38 lines
1.5 KiB
Go
38 lines
1.5 KiB
Go
|
package workbench
|
||
|
|
|
||
|
|
import (
|
||
|
|
"errors"
|
||
|
|
"testing"
|
||
|
|
|
||
|
|
"github.com/Tencent/WeKnora/internal/accesspolicy"
|
||
|
|
"github.com/Tencent/WeKnora/internal/types"
|
||
|
|
"gorm.io/gorm"
|
||
|
|
)
|
||
|
|
|
||
|
|
func TestSharedCanvasCanBeUsedWithoutOwnershipOrMutation(t *testing.T) {
|
||
|
|
for _, publication := range []bool{false, true} {
|
||
|
|
s := sqliteWorkbench(t)
|
||
|
|
flow := seedResource(t, s, 1, "owner", "flows")
|
||
|
|
policy := &accesspolicy.Snapshot{Publications: map[string]bool{"flows:" + flow.ID: publication}, Grants: map[string]bool{"flows:" + flow.ID: !publication}}
|
||
|
|
ctx := accesspolicy.WithSnapshot(workbenchContext(1, "recipient", types.TenantRoleContributor), policy)
|
||
|
|
if _, err := s.get(ctx, "flows", flow.ID); err != nil {
|
||
|
|
t.Fatalf("shared canvas not readable: %v", err)
|
||
|
|
}
|
||
|
|
task := &Resource{TenantID: 1, OwnerID: "recipient", Kind: "content-tasks", Data: asJSON(TaskData{FlowID: flow.ID})}
|
||
|
|
if err := lockReferences(ctx, s.db, task); err != nil {
|
||
|
|
t.Fatalf("shared canvas not usable: %v", err)
|
||
|
|
}
|
||
|
|
if _, err := lockResource(ctx, s.db, "flows", flow.ID); !errors.Is(err, gorm.ErrRecordNotFound) {
|
||
|
|
t.Fatalf("recipient may edit shared canvas: %v", err)
|
||
|
|
}
|
||
|
|
if _, err := lockResourceForDeletion(ctx, s.db, "flows", flow.ID); !errors.Is(err, gorm.ErrRecordNotFound) {
|
||
|
|
t.Fatalf("recipient may delete shared canvas: %v", err)
|
||
|
|
}
|
||
|
|
policy.Publications["flows:"+flow.ID] = false
|
||
|
|
delete(policy.Grants, "flows:"+flow.ID)
|
||
|
|
if err := lockReferences(ctx, s.db, task); !errors.Is(err, gorm.ErrRecordNotFound) {
|
||
|
|
t.Fatalf("revoked shared canvas remains usable: %v", err)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|