mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-09-10 18:45:53 +00:00
pulse-triage[bot]
7dd5982ace
First-run setup saved the configured administrator but left the router authorizer on its startup identity. This split Settings capability checks: administrator-only panels remained visible while API Access and Pulse Intelligence were denied until restart. Keep the captured authorizer aligned when setup commits the identity, and clear its prior bypass on successful development reset. Cover the exact split with real file-backed RBAC policy and session setup, preserve outsider denial and identity replacement, and synchronise concurrent policy reads. Extension implementations still require independent compatibility review; this is not installation or release acceptance. Change-source: pulse-maintainer
34 lines
940 B
Go
34 lines
940 B
Go
package auth
|
|
|
|
import (
|
|
"context"
|
|
"sync"
|
|
"testing"
|
|
)
|
|
|
|
func TestRBACAdminIdentityConcurrentUpdates(t *testing.T) {
|
|
manager, err := NewFileManager(t.TempDir())
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
a := NewRBACAuthorizer(manager)
|
|
var wg sync.WaitGroup
|
|
for worker := 0; worker < 4; worker++ {
|
|
wg.Go(func() {
|
|
for i := 0; i < 100; i++ {
|
|
a.SetAdminUser("configured-admin")
|
|
a.Authorize(WithUser(context.Background(), "configured-admin"), ActionAdmin, ResourceUsers)
|
|
if allowed, err := a.Authorize(WithUser(context.Background(), "outsider"), ActionAdmin, ResourceUsers); allowed || err != nil {
|
|
t.Errorf("outsider allowed=%v err=%v", allowed, err)
|
|
}
|
|
a.SetAdminUser("")
|
|
}
|
|
})
|
|
}
|
|
wg.Wait()
|
|
a.SetAdminUser("")
|
|
if allowed, err := a.Authorize(WithUser(context.Background(), "configured-admin"), ActionAdmin, ResourceUsers); allowed || err != nil {
|
|
t.Fatalf("cleared admin allowed=%v err=%v", allowed, err)
|
|
}
|
|
}
|