71 lines
2.0 KiB
Go
71 lines
2.0 KiB
Go
package test
|
|
|
|
import (
|
|
"RenewCMS/api/pkg/access"
|
|
"RenewCMS/api/pkg/claims"
|
|
"RenewCMS/internal/domain/role"
|
|
"RenewCMS/internal/infrastructure/useCases"
|
|
"errors"
|
|
"net/http"
|
|
"os"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func grantRows(rows ...string) []role.Grant {
|
|
grants := make([]role.Grant, 0, len(rows))
|
|
for _, row := range rows {
|
|
key, scope, found := strings.Cut(row, "=")
|
|
if !found {
|
|
panic("grant row without a scope: " + row)
|
|
}
|
|
grants = append(grants, role.Grant{Key: key, Scope: role.Scope(scope)})
|
|
}
|
|
return grants
|
|
}
|
|
|
|
func unlockedGrantSet(rows ...string) role.GrantSet {
|
|
return role.Role{Grants: grantRows(rows...)}.GrantSet()
|
|
}
|
|
|
|
func requireMissingKey(t *testing.T, err error, key string) {
|
|
t.Helper()
|
|
if !errors.Is(err, role.ErrMissingPermission) || missingKeyOf(t, err) != key {
|
|
t.Fatalf("expected missing permission %q, got %v", key, err)
|
|
}
|
|
}
|
|
|
|
func readTestFile(t *testing.T, path string) string {
|
|
t.Helper()
|
|
content, err := os.ReadFile(path)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return string(content)
|
|
}
|
|
|
|
func ownerCaller(userID uint32) useCases.ContentCaller {
|
|
return useCases.ContentCaller{UserID: userID, Grants: role.BuiltInRoles()[0].GrantSet()}
|
|
}
|
|
|
|
func callerWith(userID uint32, rows ...string) useCases.ContentCaller {
|
|
return useCases.ContentCaller{UserID: userID, Grants: unlockedGrantSet(rows...)}
|
|
}
|
|
|
|
func contentAccess(getUser *useCases.GetUserUseCase) func(http.Handler) http.Handler {
|
|
adminGrants := role.BuiltInRoles()[1].GrantSet()
|
|
return func(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
r = access.WithCurrentUser(r)
|
|
if userID, ok := claims.UserId(r); ok {
|
|
account, err := access.LoadUser(getUser, r, userID)
|
|
version, hasVersion := claims.TokenVersion(r)
|
|
if err == nil && account.IsVerified && (!hasVersion || version == account.TokenVersion) {
|
|
r = r.WithContext(access.WithCaller(r.Context(), access.Caller{UserID: userID, Grants: adminGrants}))
|
|
}
|
|
}
|
|
next.ServeHTTP(w, r)
|
|
})
|
|
}
|
|
}
|