Function TestSystemRoles

coderd/database/dbauthz/customroles_test.go:266–481

(t *testing.T)

}

func TestSystemRoles(t *testing.T) {
	t.Parallel()

	orgID := uuid.New()

	canManageOrgRoles := rbac.Role{
		Identifier:  rbac.RoleIdentifier{Name: "can-manage-org-roles"},
		DisplayName: "",
		Site: rbac.Permissions(map[string][]policy.Action{
			rbac.ResourceAssignOrgRole.Type: {policy.ActionRead, policy.ActionCreate, policy.ActionUpdate},
		}),
	}

	canCreateSystem := rbac.Role{
		Identifier:  rbac.RoleIdentifier{Name: "can-create-system"},
		DisplayName: "",
		Site: rbac.Permissions(map[string][]policy.Action{
			rbac.ResourceSystem.Type: {policy.ActionCreate},
		}),
	}

	canUpdateSystem := rbac.Role{
		Identifier:  rbac.RoleIdentifier{Name: "can-update-system"},
		DisplayName: "",
		Site: rbac.Permissions(map[string][]policy.Action{
			rbac.ResourceSystem.Type: {policy.ActionUpdate},
		}),
	}

	userID := uuid.New()
	subjectNoSystemPerms := rbac.Subject{
		FriendlyName: "Test user",
		ID:           userID.String(),
		Roles:        rbac.Roles([]rbac.Role{canManageOrgRoles}),
		Groups:       nil,
		Scope:        rbac.ScopeAll,
	}
	subjectWithSystemCreatePerms := subjectNoSystemPerms
	subjectWithSystemCreatePerms.Roles = rbac.Roles([]rbac.Role{canManageOrgRoles, canCreateSystem})
	subjectWithSystemUpdatePerms := subjectNoSystemPerms
	subjectWithSystemUpdatePerms.Roles = rbac.Roles([]rbac.Role{canManageOrgRoles, canUpdateSystem})

	db, _ := dbtestutil.NewDB(t)
	rec := &coderdtest.RecordingAuthorizer{
		Wrapped: rbac.NewAuthorizer(prometheus.NewRegistry()),
	}
	az := dbauthz.New(db, rec, slog.Make(), coderdtest.AccessControlStorePointer())

	t.Run("insert-requires-system-create", func(t *testing.T) {
		t.Parallel()

		insertParamsTemplate := database.InsertCustomRoleParams{
			Name: "",
			OrganizationID: uuid.NullUUID{
				UUID:  orgID,
				Valid: true,
			},
			SitePermissions:   database.CustomRolePermissions{},