WeiCHEN
d49c8f8cfc
Expose fine-grained system:* checks (admin grants all) and list system_setting_policy_audits for settings change visibility.
104 lines
3.1 KiB
Go
104 lines
3.1 KiB
Go
package authz_test
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"chat-agent-system/internal/authz"
|
|
)
|
|
|
|
func TestService_ListCapabilities_DisabledWithoutPool(t *testing.T) {
|
|
svc := authz.NewService(nil)
|
|
caps, err := svc.ListCapabilities(context.Background(), 1)
|
|
if err != nil {
|
|
t.Fatalf("unexpected error: %v", err)
|
|
}
|
|
if caps != nil {
|
|
t.Fatalf("expected nil caps when pool disabled, got %v", caps)
|
|
}
|
|
}
|
|
|
|
func TestService_IsSystemAdmin_ByRoleID(t *testing.T) {
|
|
svc := authz.NewService(nil)
|
|
admin, err := svc.IsSystemAdmin(context.Background(), 1, "role-admin")
|
|
if err != nil || !admin {
|
|
t.Fatalf("expected admin by role_id, got (%v, %v)", admin, err)
|
|
}
|
|
}
|
|
|
|
func TestService_HasSystemPermission_AdminGrantsAllSystemKeys(t *testing.T) {
|
|
svc := authz.NewService(nil)
|
|
ctx := context.Background()
|
|
for _, perm := range authz.SystemConsolePermissions() {
|
|
ok, err := svc.HasSystemPermission(ctx, 1, "role-admin", perm)
|
|
if err != nil || !ok {
|
|
t.Fatalf("admin should have %s, got (%v, %v)", perm, ok, err)
|
|
}
|
|
}
|
|
ok, err := svc.HasSystemPermission(ctx, 1, "role-admin", authz.PermManage)
|
|
if err != nil || !ok {
|
|
t.Fatalf("admin should have perm:manage, got (%v, %v)", ok, err)
|
|
}
|
|
}
|
|
|
|
func TestService_HasSystemPermission_NonAdminFailClosed(t *testing.T) {
|
|
svc := authz.NewService(nil)
|
|
ctx := context.Background()
|
|
for _, role := range []string{"role-engineer", "role-guest", "", "role-director"} {
|
|
for _, perm := range authz.SystemConsolePermissions() {
|
|
ok, err := svc.HasSystemPermission(ctx, 2, role, perm)
|
|
if err != nil {
|
|
t.Fatalf("unexpected err for %s/%s: %v", role, perm, err)
|
|
}
|
|
if ok {
|
|
t.Fatalf("non-admin %s must not have %s", role, perm)
|
|
}
|
|
}
|
|
}
|
|
ok, err := svc.HasSystemPermission(ctx, 0, "role-admin", authz.PermSystemOverview)
|
|
if err != nil || ok {
|
|
t.Fatalf("invalid userID must fail-closed, got (%v, %v)", ok, err)
|
|
}
|
|
ok, err = svc.HasSystemPermission(ctx, 1, "role-admin", "")
|
|
if err != nil || ok {
|
|
t.Fatalf("empty perm must fail-closed, got (%v, %v)", ok, err)
|
|
}
|
|
}
|
|
|
|
func TestPermissionCatalog_IncludesSystemConsoleKeys(t *testing.T) {
|
|
keys := map[string]bool{}
|
|
for _, e := range authz.PermissionCatalog() {
|
|
keys[e.Key] = true
|
|
}
|
|
for _, perm := range authz.SystemConsolePermissions() {
|
|
if !keys[perm] {
|
|
t.Fatalf("catalog missing %s", perm)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestUpsertProjectMember_RejectsDocRolesWithoutDB(t *testing.T) {
|
|
a := authz.NewAuthorizer(nil)
|
|
if err := a.UpsertProjectMember(context.Background(), 1, 2, "author"); err == nil {
|
|
t.Fatal("expected author role to be rejected")
|
|
}
|
|
if err := a.UpsertProjectMember(context.Background(), 1, 2, authz.RoleOwner); err != nil {
|
|
t.Fatalf("owner should be allowed: %v", err)
|
|
}
|
|
bad := "viewer"
|
|
if err := a.UpsertProjectMemberSpec(context.Background(), 1, 2, authz.MemberUpsert{
|
|
ProjectRole: authz.RoleMember,
|
|
DocumentDuty: &bad,
|
|
}); err == nil {
|
|
t.Fatal("document_duty=viewer must be rejected")
|
|
}
|
|
}
|
|
|
|
func TestGetProjectMember_DisabledWithoutPool(t *testing.T) {
|
|
a := authz.NewAuthorizer(nil)
|
|
rec, err := a.GetProjectMember(context.Background(), 1, 2)
|
|
if err != nil || rec != nil {
|
|
t.Fatalf("disabled authorizer must not invent a member, got (%v, %v)", rec, err)
|
|
}
|
|
}
|