woodpecker/server/database/perm_test.go

310 lines
9 KiB
Go

package database
import (
"database/sql"
"testing"
"github.com/drone/drone/shared/model"
)
func Test_find(t *testing.T) {
setup()
defer teardown()
manager := NewPermManager(db).(*permManager)
perm, err := manager.find(&model.User{ID: 101}, &model.Repo{ID: 200})
if err != nil {
t.Errorf("Want permission, got %s", err)
}
var got, want = perm.ID, int64(1)
if got != want {
t.Errorf("Want ID %d, got %d", got, want)
}
got, want = perm.UserID, int64(101)
if got != want {
t.Errorf("Want Created %d, got %d", got, want)
}
got, want = perm.RepoID, int64(200)
if got != want {
t.Errorf("Want Created %d, got %d", got, want)
}
got, want = perm.Created, int64(1398065343)
if got != want {
t.Errorf("Want Created %d, got %d", got, want)
}
got, want = perm.Updated, int64(1398065344)
if got != want {
t.Errorf("Want Updated %d, got %d", got, want)
}
var gotBool, wantBool = perm.Read, true
if gotBool != wantBool {
t.Errorf("Want Read %v, got %v", gotBool, wantBool)
}
gotBool, wantBool = perm.Write, true
if gotBool != wantBool {
t.Errorf("Want Read %v, got %v", gotBool, wantBool)
}
gotBool, wantBool = perm.Admin, true
if gotBool != wantBool {
t.Errorf("Want Read %v, got %v", gotBool, wantBool)
}
// test that we get the appropriate error message when
// no permissions are found in the database.
_, err = manager.find(&model.User{ID: 102}, &model.Repo{ID: 201})
if err != sql.ErrNoRows {
t.Errorf("Want ErrNoRows, got %s", err)
}
}
func TestPermFind(t *testing.T) {
setup()
defer teardown()
manager := NewPermManager(db).(*permManager)
u := model.User{ID: 101, Admin: false}
r := model.Repo{ID: 201, Private: false}
// public repos should always be accessible
if perm := manager.Find(&u, &r); !perm.Read {
t.Errorf("Public repos should always be READ accessible")
}
// public repos should always be accessible, even to guest users
if perm := manager.Find(nil, &r); !perm.Read || perm.Write || perm.Admin {
t.Errorf("Public repos should always be READ accessible, even to nil users")
}
// private repos should not be accessible to nil users
r.Private = true
if perm := manager.Find(nil, &r); perm.Read || perm.Write || perm.Admin {
t.Errorf("Private repos should not be READ accessible to nil users")
}
// private repos should not be accessible to users without a row in the perm table.
r.Private = true
if perm := manager.Find(&u, &r); perm.Read || perm.Write || perm.Admin {
t.Errorf("Private repos should not be READ accessible to users without a row in the perm table.")
}
// private repos should be accessible to admins
r.Private = true
u.Admin = true
if perm := manager.Find(&u, &r); !perm.Read || !perm.Write || !perm.Admin {
t.Errorf("Private repos should be READ accessible to admins")
}
// private repos should be accessible to users with rows in the perm table.
r.ID = 200
r.Private = true
u.Admin = false
if perm := manager.Find(&u, &r); !perm.Read {
t.Errorf("Private repos should be READ accessible to users with rows in the perm table.")
}
}
func TestPermRead(t *testing.T) {
setup()
defer teardown()
var manager = NewPermManager(db)
// dummy admin and repo
u := model.User{ID: 101, Admin: false}
r := model.Repo{ID: 201, Private: false}
// public repos should always be accessible
if read, err := manager.Read(&u, &r); !read || err != nil {
t.Errorf("Public repos should always be READ accessible")
}
// public repos should always be accessible, even to guest users
if read, err := manager.Read(nil, &r); !read || err != nil {
t.Errorf("Public repos should always be READ accessible, even to nil users")
}
// private repos should not be accessible to nil users
r.Private = true
if read, err := manager.Read(nil, &r); read || err != nil {
t.Errorf("Private repos should not be READ accessible to nil users")
}
// private repos should not be accessible to users without a row in the perm table.
r.Private = true
if read, _ := manager.Read(&u, &r); read {
t.Errorf("Private repos should not be READ accessible to users without a row in the perm table.")
}
// private repos should be accessible to admins
r.Private = true
u.Admin = true
if read, err := manager.Read(&u, &r); !read || err != nil {
t.Errorf("Private repos should be READ accessible to admins")
}
// private repos should be accessible to users with rows in the perm table.
r.ID = 200
r.Private = true
u.Admin = false
if read, err := manager.Read(&u, &r); !read || err != nil {
t.Errorf("Private repos should be READ accessible to users with rows in the perm table.")
}
}
func TestPermWrite(t *testing.T) {
setup()
defer teardown()
var manager = NewPermManager(db)
// dummy admin and repo
u := model.User{ID: 101, Admin: false}
r := model.Repo{ID: 201, Private: false}
// repos should not be accessible to nil users
r.Private = true
if write, err := manager.Write(nil, &r); write || err != nil {
t.Errorf("Repos should not be WRITE accessible to nil users")
}
// repos should not be accessible to users without a row in the perm table.
if write, _ := manager.Write(&u, &r); write {
t.Errorf("Repos should not be WRITE accessible to users without a row in the perm table.")
}
// repos should be accessible to admins
u.Admin = true
if write, err := manager.Write(&u, &r); !write || err != nil {
t.Errorf("Repos should be WRITE accessible to admins")
}
// repos should be accessible to users with rows in the perm table.
r.ID = 200
u.Admin = false
if write, err := manager.Write(&u, &r); !write || err != nil {
t.Errorf("Repos should be WRITE accessible to users with rows in the perm table.")
}
// repos should not be accessible to users with a row in the perm table, but write=false
u.ID = 103
u.Admin = false
if write, err := manager.Write(&u, &r); write || err != nil {
t.Errorf("Repos should not be WRITE accessible to users with perm.Write=false.")
}
}
func TestPermAdmin(t *testing.T) {
setup()
defer teardown()
var manager = NewPermManager(db)
// dummy admin and repo
u := model.User{ID: 101, Admin: false}
r := model.Repo{ID: 201, Private: false}
// repos should not be accessible to nil users
r.Private = true
if admin, err := manager.Admin(nil, &r); admin || err != nil {
t.Errorf("Repos should not be ADMIN accessible to nil users")
}
// repos should not be accessible to users without a row in the perm table.
if admin, _ := manager.Admin(&u, &r); admin {
t.Errorf("Repos should not be ADMIN accessible to users without a row in the perm table.")
}
// repos should be accessible to admins
u.Admin = true
if admin, err := manager.Admin(&u, &r); !admin || err != nil {
t.Errorf("Repos should be ADMIN accessible to admins")
}
// repos should be accessible to users with rows in the perm table.
r.ID = 200
u.Admin = false
if admin, err := manager.Admin(&u, &r); !admin || err != nil {
t.Errorf("Repos should be ADMIN accessible to users with rows in the perm table.")
}
// repos should not be accessible to users with a row in the perm table, but admin=false
u.ID = 103
u.Admin = false
if admin, err := manager.Admin(&u, &r); admin || err != nil {
t.Errorf("Repos should not be ADMIN accessible to users with perm.Admin=false.")
}
}
func TestPermRevoke(t *testing.T) {
setup()
defer teardown()
// dummy admin and repo
u := model.User{ID: 101}
r := model.Repo{ID: 200}
manager := NewPermManager(db).(*permManager)
admin, err := manager.Admin(&u, &r)
if !admin || err != nil {
t.Errorf("Want Admin permission, got Admin %v, error %s", admin, err)
}
// revoke permissions
if err := manager.Revoke(&u, &r); err != nil {
t.Errorf("Want revoked permissions, got %s", err)
}
perm, err := manager.find(&u, &r)
if perm.Admin == true || err != sql.ErrNoRows {
t.Errorf("Expected revoked permission, got Admin %v, error %v", perm.Admin, err)
}
}
func TestPermGrant(t *testing.T) {
setup()
defer teardown()
// dummy admin and repo
u := model.User{ID: 104}
r := model.Repo{ID: 200}
manager := NewPermManager(db).(*permManager)
if err := manager.Grant(&u, &r, true, true, true); err != nil {
t.Errorf("Want permissions granted, got %s", err)
}
// add new permissions
perm, err := manager.find(&u, &r)
if err != nil {
t.Errorf("Want permission, got %s", err)
} else if perm.Read != true {
t.Errorf("Want Read permission True, got %v", perm.Read)
} else if perm.Write != true {
t.Errorf("Want Write permission True, got %v", perm.Write)
} else if perm.Admin != true {
t.Errorf("Want Admin permission True, got %v", perm.Admin)
}
// update permissions
if err := manager.Grant(&u, &r, false, false, false); err != nil {
t.Errorf("Want permissions granted, got %s", err)
}
// add new permissions
perm, err = manager.find(&u, &r)
if err != nil {
t.Errorf("Want permission updated, got %s", err)
} else if perm.Read != false {
t.Errorf("Want Read permission False, got %v", perm.Read)
} else if perm.Write != false {
t.Errorf("Want Write permission False, got %v", perm.Write)
} else if perm.Admin != false {
t.Errorf("Want Admin permission False, got %v", perm.Admin)
}
}