Function TestReconcileSystemRole

coderd/rbac/rolestore/rolestore_test.go:45–123

(t *testing.T)

}

func TestReconcileSystemRole(t *testing.T) {
	t.Parallel()

	tests := []struct {
		name      string
		roleName  string
		permsFunc func(rbac.OrgSettings) rbac.OrgRolePermissions
	}{
		{"OrgMember", rbac.RoleOrgMember(), rbac.OrgMemberPermissions},
		{"ServiceAccount", rbac.RoleOrgServiceAccount(), rbac.OrgServiceAccountPermissions},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			t.Parallel()

			db, _ := dbtestutil.NewDB(t)
			org := dbgen.Organization(t, db, database.Organization{})
			ctx := testutil.Context(t, testutil.WaitShort)

			existing, err := database.ExpectOne(db.CustomRoles(ctx, database.CustomRolesParams{
				LookupRoles: []database.NameOrganizationPair{
					{
						Name:           tt.roleName,
						OrganizationID: org.ID,
					},
				},
				IncludeSystemRoles: true,
			}))
			require.NoError(t, err)

			// Zero out permissions to simulate stale state.
			_, err = db.UpdateCustomRole(ctx, database.UpdateCustomRoleParams{
				Name: existing.Name,
				OrganizationID: uuid.NullUUID{
					UUID:  org.ID,
					Valid: true,
				},
				DisplayName:       "",
				SitePermissions:   database.CustomRolePermissions{},
				UserPermissions:   database.CustomRolePermissions{},
				OrgPermissions:    database.CustomRolePermissions{},
				MemberPermissions: database.CustomRolePermissions{},
			})
			require.NoError(t, err)

			stale := existing
			stale.OrgPermissions = database.CustomRolePermissions{}
			stale.MemberPermissions = database.CustomRolePermissions{}

			reconciled, didUpdate, err := rolestore.ReconcileSystemRole(ctx, db, stale, org)
			require.NoError(t, err)
			require.True(t, didUpdate, "expected reconciliation to update stale permissions")

			dbstored, err := database.ExpectOne(db.CustomRoles(ctx, database.CustomRolesParams{
				LookupRoles: []database.NameOrganizationPair{
					{
						Name:           tt.roleName,