b684bb7d8d
- TestAdministratorsSuperuserHidden (D-03, scoped-token superusers) - TestAdministratorsSuperuserProjected (Pitfall 1) - TestAdministratorsPermissionCeiling and TestAdministratorsRoleCeiling (D-06, D-07) - TestAdministratorsSelfEdit (D-08), TestAdministratorsPasswordAndIdentity (D-11) - TestAdministratorsOutranked (D-19), TestAdministratorsOwnPassword (D-20) - TestRoleCeiling (-short) against grantsCovered
48 lines
2.2 KiB
Go
48 lines
2.2 KiB
Go
package cabana
|
|
|
|
import "testing"
|
|
|
|
// TestRoleCeiling (D-07) pins grantsCovered: plain codes go through granted,
|
|
// a wildcard a role grants is covered only by the same or a broader holder
|
|
// wildcard.
|
|
func TestRoleCeiling(t *testing.T) {
|
|
set := func(codes ...string) map[string]bool {
|
|
out := map[string]bool{}
|
|
for _, code := range codes {
|
|
out[code] = true
|
|
}
|
|
return out
|
|
}
|
|
for _, tc := range []struct {
|
|
name string
|
|
holder map[string]bool
|
|
wanted map[string]bool
|
|
want bool
|
|
}{
|
|
{"exact codes held", set("acme.blog.posts", "acme.blog.tags"), set("acme.blog.posts"), true},
|
|
{"exact code missing", set("acme.blog.posts"), set("acme.blog.posts", "acme.blog.tags"), false},
|
|
{"holder wildcard covers exact codes", set("acme.blog.*"), set("acme.blog.posts", "acme.blog.tags"), true},
|
|
{"broader holder wildcard covers exact codes", set("acme.*"), set("acme.blog.posts"), true},
|
|
{"holder wildcard of another prefix", set("acme.shop.*"), set("acme.blog.posts"), false},
|
|
{"role wildcard covered by the same wildcard", set("acme.blog.*"), set("acme.blog.*"), true},
|
|
{"role wildcard covered by a broader wildcard", set("acme.*"), set("acme.blog.*"), true},
|
|
{"role wildcard not covered by a narrower wildcard", set("acme.blog.posts.*"), set("acme.blog.*"), false},
|
|
{"role wildcard not covered by exact codes", set("acme.blog.posts", "acme.blog.tags"), set("acme.blog.*"), false},
|
|
{"suffix wildcard covered only by itself", set("*.manage"), set("*.manage"), true},
|
|
{"suffix wildcard not covered by exact codes", set("acme.manage", "shop.manage"), set("*.manage"), false},
|
|
{"suffix wildcard not covered by a prefix wildcard", set("acme.*"), set("*.manage"), false},
|
|
{"false role entries are ignored", set(), map[string]bool{"acme.blog.posts": false}, true},
|
|
{"empty role", set("acme.blog.posts"), set(), true},
|
|
{"nil role", nil, nil, true},
|
|
{"nil holder and an empty role", nil, set(), true},
|
|
{"nil holder and a granting role", nil, set("acme.blog.posts"), false},
|
|
{"nil holder and a wildcard role", nil, set("acme.*"), false},
|
|
} {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
if got := grantsCovered(tc.holder, tc.wanted); got != tc.want {
|
|
t.Fatalf("grantsCovered(%v, %v) = %v, want %v", tc.holder, tc.wanted, got, tc.want)
|
|
}
|
|
})
|
|
}
|
|
}
|