40 lines
1.8 KiB
Go
40 lines
1.8 KiB
Go
|
package accesscontrol
|
||
|
|
|
||
|
|
import (
|
||
|
|
"context"
|
||
|
|
"slices"
|
||
|
|
"testing"
|
||
|
|
|
||
|
|
"github.com/Tencent/WeKnora/internal/accesspolicy"
|
||
|
|
"github.com/Tencent/WeKnora/internal/types"
|
||
|
|
)
|
||
|
|
|
||
|
|
func TestVisiblePermissionsRespectNativeRole(t *testing.T) {
|
||
|
|
for _, role := range []types.TenantRole{types.TenantRoleViewer, types.TenantRoleContributor, types.TenantRoleAdmin} {
|
||
|
|
ctx := context.WithValue(context.Background(), types.TenantRoleContextKey, role)
|
||
|
|
permissions := visiblePermissions(ctx, &accesspolicy.Snapshot{})
|
||
|
|
if slices.Contains(permissions, "content.write") != role.HasPermission(types.TenantRoleContributor) {
|
||
|
|
t.Fatalf("content mutation visibility does not match native role %s", role)
|
||
|
|
}
|
||
|
|
if slices.Contains(permissions, "content.review") != role.HasPermission(types.TenantRoleContributor) {
|
||
|
|
t.Fatalf("content review visibility does not match native role %s", role)
|
||
|
|
}
|
||
|
|
if !slices.Contains(permissions, "content.deliver") {
|
||
|
|
t.Fatalf("delivery must be available to native readers: %s", role)
|
||
|
|
}
|
||
|
|
for _, permission := range []string{"access.read", "settings.read", "settings.write", "balance.read", "balance.write", "usage.read", "audit.read", "system.read"} {
|
||
|
|
if slices.Contains(permissions, permission) != role.HasPermission(types.TenantRoleAdmin) {
|
||
|
|
t.Fatalf("%s visibility does not match native role %s", permission, role)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if !slices.Contains(permissions, "chat.write") {
|
||
|
|
t.Fatalf("native viewer conversation permission must remain available for %s", role)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
ctx := context.WithValue(context.Background(), types.TenantRoleContextKey, types.TenantRoleContributor)
|
||
|
|
permissions := visiblePermissions(ctx, &accesspolicy.Snapshot{Restricted: true, Permissions: map[string]bool{"content.read": true}})
|
||
|
|
if !slices.Equal(permissions, []string{"content.read"}) {
|
||
|
|
t.Fatalf("custom role broadened: %v", permissions)
|
||
|
|
}
|
||
|
|
}
|