourceType: authz.ResourceDevURL,
ResourceID: "1234",
Action: authz.ActionCreate,
Negate: true,
Level: authz.LevelUser,
OrganizationID: "",
ResourceType: authz.ResourceDevURL,
ResourceID: "1234",
Action: authz.ActionCreate,
},
Expected: "-user.devurl.1234.create",
},
{
Name: "OrgID",
Permission: authz.Permission{
Negate: true,
Level: authz.LevelOrg,
LevelID: "default",
ResourceType: authz.ResourceProject,
ResourceID: "456",
Action: authz.ActionUpdate,
Negate: true,
Level: authz.LevelOrg,
OrganizationID: "default",
ResourceType: authz.ResourceProject,
ResourceID: "456",
Action: authz.ActionUpdate,
},
Expected: "-org:default.project.456.update",
},
Expand Down Expand Up @@ -111,20 +111,20 @@ func Test_ParsePermissions(t *testing.T) {
Str: "+org:1234.workspace.5678.read, -site.*.*.create",
Permissions: []authz.Permission{
{
Negate: false,
Level: "org",
LevelID: "1234",
ResourceType: authz.ResourceWorkspace,
ResourceID: "5678",
Action: authz.ActionRead,
Negate: false,
Level: "org",
OrganizationID: "1234",
ResourceType: authz.ResourceWorkspace,
ResourceID: "5678",
Action: authz.ActionRead,
},
{
Negate: true,
Level: "site",
LevelID: "",
ResourceType: "*",
ResourceID: "*",
Action: authz.ActionCreate,
Negate: true,
Level: "site",
OrganizationID: "",
ResourceType: "*",
ResourceID: "*",
Action: authz.ActionCreate,
},
},
},
Expand Down
12 changes: 6 additions & 6 deletions coderd/authz/subject.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,12 +46,12 @@ func (s SubjectTODO) OrgRoles(_ context.Context, orgID string) ([]Role, error) {
return []Role{{
Permissions: []Permission{
{
Negate: true,
Level: "*",
LevelID: "",
ResourceType: "*",
ResourceID: "*",
Action: "*",
Negate: true,
Level: "*",
OrganizationID: "",
ResourceType: "*",
ResourceID: "*",
Action: "*",
},
},
}}, nil
Expand Down