WIP: don't look at this

coder · Emyrk · Mar 26, 2022 · Mar 26, 2022 · Mar 27, 2022 · Mar 27, 2022
commit 1fac0d9c1eb6f4e44452eeec97b7f622bde49f3a
diff --git a/coderd/authz/authztest/set_test.go b/coderd/authz/authztest/set_test.go
@@ -5,14 +5,27 @@ import (
 	"testing"
 )
 
+func BenchmarkRole(b *testing.B) {
+	all := GroupedPermissions(AllPermissions())
+	r := ParseRole(all, "w(pa) s(*e) s(*e) s(*e) s(pe) s(pe) s(*) s(*)")
+	b.ResetTimer()
+	for n := 0; n < b.N; n++ {
+		if !r.Next() {
+			r.Reset()
+		}
+		FakeAuthorize(r.Permissions())
+	}
+}
+
 func TestRole(t *testing.T) {
 	all := GroupedPermissions(AllPermissions())
 	testCases := []struct {
 		Name         string
 		Permutations *Role
 		Access       bool
-	}{
+	}{ // 410,367,658
 		{
+			// [w] x [s1, s2, ""] = (w, s1), (w, s2), (w, "")
 			Name:         "W+",
 			Permutations: ParseRole(all, "w(pa) s(*e) o(*e) u(*e)"),
 			Access:       true,
@@ -71,20 +84,23 @@ func TestRole(t *testing.T) {
 	fmt.Printf("Total cases=%d\n", total)
 
 	// This is how you run the test cases
-	//for _, c := range testCases {
-	//	t.Run(c.Name, func(t *testing.T) {
-	//		c.Permutations.Each(func(set Set) {
-	//			// Actually printing all the errors would be insane
-	//			//require.Equal(t, c.Access, FakeAuthorize(set))
-	//			FakeAuthorize(set)
-	//		})
-	//	})
-	//}
+	for _, c := range testCases {
+		//t.Run(c.Name, func(t *testing.T) {
+		c.Permutations.Each(func(set Set) {
+			// Actually printing all the errors would be insane
+			//require.Equal(t, c.Access, FakeAuthorize(set))
+			FakeAuthorize(set)
+		})
+		//})
+	}
 }
 
 func FakeAuthorize(s Set) bool {
 	var f bool
 	for _, i := range s {
+		if i == nil {
+			continue
+		}
 		if i.Type() == "+" {
 			f = true
 		}

diff --git a/coderd/authz/permission.go b/coderd/authz/permission.go
@@ -0,0 +1,53 @@
+package authz
+
+import "strings"
+
+type permLevel string
+
+const (
+	LevelWildcard permLevel = "*"
+	LevelSite     permLevel = "site"
+	LevelOrg      permLevel = "org"
+	LevelUser     permLevel = "user"
+)
+
+var PermissionLevels = [4]permLevel{LevelWildcard, LevelSite, LevelOrg, LevelUser}
+
+type Permission struct {
+	// Sign is positive or negative.
+	// True = Positive, False = negative
+	Sign  bool
+	Level permLevel
+	// LevelID is used for identifying a particular org.
+	//	org:1234
+	LevelID string
+
+	ResourceType string
+	ResourceID   string
+	Action       string
+}
+
+// String returns the <level>.<resource_type>.<id>.<action> string formatted permission.
+// A string builder is used to be the most efficient.
+func (p Permission) String() string {
+	var s strings.Builder
+	// This could be 1 more than the actual capacity. But being 1 byte over for capacity is ok.
+	s.Grow(1 + 4 + len(p.Level) + len(p.LevelID) + len(p.ResourceType) + len(p.ResourceID) + len(p.Action))
+	if p.Sign {
+		s.WriteRune('+')
+	} else {
+		s.WriteRune('-')
+	}
+	s.WriteString(string(p.Level))
+	if p.LevelID != "" {
+		s.WriteRune(':')
+		s.WriteString(p.LevelID)
+	}
+	s.WriteRune('.')
+	s.WriteString(p.ResourceType)
+	s.WriteRune('.')
+	s.WriteString(p.ResourceID)
+	s.WriteRune('.')
+	s.WriteString(p.Action)
+	return s.String()
+}
diff --git a/coderd/authz/testdata/group.go b/coderd/authz/testdata/group.go
@@ -0,0 +1,13 @@
+package testdata
+
+type permissionSet string
+
+const (
+	SetPositive permissionSet = "j"
+	SetNegative permissionSet = "j!"
+	SetNeutral  permissionSet = "a"
+)
+
+var (
+	PermissionSets = []permissionSet{SetPositive, SetNegative, SetNeutral}
+)
diff --git a/coderd/authz/testdata/permissions.go b/coderd/authz/testdata/permissions.go
@@ -0,0 +1,53 @@
+package testdata
+
+import (
+	. "github.com/coder/coder/coderd/authz"
+)
+
+type level string
+
+const (
+	otherOption = "other"
+
+	levelWild   level = "*"
+	levelSite   level = "site"
+	levelOrg    level = "org"
+	levelOrgMem level = "org:mem"
+	// levelOrgAll is a helper to get both org levels above
+	levelOrgAll level = "org:*"
+	levelUser   level = "user"
+)
+
+var (
+	PermissionTypes = []bool{true, false}
+	Levels          = PermissionLevels
+	LevelIDs        = []string{"", "mem"}
+	ResourceTypes   = []string{"resource", "*", otherOption}
+	ResourceIDs     = []string{"rid", "*", otherOption}
+	Actions         = []string{"action", "*", otherOption}
+)
+
+func AllPermissions() Set {
+	all := make(Set, 0, 2*len(Levels)*len(LevelIDs)*len(ResourceTypes)*len(ResourceIDs)*len(Actions))
+	for _, p := range PermissionTypes {
+		for _, l := range Levels {
+			for _, lid := range LevelIDs {
+				for _, t := range ResourceTypes {
+					for _, i := range ResourceIDs {
+						for _, a := range Actions {
+							all = append(all, &Permission{
+								Sign:         p,
+								Level:        l,
+								LevelID:      lid,
+								ResourceType: t,
+								ResourceID:   i,
+								Action:       a,
+							})
+						}
+					}
+				}
+			}
+		}
+	}
+	return all
+}
diff --git a/coderd/authz/testdata/role.go b/coderd/authz/testdata/role.go
@@ -0,0 +1,10 @@
+package testdata
+
+import (
+	. "github.com/coder/coder/coderd/authz"
+)
+
+var _ Permission
+
+type Role struct {
+}
diff --git a/coderd/authz/testdata/set.go b/coderd/authz/testdata/set.go
@@ -0,0 +1,20 @@
+package testdata
+
+import (
+	"strings"
+
+	. "github.com/coder/coder/coderd/authz"
+)
+
+type Set []*Permission
+
+func (s Set) String() string {
+	var str strings.Builder
+	sep := ""
+	for _, v := range s {
+		str.WriteString(sep)
+		str.WriteString(v.String())
+		sep = ", "
+	}
+	return str.String()
+}