| 10 | ) |
| 11 | |
| 12 | func TestExpandScope(t *testing.T) { |
| 13 | t.Parallel() |
| 14 | |
| 15 | t.Run("low_level_pairs", func(t *testing.T) { |
| 16 | t.Parallel() |
| 17 | cases := []struct { |
| 18 | name string |
| 19 | resource string |
| 20 | action policy.Action |
| 21 | }{ |
| 22 | {name: "workspace:start", resource: rbac.ResourceWorkspace.Type, action: policy.ActionWorkspaceStart}, |
| 23 | {name: "workspace:ssh", resource: rbac.ResourceWorkspace.Type, action: policy.ActionSSH}, |
| 24 | {name: "template:use", resource: rbac.ResourceTemplate.Type, action: policy.ActionUse}, |
| 25 | {name: "api_key:read", resource: rbac.ResourceApiKey.Type, action: policy.ActionRead}, |
| 26 | } |
| 27 | for _, tc := range cases { |
| 28 | t.Run(tc.name, func(t *testing.T) { |
| 29 | t.Parallel() |
| 30 | s, err := rbac.ScopeName(tc.name).Expand() |
| 31 | require.NoError(t, err) |
| 32 | |
| 33 | // site-only single permission |
| 34 | require.Len(t, s.Site, 1) |
| 35 | require.Equal(t, tc.resource, s.Site[0].ResourceType) |
| 36 | require.Equal(t, tc.action, s.Site[0].Action) |
| 37 | require.Empty(t, s.ByOrgID) |
| 38 | require.Empty(t, s.User) |
| 39 | |
| 40 | require.Equal(t, []rbac.AllowListElement{rbac.AllowListAll()}, s.AllowIDList) |
| 41 | }) |
| 42 | } |
| 43 | }) |
| 44 | |
| 45 | t.Run("invalid_low_level", func(t *testing.T) { |
| 46 | t.Parallel() |
| 47 | invalid := []string{ |
| 48 | "", // empty |
| 49 | "workspace:", // missing action |
| 50 | ":read", // missing resource |
| 51 | "unknown:read", // unknown resource |
| 52 | "workspace:bogus", // unknown action |
| 53 | "a:b:c", // too many parts |
| 54 | } |
| 55 | for _, name := range invalid { |
| 56 | t.Run(name, func(t *testing.T) { |
| 57 | t.Parallel() |
| 58 | _, err := rbac.ScopeName(name).Expand() |
| 59 | require.Error(t, err) |
| 60 | }) |
| 61 | } |
| 62 | }) |
| 63 | } |