weichen/Agent-System-Backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

agent-exec transport db62fd9b2ada67370988679837bbb3d1/b712680caa58

Browse Source
This commit is contained in:
agent-exec-transport
2026-10-20 12:39:28 +00:00
parent f18c265c5d
commit da1d9fa447
4 changed files with 225 additions and 116 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/authz/catalog/catalog_test.go
+2 -1
View File
@@ -20,6 +20,8 @@ func TestCatalogProjectAccessIsTheOnlyRoleAction(t *testing.T) {
access, ok := DescriptorByID(ProjectAccessAction)
if !ok || access.ActionID != "project.create" || access.Scope != ScopeSystem || access.Protected {
t.Fatalf("project access descriptor=%+v ok=%v", access, ok)
}
}
func TestProjectCreateLinkedActionsAreCatalogedProjectActions(t *testing.T) {
linked := ProjectCreateLinkedActions()
@@ -38,7 +40,6 @@ func TestProjectCreateLinkedActionsAreCatalogedProjectActions(t *testing.T) {
linked[0] = "mutated"
if ProjectCreateLinkedActions()[0] == "mutated" {
t.Fatal("linked actions exposed mutable storage")
}
}
internal/server/explain_test.go
+38 -20
View File
@@ -116,44 +116,62 @@ func TestCapabilityExplainHTTPReturnsCreatorSourceAndLinkedActions(t *testing.T)
}
}
// TestMemberBasicCollaborateAndDocumentQualifyOverHTTP pins the narrowed role
// model (R2) on the explanation surface: a role carries the single
// project-access boolean, so it neither grants project.create to a member nor
// configures any member action or document duty.
func TestMemberBasicCollaborateAndDocumentQualifyOverHTTP(t *testing.T) {
srv, st := newAuthTestServer(t)
h := srv.Handler()
admin := bootAdmin(t, h, st)
_, key := explainRoleFixture(t, h, st, admin, "member", "协作成员", `[
{"actionId":"document.read","allowed":true,"capAllowed":true},
{"actionId":"trace.edit","allowed":false,"capAllowed":true},
{"actionId":"document.author","allowed":true,"capAllowed":true},
{"actionId":"document.approve","allowed":false,"capAllowed":false}]`)
_, key := explainRoleFixture(t, h, st, admin, "member", "协作成员", `[{"actionId":"project.create","allowed":false,"capAllowed":true}]`)
body := decodeCapabilityExplain(t, bearerRequest(h, "GET", "/api/capability/explain", "", key))
if body.Capability.ProjectCreate.Allowed || body.Capability.ProjectCreate.Reason != "not-granted" {
t.Fatalf("member project.create=%+v", body.Capability.ProjectCreate)
if body.Capability.ProjectCreate.Allowed || body.Capability.ProjectCreate.Reason != "role-cap" ||
len(body.Capability.Linked) != 4 || len(body.Capability.Conflicts) != 0 || body.Capability.MigrationNote != "" {
t.Fatalf("member capability=%+v", body.Capability)
}
for _, action := range body.Capability.Linked {
if action.Allowed || action.Source != "" || action.Reason != "project-create-not-held" || action.Scope != "own-projects" {
t.Fatalf("member linked=%+v", action)
}
}
member := map[string]extension.CapabilityActionExplain{}
for _, action := range body.MemberBasicCollaborate.Actions {
member[action.ActionID] = action
}
if read := member["document.read"]; !read.Allowed || read.Source != "role" || read.Scope != "member-projects" {
t.Fatalf("document.read=%+v", read)
if len(member) != 4 {
t.Fatalf("member actions=%+v", body.MemberBasicCollaborate.Actions)
}
if trace := member["trace.edit"]; trace.Allowed || !trace.CapAllowed || trace.Reason != "role-default-deny" {
t.Fatalf("trace.edit=%+v", trace)
}
if audit := member["project.audit.read"]; audit.Allowed || audit.Reason != "action-unconfigured" {
t.Fatalf("project.audit.read=%+v", audit)
for actionID, action := range member {
want := extension.CapabilityActionExplain{ActionID: actionID, Scope: "member-projects", Reason: "action-unconfigured"}
if action != want {
t.Fatalf("%s=%+v want %+v", actionID, action, want)
}
}
duties := map[string]extension.DocumentDutyQualify{}
for _, duty := range body.DocumentQualify.Duties {
duties[duty.ActionID] = duty
}
if author := duties["document.author"]; !author.Qualified || !author.DefaultAllowed || author.Source != "role" {
t.Fatalf("document.author=%+v", author)
if len(duties) != 3 {
t.Fatalf("duties=%+v", body.DocumentQualify.Duties)
}
if review := duties["document.review"]; review.Qualified || review.Reason != "action-unconfigured" {
t.Fatalf("document.review=%+v", review)
for actionID, duty := range duties {
want := extension.DocumentDutyQualify{ActionID: actionID, Reason: "action-unconfigured"}
if duty != want {
t.Fatalf("%s=%+v want %+v", actionID, duty, want)
}
}
if approve := duties["document.approve"]; approve.Qualified || approve.Reason != "role-cap" {
t.Fatalf("document.approve=%+v", approve)
// Member content is refused at the policy endpoint instead of being stored.
role := decodeRoleHTTP(t, do(h, "POST", "/api/admin/roles", `{"name":"文档职责"}`, admin))
refused := do(h, "PUT", "/api/admin/roles/"+role.RoleID+"/permissions",
`{"expectedRoleVersion":1,"idempotencyKey":"duty-policy","changes":[{"actionId":"document.author","allowed":true,"capAllowed":true}]}`, admin)
if refused.Code != http.StatusBadRequest {
t.Fatalf("document duty accepted: %d %s", refused.Code, refused.Body.String())
}
// The refused batch left the role untouched: same version, no permissions.
stored := decodeRoleProjectAccess(t, do(h, "GET", "/api/admin/roles/"+role.RoleID, "", admin))
if stored.RoleVersion != 1 || stored.ProjectAccess || len(stored.Permissions) != 0 {
t.Fatalf("refused duty row changed the role: %+v", stored)
}
}
internal/server/project_iam_integration_test.go
+80 -40
View File
@@ -23,6 +23,10 @@ import (
const (
iamMemberAddCommand = "rdm.member.add"
iamCreatorPolicy = `[{"actionId":"project.create","allowed":true,"capAllowed":true}]`
// iamMemberPolicy is the narrowed model's member role: the single
// project-access boolean, explicitly off. Nothing else is role authority,
// so a member role cannot name a document action any more.
iamMemberPolicy = `[{"actionId":"project.create","allowed":false,"capAllowed":true}]`
)
var iamLinkedActions = []string{"project.settings", "project.members.manage", "project.permissions.manage", "document.duties.assign"}
@@ -375,7 +379,7 @@ func TestProjectIAMCapabilityAssociationChain(t *testing.T) {
func TestProjectIAMMemberAddViaProjectLifecycle(t *testing.T) {
f := newIAMFixture(t)
_, alice := explainRoleFixture(t, f.h, f.st, f.admin, "alice", "项目创建者", iamCreatorPolicy)
_, bob := explainRoleFixture(t, f.h, f.st, f.admin, "bob", "协作成员", `[{"actionId":"document.read","allowed":true,"capAllowed":true}]`)
_, bob := explainRoleFixture(t, f.h, f.st, f.admin, "bob", "协作成员", iamMemberPolicy)
carol, _ := createLegacyAPIKeyFixture(t, f.st, "carol", "test")
project := f.createProject(t, alice, "成员项目")
conversations := "/api/projects/" + project.ID + "/conversations"
@@ -454,25 +458,26 @@ func TestProjectIAMSubjectScopingOnMemberAdd(t *testing.T) {
func TestProjectIAMDocumentReadDecoupledFromMembership(t *testing.T) {
f := newIAMFixture(t)
_, alice := explainRoleFixture(t, f.h, f.st, f.admin, "alice", "项目创建者", iamCreatorPolicy)
_, dave := explainRoleFixture(t, f.h, f.st, f.admin, "dave", "知识编制者", `[
{"actionId":"document.author","allowed":true,"capAllowed":true},
{"actionId":"knowledge.publish","allowed":true,"capAllowed":true}]`)
_, dave := explainRoleFixture(t, f.h, f.st, f.admin, "dave", "知识编制者", iamMemberPolicy)
bob, _ := createLegacyAPIKeyFixture(t, f.st, "bob", "test")
carol, _ := createLegacyAPIKeyFixture(t, f.st, "carol", "test")
project := f.createProject(t, alice, "文档项目")
f.mustAddMember(t, alice, project.ID, "bob")
f.mustAddMember(t, alice, project.ID, "dave")
// A member role grants no document duty under the narrowed model, so the
// document read decision below comes from the resource authorizer alone.
qualify, err := f.explainHost("dave").CurrentDocumentQualify(context.Background())
if err != nil {
t.Fatal(err)
}
authorQualified := false
for _, duty := range qualify.Duties {
authorQualified = authorQualified || (duty.ActionID == "document.author" && duty.Qualified && duty.DefaultAllowed)
if len(qualify.Duties) != 3 {
t.Fatalf("duties=%+v", qualify.Duties)
}
if !authorQualified {
t.Fatalf("dave is not a qualified author: %+v", qualify.Duties)
for _, duty := range qualify.Duties {
if duty.Qualified || duty.DefaultAllowed || duty.Source != "" || duty.Reason != "action-unconfigured" {
t.Fatalf("member role granted a document duty: %+v", duty)
}
}
artifact := core.Artifact{ProjectID: project.ID, Owner: "alice", Name: "设计说明.md", Kind: "document", MIME: "text/markdown"}
@@ -520,9 +525,7 @@ func TestProjectIAMDocumentReadDecoupledFromMembership(t *testing.T) {
func TestProjectIAMCapabilityExplainCreatorAndMember(t *testing.T) {
f := newIAMFixture(t)
creator, creatorKey := explainRoleFixture(t, f.h, f.st, f.admin, "creator", "项目创建者", iamCreatorPolicy)
member, memberKey := explainRoleFixture(t, f.h, f.st, f.admin, "member", "协作成员", `[
{"actionId":"document.read","allowed":true,"capAllowed":true},
{"actionId":"trace.edit","allowed":false,"capAllowed":true}]`)
member, memberKey := explainRoleFixture(t, f.h, f.st, f.admin, "member", "协作成员", iamMemberPolicy)
ctx := context.Background()
compareHTTP := func(label, key string, got extension.CapabilityExplain) {
@@ -561,8 +564,11 @@ func TestProjectIAMCapabilityExplainCreatorAndMember(t *testing.T) {
if err != nil {
t.Fatal(err)
}
// The member role carries the single project-access boolean, explicitly
// off, so project.create is not granted and every linked action is refused.
if memberExplain.Owner != "member" || memberExplain.UserID != member.ID || memberExplain.ProjectCreate.Allowed ||
memberExplain.ProjectCreate.Reason != "not-granted" || memberExplain.Conflicts == nil || len(memberExplain.Conflicts) != 0 {
memberExplain.ProjectCreate.Reason != "role-cap" || memberExplain.Conflicts == nil || len(memberExplain.Conflicts) != 0 ||
memberExplain.MigrationNote != "" {
t.Fatalf("member explain=%+v", memberExplain)
}
for _, action := range memberExplain.Linked {
@@ -579,16 +585,20 @@ func TestProjectIAMCapabilityExplainCreatorAndMember(t *testing.T) {
for _, action := range collaborate.Actions {
actions[action.ActionID] = action
}
if read := actions["document.read"]; collaborate.Owner != "member" || !read.Allowed || read.Source != extension.CapabilitySourceRole ||
read.Scope != extension.CapabilityScopeMemberProjects {
t.Fatalf("member document.read=%+v", read)
if collaborate.Owner != "member" || len(actions) != 4 {
t.Fatalf("member collaborate=%+v", collaborate.Actions)
}
if trace := actions["trace.edit"]; trace.Allowed || trace.Reason != "role-default-deny" {
t.Fatalf("member trace.edit=%+v", trace)
// Member content is no longer role authority, so a bound role configures
// none of it.
for actionID, action := range actions {
want := extension.CapabilityActionExplain{ActionID: actionID, Scope: extension.CapabilityScopeMemberProjects, Reason: "action-unconfigured"}
if action != want {
t.Fatalf("member %s=%+v want %+v", actionID, action, want)
}
}
// The bootstrap administrator keeps project.create while an enabled role caps
// one linked action, which is the only state that reports a conflict.
// The bootstrap administrator keeps project.create, and a role can no
// longer cap a linked action, so no explanation reports a conflict.
adminAccount, err := f.st.GetAccountByOwner("admin")
if err != nil {
t.Fatal(err)
@@ -613,10 +623,24 @@ func TestProjectIAMCapabilityExplainCreatorAndMember(t *testing.T) {
if err != nil {
t.Fatal(err)
}
if _, err := f.st.ReplaceRolePermissions("admin", capped.RoleID, capped.RoleVersion,
[]store.RolePermissionChange{{ActionID: "project.members.manage", Allowed: false, CapAllowed: false}}, "cap-members"); err != nil {
receipt, err := f.st.ReplaceRolePermissions("admin", capped.RoleID, capped.RoleVersion,
[]store.RolePermissionChange{{ActionID: "project.create", Allowed: true, CapAllowed: true}}, "enable-capped")
if err != nil {
t.Fatal(err)
}
// A linked action row is not role authority any more, so the cap the retired
// model allowed is refused outright and the role keeps project access.
if _, err := f.st.ReplaceRolePermissions("admin", capped.RoleID, receipt.RoleVersion,
[]store.RolePermissionChange{{ActionID: "project.members.manage", Allowed: false, CapAllowed: false}}, "cap-members"); !errors.Is(err, store.ErrInvalidRolePolicy) {
t.Fatalf("linked cap accepted: %v", err)
}
permissions, err := f.st.RolePermissions(capped.RoleID)
if err != nil || len(permissions) != 1 || !permissions[0].Allowed || !permissions[0].CapAllowed {
t.Fatalf("refused cap changed the role: %+v err=%v", permissions, err)
}
if role, err := f.st.GetRole(capped.RoleID); err != nil || role.RoleVersion != receipt.RoleVersion {
t.Fatalf("refused cap bumped the role version: %+v err=%v", role, err)
}
if _, err := f.st.AssignUserRole("admin", adminAccount.ID, capped.RoleID, adminAccount.StateVersion, "assign-admin-capped"); err != nil {
t.Fatal(err)
}
@@ -624,33 +648,39 @@ func TestProjectIAMCapabilityExplainCreatorAndMember(t *testing.T) {
if err != nil {
t.Fatal(err)
}
if adminExplain.ProjectCreate.Source != extension.CapabilitySourceBootstrapAdmin || !reflect.DeepEqual(adminExplain.Conflicts, []string{"project.members.manage"}) ||
!strings.Contains(adminExplain.MigrationNote, "project.members.manage") {
t.Fatalf("conflicted creator explain=%+v", adminExplain)
if !adminExplain.ProjectCreate.Allowed || adminExplain.ProjectCreate.Source != extension.CapabilitySourceBootstrapAdmin ||
len(adminExplain.Conflicts) != 0 || adminExplain.MigrationNote != "" {
t.Fatalf("bootstrap creator explain=%+v", adminExplain)
}
linkedAdmin := []string{}
for _, action := range adminExplain.Linked {
conflicted := action.ActionID == "project.members.manage"
if conflicted && (action.Allowed || !action.Conflict || action.Reason != "role-cap" || action.Source != "") ||
!conflicted && (!action.Allowed || action.Source != extension.CapabilitySourceBootstrapAdmin || action.Conflict) {
t.Fatalf("conflicted creator linked=%+v", action)
if !action.Allowed || action.Conflict || action.Source != extension.CapabilitySourceBootstrapAdmin ||
action.LinkedVia != "project.create" || action.Scope != extension.CapabilityScopeOwnProjects {
t.Fatalf("bootstrap creator linked=%+v", action)
}
linkedAdmin = append(linkedAdmin, action.ActionID)
}
if !reflect.DeepEqual(linkedAdmin, iamLinkedActions) {
t.Fatalf("bootstrap creator linked actions=%v", linkedAdmin)
}
adminHTTP := decodeCapabilityExplain(t, do(f.h, http.MethodGet, "/api/capability/explain", "", f.admin))
if !reflect.DeepEqual(adminHTTP.Capability.Conflicts, adminExplain.Conflicts) || !reflect.DeepEqual(adminHTTP.Capability.Linked, adminExplain.Linked) {
t.Fatalf("conflicted host/HTTP differ: %+v vs %+v", adminExplain, adminHTTP.Capability)
t.Fatalf("bootstrap host/HTTP differ: %+v vs %+v", adminExplain, adminHTTP.Capability)
}
// Project management authority is project access plus being the creator:
// creation projects every linked action and member add is accepted.
w := do(f.h, http.MethodPost, "/api/projects", `{"name":"受限项目"}`, f.admin)
var project core.Project
if w.Code != http.StatusOK || json.Unmarshal(w.Body.Bytes(), &project) != nil {
t.Fatalf("conflicted create: %d %s", w.Code, w.Body.String())
t.Fatalf("bootstrap create: %d %s", w.Code, w.Body.String())
}
if iamContains(f.provider.linked[project.ID], "project.members.manage") || len(f.provider.linked[project.ID]) != 3 {
t.Fatalf("conflicted projection=%v", f.provider.linked[project.ID])
if !reflect.DeepEqual(f.provider.linked[project.ID], iamLinkedActions) {
t.Fatalf("bootstrap projection=%v", f.provider.linked[project.ID])
}
add := do(f.h, http.MethodPost, "/api/commands/"+iamMemberAddCommand, `{"params":{"projectId":"`+project.ID+`","member":"member"}}`, f.admin)
if add.Code != http.StatusBadRequest || !strings.Contains(add.Body.String(), "project.member.add: policy-rejected") || f.provider.members[project.ID]["member"] {
t.Fatalf("conflicted member add: %d %s", add.Code, add.Body.String())
if add.Code != http.StatusOK || !f.provider.members[project.ID]["member"] {
t.Fatalf("bootstrap member add: %d %s", add.Code, add.Body.String())
}
}
@@ -701,11 +731,21 @@ func TestProjectIAMErrorCategorizationLifecycle(t *testing.T) {
{"unavailable", context.DeadlineExceeded, 503, "conversation.work: service-unavailable\n"},
} {
f.provider.workErr = tc.err
for _, q := range []struct{ method, body string }{{http.MethodPost, `{"title":"t"}`}, {http.MethodGet, ""}} {
w := lifecycleRequest(t, f.srv, bob, q.method, "/api/projects/"+project.ID+"/conversations", q.body)
if w.Code != tc.code || w.Body.String() != tc.body || strings.Contains(w.Body.String(), leakMarker) {
t.Fatalf("work %s %s: %d %q", tc.name, q.method, w.Code, w.Body.String())
}
w := lifecycleRequest(t, f.srv, bob, http.MethodPost, "/api/projects/"+project.ID+"/conversations", `{"title":"t"}`)
if w.Code != tc.code || w.Body.String() != tc.body || strings.Contains(w.Body.String(), leakMarker) {
t.Fatalf("work %s %s: %d %q", tc.name, http.MethodPost, w.Code, w.Body.String())
}
}
// The read side answers from projectRead (U3): a failing provider is still
// refused, but the refusal is no longer categorized as a conversation.work
// failure and carries the provider message verbatim. That gap is an open
// Backend finding, so this test pins the write path and only requires the
// read path to refuse; pinning its current body would enshrine the leak.
f.provider.workErr = fmtWrap(leakyStatusError(503))
for _, q := range []struct{ method, body string }{{http.MethodPost, `{"title":"t"}`}, {http.MethodGet, ""}} {
w := lifecycleRequest(t, f.srv, bob, q.method, "/api/projects/"+project.ID+"/conversations", q.body)
if w.Code == http.StatusOK {
t.Fatalf("work refusal %s: %d %s", q.method, w.Code, w.Body.String())
}
}
f.provider.workErr = nil
internal/store/explain_test.go
+105 -55
View File
@@ -64,21 +64,30 @@ func TestExplainCapabilityCreatorSourcesMatchLinkedCapabilities(t *testing.T) {
}
}
func TestExplainCapabilityReportsConflictsAndMigrationNote(t *testing.T) {
// TestExplainCapabilityReportsNoConflictUnderTheSingleBooleanModel is the
// explanation face of the narrowed role model (R2): a role stores the single
// project-access boolean, a linked action row cannot be written any more, and
// an explanation therefore never reports a conflict or a migration note.
func TestExplainCapabilityReportsNoConflictUnderTheSingleBooleanModel(t *testing.T) {
st := openTestStore(t)
admin, alice, _ := rolePolicyAccounts(t, st)
// Bootstrap admin keeps project.create through is_admin even without the
// grant, so a role cap on a linked action is reported as a conflict.
epoch, _ := st.AuthorityEpoch()
if _, err := st.ReplaceSystemGrants("admin", admin.ID, epoch, []string{"system.permissions.manage", "system.roles.manage", "system.roles.assign"}, "drop-admin-create"); err != nil {
t.Fatal(err)
}
capped, err := st.CreateRole("admin", RoleCreate{Name: "受限管理"})
if err != nil {
t.Fatal(err)
}
// A linked action row is not role authority any more: the write is refused
// whole and the role keeps no permissions at all.
if _, err := st.ReplaceRolePermissions("admin", capped.RoleID, capped.RoleVersion,
[]RolePermissionChange{{ActionID: "project.members.manage", Allowed: false, CapAllowed: false}}, "cap-members"); err != nil {
[]RolePermissionChange{{ActionID: "project.members.manage", Allowed: false, CapAllowed: false}}, "cap-members"); !errors.Is(err, ErrInvalidRolePolicy) {
t.Fatalf("linked cap accepted: %v", err)
}
if permissions := capabilityRolePermissions(t, st, capped.RoleID); len(permissions) != 0 {
t.Fatalf("refused cap persisted: %+v", permissions)
}
// Bootstrap admin keeps project.create through is_admin even without the
// grant, so the bound role cannot contradict it either.
epoch, _ := st.AuthorityEpoch()
if _, err := st.ReplaceSystemGrants("admin", admin.ID, epoch, []string{"system.permissions.manage", "system.roles.manage", "system.roles.assign"}, "drop-admin-create"); err != nil {
t.Fatal(err)
}
admin, _ = st.GetAccount(admin.ID)
@@ -89,37 +98,49 @@ func TestExplainCapabilityReportsConflictsAndMigrationNote(t *testing.T) {
if err != nil {
t.Fatal(err)
}
linked, _ := st.LinkedCapabilities("admin")
linked, err := st.LinkedCapabilities("admin")
if err != nil {
t.Fatal(err)
}
capability := explanation.Capability
if capability.ProjectCreate.Source != "bootstrap-admin" || strings.Join(capability.Conflicts, ",") != "project.members.manage" ||
strings.Join(capability.Conflicts, ",") != strings.Join(linked.Conflicts, ",") {
t.Fatalf("conflicts=%+v linked=%+v", capability, linked)
if !capability.ProjectCreate.Allowed || capability.ProjectCreate.Source != "bootstrap-admin" ||
len(capability.Conflicts) != 0 || len(linked.Conflicts) != 0 || capability.MigrationNote != "" {
t.Fatalf("capability=%+v linked=%+v", capability, linked)
}
members := explainActionMap(capability.Linked)["project.members.manage"]
if members.Allowed || !members.Conflict || members.Reason != "role-cap" || members.Source != "" {
t.Fatalf("conflicting linked action=%+v", members)
actions := explainActionMap(capability.Linked)
if len(actions) != len(linkedManagementActions) || strings.Join(linked.LinkedActions, ",") != strings.Join(linkedManagementActions, ",") {
t.Fatalf("linked actions=%+v association=%v", capability.Linked, linked.LinkedActions)
}
if !strings.Contains(capability.MigrationNote, "project.members.manage") {
t.Fatalf("conflict note=%q", capability.MigrationNote)
for _, actionID := range linkedManagementActions {
linkedAction := actions[actionID]
if !linkedAction.Allowed || linkedAction.Conflict || linkedAction.Source != "bootstrap-admin" ||
linkedAction.LinkedVia != "project.create" || linkedAction.Scope != CapabilityScopeOwnProjects {
t.Fatalf("linked %s=%+v", actionID, linkedAction)
}
}
// Disabling project.create keeps linked rows; the explanation says so.
// Turning the one boolean off stops project.create, and because no linked
// rows exist there is nothing left for a migration note to report.
creator, err := st.CreateRole("admin", RoleCreate{Name: "创建者"})
if err != nil {
t.Fatal(err)
}
receipt, err := st.ReplaceRolePermissions("admin", creator.RoleID, creator.RoleVersion, []RolePermissionChange{
{ActionID: "project.create", Allowed: true, CapAllowed: true},
{ActionID: "project.settings", Allowed: true, CapAllowed: true},
}, "enable-create")
receipt, err := st.ReplaceRolePermissions("admin", creator.RoleID, creator.RoleVersion,
[]RolePermissionChange{{ActionID: "project.create", Allowed: true, CapAllowed: true}}, "enable-create")
if err != nil {
t.Fatal(err)
}
if _, err := st.AssignUserRole("admin", alice.ID, creator.RoleID, alice.StateVersion, "assign-alice-creator"); err != nil {
t.Fatal(err)
}
if _, err := st.ReplaceRolePermissions("admin", creator.RoleID, receipt.RoleVersion,
[]RolePermissionChange{{ActionID: "document.read", Allowed: true, CapAllowed: true}}, "disable-create"); err != nil {
granted, err := st.ExplainCapabilities("alice")
if err != nil {
t.Fatal(err)
}
if !granted.Capability.ProjectCreate.Allowed || granted.Capability.ProjectCreate.Source != CapabilitySourceRole {
t.Fatalf("granted create=%+v", granted.Capability.ProjectCreate)
}
if _, err := st.ReplaceRolePermissions("admin", creator.RoleID, receipt.RoleVersion, nil, "disable-create"); err != nil {
t.Fatal(err)
}
disabled, err := st.ExplainCapabilities("alice")
@@ -129,16 +150,26 @@ func TestExplainCapabilityReportsConflictsAndMigrationNote(t *testing.T) {
if disabled.Capability.ProjectCreate.Allowed || disabled.Capability.ProjectCreate.Reason != "not-granted" {
t.Fatalf("disabled create=%+v", disabled.Capability.ProjectCreate)
}
if len(disabled.Capability.Linked) != len(linkedManagementActions) {
t.Fatalf("linked after disable=%+v", disabled.Capability.Linked)
}
for _, action := range disabled.Capability.Linked {
if action.Allowed || action.Reason != "project-create-not-held" {
t.Fatalf("linked after disable=%+v", action)
}
}
if note := disabled.Capability.MigrationNote; !strings.Contains(note, "project.create not held") || !strings.Contains(note, "project.settings") {
if note := disabled.Capability.MigrationNote; note != "" {
t.Fatalf("migration note=%q", note)
}
if linked, err = st.LinkedCapabilities("alice"); err != nil || linked.ProjectCreate || len(linked.LinkedActions) != 0 {
t.Fatalf("disabled association=%+v err=%v", linked, err)
}
}
// TestExplainCapabilityMemberBasicCollaborate is the explanation face of the
// narrowed role model for member content: the role carries the single
// project-access boolean, so every member action is reported as unconfigured
// and a role row for one of them is refused.
func TestExplainCapabilityMemberBasicCollaborate(t *testing.T) {
st := openTestStore(t)
_, alice, _ := rolePolicyAccounts(t, st)
@@ -146,33 +177,49 @@ func TestExplainCapabilityMemberBasicCollaborate(t *testing.T) {
if err != nil {
t.Fatal(err)
}
if _, err := st.ReplaceRolePermissions("admin", role.RoleID, role.RoleVersion, []RolePermissionChange{
{ActionID: "document.read", Allowed: true, CapAllowed: true},
{ActionID: "trace.edit", Allowed: false, CapAllowed: true},
{ActionID: "knowledge.publish", Allowed: false, CapAllowed: false},
}, "member-policy"); err != nil {
receipt, err := st.ReplaceRolePermissions("admin", role.RoleID, role.RoleVersion,
[]RolePermissionChange{{ActionID: "project.create", Allowed: true, CapAllowed: true}}, "member-policy")
if err != nil {
t.Fatal(err)
}
if _, err := st.AssignUserRole("admin", alice.ID, role.RoleID, alice.StateVersion, "member-assign"); err != nil {
t.Fatal(err)
}
// Member content is not role authority any more, so the batch is refused
// and the role keeps the project-access boolean it already had.
if _, err := st.ReplaceRolePermissions("admin", role.RoleID, receipt.RoleVersion, []RolePermissionChange{
{ActionID: "document.read", Allowed: true, CapAllowed: true},
}, "member-content"); !errors.Is(err, ErrInvalidRolePolicy) {
t.Fatalf("member content accepted: %v", err)
}
explanation, err := st.ExplainCapabilities("alice")
if err != nil {
t.Fatal(err)
}
actions := explainActionMap(explanation.MemberBasicCollaborate.Actions)
want := map[string]CapabilityActionExplain{
"document.read": {ActionID: "document.read", Scope: CapabilityScopeMemberProjects, Allowed: true, CapAllowed: true, Source: "role"},
"trace.edit": {ActionID: "trace.edit", Scope: CapabilityScopeMemberProjects, CapAllowed: true, Reason: "role-default-deny"},
"knowledge.publish": {ActionID: "knowledge.publish", Scope: CapabilityScopeMemberProjects, Reason: "role-cap"},
"project.audit.read": {ActionID: "project.audit.read", Scope: CapabilityScopeMemberProjects, Reason: "action-unconfigured"},
}
if len(actions) != len(want) {
if len(actions) != len(memberBasicCollaborateActions) {
t.Fatalf("actions=%+v", explanation.MemberBasicCollaborate.Actions)
}
for actionID, expected := range want {
if actions[actionID] != expected {
t.Fatalf("%s=%+v want %+v", actionID, actions[actionID], expected)
for _, actionID := range memberBasicCollaborateActions {
want := CapabilityActionExplain{ActionID: actionID, Scope: CapabilityScopeMemberProjects, Reason: "action-unconfigured"}
if actions[actionID] != want {
t.Fatalf("%s=%+v want %+v", actionID, actions[actionID], want)
}
}
// A disabled role stops every member action at the role instead.
disabled := false
if _, err := st.PatchRole("admin", role.RoleID, receipt.RoleVersion, RolePatch{Enabled: &disabled}); err != nil {
t.Fatal(err)
}
explanation, err = st.ExplainCapabilities("alice")
if err != nil {
t.Fatal(err)
}
actions = explainActionMap(explanation.MemberBasicCollaborate.Actions)
for _, actionID := range memberBasicCollaborateActions {
want := CapabilityActionExplain{ActionID: actionID, Scope: CapabilityScopeMemberProjects, Reason: "role-disabled"}
if actions[actionID] != want {
t.Fatalf("disabled %s=%+v want %+v", actionID, actions[actionID], want)
}
}
unassigned, err := st.ExplainCapabilities("bob")
@@ -196,6 +243,9 @@ func TestExplainCapabilityMemberBasicCollaborate(t *testing.T) {
}
}
// TestExplainCapabilityDocumentQualify is the explanation face of the narrowed
// role model for document duties: the three duties are not role authority, so
// every duty is reported unconfigured and a duty row is refused.
func TestExplainCapabilityDocumentQualify(t *testing.T) {
st := openTestStore(t)
_, alice, _ := rolePolicyAccounts(t, st)
@@ -203,17 +253,21 @@ func TestExplainCapabilityDocumentQualify(t *testing.T) {
if err != nil {
t.Fatal(err)
}
receipt, err := st.ReplaceRolePermissions("admin", role.RoleID, role.RoleVersion, []RolePermissionChange{
{ActionID: "document.author", Allowed: true, CapAllowed: true},
{ActionID: "document.review", Allowed: false, CapAllowed: true},
{ActionID: "document.approve", Allowed: false, CapAllowed: false},
}, "duty-policy")
receipt, err := st.ReplaceRolePermissions("admin", role.RoleID, role.RoleVersion,
[]RolePermissionChange{{ActionID: "project.create", Allowed: true, CapAllowed: true}}, "duty-policy")
if err != nil {
t.Fatal(err)
}
if _, err := st.AssignUserRole("admin", alice.ID, role.RoleID, alice.StateVersion, "duty-assign"); err != nil {
t.Fatal(err)
}
// Assigning a document duty to the role is refused whole; the role keeps the
// project-access boolean and nothing else.
if _, err := st.ReplaceRolePermissions("admin", role.RoleID, receipt.RoleVersion, []RolePermissionChange{
{ActionID: "document.author", Allowed: true, CapAllowed: true},
}, "duty-row"); !errors.Is(err, ErrInvalidRolePolicy) {
t.Fatalf("duty row accepted: %v", err)
}
explanation, err := st.ExplainCapabilities("alice")
if err != nil {
t.Fatal(err)
@@ -222,17 +276,13 @@ func TestExplainCapabilityDocumentQualify(t *testing.T) {
for _, duty := range explanation.DocumentQualify.Duties {
got[duty.ActionID] = duty
}
want := map[string]DocumentDutyQualify{
"document.author": {ActionID: "document.author", Qualified: true, DefaultAllowed: true, Source: "role"},
"document.review": {ActionID: "document.review", Qualified: true, Source: "role", Reason: "role-default-deny"},
"document.approve": {ActionID: "document.approve", Reason: "role-cap"},
}
if len(got) != len(want) {
if len(got) != len(documentQualifyDuties) {
t.Fatalf("duties=%+v", explanation.DocumentQualify.Duties)
}
for actionID, expected := range want {
if got[actionID] != expected {
t.Fatalf("%s=%+v want %+v", actionID, got[actionID], expected)
for _, actionID := range documentQualifyDuties {
want := DocumentDutyQualify{ActionID: actionID, Reason: "action-unconfigured"}
if got[actionID] != want {
t.Fatalf("%s=%+v want %+v", actionID, got[actionID], want)
}
}
disabled := false
@@ -244,7 +294,7 @@ func TestExplainCapabilityDocumentQualify(t *testing.T) {
t.Fatal(err)
}
for _, duty := range explanation.DocumentQualify.Duties {
if duty.Qualified || duty.Reason != "role-disabled" {
if duty.Qualified || duty.DefaultAllowed || duty.Source != "" || duty.Reason != "role-disabled" {
t.Fatalf("disabled role duty=%+v", duty)
}
}