mirror of
https://github.com/Noooste/garage-ui.git
synced 2026-08-27 15:37:03 +00:00
Noste
0d804fbd39
* feat(access-control): fine grain tokens * fix(docs): clean wording * test(access-control): add tests for team extraction from access tokens and bucket info permissions * test(vocabulary): add test for ExpandGlob function to reject non-glob patterns * feat(helm): add multi-user access control documentation and schema support
47 lines
1.1 KiB
Go
47 lines
1.1 KiB
Go
package handlers
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"Noooste/garage-ui/internal/authz"
|
|
"Noooste/garage-ui/internal/models"
|
|
)
|
|
|
|
func teamSubject() authz.Subject {
|
|
return authz.Subject{
|
|
ID: "alice",
|
|
Bindings: []authz.Binding{{
|
|
BucketPrefixes: []string{"backend-"},
|
|
Permissions: authz.PermSet{"bucket.list": {}, "bucket.read": {}, "object.read": {}},
|
|
}},
|
|
}
|
|
}
|
|
|
|
func TestFilterBucketsForSubject(t *testing.T) {
|
|
buckets := []models.BucketInfo{
|
|
{Name: "backend-api"},
|
|
{Name: "backend-assets"},
|
|
{Name: "data-warehouse"},
|
|
}
|
|
got := filterBucketsForSubject(buckets, teamSubject())
|
|
if len(got) != 2 {
|
|
t.Fatalf("filtered to %d buckets, want 2", len(got))
|
|
}
|
|
for _, b := range got {
|
|
if b.Name == "data-warehouse" {
|
|
t.Error("data-warehouse must be filtered out")
|
|
}
|
|
if len(b.EffectivePermissions) == 0 {
|
|
t.Errorf("%s: effective_permissions must be populated", b.Name)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestFilterBucketsAdminSeesAll(t *testing.T) {
|
|
buckets := []models.BucketInfo{{Name: "a"}, {Name: "b"}}
|
|
got := filterBucketsForSubject(buckets, authz.AdminSubject("root"))
|
|
if len(got) != 2 {
|
|
t.Fatalf("admin sees %d buckets, want 2", len(got))
|
|
}
|
|
}
|