Jakub Zych
a5ce43f211
validatePluginTokenScope checked the trimmed name with pact.ValidTokenScopeName while compileTokenScopes registered the untrimmed one, so " blog:read" booted, was listed under its padded name and could never be granted, and the duplicate check depended on registration order. The name is now validated exactly as registered, which is the shared rule pact.ValidTokenScopeName states.
48 lines
1.6 KiB
Go
48 lines
1.6 KiB
Go
package cabana
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"git.golem15.com/golem15/summercms/modules/pact"
|
|
)
|
|
|
|
// TestTokenScopeNameParity pins plan 07's shared scope name rule (P-30):
|
|
// cabana's plugin scope validation accepts and refuses exactly the names
|
|
// pact.ValidTokenScopeName does (the table of pact's TestFrontendTokenScopes;
|
|
// "*" is refused by both, by cabana also as reserved). A padded name is
|
|
// refused by both: cabana validates the name it registers, untrimmed.
|
|
func TestTokenScopeNameParity(t *testing.T) {
|
|
names := []struct {
|
|
name string
|
|
ok bool
|
|
}{
|
|
{"read", true},
|
|
{"servers:write", true},
|
|
{"a_b-c:d", true},
|
|
{"", false},
|
|
{"Read", false},
|
|
{"servers:", false},
|
|
{":x", false},
|
|
{"a:b:c", false},
|
|
{"*", false},
|
|
{"with space", false},
|
|
// RB-WR-02: a padded name is refused as registered, not trimmed first.
|
|
{" read", false},
|
|
{"read ", false},
|
|
{"read\n", false},
|
|
{"\tblog:read", false},
|
|
}
|
|
for _, c := range names {
|
|
if got := pact.ValidTokenScopeName(c.name); got != c.ok {
|
|
t.Fatalf("pact.ValidTokenScopeName(%q) = %v, want %v (the table drifted from pact's)", c.name, got, c.ok)
|
|
}
|
|
cat := &tokenScopeCatalog{byName: map[string]*compiledTokenScope{}}
|
|
scope := pact.TokenScope{Name: c.name, Label: "Label", Description: "Description", Permissions: []string{"acme.*"}, Methods: []string{"GET"}}
|
|
reg := &Registry{permissions: map[string]pact.Permission{"acme.read": {Code: "acme.read"}}}
|
|
err := validatePluginTokenScope(reg, "acme.plugin", scope, cat)
|
|
if (err == nil) != c.ok {
|
|
t.Errorf("validatePluginTokenScope(%q) err = %v, want accepted %v", c.name, err, c.ok)
|
|
}
|
|
}
|
|
}
|