-
Notifications
You must be signed in to change notification settings - Fork 34
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
test: verify resource permissions are asserted correctly
Signed-off-by: Kush Sharma <[email protected]>
- Loading branch information
1 parent
581f66c
commit 00d1c2e
Showing
1 changed file
with
181 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -1635,6 +1635,187 @@ func (s *APIRegressionTestSuite) TestResourceAPI() { | |
| s.Assert().NoError(err) | ||
| s.Assert().False(deletePermResp.GetStatus()) | ||
| }) | ||
| s.Run("3. run time permissions and roles assigned over resources should enforce correctly", func() { | ||
| // create org | ||
| createOrgResp, err := s.testBench.Client.CreateOrganization(ctxOrgAdminAuth, &frontierv1beta1.CreateOrganizationRequest{ | ||
| Body: &frontierv1beta1.OrganizationRequestBody{ | ||
| Title: "org 3", | ||
| Name: "org-resource-3", | ||
| }, | ||
| }) | ||
| s.Assert().NoError(err) | ||
|
|
||
| // create users | ||
| user1Resp, err := s.testBench.Client.CreateUser(ctxOrgAdminAuth, &frontierv1beta1.CreateUserRequest{Body: &frontierv1beta1.UserRequestBody{ | ||
| Title: "member 1", | ||
| Email: "[email protected]", | ||
| Name: "user_org_3_resource_1", | ||
| }}) | ||
| s.Assert().NoError(err) | ||
| user2Resp, err := s.testBench.Client.CreateUser(ctxOrgAdminAuth, &frontierv1beta1.CreateUserRequest{Body: &frontierv1beta1.UserRequestBody{ | ||
| Title: "member 2", | ||
| Email: "[email protected]", | ||
| Name: "user_org_3_resource_2", | ||
| }}) | ||
| s.Assert().NoError(err) | ||
|
|
||
| // create a project within org | ||
| createProjResp, err := s.testBench.Client.CreateProject(ctxOrgAdminAuth, &frontierv1beta1.CreateProjectRequest{ | ||
| Body: &frontierv1beta1.ProjectRequestBody{ | ||
| Name: "org-3-proj-1", | ||
| OrgId: createOrgResp.GetOrganization().GetId(), | ||
| }, | ||
| }) | ||
| s.Assert().NoError(err) | ||
|
|
||
| // create permission for a resource type | ||
| resourceNamespace := "compute/network" | ||
| createdPermissions, err := s.testBench.AdminClient.CreatePermission(ctxOrgAdminAuth, &frontierv1beta1.CreatePermissionRequest{ | ||
| Bodies: []*frontierv1beta1.PermissionRequestBody{ | ||
| { | ||
| Key: "compute.network.create", | ||
| }, | ||
| { | ||
| Key: "compute.network.delete", | ||
| }, | ||
| }, | ||
| }) | ||
| s.Assert().NoError(err) | ||
| s.Assert().Len(createdPermissions.GetPermissions(), 2) | ||
|
|
||
| // create a role at project level without resource access | ||
| projectViewerRoleResp, err := s.testBench.AdminClient.CreateRole(ctxOrgAdminAuth, &frontierv1beta1.CreateRoleRequest{ | ||
| Body: &frontierv1beta1.RoleRequestBody{ | ||
| Name: "project_viewer_custom", | ||
| Permissions: []string{ | ||
| "app_project_get", | ||
| "app_project_resourcelist", | ||
| }, | ||
| }, | ||
| }) | ||
| s.Assert().NoError(err) | ||
| s.Assert().NotNil(projectViewerRoleResp) | ||
|
|
||
| // create a role at project level with resource create access | ||
| projectManagerRoleResp, err := s.testBench.AdminClient.CreateRole(ctxOrgAdminAuth, &frontierv1beta1.CreateRoleRequest{ | ||
| Body: &frontierv1beta1.RoleRequestBody{ | ||
| Name: "project_manager_custom", | ||
| Permissions: []string{ | ||
| "app_project_get", | ||
| "app_project_resourcelist", | ||
| "compute.network.create", | ||
| }, | ||
| }, | ||
| }) | ||
| s.Assert().NoError(err) | ||
| s.Assert().NotNil(projectManagerRoleResp) | ||
|
|
||
| // create a role at project level with resource delete access | ||
| projectOwnerRoleResp, err := s.testBench.AdminClient.CreateRole(ctxOrgAdminAuth, &frontierv1beta1.CreateRoleRequest{ | ||
| Body: &frontierv1beta1.RoleRequestBody{ | ||
| Name: "project_owner_custom", | ||
| Permissions: []string{ | ||
| "app_project_get", | ||
| "app_project_resourcelist", | ||
| "compute.network.create", | ||
| "compute.network.delete", | ||
| }, | ||
| }, | ||
| }) | ||
| s.Assert().NoError(err) | ||
| s.Assert().NotNil(projectOwnerRoleResp) | ||
|
|
||
| // create a resource under the project | ||
| createResource1Resp, err := s.testBench.Client.CreateProjectResource(ctxOrgAdminAuth, &frontierv1beta1.CreateProjectResourceRequest{ | ||
| ProjectId: createProjResp.GetProject().GetId(), | ||
| Body: &frontierv1beta1.ResourceRequestBody{ | ||
| Name: "res-1", | ||
| Namespace: resourceNamespace, | ||
| }, | ||
| }) | ||
| s.Assert().NoError(err) | ||
| s.Assert().NotNil(createResource1Resp) | ||
|
|
||
| // assign project viewer role to user | ||
| _, err = s.testBench.Client.CreatePolicy(ctxOrgAdminAuth, &frontierv1beta1.CreatePolicyRequest{ | ||
| Body: &frontierv1beta1.PolicyRequestBody{ | ||
| RoleId: projectViewerRoleResp.GetRole().GetId(), | ||
| Resource: schema.JoinNamespaceAndResourceID(schema.ProjectNamespace, createProjResp.GetProject().GetId()), | ||
| Principal: schema.JoinNamespaceAndResourceID(schema.UserPrincipal, user1Resp.GetUser().GetId()), | ||
| }, | ||
| }) | ||
| s.Assert().NoError(err) | ||
|
|
||
| // by default no user should have access to it | ||
| checkCreatePermResp, err := s.testBench.AdminClient.CheckFederatedResourcePermission(ctxOrgAdminAuth, &frontierv1beta1.CheckFederatedResourcePermissionRequest{ | ||
| Resource: schema.JoinNamespaceAndResourceID(resourceNamespace, createResource1Resp.GetResource().GetId()), | ||
| Permission: "compute.network.create", | ||
| Subject: schema.JoinNamespaceAndResourceID(schema.UserPrincipal, user1Resp.GetUser().GetId()), | ||
| }) | ||
| s.Assert().NoError(err) | ||
| s.Assert().False(checkCreatePermResp.GetStatus()) | ||
| checkCreatePermOnProjectResp, err := s.testBench.AdminClient.CheckFederatedResourcePermission(ctxOrgAdminAuth, &frontierv1beta1.CheckFederatedResourcePermissionRequest{ | ||
| Resource: schema.JoinNamespaceAndResourceID(schema.ProjectNamespace, createProjResp.GetProject().GetId()), | ||
| Permission: "compute.network.create", | ||
| Subject: schema.JoinNamespaceAndResourceID(schema.UserPrincipal, user1Resp.GetUser().GetId()), | ||
| }) | ||
| s.Assert().NoError(err) | ||
| s.Assert().False(checkCreatePermOnProjectResp.GetStatus()) | ||
|
|
||
| // assign project manager to the user | ||
| _, err = s.testBench.Client.CreatePolicy(ctxOrgAdminAuth, &frontierv1beta1.CreatePolicyRequest{ | ||
| Body: &frontierv1beta1.PolicyRequestBody{ | ||
| RoleId: projectManagerRoleResp.GetRole().GetId(), | ||
| Resource: schema.JoinNamespaceAndResourceID(schema.ProjectNamespace, createProjResp.GetProject().GetId()), | ||
| Principal: schema.JoinNamespaceAndResourceID(schema.UserPrincipal, user1Resp.GetUser().GetId()), | ||
| }, | ||
| }) | ||
| s.Assert().NoError(err) | ||
|
|
||
| // user now should have access to create but not delete | ||
| checkCreatePermResp, err = s.testBench.AdminClient.CheckFederatedResourcePermission(ctxOrgAdminAuth, &frontierv1beta1.CheckFederatedResourcePermissionRequest{ | ||
| Resource: schema.JoinNamespaceAndResourceID(schema.ProjectNamespace, createProjResp.GetProject().GetId()), | ||
| Permission: "compute.network.create", | ||
| Subject: schema.JoinNamespaceAndResourceID(schema.UserPrincipal, user1Resp.GetUser().GetId()), | ||
| }) | ||
| s.Assert().NoError(err) | ||
| s.Assert().True(checkCreatePermResp.GetStatus()) | ||
| checkDeletePermResp, err := s.testBench.AdminClient.CheckFederatedResourcePermission(ctxOrgAdminAuth, &frontierv1beta1.CheckFederatedResourcePermissionRequest{ | ||
| Resource: schema.JoinNamespaceAndResourceID(resourceNamespace, createResource1Resp.GetResource().GetId()), | ||
| Permission: "compute.network.delete", | ||
| Subject: schema.JoinNamespaceAndResourceID(schema.UserPrincipal, user1Resp.GetUser().GetId()), | ||
| }) | ||
| s.Assert().NoError(err) | ||
| s.Assert().False(checkDeletePermResp.GetStatus()) | ||
|
|
||
| // make user project owner | ||
| _, err = s.testBench.Client.CreatePolicy(ctxOrgAdminAuth, &frontierv1beta1.CreatePolicyRequest{ | ||
| Body: &frontierv1beta1.PolicyRequestBody{ | ||
| RoleId: projectOwnerRoleResp.GetRole().GetId(), | ||
| Resource: schema.JoinNamespaceAndResourceID(schema.ProjectNamespace, createProjResp.GetProject().GetId()), | ||
| Principal: schema.JoinNamespaceAndResourceID(schema.UserPrincipal, user1Resp.GetUser().GetId()), | ||
| }, | ||
| }) | ||
| s.Assert().NoError(err) | ||
|
|
||
| // should have access to delete as well | ||
| checkDeletePermResp, err = s.testBench.AdminClient.CheckFederatedResourcePermission(ctxOrgAdminAuth, &frontierv1beta1.CheckFederatedResourcePermissionRequest{ | ||
| Resource: schema.JoinNamespaceAndResourceID(resourceNamespace, createResource1Resp.GetResource().GetId()), | ||
| Permission: "compute.network.delete", | ||
| Subject: schema.JoinNamespaceAndResourceID(schema.UserPrincipal, user1Resp.GetUser().GetId()), | ||
| }) | ||
| s.Assert().NoError(err) | ||
| s.Assert().True(checkDeletePermResp.GetStatus()) | ||
|
|
||
| // any other user shouldn't have access to it | ||
| checkCreatePermResp, err = s.testBench.AdminClient.CheckFederatedResourcePermission(ctxOrgAdminAuth, &frontierv1beta1.CheckFederatedResourcePermissionRequest{ | ||
| Resource: schema.JoinNamespaceAndResourceID(resourceNamespace, createResource1Resp.GetResource().GetId()), | ||
| Permission: "compute.network.create", | ||
| Subject: schema.JoinNamespaceAndResourceID(schema.UserPrincipal, user2Resp.GetUser().GetId()), | ||
| }) | ||
| s.Assert().NoError(err) | ||
| s.Assert().False(checkCreatePermResp.GetStatus()) | ||
| }) | ||
| } | ||
|
|
||
| func (s *APIRegressionTestSuite) TestPolicyAPI() { | ||
|
|
||