Function TestAsAuthzSystem

coderd/httpmw/authz_test.go:17–89

(t *testing.T)

)

func TestAsAuthzSystem(t *testing.T) {
	t.Parallel()
	userActor := coderdtest.RandomRBACSubject()

	base := http.HandlerFunc(func(_ http.ResponseWriter, r *http.Request) {
		actor, ok := dbauthz.ActorFromContext(r.Context())
		assert.True(t, ok, "actor should exist")
		assert.True(t, userActor.Equal(actor), "actor should be the user actor")
	})

	mwSetUser := func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
			r = r.WithContext(dbauthz.As(r.Context(), userActor))
			next.ServeHTTP(rw, r)
		})
	}

	mwAssertSystem := mwAssert(func(req *http.Request) {
		actor, ok := dbauthz.ActorFromContext(req.Context())
		assert.True(t, ok, "actor should exist")
		assert.False(t, userActor.Equal(actor), "systemActor should not be the user actor")
		assert.Contains(t, actor.Roles.Names(), rbac.RoleIdentifier{Name: "system"}, "should have system role")
	})

	mwAssertUser := mwAssert(func(req *http.Request) {
		actor, ok := dbauthz.ActorFromContext(req.Context())
		assert.True(t, ok, "actor should exist")
		assert.True(t, userActor.Equal(actor), "should be the useractor")
	})

	mwAssertNoUser := mwAssert(func(req *http.Request) {
		_, ok := dbauthz.ActorFromContext(req.Context())
		assert.False(t, ok, "actor should not exist")
	})

	// Request as the user actor
	const pattern = "/"
	req := httptest.NewRequest("GET", pattern, nil)
	res := httptest.NewRecorder()

	handler := chi.NewRouter()
	handler.Route(pattern, func(r chi.Router) {
		r.Use(
			// First assert there is no actor context
			mwAssertNoUser,
			httpmw.AsAuthzSystem(
				// Assert the system actor
				mwAssertSystem,
				mwAssertSystem,
			),
			// Assert no user present outside of the AsAuthzSystem chain
			mwAssertNoUser,
			// ----
			// Set to the user actor
			mwSetUser,
			// Assert the user actor
			mwAssertUser,
			httpmw.AsAuthzSystem(