Function TestScopeAllowList

coderd/rbac/authz_internal_test.go:1175–1298

(t *testing.T)

}

func TestScopeAllowList(t *testing.T) {
	t.Parallel()

	defOrg := uuid.New()

	// Some IDs to use
	wid := uuid.New()
	gid := uuid.New()

	user := Subject{
		ID: "me",
		Roles: Roles{
			must(RoleByName(RoleOwner())),
		},
		Scope: Scope{
			Role: Role{
				Identifier: RoleIdentifier{
					Name:           "AllowList",
					OrganizationID: defOrg,
				},
				DisplayName: "AllowList",
				// Allow almost everything
				Site: allPermsExcept(ResourceUser),
			},
			AllowIDList: []AllowListElement{
				{Type: ResourceWorkspace.Type, ID: wid.String()},
				{Type: ResourceWorkspace.Type, ID: ""}, // Allow to create
				{Type: ResourceTemplate.Type, ID: policy.WildcardSymbol},
				{Type: ResourceGroup.Type, ID: gid.String()},

				// This scope allows all users, but the permissions do not.
				{Type: ResourceUser.Type, ID: policy.WildcardSymbol},
			},
		},
	}

	testAuthorize(t, "AllowList", user,
		// Allowed:
		cases(func(c authTestCase) authTestCase {
			c.allow = true
			return c
		},
			[]authTestCase{
				{resource: ResourceWorkspace.InOrg(defOrg).WithOwner(user.ID).WithID(wid), actions: []policy.Action{policy.ActionRead}},
				// matching on empty id
				{resource: ResourceWorkspace.InOrg(defOrg).WithOwner(user.ID), actions: []policy.Action{policy.ActionCreate}},

				// Template has wildcard ID, so any uuid is allowed, including the empty
				{resource: ResourceTemplate.InOrg(defOrg).WithID(uuid.New()), actions: AllActions()},
				{resource: ResourceTemplate.InOrg(defOrg).WithID(uuid.New()), actions: AllActions()},
				{resource: ResourceTemplate.InOrg(defOrg), actions: AllActions()},

				// Group
				{resource: ResourceGroup.InOrg(defOrg).WithID(gid), actions: []policy.Action{policy.ActionRead}},
			},
		),

		// Not allowed: