db_test.go
1package abac
2
3import (
4 "database/sql"
5 "testing"
6
7 _ "github.com/mattn/go-sqlite3"
8 "github.com/stretchr/testify/assert"
9)
10
11func makeDB() *sql.DB {
12 db, err := sql.Open("sqlite3", "file:test.db?cache=shared&mode=memory")
13 //db, err := sql.Open("sqlite3", "file:test.db")
14 if err != nil {
15 panic(err)
16 }
17 if err := Migrate(db); err != nil {
18 panic(err)
19 }
20 return db
21}
22
23func TestAttributes(t *testing.T) {
24 db := makeDB()
25 defer db.Close()
26
27 assert.NoError(t, SetAttributeForUser(db, "key1", "value1", 3))
28 assert.NoError(t, SetAttributeForUser(db, "key1", "value1", 4))
29 assert.NoError(t, SetAttributeForUser(db, "key1", "value1", 5))
30}
31
32func TestPermissions(t *testing.T) {
33 db := makeDB()
34 defer db.Close()
35
36 // set some rules
37 assert.NoError(t, SetDefaultForResource(db, "test", 100, Write))
38 assert.NoError(t, SetDefaultForType(db, "test", Read))
39 assert.NoError(t, SetPermissionForUser(db, "test", 100, 1, Admin))
40 assert.NoError(t, SetPermissionForAttribute(db, "test", 100, "key1", "value1", Private))
41
42 // assign users to attributes
43 assert.NoError(t, SetAttributeForUser(db, "key1", "value1", 3))
44 assert.NoError(t, SetAttributeForUser(db, "key1", "value1", 4))
45
46 // for a particular user, get the specific rule
47 p, err := GetPermission(db, "test", 100, 1)
48 assert.NoError(t, err)
49 assert.Equal(t, Admin, p)
50 // no specific rule for that user, use default for resource
51 p, err = GetPermission(db, "test", 100, 6)
52 assert.NoError(t, err)
53 assert.Equal(t, Write, p)
54 // no specific rule for resource or user, use default for type
55 p, err = GetPermission(db, "test", 101, 6)
56 assert.NoError(t, err)
57 assert.Equal(t, Read, p)
58 // user which has a permissioned attribute
59 p, err = GetPermission(db, "test", 100, 4)
60 assert.NoError(t, err)
61 assert.Equal(t, Private, p)
62}
63
64func TestPrecedence(t *testing.T) {
65 db := makeDB()
66 defer db.Close()
67
68 // set some rules
69 assert.NoError(t, SetDefaultForResource(db, "test", 100, Write))
70 assert.NoError(t, SetDefaultForType(db, "test", Read))
71 assert.NoError(t, SetPermissionForUser(db, "test", 100, 1, Delete))
72 assert.NoError(t, SetPermissionForAttribute(db, "test", 100, "key1", "value1", Admin))
73
74 // assign users to attributes
75 assert.NoError(t, SetAttributeForUser(db, "key1", "value1", 1))
76
77 // for the user, attribute wins
78 p, err := GetPermission(db, "test", 100, 1)
79 assert.NoError(t, err)
80 assert.Equal(t, Admin, p)
81
82 // set some special rules
83 assert.NoError(t, SetDefaultForUser(db, "test", 2, Ban))
84 p, err = GetPermission(db, "test", 100, 2)
85 assert.NoError(t, err)
86 assert.Equal(t, Ban, p)
87 assert.False(t, Has(p, Write))
88
89 // make a god
90 assert.NoError(t, SetDefaultForUser(db, "test", 9, God))
91 p, err = GetPermission(db, "test", 100, 9)
92 assert.NoError(t, err)
93 assert.Equal(t, God, p)
94 assert.True(t, Has(p, Write))
95
96 // god overrides specific default rules
97 assert.NoError(t, SetDefaultForResource(db, "test", 102, Private))
98 p, err = GetPermission(db, "test", 102, 9)
99 assert.NoError(t, err)
100 assert.Equal(t, God, p)
101 assert.True(t, Has(p, Write))
102
103 // normal users get default
104 p, err = GetPermission(db, "test", 102, 1)
105 assert.NoError(t, err)
106 assert.Equal(t, Private, p)
107 assert.False(t, Has(p, Write))
108}
109
110func TestGetPermissionsForUser(t *testing.T) {
111 db := makeDB()
112 defer db.Close()
113
114 // Test empty result for user with no permissions
115 perms, err := GetPermissionsForUser(db, 999)
116 assert.NoError(t, err)
117 assert.Empty(t, perms)
118
119 // Set a concrete resource permission for user 1
120 assert.NoError(t, SetPermissionForUser(db, "document", 42, 1, Write))
121
122 // Set a default permission for user 1 (NULL resource_id)
123 assert.NoError(t, SetDefaultForUser(db, "document", 1, Admin))
124
125 // GetPermissionsForUser should return only the concrete resource permission
126 perms, err = GetPermissionsForUser(db, 1)
127 assert.NoError(t, err)
128 assert.Len(t, perms, 1)
129 assert.Equal(t, "document", perms[0].ResourceType)
130 assert.Equal(t, int64(42), perms[0].ResourceID)
131 assert.Equal(t, Write, perms[0].Permission)
132
133 // Set another permission for user 1 on a different resource
134 assert.NoError(t, SetPermissionForUser(db, "document", 43, 1, Read))
135
136 perms, err = GetPermissionsForUser(db, 1)
137 assert.NoError(t, err)
138 assert.Len(t, perms, 2)
139 assert.Equal(t, int64(42), perms[0].ResourceID)
140 assert.Equal(t, Write, perms[0].Permission)
141 assert.Equal(t, int64(43), perms[1].ResourceID)
142 assert.Equal(t, Read, perms[1].Permission)
143
144 // Set a permission for user 2
145 assert.NoError(t, SetPermissionForUser(db, "document", 42, 2, Admin))
146
147 perms, err = GetPermissionsForUser(db, 2)
148 assert.NoError(t, err)
149 assert.Len(t, perms, 1)
150 assert.Equal(t, "document", perms[0].ResourceType)
151 assert.Equal(t, int64(42), perms[0].ResourceID)
152 assert.Equal(t, Admin, perms[0].Permission)
153}
