42 lines
1.9 KiB
Go
42 lines
1.9 KiB
Go
|
package service
|
||
|
|
|
||
|
|
import (
|
||
|
|
"context"
|
||
|
|
"testing"
|
||
|
|
|
||
|
|
"github.com/Tencent/WeKnora/internal/accesspolicy"
|
||
|
|
"github.com/Tencent/WeKnora/internal/types"
|
||
|
|
"github.com/Tencent/WeKnora/internal/types/interfaces"
|
||
|
|
)
|
||
|
|
|
||
|
|
type batchAccessKBStub struct {
|
||
|
|
interfaces.KnowledgeBaseService
|
||
|
|
calls map[string]int
|
||
|
|
}
|
||
|
|
|
||
|
|
func (s *batchAccessKBStub) GetKnowledgeBaseByIDOnly(_ context.Context, id string) (*types.KnowledgeBase, error) {
|
||
|
|
s.calls[id]++
|
||
|
|
return &types.KnowledgeBase{ID: id, TenantID: 7, CreatorID: "owner"}, nil
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestFilterAccessibleKnowledgeHonorsGrantAndRevocation(t *testing.T) {
|
||
|
|
kb := &batchAccessKBStub{calls: map[string]int{}}
|
||
|
|
s := &knowledgeService{kbService: kb}
|
||
|
|
ctx := context.WithValue(context.Background(), types.TenantIDContextKey, uint64(7))
|
||
|
|
ctx = context.WithValue(ctx, types.UserIDContextKey, "reader")
|
||
|
|
policy := &accesspolicy.Snapshot{Restricted: true, Permissions: map[string]bool{"knowledge.read": true}, Publications: map[string]bool{"knowledge:private": false, "knowledge:public": true}, Grants: map[string]bool{"knowledge:private": true}}
|
||
|
|
ctx = accesspolicy.WithSnapshot(ctx, policy)
|
||
|
|
rows := []*types.Knowledge{{ID: "one", KnowledgeBaseID: "private"}, {ID: "two", KnowledgeBaseID: "private"}, {ID: "public", KnowledgeBaseID: "public"}, {ID: "unpublished", KnowledgeBaseID: "unpublished"}, nil}
|
||
|
|
if got := s.filterAccessibleKnowledge(ctx, rows); len(got) != 3 || kb.calls["private"] != 1 {
|
||
|
|
t.Fatalf("grant should allow documents and check each KB once: %d rows, %v calls", len(got), kb.calls)
|
||
|
|
}
|
||
|
|
delete(policy.Grants, "knowledge:private")
|
||
|
|
if got := s.filterAccessibleKnowledge(ctx, rows); len(got) != 1 || got[0].ID != "public" {
|
||
|
|
t.Fatalf("revoked documents remain in batch: %v", got)
|
||
|
|
}
|
||
|
|
delete(policy.Permissions, "knowledge.read")
|
||
|
|
if got := s.filterAccessibleKnowledge(ctx, rows); len(got) != 0 {
|
||
|
|
t.Fatalf("module permission must restrict all documents: %v", got)
|
||
|
|
}
|
||
|
|
}
|