Function TestInTX

coderd/database/dbauthz/dbauthz_test.go:88–126

TestInTX is not perfect, just checks that it properly checks auth.

(t *testing.T)

// TestInTX is not perfect, just checks that it properly checks auth.
func TestInTX(t *testing.T) {
	t.Parallel()

	var (
		ctrl  = gomock.NewController(t)
		db    = dbmock.NewMockStore(ctrl)
		mTx   = dbmock.NewMockStore(ctrl) // to record the 'in tx' calls
		faker = gofakeit.New(0)
		w     = testutil.Fake(t, faker, database.Workspace{})
		actor = rbac.Subject{
			ID:     uuid.NewString(),
			Roles:  rbac.RoleIdentifiers{rbac.RoleOwner()},
			Groups: []string{},
			Scope:  rbac.ScopeAll,
		}
		ctx = dbauthz.As(context.Background(), actor)
	)

	db.EXPECT().Wrappers().Times(1).Return([]string{}) // called by dbauthz.New
	q := dbauthz.New(db, &coderdtest.RecordingAuthorizer{
		Wrapped: (&coderdtest.FakeAuthorizer{}).AlwaysReturn(xerrors.New("custom error")),
	}, slog.Make(), coderdtest.AccessControlStorePointer())

	db.EXPECT().InTx(gomock.Any(), gomock.Any()).Times(1).DoAndReturn(
		func(f func(database.Store) error, _ *database.TxOptions) error {
			return f(mTx)
		},
	)
	mTx.EXPECT().Wrappers().Times(1).Return([]string{})
	mTx.EXPECT().GetWorkspaceByID(gomock.Any(), gomock.Any()).Times(1).Return(w, nil)
	err := q.InTx(func(tx database.Store) error {
		// The inner tx should use the parent's authz
		_, err := tx.GetWorkspaceByID(ctx, w.ID)
		return err
	}, nil)
	require.ErrorContains(t, err, "custom error", "must be our custom error")
	require.ErrorAs(t, err, &dbauthz.NotAuthorizedError{}, "must be an authorized error")
	require.True(t, dbauthz.IsNotAuthorizedError(err), "must be an authorized error")
}

// TestNew should not double wrap a querier.
func TestNew(t *testing.T) {