41 lines
1.4 KiB
Go
41 lines
1.4 KiB
Go
|
package accesspolicy
|
||
|
|
|
||
|
|
import (
|
||
|
|
"context"
|
||
|
|
"testing"
|
||
|
|
)
|
||
|
|
|
||
|
|
func TestManagedResourceRequiresOwnerPublicationOrGrant(t *testing.T) {
|
||
|
|
s := &Snapshot{Restricted: true, Permissions: map[string]bool{"knowledge.read": true}, Publications: map[string]bool{"knowledge:k": false}, Grants: map[string]bool{}}
|
||
|
|
ctx := WithSnapshot(context.Background(), s)
|
||
|
|
if Readable(ctx, "knowledge", "k", false, true) {
|
||
|
|
t.Fatal("managed private resource retained native public access")
|
||
|
|
}
|
||
|
|
if !Readable(ctx, "knowledge", "k", true, false) {
|
||
|
|
t.Fatal("owner lost resource access")
|
||
|
|
}
|
||
|
|
s.Grants["knowledge:k"] = true
|
||
|
|
if !Readable(ctx, "knowledge", "k", false, false) {
|
||
|
|
t.Fatal("grant did not provide read access")
|
||
|
|
}
|
||
|
|
delete(s.Grants, "knowledge:k")
|
||
|
|
if Readable(ctx, "knowledge", "k", false, true) {
|
||
|
|
t.Fatal("revoked grant still readable")
|
||
|
|
}
|
||
|
|
s.Publications["knowledge:k"] = true
|
||
|
|
if !Readable(ctx, "knowledge", "k", false, false) {
|
||
|
|
t.Fatal("published resource inaccessible")
|
||
|
|
}
|
||
|
|
if Allowed(ctx, "knowledge.write") || Allowed(ctx, "content.read") {
|
||
|
|
t.Fatal("unassigned feature allowed")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestSharedIDsSeparateKinds(t *testing.T) {
|
||
|
|
ctx := WithSnapshot(context.Background(), &Snapshot{Publications: map[string]bool{"agents:a": true, "agents:b": false, "knowledge:c": true}, Grants: map[string]bool{"agents:a": true}})
|
||
|
|
ids := SharedIDs(ctx, "agents")
|
||
|
|
if len(ids) != 1 || ids[0] != "a" {
|
||
|
|
t.Fatalf("unexpected shared IDs: %v", ids)
|
||
|
|
}
|
||
|
|
}
|