fsylvain/RenewCMS
1
1 Fork 0
Code Issues Pull Requests Packages Projects Releases 31 Wiki Activity

refac: debt on role backend

Browse Source
This commit is contained in:
Florian Sylvain committed 2026-10-26 23:34:35 +01:00
1 parent de142f6c5f
commit a043f7f41a
130 files changed
+3591 -512
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

test/roles_permissions_enforcement_test.go
+11 -16
View File
@@ -73,17 +73,17 @@ func TestCheckPermissionUseCase(t *testing.T) {
if err != nil {
t.Fatal(err)
}
if grants.Scope("authors.edit") != role.ScopeOwn || grants.Scope("users.view") != role.ScopeNone {
if grants.ScopeFor("authors.edit", "") != role.ScopeOwn || grants.ScopeFor("users.view", "") != role.ScopeNone {
t.Errorf("unexpected grants %v", grants)
}
})
t.Run("A custom role is judged by its grants only, owner-only keys included", func(t *testing.T) {
t.Run("A custom role is judged by its grants only, owner-only keys excluded", func(t *testing.T) {
check, roles := newCheck()
custom, _ := roles.Create(role.Role{Name: "Hand made", Version: 1, Grants: []role.Grant{{Key: "system.apply_updates", Scope: role.ScopeAll}}})
account := user.User{ID: 20, RoleID: custom.ID}
if _, err := check.Require(account, "system.apply_updates"); err != nil {
t.Errorf("expected the hand-placed owner-only key to be honoured, got %v", err)
if _, err := check.Require(account, "system.apply_updates"); !errors.Is(err, role.ErrMissingPermission) {
t.Errorf("expected the hand-placed owner-only key to be ignored on an unlocked role, got %v", err)
}
if _, err := check.Require(account, "schema.view"); !errors.Is(err, role.ErrMissingPermission) {
t.Errorf("expected no implied keys, got %v", err)
@@ -122,11 +122,6 @@ func TestCheckPermissionUseCase(t *testing.T) {
if err == nil || errors.Is(err, role.ErrMissingPermission) {
t.Fatalf("expected a plain failure, got %v", err)
}
roles.fail.failNext("ListGrants")
_, err = check.Require(owner, "users.view")
if err == nil || errors.Is(err, role.ErrMissingPermission) {
t.Fatalf("expected a plain failure, got %v", err)
}
})
t.Run("Grant changes apply to the next call with no cache", func(t *testing.T) {
@@ -146,13 +141,13 @@ func TestCheckPermissionUseCase(t *testing.T) {
func TestGrantSet(t *testing.T) {
t.Run("an absent key is none and a nil set holds nothing", func(t *testing.T) {
var empty role.GrantSet
if empty.Scope("users.view") != role.ScopeNone || empty.Holds("users.view") || empty.HoldsAll("users.view") {
if empty.ScopeFor("users.view", "") != role.ScopeNone || empty.Holds("users.view") || empty.HoldsAll("users.view") {
t.Error("a nil set must hold nothing")
}
})
t.Run("Holds is true for own and all, HoldsAll only for all", func(t *testing.T) {
set := role.NewGrantSet([]role.Grant{{Key: "a", Scope: role.ScopeOwn}, {Key: "b", Scope: role.ScopeAll}, {Key: "c", Scope: role.ScopeNone}})
if !set.Holds("a") || set.HoldsAll("a") || !set.Holds("b") || !set.HoldsAll("b") || set.Holds("c") {
set := unlockedGrantSet("content.update=own", "content.delete=all", "content.read=none")
if !set.Holds("content.update") || set.HoldsAll("content.update") || !set.Holds("content.delete") || !set.HoldsAll("content.delete") || set.Holds("content.read") {
t.Errorf("unexpected %v", set)
}
})
@@ -165,8 +160,8 @@ func TestGrantSet(t *testing.T) {
}
var (
activityViewAllGrants = role.NewGrantSet([]role.Grant{{Key: role.KeyActivityView, Scope: role.ScopeAll}})
activityViewOwnGrants = role.NewGrantSet([]role.Grant{{Key: role.KeyActivityView, Scope: role.ScopeOwn}})
authorsEditOwnGrants = role.NewGrantSet([]role.Grant{{Key: role.KeyAuthorsEdit, Scope: role.ScopeOwn}})
authorsEditAllGrants = role.NewGrantSet([]role.Grant{{Key: role.KeyAuthorsEdit, Scope: role.ScopeAll}})
activityViewAllGrants = unlockedGrantSet(role.KeyActivityView + "=all")
activityViewOwnGrants = unlockedGrantSet(role.KeyActivityView + "=own")
authorsEditOwnGrants = unlockedGrantSet(role.KeyAuthorsEdit + "=own")
authorsEditAllGrants = unlockedGrantSet(role.KeyAuthorsEdit + "=all")
)