119 lines
4.3 KiB
Go
119 lines
4.3 KiB
Go
package zddc
|
|
|
|
import "testing"
|
|
|
|
// helper: build a chain from levels (root-to-leaf), HasAnyFile=true.
|
|
func buildChain(levels ...ZddcFile) PolicyChain {
|
|
return PolicyChain{Levels: levels, HasAnyFile: true}
|
|
}
|
|
|
|
// helper: ACL with a permissions map and an explicit inherit setting.
|
|
func aclFenced(perms map[string]string, inherit bool) ACLRules {
|
|
return ACLRules{Permissions: perms, Inherit: &inherit}
|
|
}
|
|
|
|
func aclOpen(perms map[string]string) ACLRules {
|
|
return ACLRules{Permissions: perms}
|
|
}
|
|
|
|
func TestVisibleStart_NoFence(t *testing.T) {
|
|
chain := buildChain(
|
|
ZddcFile{ACL: aclOpen(map[string]string{"*@example.com": "r"})},
|
|
ZddcFile{ACL: aclOpen(map[string]string{"*@example.com": "rwcd"})},
|
|
ZddcFile{ACL: aclOpen(map[string]string{"*@example.com": "rwcda"})},
|
|
)
|
|
if got := chain.VisibleStart(2); got != 0 {
|
|
t.Errorf("no fence: VisibleStart = %d, want 0", got)
|
|
}
|
|
}
|
|
|
|
func TestVisibleStart_FenceClampsToFence(t *testing.T) {
|
|
chain := buildChain(
|
|
ZddcFile{ACL: aclOpen(map[string]string{"*@example.com": "r"})},
|
|
ZddcFile{ACL: aclFenced(map[string]string{"*@vendor.com": "rwcd"}, false)},
|
|
ZddcFile{ACL: aclOpen(map[string]string{})},
|
|
)
|
|
if got := chain.VisibleStart(2); got != 1 {
|
|
t.Errorf("fence at 1: VisibleStart(2) = %d, want 1", got)
|
|
}
|
|
if got := chain.VisibleStart(1); got != 1 {
|
|
t.Errorf("fence at 1: VisibleStart(1) = %d, want 1", got)
|
|
}
|
|
// Fence above toIdx is irrelevant.
|
|
if got := chain.VisibleStart(0); got != 0 {
|
|
t.Errorf("fence at 1: VisibleStart(0) = %d, want 0 (fence not yet in scope)", got)
|
|
}
|
|
}
|
|
|
|
func TestVisibleStart_NestedFencesDeepestWins(t *testing.T) {
|
|
chain := buildChain(
|
|
ZddcFile{ACL: aclOpen(map[string]string{"*@example.com": "r"})},
|
|
ZddcFile{ACL: aclFenced(map[string]string{"*@a.com": "r"}, false)},
|
|
ZddcFile{ACL: aclFenced(map[string]string{"*@b.com": "rwcd"}, false)},
|
|
ZddcFile{ACL: aclOpen(map[string]string{})},
|
|
)
|
|
if got := chain.VisibleStart(3); got != 2 {
|
|
t.Errorf("nested fence: deepest wins, got %d want 2", got)
|
|
}
|
|
}
|
|
|
|
// End-to-end: a fence at the vendor folder hides root-level grants for
|
|
// users who don't match the vendor-folder grants.
|
|
func TestEffectiveVerbs_FenceHidesAncestorGrants(t *testing.T) {
|
|
chain := buildChain(
|
|
// Root: everyone-at-example reads everywhere.
|
|
ZddcFile{ACL: aclOpen(map[string]string{"*@example.com": "rwcd"})},
|
|
// Vendor folder: deny everyone-at-example, allow vendor explicitly,
|
|
// AND fence — so the root grant doesn't sneak through.
|
|
ZddcFile{ACL: aclFenced(map[string]string{
|
|
"*@vendor.com": "rwcd",
|
|
"_doc_controller": "rwcda",
|
|
}, false)},
|
|
)
|
|
|
|
// alice@example.com used to inherit root rwcd; with the fence she has
|
|
// no grant in the vendor folder → 0 verbs.
|
|
if got := EffectiveVerbs(chain, "alice@example.com"); got != 0 {
|
|
t.Errorf("alice should be denied by fence; got %s", got)
|
|
}
|
|
// rep@vendor.com matches the local rule.
|
|
if got := EffectiveVerbs(chain, "rep@vendor.com"); got != VerbsRWCD {
|
|
t.Errorf("vendor should have rwcd; got %s", got)
|
|
}
|
|
}
|
|
|
|
// Roles defined above the fence are invisible to descendants — operators
|
|
// who fence must redefine roles locally if they want to use them.
|
|
func TestRoleMembers_FenceHidesAncestorRoles(t *testing.T) {
|
|
rootLevel := ZddcFile{
|
|
Roles: map[string]Role{"_doc_controller": {Members: []string{"dc@example.com"}}},
|
|
ACL: aclOpen(map[string]string{"*@example.com": "r"}),
|
|
}
|
|
fencedLevel := ZddcFile{
|
|
ACL: aclFenced(map[string]string{"*@vendor.com": "rwcd"}, false),
|
|
}
|
|
chain := buildChain(rootLevel, fencedLevel)
|
|
|
|
// Below the fence, the role from root is invisible.
|
|
if got := RoleMembers(chain, 1, "_doc_controller"); got != nil {
|
|
t.Errorf("role above fence should be invisible; got %v", got)
|
|
}
|
|
}
|
|
|
|
// A role redefined locally below the fence shadows correctly because
|
|
// the redefinition is at-or-below the fence (visible).
|
|
func TestRoleMembers_LocalRedefinitionWorks(t *testing.T) {
|
|
chain := buildChain(
|
|
ZddcFile{
|
|
Roles: map[string]Role{"_doc_controller": {Members: []string{"dc@example.com"}}},
|
|
},
|
|
ZddcFile{
|
|
ACL: aclFenced(map[string]string{"_doc_controller": "rwcda"}, false),
|
|
Roles: map[string]Role{"_doc_controller": {Members: []string{"vendor-dc@example.com"}}},
|
|
},
|
|
)
|
|
got := RoleMembers(chain, 1, "_doc_controller")
|
|
if len(got) != 1 || got[0] != "vendor-dc@example.com" {
|
|
t.Errorf("local redefinition should win; got %v", got)
|
|
}
|
|
}
|