From 74300a75a9871e1e0f546988d89014bc2bf46999 Mon Sep 17 00:00:00 2001 From: Angira Kekteeva Date: Sun, 17 Jul 2022 07:33:47 +0400 Subject: [PATCH] [#584] Add tests Signed-off-by: Angira Kekteeva --- api/handler/acl_test.go | 297 ++++++++++++++++++++++++++++++++++++++-- 1 file changed, 289 insertions(+), 8 deletions(-) diff --git a/api/handler/acl_test.go b/api/handler/acl_test.go index 96b0d576c..731a0b255 100644 --- a/api/handler/acl_test.go +++ b/api/handler/acl_test.go @@ -257,6 +257,286 @@ func TestMergeAstModified(t *testing.T) { require.Equal(t, expected, actual) } +func TestMergeAppended(t *testing.T) { + key, err := keys.NewPrivateKey() + require.NoError(t, err) + users := []string{hex.EncodeToString(key.PublicKey().Bytes())} + + parent := &ast{ + Resources: []*astResource{ + { + resourceInfo: resourceInfo{ + Bucket: "bucket", + }, + Operations: []*astOperation{ + { + Users: users, + Op: eacl.OperationGet, + Action: eacl.ActionAllow, + }, + { + Users: users, + Op: eacl.OperationPut, + Action: eacl.ActionAllow, + }, + { + Users: users, + Op: eacl.OperationDelete, + Action: eacl.ActionAllow, + }, + { + Op: eacl.OperationGet, + Action: eacl.ActionDeny, + }, + { + Op: eacl.OperationPut, + Action: eacl.ActionDeny, + }, + { + Op: eacl.OperationDelete, + Action: eacl.ActionDeny, + }, + }, + }, + }, + } + + child := &ast{ + Resources: []*astResource{ + { + resourceInfo: resourceInfo{ + Bucket: "bucket", + Object: "objectName", + }, + Operations: []*astOperation{ + { + Users: users, + Op: eacl.OperationGet, + Action: eacl.ActionAllow, + }, + { + Users: users, + Op: eacl.OperationPut, + Action: eacl.ActionAllow, + }, + { + Users: users, + Op: eacl.OperationDelete, + Action: eacl.ActionAllow, + }, + { + Op: eacl.OperationGet, + Action: eacl.ActionAllow, + }, + { + Op: eacl.OperationPut, + Action: eacl.ActionAllow, + }, + { + Op: eacl.OperationDelete, + Action: eacl.ActionAllow, + }, + }, + }, + }, + } + + expected := &ast{ + Resources: []*astResource{ + { + resourceInfo: resourceInfo{ + Bucket: "bucket", + }, + Operations: []*astOperation{ + { + Users: users, + Op: eacl.OperationGet, + Action: eacl.ActionAllow, + }, + { + Users: users, + Op: eacl.OperationPut, + Action: eacl.ActionAllow, + }, + { + Users: users, + Op: eacl.OperationDelete, + Action: eacl.ActionAllow, + }, + { + Op: eacl.OperationGet, + Action: eacl.ActionDeny, + }, + { + Op: eacl.OperationPut, + Action: eacl.ActionDeny, + }, + { + Op: eacl.OperationDelete, + Action: eacl.ActionDeny, + }, + }, + }, + { + resourceInfo: resourceInfo{ + Bucket: "bucket", + Object: "objectName", + }, + Operations: []*astOperation{ + { + Users: users, + Op: eacl.OperationGet, + Action: eacl.ActionAllow, + }, + { + Users: users, + Op: eacl.OperationPut, + Action: eacl.ActionAllow, + }, + { + Users: users, + Op: eacl.OperationDelete, + Action: eacl.ActionAllow, + }, + { + Op: eacl.OperationGet, + Action: eacl.ActionAllow, + }, + { + Op: eacl.OperationPut, + Action: eacl.ActionAllow, + }, + { + Op: eacl.OperationDelete, + Action: eacl.ActionAllow, + }, + }, + }, + }, + } + actual, updated := mergeAst(parent, child) + require.True(t, updated) + require.Equal(t, expected, actual) +} + +func TestOrder(t *testing.T) { + key, err := keys.NewPrivateKey() + require.NoError(t, err) + users := []string{hex.EncodeToString(key.PublicKey().Bytes())} + targetUser := eacl.NewTarget() + targetUser.SetBinaryKeys([][]byte{key.PublicKey().Bytes()}) + targetOther := eacl.NewTarget() + targetOther.SetRole(eacl.RoleOthers) + bucketName := "bucket" + objectName := "objectName" + + expectedAst := &ast{ + Resources: []*astResource{ + { + resourceInfo: resourceInfo{ + Bucket: bucketName, + }, + Operations: []*astOperation{ + { + Users: users, + Op: eacl.OperationGet, + Action: eacl.ActionAllow, + }, + { + Op: eacl.OperationGet, + Action: eacl.ActionDeny, + }, + }, + }, + { + resourceInfo: resourceInfo{ + Bucket: bucketName, + Object: objectName, + }, + Operations: []*astOperation{ + { + Users: users, + Op: eacl.OperationGet, + Action: eacl.ActionAllow, + }, + { + Op: eacl.OperationGet, + Action: eacl.ActionDeny, + }, + }, + }, + }, + } + + record1 := eacl.NewRecord() + record1.SetOperation(eacl.OperationGet) + record1.SetAction(eacl.ActionAllow) + record1.SetTargets(*targetUser) + record1.AddObjectAttributeFilter(eacl.MatchStringEqual, object.AttributeFileName, objectName) + record2 := eacl.NewRecord() + record2.SetOperation(eacl.OperationGet) + record2.SetAction(eacl.ActionDeny) + record2.AddObjectAttributeFilter(eacl.MatchStringEqual, object.AttributeFileName, objectName) + record2.SetTargets(*targetOther) + record3 := eacl.NewRecord() + record3.SetOperation(eacl.OperationGet) + record3.SetAction(eacl.ActionAllow) + record3.SetTargets(*targetUser) + record4 := eacl.NewRecord() + record4.SetOperation(eacl.OperationGet) + record4.SetAction(eacl.ActionDeny) + record4.SetTargets(*targetOther) + + expectedEacl := eacl.NewTable() + expectedEacl.AddRecord(record1) + expectedEacl.AddRecord(record2) + expectedEacl.AddRecord(record3) + expectedEacl.AddRecord(record4) + + t.Run("astToTable order and vice versa", func(t *testing.T) { + actualEacl, err := astToTable(expectedAst) + require.NoError(t, err) + require.Equal(t, expectedEacl, actualEacl) + + actualAst := tableToAst(actualEacl, bucketName) + require.Equal(t, expectedAst, actualAst) + }) + + t.Run("tableToAst order and vice versa", func(t *testing.T) { + actualAst := tableToAst(expectedEacl, bucketName) + require.Equal(t, expectedAst, actualAst) + + actualEacl, err := astToTable(actualAst) + require.NoError(t, err) + require.Equal(t, expectedEacl, actualEacl) + }) + + t.Run("append a resource", func(t *testing.T) { + childName := "child" + child := &ast{Resources: []*astResource{{ + resourceInfo: resourceInfo{ + Bucket: bucketName, + Object: childName, + }, + Operations: []*astOperation{{Op: eacl.OperationDelete, Action: eacl.ActionDeny}}}}, + } + + childRecord := eacl.NewRecord() + childRecord.SetOperation(eacl.OperationDelete) + childRecord.SetAction(eacl.ActionDeny) + childRecord.SetTargets(*targetOther) + childRecord.AddObjectAttributeFilter(eacl.MatchStringEqual, object.AttributeFileName, childName) + + mergedAst, updated := mergeAst(expectedAst, child) + require.True(t, updated) + + mergedEacl, err := astToTable(mergedAst) + require.NoError(t, err) + + require.Equal(t, *childRecord, mergedEacl.Records()[0]) + }) +} + func TestMergeAstModifiedConflict(t *testing.T) { child := &ast{ Resources: []*astResource{ @@ -360,16 +640,17 @@ func TestAstToTable(t *testing.T) { expectedTable := eacl.NewTable() record := eacl.NewRecord() - record.SetAction(eacl.ActionAllow) - record.SetOperation(eacl.OperationPut) - // Unknown role is used, because it is ignored when keys are set - eacl.AddFormedTarget(record, eacl.RoleUnknown, *(*ecdsa.PublicKey)(key.PublicKey())) + record.SetAction(eacl.ActionDeny) + record.SetOperation(eacl.OperationGet) + eacl.AddFormedTarget(record, eacl.RoleOthers) + record.AddObjectAttributeFilter(eacl.MatchStringEqual, object.AttributeFileName, "objectName") expectedTable.AddRecord(record) + record2 := eacl.NewRecord() - record2.SetAction(eacl.ActionDeny) - record2.SetOperation(eacl.OperationGet) - eacl.AddFormedTarget(record2, eacl.RoleOthers) - record2.AddObjectAttributeFilter(eacl.MatchStringEqual, object.AttributeFileName, "objectName") + record2.SetAction(eacl.ActionAllow) + record2.SetOperation(eacl.OperationPut) + // Unknown role is used, because it is ignored when keys are set + eacl.AddFormedTarget(record2, eacl.RoleUnknown, *(*ecdsa.PublicKey)(key.PublicKey())) expectedTable.AddRecord(record2) actualTable, err := astToTable(ast)