(t *testing.T)
| 72 | } |
| 73 | |
| 74 | func TestIntersectAllowLists(t *testing.T) { |
| 75 | t.Parallel() |
| 76 | |
| 77 | id := uuid.NewString() |
| 78 | id2 := uuid.NewString() |
| 79 | |
| 80 | t.Run("scope_all_db_specific", func(t *testing.T) { |
| 81 | t.Parallel() |
| 82 | out := rbac.IntersectAllowLists( |
| 83 | []rbac.AllowListElement{rbac.AllowListAll()}, |
| 84 | []rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: id}}, |
| 85 | ) |
| 86 | require.Equal(t, []rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: id}}, out) |
| 87 | }) |
| 88 | |
| 89 | t.Run("db_all_keeps_scope", func(t *testing.T) { |
| 90 | t.Parallel() |
| 91 | scopeList := []rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: policy.WildcardSymbol}} |
| 92 | out := rbac.IntersectAllowLists(scopeList, []rbac.AllowListElement{{Type: policy.WildcardSymbol, ID: policy.WildcardSymbol}}) |
| 93 | require.Equal(t, scopeList, out) |
| 94 | }) |
| 95 | |
| 96 | t.Run("typed_wildcard_intersection", func(t *testing.T) { |
| 97 | t.Parallel() |
| 98 | scopeList := []rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: policy.WildcardSymbol}} |
| 99 | out := rbac.IntersectAllowLists(scopeList, []rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: id}}) |
| 100 | require.Equal(t, []rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: id}}, out) |
| 101 | }) |
| 102 | |
| 103 | t.Run("db_wildcard_type_specific", func(t *testing.T) { |
| 104 | t.Parallel() |
| 105 | scopeList := []rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: id}} |
| 106 | out := rbac.IntersectAllowLists(scopeList, []rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: policy.WildcardSymbol}}) |
| 107 | require.Equal(t, []rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: id}}, out) |
| 108 | }) |
| 109 | |
| 110 | t.Run("disjoint_types", func(t *testing.T) { |
| 111 | t.Parallel() |
| 112 | scopeList := []rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: id}} |
| 113 | out := rbac.IntersectAllowLists(scopeList, []rbac.AllowListElement{{Type: rbac.ResourceTemplate.Type, ID: id}}) |
| 114 | require.Empty(t, out) |
| 115 | }) |
| 116 | |
| 117 | t.Run("different_ids", func(t *testing.T) { |
| 118 | t.Parallel() |
| 119 | scopeList := []rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: uuid.NewString()}} |
| 120 | out := rbac.IntersectAllowLists(scopeList, []rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: id}}) |
| 121 | require.Empty(t, out) |
| 122 | }) |
| 123 | |
| 124 | t.Run("multi_entry_overlap", func(t *testing.T) { |
| 125 | t.Parallel() |
| 126 | templateSpecific := uuid.NewString() |
| 127 | scopeList := []rbac.AllowListElement{ |
| 128 | {Type: rbac.ResourceWorkspace.Type, ID: id}, |
| 129 | {Type: rbac.ResourceWorkspace.Type, ID: id2}, |
| 130 | {Type: rbac.ResourceTemplate.Type, ID: policy.WildcardSymbol}, |
| 131 | } |
nothing calls this directly
no test coverage detected