Function TestGroupsAuth

coderd/database/dbauthz/groupsauth_test.go:22–166

nolint:tparallel

(t *testing.T)

// nolint:tparallel
func TestGroupsAuth(t *testing.T) {
	t.Parallel()

	authz := rbac.NewAuthorizer(prometheus.NewRegistry())
	store, _ := dbtestutil.NewDB(t)
	db := dbauthz.New(store, authz, slogtest.Make(t, &slogtest.Options{
		IgnoreErrors: true,
	}), coderdtest.AccessControlStorePointer())

	ownerCtx := dbauthz.As(context.Background(), rbac.Subject{
		ID:     "owner",
		Roles:  rbac.Roles(must(rbac.RoleIdentifiers{rbac.RoleOwner()}.Expand())),
		Groups: []string{},
		Scope:  rbac.ExpandableScope(rbac.ScopeAll),
	})

	org := dbgen.Organization(t, db, database.Organization{})
	group := dbgen.Group(t, db, database.Group{
		OrganizationID: org.ID,
	})

	var users []database.User
	for i := 0; i < 5; i++ {
		user := dbgen.User(t, db, database.User{})
		users = append(users, user)
		err := db.InsertGroupMember(ownerCtx, database.InsertGroupMemberParams{
			UserID:  user.ID,
			GroupID: group.ID,
		})
		require.NoError(t, err)
	}

	totalMembers := len(users)
	testCases := []struct {
		Name            string
		Subject         rbac.Subject
		ReadGroup       bool
		ReadMembers     bool
		MembersExpected int
	}{
		{
			Name: "Owner",
			Subject: rbac.Subject{
				ID:     "owner",
				Roles:  rbac.Roles(must(rbac.RoleIdentifiers{rbac.RoleOwner()}.Expand())),
				Groups: []string{},
				Scope:  rbac.ExpandableScope(rbac.ScopeAll),
			},
			ReadGroup:       true,
			ReadMembers:     true,
			MembersExpected: totalMembers,
		},
		{
			Name: "UserAdmin",
			Subject: rbac.Subject{
				ID:     "useradmin",
				Roles:  rbac.Roles(must(rbac.RoleIdentifiers{rbac.RoleUserAdmin()}.Expand())),
				Groups: []string{},