Function TestAuthorizeDomain

coderd/rbac/authz_internal_test.go:281–715

TestAuthorizeDomain test the very basic roles that are commonly used.

(t *testing.T)

// TestAuthorizeDomain test the very basic roles that are commonly used.
func TestAuthorizeDomain(t *testing.T) {
	t.Parallel()
	defOrg := uuid.New()
	unusedID := uuid.New()
	allUsersGroup := "Everyone"

	// orphanedUser has no organization
	orphanedUser := Subject{
		ID:     "me",
		Scope:  must(ExpandScope(ScopeAll)),
		Groups: []string{},
		Roles: Roles{
			must(RoleByName(RoleMember())),
		},
	}
	testAuthorize(t, "OrphanedUser", orphanedUser, []authTestCase{
		{resource: ResourceWorkspace.InOrg(defOrg).WithOwner(orphanedUser.ID), actions: ResourceWorkspace.AvailableActions(), allow: false},

		// Orphaned user cannot create workspaces in any organization
		{resource: ResourceWorkspace.AnyOrganization().WithOwner(orphanedUser.ID), actions: []policy.Action{policy.ActionCreate}, allow: false},
	})

	user := Subject{
		ID:     "me",
		Scope:  must(ExpandScope(ScopeAll)),
		Groups: []string{allUsersGroup},
		Roles: Roles{
			must(RoleByName(RoleMember())),
			orgMemberRole(defOrg),
		},
	}

	testAuthorize(t, "UserACLList", user, []authTestCase{
		{
			resource: ResourceWorkspace.WithOwner(unusedID.String()).InOrg(unusedID).WithACLUserList(map[string][]policy.Action{
				user.ID: ResourceWorkspace.AvailableActions(),
			}),
			actions: ResourceWorkspace.AvailableActions(),
			allow:   true,
		},
		{
			resource: ResourceWorkspace.WithOwner(unusedID.String()).InOrg(unusedID).WithACLUserList(map[string][]policy.Action{
				user.ID: {policy.WildcardSymbol},
			}),
			actions: ResourceWorkspace.AvailableActions(),
			allow:   true,
		},
		{
			resource: ResourceWorkspace.WithOwner(unusedID.String()).InOrg(unusedID).WithACLUserList(map[string][]policy.Action{
				user.ID: {policy.ActionRead, policy.ActionUpdate},
			}),
			actions: []policy.Action{policy.ActionCreate, policy.ActionDelete},
			allow:   false,
		},
		{
			// By default users cannot update templates
			resource: ResourceTemplate.InOrg(defOrg).WithACLUserList(map[string][]policy.Action{
				user.ID: {policy.ActionUpdate},