638 lines
14 KiB
Go
638 lines
14 KiB
Go
package dbrp_test
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"github.com/google/go-cmp/cmp"
|
|
"github.com/influxdata/influxdb/v2"
|
|
influxdbcontext "github.com/influxdata/influxdb/v2/context"
|
|
"github.com/influxdata/influxdb/v2/dbrp"
|
|
"github.com/influxdata/influxdb/v2/mock"
|
|
influxdbtesting "github.com/influxdata/influxdb/v2/testing"
|
|
)
|
|
|
|
func TestAuth_FindByID(t *testing.T) {
|
|
type fields struct {
|
|
service influxdb.DBRPMappingServiceV2
|
|
}
|
|
type args struct {
|
|
orgID influxdb.ID
|
|
id influxdb.ID
|
|
permission influxdb.Permission
|
|
}
|
|
type wants struct {
|
|
err error
|
|
}
|
|
|
|
tests := []struct {
|
|
name string
|
|
fields fields
|
|
args args
|
|
wants wants
|
|
}{
|
|
{
|
|
name: "authorized to access id by org id",
|
|
fields: fields{
|
|
service: &mock.DBRPMappingServiceV2{
|
|
FindByIDFn: func(_ context.Context, _, _ influxdb.ID) (*influxdb.DBRPMappingV2, error) {
|
|
return &influxdb.DBRPMappingV2{
|
|
OrganizationID: influxdb.ID(1),
|
|
BucketID: influxdb.ID(1),
|
|
}, nil
|
|
},
|
|
},
|
|
},
|
|
args: args{
|
|
permission: influxdb.Permission{
|
|
Action: "read",
|
|
Resource: influxdb.Resource{
|
|
Type: influxdb.BucketsResourceType,
|
|
OrgID: influxdbtesting.IDPtr(1),
|
|
},
|
|
},
|
|
id: 1,
|
|
orgID: 1,
|
|
},
|
|
wants: wants{
|
|
err: nil,
|
|
},
|
|
},
|
|
{
|
|
name: "authorized to access id by id",
|
|
fields: fields{
|
|
service: &mock.DBRPMappingServiceV2{
|
|
FindByIDFn: func(_ context.Context, _, _ influxdb.ID) (*influxdb.DBRPMappingV2, error) {
|
|
return &influxdb.DBRPMappingV2{
|
|
OrganizationID: influxdb.ID(1),
|
|
BucketID: influxdb.ID(1),
|
|
}, nil
|
|
},
|
|
},
|
|
},
|
|
args: args{
|
|
permission: influxdb.Permission{
|
|
Action: "read",
|
|
Resource: influxdb.Resource{
|
|
Type: influxdb.BucketsResourceType,
|
|
ID: influxdbtesting.IDPtr(1),
|
|
},
|
|
},
|
|
id: 1,
|
|
orgID: 1,
|
|
},
|
|
wants: wants{
|
|
err: nil,
|
|
},
|
|
},
|
|
{
|
|
name: "unauthorized to access id by org id",
|
|
fields: fields{
|
|
service: &mock.DBRPMappingServiceV2{
|
|
FindByIDFn: func(_ context.Context, _, _ influxdb.ID) (*influxdb.DBRPMappingV2, error) {
|
|
return &influxdb.DBRPMappingV2{
|
|
OrganizationID: influxdb.ID(2),
|
|
BucketID: influxdb.ID(1),
|
|
}, nil
|
|
},
|
|
},
|
|
},
|
|
args: args{
|
|
permission: influxdb.Permission{
|
|
Action: "read",
|
|
Resource: influxdb.Resource{
|
|
Type: influxdb.BucketsResourceType,
|
|
OrgID: influxdbtesting.IDPtr(1),
|
|
},
|
|
},
|
|
id: 1,
|
|
orgID: 2,
|
|
},
|
|
wants: wants{
|
|
err: &influxdb.Error{
|
|
Msg: "read:orgs/0000000000000002/buckets/0000000000000001 is unauthorized",
|
|
Code: influxdb.EUnauthorized,
|
|
},
|
|
},
|
|
},
|
|
{
|
|
name: "unauthorized to access id by id",
|
|
fields: fields{
|
|
service: &mock.DBRPMappingServiceV2{
|
|
FindByIDFn: func(_ context.Context, _, _ influxdb.ID) (*influxdb.DBRPMappingV2, error) {
|
|
return &influxdb.DBRPMappingV2{
|
|
OrganizationID: influxdb.ID(1),
|
|
BucketID: influxdb.ID(1),
|
|
}, nil
|
|
},
|
|
},
|
|
},
|
|
args: args{
|
|
permission: influxdb.Permission{
|
|
Action: "read",
|
|
Resource: influxdb.Resource{
|
|
Type: influxdb.DBRPResourceType,
|
|
ID: influxdbtesting.IDPtr(2),
|
|
},
|
|
},
|
|
id: 1,
|
|
orgID: 2,
|
|
},
|
|
wants: wants{
|
|
err: &influxdb.Error{
|
|
Msg: "read:orgs/0000000000000002/buckets/0000000000000001 is unauthorized",
|
|
Code: influxdb.EUnauthorized,
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
s := dbrp.NewAuthorizedService(tt.fields.service)
|
|
|
|
ctx := context.Background()
|
|
ctx = influxdbcontext.SetAuthorizer(ctx, mock.NewMockAuthorizer(false, []influxdb.Permission{tt.args.permission}))
|
|
|
|
_, err := s.FindByID(ctx, tt.args.orgID, tt.args.id)
|
|
influxdbtesting.ErrorsEqual(t, err, tt.wants.err)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestAuth_FindMany(t *testing.T) {
|
|
type fields struct {
|
|
service influxdb.DBRPMappingServiceV2
|
|
}
|
|
type args struct {
|
|
filter influxdb.DBRPMappingFilterV2
|
|
permissions []influxdb.Permission
|
|
}
|
|
type wants struct {
|
|
err error
|
|
ms []*influxdb.DBRPMappingV2
|
|
}
|
|
|
|
tests := []struct {
|
|
name string
|
|
fields fields
|
|
args args
|
|
wants wants
|
|
}{
|
|
{
|
|
name: "no result",
|
|
fields: fields{
|
|
service: &mock.DBRPMappingServiceV2{
|
|
FindManyFn: func(ctx context.Context, dbrp influxdb.DBRPMappingFilterV2, opts ...influxdb.FindOptions) ([]*influxdb.DBRPMappingV2, int, error) {
|
|
return []*influxdb.DBRPMappingV2{
|
|
{
|
|
ID: 1,
|
|
OrganizationID: 1,
|
|
BucketID: 1,
|
|
},
|
|
{
|
|
ID: 2,
|
|
OrganizationID: 1,
|
|
BucketID: 2,
|
|
},
|
|
{
|
|
ID: 3,
|
|
OrganizationID: 2,
|
|
BucketID: 3,
|
|
},
|
|
{
|
|
ID: 4,
|
|
OrganizationID: 3,
|
|
BucketID: 4,
|
|
},
|
|
}, 4, nil
|
|
},
|
|
},
|
|
},
|
|
args: args{
|
|
permissions: []influxdb.Permission{{
|
|
Action: "read",
|
|
Resource: influxdb.Resource{
|
|
Type: influxdb.DBRPResourceType,
|
|
OrgID: influxdbtesting.IDPtr(42),
|
|
},
|
|
}},
|
|
filter: influxdb.DBRPMappingFilterV2{},
|
|
},
|
|
wants: wants{
|
|
err: nil,
|
|
ms: []*influxdb.DBRPMappingV2{},
|
|
},
|
|
},
|
|
{
|
|
name: "partial",
|
|
fields: fields{
|
|
service: &mock.DBRPMappingServiceV2{
|
|
FindManyFn: func(ctx context.Context, dbrp influxdb.DBRPMappingFilterV2, opts ...influxdb.FindOptions) ([]*influxdb.DBRPMappingV2, int, error) {
|
|
return []*influxdb.DBRPMappingV2{
|
|
{
|
|
ID: 1,
|
|
OrganizationID: 1,
|
|
BucketID: 1,
|
|
},
|
|
{
|
|
ID: 2,
|
|
OrganizationID: 1,
|
|
BucketID: 2,
|
|
},
|
|
{
|
|
ID: 3,
|
|
OrganizationID: 2,
|
|
BucketID: 3,
|
|
},
|
|
{
|
|
ID: 4,
|
|
OrganizationID: 3,
|
|
BucketID: 4,
|
|
},
|
|
}, 4, nil
|
|
},
|
|
},
|
|
},
|
|
args: args{
|
|
permissions: []influxdb.Permission{{
|
|
Action: "read",
|
|
Resource: influxdb.Resource{
|
|
Type: influxdb.BucketsResourceType,
|
|
OrgID: influxdbtesting.IDPtr(1),
|
|
},
|
|
}},
|
|
filter: influxdb.DBRPMappingFilterV2{},
|
|
},
|
|
wants: wants{
|
|
err: nil,
|
|
ms: []*influxdb.DBRPMappingV2{
|
|
{
|
|
ID: 1,
|
|
OrganizationID: 1,
|
|
BucketID: 1,
|
|
},
|
|
{
|
|
ID: 2,
|
|
OrganizationID: 1,
|
|
BucketID: 2,
|
|
},
|
|
},
|
|
},
|
|
},
|
|
{
|
|
name: "all",
|
|
fields: fields{
|
|
service: &mock.DBRPMappingServiceV2{
|
|
FindManyFn: func(ctx context.Context, dbrp influxdb.DBRPMappingFilterV2, opts ...influxdb.FindOptions) ([]*influxdb.DBRPMappingV2, int, error) {
|
|
return []*influxdb.DBRPMappingV2{
|
|
{
|
|
ID: 1,
|
|
OrganizationID: 1,
|
|
BucketID: 1,
|
|
},
|
|
{
|
|
ID: 2,
|
|
OrganizationID: 1,
|
|
BucketID: 2,
|
|
},
|
|
{
|
|
ID: 3,
|
|
OrganizationID: 2,
|
|
BucketID: 3,
|
|
},
|
|
{
|
|
ID: 4,
|
|
OrganizationID: 3,
|
|
BucketID: 4,
|
|
},
|
|
}, 4, nil
|
|
},
|
|
},
|
|
},
|
|
args: args{
|
|
permissions: []influxdb.Permission{
|
|
{
|
|
Action: "read",
|
|
Resource: influxdb.Resource{
|
|
Type: influxdb.BucketsResourceType,
|
|
OrgID: influxdbtesting.IDPtr(1),
|
|
},
|
|
},
|
|
{
|
|
Action: "read",
|
|
Resource: influxdb.Resource{
|
|
Type: influxdb.BucketsResourceType,
|
|
OrgID: influxdbtesting.IDPtr(2),
|
|
},
|
|
},
|
|
{
|
|
Action: "read",
|
|
Resource: influxdb.Resource{
|
|
Type: influxdb.BucketsResourceType,
|
|
OrgID: influxdbtesting.IDPtr(3),
|
|
},
|
|
},
|
|
},
|
|
filter: influxdb.DBRPMappingFilterV2{},
|
|
},
|
|
wants: wants{
|
|
err: nil,
|
|
ms: []*influxdb.DBRPMappingV2{
|
|
{
|
|
ID: 1,
|
|
OrganizationID: 1,
|
|
BucketID: 1,
|
|
},
|
|
{
|
|
ID: 2,
|
|
OrganizationID: 1,
|
|
BucketID: 2,
|
|
},
|
|
{
|
|
ID: 3,
|
|
OrganizationID: 2,
|
|
BucketID: 3,
|
|
},
|
|
{
|
|
ID: 4,
|
|
OrganizationID: 3,
|
|
BucketID: 4,
|
|
},
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
s := dbrp.NewAuthorizedService(tt.fields.service)
|
|
|
|
ctx := context.Background()
|
|
ctx = influxdbcontext.SetAuthorizer(ctx, mock.NewMockAuthorizer(false, tt.args.permissions))
|
|
|
|
gots, ngots, err := s.FindMany(ctx, tt.args.filter)
|
|
if ngots != len(gots) {
|
|
t.Errorf("got wrong number back")
|
|
}
|
|
influxdbtesting.ErrorsEqual(t, err, tt.wants.err)
|
|
if diff := cmp.Diff(tt.wants.ms, gots, influxdbtesting.DBRPMappingCmpOptionsV2...); diff != "" {
|
|
t.Errorf("unexpected result -want/+got:\n\t%s", diff)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestAuth_Create(t *testing.T) {
|
|
type fields struct {
|
|
service influxdb.DBRPMappingServiceV2
|
|
}
|
|
type args struct {
|
|
m influxdb.DBRPMappingV2
|
|
permission influxdb.Permission
|
|
}
|
|
type wants struct {
|
|
err error
|
|
}
|
|
|
|
tests := []struct {
|
|
name string
|
|
fields fields
|
|
args args
|
|
wants wants
|
|
}{
|
|
{
|
|
name: "authorized",
|
|
fields: fields{
|
|
service: &mock.DBRPMappingServiceV2{},
|
|
},
|
|
args: args{
|
|
m: influxdb.DBRPMappingV2{
|
|
ID: 1,
|
|
OrganizationID: 1,
|
|
BucketID: 2,
|
|
},
|
|
permission: influxdb.Permission{
|
|
Action: "write",
|
|
Resource: influxdb.Resource{
|
|
Type: influxdb.BucketsResourceType,
|
|
OrgID: influxdbtesting.IDPtr(1),
|
|
ID: influxdbtesting.IDPtr(2),
|
|
},
|
|
},
|
|
},
|
|
wants: wants{
|
|
err: nil,
|
|
},
|
|
},
|
|
{
|
|
name: "unauthorized",
|
|
fields: fields{
|
|
service: &mock.DBRPMappingServiceV2{},
|
|
},
|
|
args: args{
|
|
m: influxdb.DBRPMappingV2{
|
|
ID: 1,
|
|
OrganizationID: 1,
|
|
BucketID: 2,
|
|
},
|
|
permission: influxdb.Permission{
|
|
Action: "read",
|
|
Resource: influxdb.Resource{
|
|
Type: influxdb.BucketsResourceType,
|
|
OrgID: influxdbtesting.IDPtr(1),
|
|
ID: influxdbtesting.IDPtr(2),
|
|
},
|
|
},
|
|
},
|
|
wants: wants{
|
|
err: &influxdb.Error{
|
|
Msg: "write:orgs/0000000000000001/buckets/0000000000000002 is unauthorized",
|
|
Code: influxdb.EUnauthorized,
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
s := dbrp.NewAuthorizedService(tt.fields.service)
|
|
|
|
ctx := context.Background()
|
|
ctx = influxdbcontext.SetAuthorizer(ctx, mock.NewMockAuthorizer(false, []influxdb.Permission{tt.args.permission}))
|
|
|
|
err := s.Create(ctx, &tt.args.m)
|
|
influxdbtesting.ErrorsEqual(t, err, tt.wants.err)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestAuth_Update(t *testing.T) {
|
|
type fields struct {
|
|
service influxdb.DBRPMappingServiceV2
|
|
}
|
|
type args struct {
|
|
orgID influxdb.ID
|
|
id influxdb.ID
|
|
permission influxdb.Permission
|
|
}
|
|
type wants struct {
|
|
err error
|
|
}
|
|
|
|
tests := []struct {
|
|
name string
|
|
fields fields
|
|
args args
|
|
wants wants
|
|
}{
|
|
{
|
|
name: "authorized",
|
|
fields: fields{
|
|
service: &mock.DBRPMappingServiceV2{},
|
|
},
|
|
args: args{
|
|
permission: influxdb.Permission{
|
|
Action: "write",
|
|
Resource: influxdb.Resource{
|
|
Type: influxdb.BucketsResourceType,
|
|
OrgID: influxdbtesting.IDPtr(1),
|
|
},
|
|
},
|
|
id: 1,
|
|
orgID: 1,
|
|
},
|
|
wants: wants{
|
|
err: nil,
|
|
},
|
|
},
|
|
{
|
|
name: "unauthorized",
|
|
fields: fields{
|
|
service: &mock.DBRPMappingServiceV2{},
|
|
},
|
|
args: args{
|
|
permission: influxdb.Permission{
|
|
Action: "read",
|
|
Resource: influxdb.Resource{
|
|
Type: influxdb.BucketsResourceType,
|
|
OrgID: influxdbtesting.IDPtr(1),
|
|
},
|
|
},
|
|
id: 1,
|
|
orgID: 1,
|
|
},
|
|
wants: wants{
|
|
err: &influxdb.Error{
|
|
Msg: "write:orgs/0000000000000001/buckets/0000000000000001 is unauthorized",
|
|
Code: influxdb.EUnauthorized,
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
s := dbrp.NewAuthorizedService(tt.fields.service)
|
|
|
|
ctx := context.Background()
|
|
ctx = influxdbcontext.SetAuthorizer(ctx, mock.NewMockAuthorizer(false, []influxdb.Permission{tt.args.permission}))
|
|
|
|
// Does not matter how we update, we only need to check auth.
|
|
err := s.Update(ctx, &influxdb.DBRPMappingV2{ID: tt.args.id, OrganizationID: tt.args.orgID, BucketID: 1})
|
|
influxdbtesting.ErrorsEqual(t, err, tt.wants.err)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestAuth_Delete(t *testing.T) {
|
|
type fields struct {
|
|
service influxdb.DBRPMappingServiceV2
|
|
}
|
|
type args struct {
|
|
orgID influxdb.ID
|
|
id influxdb.ID
|
|
permission influxdb.Permission
|
|
}
|
|
type wants struct {
|
|
err error
|
|
}
|
|
|
|
tests := []struct {
|
|
name string
|
|
fields fields
|
|
args args
|
|
wants wants
|
|
}{
|
|
{
|
|
name: "authorized",
|
|
fields: fields{
|
|
service: &mock.DBRPMappingServiceV2{
|
|
FindByIDFn: func(_ context.Context, _, _ influxdb.ID) (*influxdb.DBRPMappingV2, error) {
|
|
return &influxdb.DBRPMappingV2{
|
|
OrganizationID: influxdb.ID(1),
|
|
BucketID: influxdb.ID(1),
|
|
}, nil
|
|
},
|
|
},
|
|
},
|
|
args: args{
|
|
permission: influxdb.Permission{
|
|
Action: "write",
|
|
Resource: influxdb.Resource{
|
|
Type: influxdb.BucketsResourceType,
|
|
OrgID: influxdbtesting.IDPtr(1),
|
|
},
|
|
},
|
|
id: 1,
|
|
orgID: 1,
|
|
},
|
|
wants: wants{
|
|
err: nil,
|
|
},
|
|
},
|
|
{
|
|
name: "unauthorized",
|
|
fields: fields{
|
|
service: &mock.DBRPMappingServiceV2{
|
|
FindByIDFn: func(_ context.Context, _, _ influxdb.ID) (*influxdb.DBRPMappingV2, error) {
|
|
return &influxdb.DBRPMappingV2{
|
|
OrganizationID: influxdb.ID(1),
|
|
BucketID: influxdb.ID(1),
|
|
}, nil
|
|
},
|
|
},
|
|
},
|
|
args: args{
|
|
permission: influxdb.Permission{
|
|
Action: "read",
|
|
Resource: influxdb.Resource{
|
|
Type: influxdb.BucketsResourceType,
|
|
OrgID: influxdbtesting.IDPtr(1),
|
|
},
|
|
},
|
|
id: 1,
|
|
orgID: 1,
|
|
},
|
|
wants: wants{
|
|
err: &influxdb.Error{
|
|
Msg: "write:orgs/0000000000000001/buckets/0000000000000001 is unauthorized",
|
|
Code: influxdb.EUnauthorized,
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
s := dbrp.NewAuthorizedService(tt.fields.service)
|
|
|
|
ctx := context.Background()
|
|
ctx = influxdbcontext.SetAuthorizer(ctx, mock.NewMockAuthorizer(false, []influxdb.Permission{tt.args.permission}))
|
|
|
|
err := s.Delete(ctx, tt.args.orgID, tt.args.id)
|
|
influxdbtesting.ErrorsEqual(t, err, tt.wants.err)
|
|
})
|
|
}
|
|
}
|