73 lines
2.5 KiB
Go
73 lines
2.5 KiB
Go
package catalog
|
|
|
|
import "testing"
|
|
|
|
func TestCatalogRejectsUnknownAndProtectsManagementActions(t *testing.T) {
|
|
if _, ok := DescriptorByID("invented.action"); ok {
|
|
t.Fatal("unknown action registered")
|
|
}
|
|
got, ok := DescriptorByID("system.roles.manage")
|
|
if !ok || got.Scope != ScopeSystem || !got.Protected {
|
|
t.Fatalf("descriptor=%+v", got)
|
|
}
|
|
create, ok := DescriptorByID("project.create")
|
|
if !ok || create.Scope != ScopeSystem || create.Protected {
|
|
t.Fatalf("project.create=%+v", create)
|
|
}
|
|
}
|
|
|
|
func TestCatalogProjectAccessIsTheOnlyRoleAction(t *testing.T) {
|
|
access, ok := DescriptorByID(ProjectAccessAction)
|
|
if !ok || access.ActionID != "project.create" || access.Scope != ScopeSystem || access.Protected {
|
|
t.Fatalf("project access descriptor=%+v ok=%v", access, ok)
|
|
}
|
|
}
|
|
|
|
func TestProjectCreateLinkedActionsAreCatalogedProjectActions(t *testing.T) {
|
|
linked := ProjectCreateLinkedActions()
|
|
if len(linked) != 4 {
|
|
t.Fatalf("linked=%v", linked)
|
|
}
|
|
for _, actionID := range linked {
|
|
descriptor, ok := DescriptorByID(actionID)
|
|
if !ok || descriptor.Scope != ScopeProject || descriptor.Protected || !IsProjectCreateLinkedAction(actionID) {
|
|
t.Fatalf("linked action %s descriptor=%+v ok=%v", actionID, descriptor, ok)
|
|
}
|
|
}
|
|
if IsProjectCreateLinkedAction(ProjectCreateAction) || IsProjectCreateLinkedAction("document.read") {
|
|
t.Fatal("unlinked action reported as linked")
|
|
}
|
|
linked[0] = "mutated"
|
|
if ProjectCreateLinkedActions()[0] == "mutated" {
|
|
t.Fatal("linked actions exposed mutable storage")
|
|
}
|
|
}
|
|
|
|
func TestCatalogReturnsIndependentCopies(t *testing.T) {
|
|
first := Catalog()
|
|
if len(first) == 0 {
|
|
t.Fatal("empty catalog")
|
|
}
|
|
first[0].Label = "mutated"
|
|
second := Catalog()
|
|
if second[0].Label == "mutated" {
|
|
t.Fatal("Catalog exposed mutable registry storage")
|
|
}
|
|
}
|
|
|
|
// TestCatalogLinkedActionsStayProjectScopedAndUnprotected pins the narrowing
|
|
// that the ported batch writers enforce: project.create remains the single
|
|
// role authority, and the linked own-project management actions stay
|
|
// project-scoped and never protected so the role cannot inherit them.
|
|
func TestCatalogLinkedActionsStayProjectScopedAndUnprotected(t *testing.T) {
|
|
for _, actionID := range ProjectCreateLinkedActions() {
|
|
descriptor, ok := DescriptorByID(actionID)
|
|
if !ok || descriptor.Scope != ScopeProject || descriptor.Protected {
|
|
t.Fatalf("linked %s descriptor=%+v ok=%v", actionID, descriptor, ok)
|
|
}
|
|
if IsProjectCreateLinkedAction(ProjectAccessAction) {
|
|
t.Fatal("project.create reported as a linked action of itself")
|
|
}
|
|
}
|
|
}
|