andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-10-18 05:52:51 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
3ff4fbc7e4f22cd6eee49d3de951350c5ed855cd
zitadel/internal/command/user_grant_test.go
T
SilvanGitHubCursor AgentSilvan
 3ff4fbc7e4 fix(eventstore): add owners to unique constraints (#12740) 
<!-- CURSOR_AGENT_PR_BODY_BEGIN -->
# Which Problems Are Solved

Bulk unique-constraint deletes (org, IDP with many links, user, project)
reconstruct every uniqueness key in Go and emit N `DELETE`s. That can
OOM on large tenants.

A one-shot owner backfill is also not enough: during a rolling deploy,
older binaries still insert `owners = '{}'`, so a later owner-only
delete would miss those rows.

Owner-only org/user/grant delete only matches rows whose `owners` bag
contains that tag. Several grant and member types stamped the aggregate
resource owner, which is not always the user’s home org or the granted
org. Username-scope rewrites also dropped `user:` tags, so owner-only
user delete could miss rewritten username rows.

Command must not switch to owner-only delete on the first 79 of a
version, because leftover `'{}'` rows from rolling-update overlap are
only backfilled on a later 79. A failed 79 must not turn owner-delete
on, and backfill joins must not stamp the wrong org (unverified domains,
org-scoped usernames colliding with instance-scoped ones).

# How the Problems Are Solved

Uniqueness stays the existing primary key `(instance_id, unique_type,
unique_field)`. `owners` is only a lifecycle bag of tags (`org:<id>`,
`user:<id>`, `idp:<id>`, `project:<id>`, `grant:<id>`).

- Add `owners TEXT[] NOT NULL DEFAULT '{}'` on
`eventstore.unique_constraints` (init SQL for greenfield, setup 78 for
existing clusters).
- Create `unique_constraints_owners_gin` with `CREATE INDEX
CONCURRENTLY` **outside a transaction** (same pattern as step 76).
Built-in `GIN (owners)` only; no `btree_gin`.
- Stamp `WithOwners` on **add** events. Field-level removes ignore
owners. `RemoveByOwner` stores the tag in `Owners` and both v1/v3 and v2
pushers run `DELETE … WHERE instance_id = $1 AND owners @>
ARRAY[$tag]::text[]`.
- Setup 79 backfills `owners` from projections via numbered
`cmd/setup/79/*.sql` files. Table names are interpolated from
`internal/query/projection` constants. Matches use `unique_field IN (x,
lower(x))` so the primary key can be used. Missing projection tables
(`42P01`) are skipped.
- Org domains are tagged only when `is_verified`. Instance-scoped
usernames join only users that are not org-scoped (organization settings
or domain policy `user_login_must_be_domain`). Every username row still
gets `org:` + `user:` of that user.
- 79 is a **repeatable** migration. `Check` re-runs when
`lastRun["version"]` changed or when setup-only `ForceFinalize` is set
and `lastRun["finalized"]` is still false. `Finalized` is written only
after Execute succeeds.
- Failed setup events keep the last successful `lastRun`. Command reads
`finalized` only from `system.migration.repeatable.done`.
- Org / user / project remove skip N-key event replay **when that
`finalized` bit is true**. Otherwise they keep today’s N-key lists
**and** still emit `RemoveByOwner`. The “ready” result is cached in
memory once true.

Setup writes `finalized` on the 79 repeatable.done payload:

- First 79 of a version: backfill only, `finalized=false` (unless
`ForceFinalize` is already set).
- Later 79: version change or
`BackfillUniqueConstraintOwners.ForceFinalize` /
`ZITADEL_BACKFILLUNIQUECONSTRAINTOWNERS_FORCEFINALIZE` after the rolling
update is done. That run backfills leftovers and writes
`finalized=true`.

Member and grant owner bags now include every org that should delete the
row:

- Instance, org, and project members also stamp
`org:<user_resource_owner>`.
- User grants stamp grant, user, project, and granted orgs.
- Project grant members stamp the project org, user org, and granted
org.
- Project grants stamp both orgs plus `grant:<id>`. Grant remove emits
`RemoveByOwner(grant)`.
- Username-scope rewrites keep `user:<id>` as well as `org:`.
- User/grant orgs are carried as unexported add-event fields (not
persisted JSON). `WithOwners` skips empty and duplicate tags.

# Additional Changes

- Table-driven owner-tag tests, including project grant (two `org:` tags
plus `grant:`), cross-org members, user grants, and username-scope
rewrite `user:` tags.
- Table-driven 79 `Check` + `finalizeAfterSuccess` tests for version
change, sequential version bumps, ForceFinalize restart, and
already-finalized skip.
- Command tests: a failed 79 event with `finalized=true` does not enable
owner-delete.
- Integration fixtures (verified vs unverified org domain;
instance-scoped `bob` vs org-scoped `bob`).
- Instance-only and global unique types stay untagged (`'{}'`). Instance
wipe still uses `UniqueConstraintInstanceRemove`.
- Pusher owner cases live in `eventstore_pusher_owners_test.go` so
`eventstore_pusher_test.go` stays under 1k lines.

# Additional Context

A later cleanup can delete the N-key replay helpers once a release that
ran 79 a second time (or an operator who set `ForceFinalize`) is in
production. That is not required for correctness.

<!-- CURSOR_AGENT_PR_BODY_END -->

<div><a
href="https://cursor.com/agents/bc-44f9bc9b-9a93-4cd9-8dd1-663a7b9aad2a?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-web-light.png"><img
alt="Open in Web" width="114" height="28"
src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a>&nbsp;<a
href="https://cursor.com/background-agent?bcId=bc-44f9bc9b-9a93-4cd9-8dd1-663a7b9aad2a&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img
alt="Open in Cursor" width="131" height="28"
src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a>&nbsp;</div>

---------

Co-authored-by: Cursor Agent <[email protected]>
Co-authored-by: Silvan <[email protected]>
2026-09-18 15:08:42 +02:00

3284 lines
85 KiB
Go
Raw Blame History

package command
import (
"context"
"errors"
"testing"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"golang.org/x/text/language"
"github.com/zitadel/zitadel/internal/api/authz"
"github.com/zitadel/zitadel/internal/domain"
"github.com/zitadel/zitadel/internal/eventstore"
"github.com/zitadel/zitadel/internal/eventstore/v1/models"
"github.com/zitadel/zitadel/internal/id"
id_mock "github.com/zitadel/zitadel/internal/id/mock"
"github.com/zitadel/zitadel/internal/repository/project"
"github.com/zitadel/zitadel/internal/repository/user"
"github.com/zitadel/zitadel/internal/repository/usergrant"
"github.com/zitadel/zitadel/internal/zerrors"
)
var (
errMockedPermissionCheck = errors.New("mocked permission check error")
isMockedPermissionCheckErr = func(err error) bool {
return errors.Is(err, errMockedPermissionCheck)
}
succeedingUserGrantPermissionCheck = func(_, _ string) PermissionCheck {
return func(_, _ string) error { return nil }
}
failingUserGrantPermissionCheck = func(_, _ string) PermissionCheck {
return func(_, _ string) error { return errMockedPermissionCheck }
}
)
func TestCommandSide_AddUserGrant(t *testing.T) {
type fields struct {
eventstore func(t *testing.T) *eventstore.Eventstore
idGenerator func(t *testing.T) id.Generator
}
type args struct {
ctx context.Context
userGrant *domain.UserGrant
}
type res struct {
want *domain.UserGrant
err func(error) bool
}
tests := []struct {
name string
fields fields
args args
res res
}{
{
name: "invalid usergrant, error",
fields: fields{
eventstore: expectEventstore(),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "org", "user", []string{domain.RoleProjectOwner}),
userGrant: &domain.UserGrant{
UserID: "user1",
ObjectRoot: models.ObjectRoot{
ResourceOwner: "org1",
},
},
},
res: res{
err: zerrors.IsErrorInvalidArgument,
},
},
{
name: "user removed, precondition error",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
user.NewHumanAddedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"username1",
"firstname1",
"lastname1",
"nickname1",
"displayname1",
language.German,
domain.GenderMale,
"email1",
true,
),
),
eventFromEventPusher(
user.NewUserRemovedEvent(
context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"username1",
nil,
true,
),
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "org", "user", []string{domain.RoleProjectOwner}),
userGrant: &domain.UserGrant{
UserID: "user1",
ProjectID: "project1",
ObjectRoot: models.ObjectRoot{
ResourceOwner: "org1",
},
},
},
res: res{
err: zerrors.IsPreconditionFailed,
},
},
{
name: "project removed, precondition error",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
user.NewHumanAddedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"username1",
"firstname1",
"lastname1",
"nickname1",
"displayname1",
language.German,
domain.GenderMale,
"email1",
true,
),
),
eventFromEventPusher(
project.NewProjectAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectname1", true, true, true,
domain.PrivateLabelingSettingUnspecified,
),
),
eventFromEventPusher(
project.NewProjectRemovedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectname1",
nil,
),
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "org", "user", []string{domain.RoleProjectOwner}),
userGrant: &domain.UserGrant{
UserID: "user1",
ProjectID: "project1",
ObjectRoot: models.ObjectRoot{
ResourceOwner: "org1",
},
},
},
res: res{
err: zerrors.IsPreconditionFailed,
},
},
{
name: "project on other org, precondition error",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
user.NewHumanAddedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"username1",
"firstname1",
"lastname1",
"nickname1",
"displayname1",
language.German,
domain.GenderMale,
"email1",
true,
),
),
eventFromEventPusher(
project.NewProjectAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectname1", true, true, true,
domain.PrivateLabelingSettingUnspecified,
),
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "org2", "user", []string{domain.RoleProjectOwner}),
userGrant: &domain.UserGrant{
UserID: "user1",
ProjectID: "project1",
ObjectRoot: models.ObjectRoot{
ResourceOwner: "org2",
},
},
},
res: res{
err: zerrors.IsPreconditionFailed,
},
},
{
name: "project roles not existing, precondition error",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
user.NewHumanAddedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"username1",
"firstname1",
"lastname1",
"nickname1",
"displayname1",
language.German,
domain.GenderMale,
"email1",
true,
),
),
eventFromEventPusher(
project.NewProjectAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectname1", true, true, true,
domain.PrivateLabelingSettingUnspecified,
),
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "org", "user", []string{domain.RoleProjectOwner}),
userGrant: &domain.UserGrant{
UserID: "user1",
ProjectID: "project1",
RoleKeys: []string{"roleKey"},
ObjectRoot: models.ObjectRoot{
ResourceOwner: "org1",
},
},
},
res: res{
err: zerrors.IsPreconditionFailed,
},
},
{
name: "project grant not existing, precondition error",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
user.NewHumanAddedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"username1",
"firstname1",
"lastname1",
"nickname1",
"displayname1",
language.German,
domain.GenderMale,
"email1",
true,
),
),
eventFromEventPusher(
project.NewProjectAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectname1", true, true, true,
domain.PrivateLabelingSettingUnspecified,
),
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "org", "user", []string{domain.RoleProjectOwner}),
userGrant: &domain.UserGrant{
UserID: "user1",
ProjectID: "project1",
ProjectGrantID: "projectgrant1",
RoleKeys: []string{"roleKey"},
ObjectRoot: models.ObjectRoot{
ResourceOwner: "org1",
},
},
},
res: res{
err: zerrors.IsPreconditionFailed,
},
},
{
name: "project grant roles not existing, precondition error",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
user.NewHumanAddedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"username1",
"firstname1",
"lastname1",
"nickname1",
"displayname1",
language.German,
domain.GenderMale,
"email1",
true,
),
),
eventFromEventPusher(
project.NewProjectAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectname1", true, true, true,
domain.PrivateLabelingSettingUnspecified,
),
),
eventFromEventPusher(
project.NewRoleAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"rolekey1",
"rolekey",
"",
),
),
eventFromEventPusher(
project.NewGrantAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectgrant1",
"org2",
nil,
),
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "org", "user", []string{domain.RoleProjectOwner}),
userGrant: &domain.UserGrant{
UserID: "user1",
ProjectID: "project1",
ProjectGrantID: "projectgrant1",
RoleKeys: []string{"roleKey"},
ObjectRoot: models.ObjectRoot{
ResourceOwner: "org1",
},
},
},
res: res{
err: zerrors.IsPreconditionFailed,
},
},
{
name: "project grant on other org, precondition error",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
user.NewHumanAddedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"username1",
"firstname1",
"lastname1",
"nickname1",
"displayname1",
language.German,
domain.GenderMale,
"email1",
true,
),
),
eventFromEventPusher(
project.NewProjectAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectname1", true, true, true,
domain.PrivateLabelingSettingUnspecified,
),
),
eventFromEventPusher(
project.NewRoleAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"rolekey1",
"rolekey",
"",
),
),
eventFromEventPusher(
project.NewGrantAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectgrant1",
"org3",
[]string{"rolekey1"},
),
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "org2", "user", []string{domain.RoleProjectOwner}),
userGrant: &domain.UserGrant{
UserID: "user1",
ProjectID: "project1",
ProjectGrantID: "projectgrant1",
RoleKeys: []string{"rolekey1"},
ObjectRoot: models.ObjectRoot{
ResourceOwner: "org2",
},
},
},
res: res{
err: zerrors.IsPreconditionFailed,
},
},
{
name: "usergrant for project, ok",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
user.NewHumanAddedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"username1",
"firstname1",
"lastname1",
"nickname1",
"displayname1",
language.German,
domain.GenderMale,
"email1",
true,
),
),
eventFromEventPusher(
project.NewProjectAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectname1", true, true, true,
domain.PrivateLabelingSettingUnspecified,
),
),
eventFromEventPusher(
project.NewRoleAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"rolekey1",
"rolekey",
"",
),
),
),
expectPush(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"",
[]string{"rolekey1"},
).WithOwnerOrgs("org1", "org1", ""),
),
),
idGenerator: func(t *testing.T) id.Generator {
return id_mock.NewIDGeneratorExpectIDs(t, "usergrant1")
},
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrant: &domain.UserGrant{
UserID: "user1",
ProjectID: "project1",
RoleKeys: []string{"rolekey1"},
ObjectRoot: models.ObjectRoot{
ResourceOwner: "org1",
},
},
},
res: res{
want: &domain.UserGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "usergrant1",
ResourceOwner: "org1",
},
UserID: "user1",
ProjectID: "project1",
RoleKeys: []string{"rolekey1"},
State: domain.UserGrantStateActive,
},
},
},
{
name: "usergrant for project, and removed project grant on same resourceowner, ok",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
user.NewHumanAddedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"username1",
"firstname1",
"lastname1",
"nickname1",
"displayname1",
language.German,
domain.GenderMale,
"email1",
true,
),
),
eventFromEventPusher(
project.NewProjectAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectname1", true, true, true,
domain.PrivateLabelingSettingUnspecified,
),
),
eventFromEventPusher(
project.NewRoleAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"rolekey1",
"rolekey",
"",
),
),
eventFromEventPusher(
project.NewGrantAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectgrant1",
"org1",
[]string{"rolekey1"},
),
),
eventFromEventPusher(
project.NewGrantRemovedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectgrant1",
"org1",
),
),
),
expectPush(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"",
[]string{"rolekey1"},
).WithOwnerOrgs("org1", "org1", ""),
),
),
idGenerator: func(t *testing.T) id.Generator {
return id_mock.NewIDGeneratorExpectIDs(t, "usergrant1")
},
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrant: &domain.UserGrant{
UserID: "user1",
ProjectID: "project1",
RoleKeys: []string{"rolekey1"},
ObjectRoot: models.ObjectRoot{
ResourceOwner: "org1",
},
},
},
res: res{
want: &domain.UserGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "usergrant1",
ResourceOwner: "org1",
},
UserID: "user1",
ProjectID: "project1",
RoleKeys: []string{"rolekey1"},
State: domain.UserGrantStateActive,
},
},
},
{
name: "usergrant for project, and project grant on same resourceowner, ok",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
user.NewHumanAddedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"username1",
"firstname1",
"lastname1",
"nickname1",
"displayname1",
language.German,
domain.GenderMale,
"email1",
true,
),
),
eventFromEventPusher(
project.NewProjectAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectname1", true, true, true,
domain.PrivateLabelingSettingUnspecified,
),
),
eventFromEventPusher(
project.NewRoleAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"rolekey1",
"rolekey",
"",
),
),
eventFromEventPusher(
project.NewGrantAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectgrant1",
"org1",
[]string{"rolekey1"},
),
),
),
expectPush(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"projectgrant1",
[]string{"rolekey1"},
).WithOwnerOrgs("org1", "org1", "org1"),
),
),
idGenerator: func(t *testing.T) id.Generator {
return id_mock.NewIDGeneratorExpectIDs(t, "usergrant1")
},
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrant: &domain.UserGrant{
UserID: "user1",
ProjectID: "project1",
RoleKeys: []string{"rolekey1"},
ObjectRoot: models.ObjectRoot{
ResourceOwner: "org1",
},
},
},
res: res{
want: &domain.UserGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "usergrant1",
ResourceOwner: "org1",
},
UserID: "user1",
ProjectID: "project1",
ProjectGrantID: "projectgrant1",
RoleKeys: []string{"rolekey1"},
State: domain.UserGrantStateActive,
},
},
},
{
name: "usergrant without Organization ID on project, ok",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
user.NewHumanAddedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"username1",
"firstname1",
"lastname1",
"nickname1",
"displayname1",
language.German,
domain.GenderMale,
"email1",
true,
),
),
eventFromEventPusher(
project.NewProjectAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectname1", true, true, true,
domain.PrivateLabelingSettingUnspecified,
),
),
eventFromEventPusher(
project.NewRoleAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"rolekey1",
"rolekey",
"",
),
),
),
expectPush(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"",
[]string{"rolekey1"},
).WithOwnerOrgs("org1", "org1", ""),
),
),
idGenerator: func(t *testing.T) id.Generator {
return id_mock.NewIDGeneratorExpectIDs(t, "usergrant1")
},
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrant: &domain.UserGrant{
UserID: "user1",
ProjectID: "project1",
RoleKeys: []string{"rolekey1"},
},
},
res: res{
want: &domain.UserGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "usergrant1",
ResourceOwner: "org1",
},
UserID: "user1",
ProjectID: "project1",
RoleKeys: []string{"rolekey1"},
State: domain.UserGrantStateActive,
},
},
},
{
name: "usergrant for projectgrant, ok",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
user.NewHumanAddedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"username1",
"firstname1",
"lastname1",
"nickname1",
"displayname1",
language.German,
domain.GenderMale,
"email1",
true,
),
),
eventFromEventPusher(
project.NewProjectAddedEvent(context.Background(),
&project.NewAggregate("project1", "org2").Aggregate,
"projectname1", true, true, true,
domain.PrivateLabelingSettingUnspecified,
),
),
eventFromEventPusher(
project.NewRoleAddedEvent(context.Background(),
&project.NewAggregate("project1", "org2").Aggregate,
"rolekey1",
"rolekey",
"",
),
),
eventFromEventPusher(
project.NewGrantAddedEvent(context.Background(),
&project.NewAggregate("project1", "org2").Aggregate,
"projectgrant1",
"org1",
[]string{"rolekey1"},
),
),
),
expectPush(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"projectgrant1",
[]string{"rolekey1"},
).WithOwnerOrgs("org1", "org2", "org1"),
),
),
idGenerator: func(t *testing.T) id.Generator {
return id_mock.NewIDGeneratorExpectIDs(t, "usergrant1")
},
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrant: &domain.UserGrant{
UserID: "user1",
ProjectID: "project1",
ProjectGrantID: "projectgrant1",
RoleKeys: []string{"rolekey1"},
ObjectRoot: models.ObjectRoot{
ResourceOwner: "org1",
},
},
},
res: res{
want: &domain.UserGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "usergrant1",
ResourceOwner: "org1",
},
UserID: "user1",
ProjectID: "project1",
ProjectGrantID: "projectgrant1",
RoleKeys: []string{"rolekey1"},
State: domain.UserGrantStateActive,
},
},
},
{
name: "usergrant for granted Organization ID, ok",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
user.NewHumanAddedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"username1",
"firstname1",
"lastname1",
"nickname1",
"displayname1",
language.German,
domain.GenderMale,
"email1",
true,
),
),
eventFromEventPusher(
project.NewProjectAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectname1", true, true, true,
domain.PrivateLabelingSettingUnspecified,
),
),
eventFromEventPusher(
project.NewRoleAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"rolekey1",
"rolekey",
"",
),
),
eventFromEventPusher(
project.NewGrantAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectgrant1",
"org2",
[]string{"rolekey1"},
),
),
),
expectPush(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org2").Aggregate,
"user1",
"project1",
"projectgrant1",
[]string{"rolekey1"},
).WithOwnerOrgs("org1", "org1", "org2"),
),
),
idGenerator: func(t *testing.T) id.Generator {
return id_mock.NewIDGeneratorExpectIDs(t, "usergrant1")
},
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrant: &domain.UserGrant{
UserID: "user1",
ProjectID: "project1",
RoleKeys: []string{"rolekey1"},
ObjectRoot: models.ObjectRoot{
ResourceOwner: "org2",
},
},
},
res: res{
want: &domain.UserGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "usergrant1",
ResourceOwner: "org2",
},
UserID: "user1",
ProjectID: "project1",
ProjectGrantID: "projectgrant1",
RoleKeys: []string{"rolekey1"},
State: domain.UserGrantStateActive,
},
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
r := &Commands{
eventstore: tt.fields.eventstore(t),
}
if tt.fields.idGenerator != nil {
r.idGenerator = tt.fields.idGenerator(t)
}
got, err := r.AddUserGrant(tt.args.ctx, tt.args.userGrant, succeedingUserGrantPermissionCheck)
if tt.res.err == nil {
assert.NoError(t, err)
}
if tt.res.err != nil && !tt.res.err(err) {
t.Errorf("got wrong err: %v ", err)
}
if tt.res.err == nil {
assert.Equal(t, tt.res.want, got)
}
})
}
}
func TestCommandSide_AddUserGrant_permission_failed(t *testing.T) {
t.Run("with failing permission check", func(t *testing.T) {
r := &Commands{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
user.NewHumanAddedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"username1",
"firstname1",
"lastname1",
"nickname1",
"displayname1",
language.German,
domain.GenderMale,
"email1",
true,
),
),
eventFromEventPusher(
project.NewProjectAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectname1", true, true, true,
domain.PrivateLabelingSettingUnspecified,
),
),
eventFromEventPusher(
project.NewRoleAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"rolekey1",
"rolekey",
"",
),
),
),
)(t),
}
// we use an empty context and only rely on the permission check implementation
_, err := r.AddUserGrant(context.Background(), &domain.UserGrant{
UserID: "user1",
ProjectID: "project1",
RoleKeys: []string{"rolekey1"},
ObjectRoot: models.ObjectRoot{
ResourceOwner: "org1",
},
}, failingUserGrantPermissionCheck)
assert.ErrorIs(t, err, errMockedPermissionCheck)
})
}
func TestCommandSide_ChangeUserGrant(t *testing.T) {
type fields struct {
eventstore func(t *testing.T) *eventstore.Eventstore
}
type args struct {
ctx context.Context
userGrant *domain.UserGrant
permissionCheck UserGrantPermissionCheck
cascade bool
ignoreUnchanged bool
}
type res struct {
want *domain.UserGrant
err func(error) bool
}
tests := []struct {
name string
fields fields
args args
res res
}{
{
name: "invalid usergrant, error",
fields: fields{
eventstore: expectEventstore(),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "org", "user", []string{domain.RoleProjectOwner}),
userGrant: &domain.UserGrant{
UserID: "user1",
ObjectRoot: models.ObjectRoot{
ResourceOwner: "org1",
},
},
},
res: res{
err: zerrors.IsErrorInvalidArgument,
},
},
{
name: "invalid permissions, error",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
),
expectFilter(
eventFromEventPusher(
user.NewHumanAddedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"username1",
"firstname1",
"lastname1",
"nickname1",
"displayname1",
language.German,
domain.GenderMale,
"email1",
true,
),
),
eventFromEventPusher(
project.NewProjectAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectname1", true, true, true,
domain.PrivateLabelingSettingUnspecified,
),
),
eventFromEventPusher(
project.NewRoleAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"rolekey1",
"rolekey",
"",
),
),
eventFromEventPusher(
project.NewRoleAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"rolekey2",
"rolekey 2",
"",
),
),
),
),
},
args: args{
ctx: context.Background(),
userGrant: &domain.UserGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "usergrant1",
ResourceOwner: "org1",
},
UserID: "user1",
},
permissionCheck: failingUserGrantPermissionCheck,
},
res: res{
err: isMockedPermissionCheckErr,
},
},
{
name: "usergrant not existing, not found error",
fields: fields{
eventstore: expectEventstore(
expectFilter(),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrant: &domain.UserGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "usergrant1",
ResourceOwner: "org1",
},
UserID: "user1",
ProjectID: "project1",
RoleKeys: []string{"rolekey1"},
},
},
res: res{
err: zerrors.IsNotFound,
},
},
{
name: "usergrant not existing, not found error",
fields: fields{
eventstore: expectEventstore(
expectFilter(),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrant: &domain.UserGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "usergrant1",
ResourceOwner: "org1",
},
UserID: "user1",
ProjectID: "project1",
RoleKeys: []string{"rolekey1"},
},
},
res: res{
err: zerrors.IsNotFound,
},
},
{
name: "usergrant roles not changed, precondition error",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrant: &domain.UserGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "usergrant1",
ResourceOwner: "org1",
},
UserID: "user1",
ProjectID: "project1",
RoleKeys: []string{"rolekey1"},
},
},
res: res{
err: zerrors.IsPreconditionFailed,
},
},
{
name: "user removed, precondition error",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
),
expectFilter(
eventFromEventPusher(
user.NewHumanAddedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"username1",
"firstname1",
"lastname1",
"nickname1",
"displayname1",
language.German,
domain.GenderMale,
"email1",
true,
),
),
eventFromEventPusher(
user.NewUserRemovedEvent(
context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"username1",
nil,
true,
),
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "org", "user", []string{domain.RoleProjectOwner}),
userGrant: &domain.UserGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "usergrant1",
ResourceOwner: "org1",
},
UserID: "user1",
ProjectID: "project1",
},
},
res: res{
err: zerrors.IsPreconditionFailed,
},
},
{
name: "project removed, precondition error",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
),
expectFilter(
eventFromEventPusher(
user.NewHumanAddedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"username1",
"firstname1",
"lastname1",
"nickname1",
"displayname1",
language.German,
domain.GenderMale,
"email1",
true,
),
),
eventFromEventPusher(
project.NewProjectAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectname1", true, true, true,
domain.PrivateLabelingSettingUnspecified,
),
),
eventFromEventPusher(
project.NewProjectRemovedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectname1",
nil,
),
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "org", "user", []string{domain.RoleProjectOwner}),
userGrant: &domain.UserGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "usergrant1",
ResourceOwner: "org1",
},
UserID: "user1",
ProjectID: "project1",
},
},
res: res{
err: zerrors.IsPreconditionFailed,
},
},
{
name: "project roles not existing, precondition error",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
),
expectFilter(
eventFromEventPusher(
user.NewHumanAddedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"username1",
"firstname1",
"lastname1",
"nickname1",
"displayname1",
language.German,
domain.GenderMale,
"email1",
true,
),
),
eventFromEventPusher(
project.NewProjectAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectname1", true, true, true,
domain.PrivateLabelingSettingUnspecified,
),
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "org", "user", []string{domain.RoleProjectOwner}),
userGrant: &domain.UserGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "usergrant1",
ResourceOwner: "org1",
},
UserID: "user1",
ProjectID: "project1",
RoleKeys: []string{"roleKey"},
},
},
res: res{
err: zerrors.IsPreconditionFailed,
},
},
{
name: "project grant not existing, precondition error",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
),
expectFilter(
eventFromEventPusher(
user.NewHumanAddedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"username1",
"firstname1",
"lastname1",
"nickname1",
"displayname1",
language.German,
domain.GenderMale,
"email1",
true,
),
),
eventFromEventPusher(
project.NewProjectAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectname1", true, true, true,
domain.PrivateLabelingSettingUnspecified,
),
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "org", "user", []string{domain.RoleProjectOwner}),
userGrant: &domain.UserGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "usergrant1",
ResourceOwner: "org1",
},
UserID: "user1",
ProjectID: "project1",
ProjectGrantID: "projectgrant1",
RoleKeys: []string{"roleKey"},
},
},
res: res{
err: zerrors.IsPreconditionFailed,
},
},
{
name: "project grant roles not existing, precondition error",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
),
expectFilter(
eventFromEventPusher(
user.NewHumanAddedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"username1",
"firstname1",
"lastname1",
"nickname1",
"displayname1",
language.German,
domain.GenderMale,
"email1",
true,
),
),
eventFromEventPusher(
project.NewProjectAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectname1", true, true, true,
domain.PrivateLabelingSettingUnspecified,
),
),
eventFromEventPusher(
project.NewRoleAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"rolekey1",
"rolekey",
"",
),
),
eventFromEventPusher(
project.NewGrantAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectgrant1",
"org2",
nil,
),
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "org", "user", []string{domain.RoleProjectOwner}),
userGrant: &domain.UserGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "usergrant1",
ResourceOwner: "org1",
},
UserID: "user1",
ProjectID: "project1",
ProjectGrantID: "projectgrant1",
RoleKeys: []string{"roleKey"},
},
},
res: res{
err: zerrors.IsPreconditionFailed,
},
},
{
name: "usergrant for project, ok",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
),
expectFilter(
eventFromEventPusher(
user.NewHumanAddedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"username1",
"firstname1",
"lastname1",
"nickname1",
"displayname1",
language.German,
domain.GenderMale,
"email1",
true,
),
),
eventFromEventPusher(
project.NewProjectAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectname1", true, true, true,
domain.PrivateLabelingSettingUnspecified,
),
),
eventFromEventPusher(
project.NewRoleAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"rolekey1",
"rolekey",
"",
),
),
eventFromEventPusher(
project.NewRoleAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"rolekey2",
"rolekey 2",
"",
),
),
),
expectPush(
usergrant.NewUserGrantChangedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
[]string{"rolekey1", "rolekey2"},
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrant: &domain.UserGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "usergrant1",
ResourceOwner: "org1",
},
UserID: "user1",
ProjectID: "project1",
RoleKeys: []string{"rolekey1", "rolekey2"},
},
},
res: res{
want: &domain.UserGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "usergrant1",
ResourceOwner: "org1",
},
UserID: "user1",
ProjectID: "project1",
RoleKeys: []string{"rolekey1", "rolekey2"},
State: domain.UserGrantStateActive,
},
},
},
{
name: "usergrant for project cascade, ok",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
),
expectFilter(
eventFromEventPusher(
user.NewHumanAddedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"username1",
"firstname1",
"lastname1",
"nickname1",
"displayname1",
language.German,
domain.GenderMale,
"email1",
true,
),
),
eventFromEventPusher(
project.NewProjectAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectname1", true, true, true,
domain.PrivateLabelingSettingUnspecified,
),
),
eventFromEventPusher(
project.NewRoleAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"rolekey1",
"rolekey",
"",
),
),
eventFromEventPusher(
project.NewRoleAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"rolekey2",
"rolekey 2",
"",
),
),
),
expectPush(
usergrant.NewUserGrantCascadeChangedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
[]string{"rolekey1", "rolekey2"},
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrant: &domain.UserGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "usergrant1",
ResourceOwner: "org1",
},
RoleKeys: []string{"rolekey1", "rolekey2"},
},
cascade: true,
},
res: res{
want: &domain.UserGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "usergrant1",
ResourceOwner: "org1",
},
UserID: "user1",
ProjectID: "project1",
State: domain.UserGrantStateActive,
RoleKeys: []string{"rolekey1", "rolekey2"},
},
},
},
{
name: "usergrant for projectgrant, ok",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org2").Aggregate,
"user1",
"project1",
"projectgrant1", []string{"rolekey1"}),
),
),
expectFilter(
eventFromEventPusher(
user.NewHumanAddedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"username1",
"firstname1",
"lastname1",
"nickname1",
"displayname1",
language.German,
domain.GenderMale,
"email1",
true,
),
),
eventFromEventPusher(
project.NewProjectAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectname1", true, true, true,
domain.PrivateLabelingSettingUnspecified,
),
),
eventFromEventPusher(
project.NewRoleAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"rolekey1",
"rolekey",
"",
),
),
eventFromEventPusher(
project.NewRoleAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"rolekey2",
"rolekey2",
"",
),
),
eventFromEventPusher(
project.NewGrantAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectgrant1",
"org2",
[]string{"rolekey1", "rolekey2"},
),
),
),
expectPush(
usergrant.NewUserGrantChangedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org2").Aggregate,
"user1",
[]string{"rolekey1", "rolekey2"},
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrant: &domain.UserGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "usergrant1",
ResourceOwner: "org2",
},
UserID: "user1",
ProjectID: "project1",
ProjectGrantID: "projectgrant1",
RoleKeys: []string{"rolekey1", "rolekey2"},
},
},
res: res{
want: &domain.UserGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "usergrant1",
ResourceOwner: "org2",
},
UserID: "user1",
ProjectID: "project1",
ProjectGrantID: "projectgrant1",
RoleKeys: []string{"rolekey1", "rolekey2"},
State: domain.UserGrantStateActive,
},
},
},
{
name: "usergrant for projectgrant same Organization ID, ok",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
),
expectFilter(
eventFromEventPusher(
user.NewHumanAddedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"username1",
"firstname1",
"lastname1",
"nickname1",
"displayname1",
language.German,
domain.GenderMale,
"email1",
true,
),
),
eventFromEventPusher(
project.NewProjectAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectname1", true, true, true,
domain.PrivateLabelingSettingUnspecified,
),
),
eventFromEventPusher(
project.NewRoleAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"rolekey1",
"rolekey",
"",
),
),
eventFromEventPusher(
project.NewRoleAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"rolekey2",
"rolekey2",
"",
),
),
eventFromEventPusher(
project.NewGrantAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectgrant1",
"org1",
[]string{"rolekey1", "rolekey2"},
),
),
),
expectPush(
usergrant.NewUserGrantChangedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
[]string{"rolekey1", "rolekey2"},
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrant: &domain.UserGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "usergrant1",
ResourceOwner: "org1",
},
UserID: "user1",
ProjectID: "project1",
ProjectGrantID: "",
RoleKeys: []string{"rolekey1", "rolekey2"},
},
},
res: res{
want: &domain.UserGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "usergrant1",
ResourceOwner: "org1",
},
UserID: "user1",
ProjectID: "project1",
ProjectGrantID: "",
RoleKeys: []string{"rolekey1", "rolekey2"},
State: domain.UserGrantStateActive,
},
},
},
{
name: "usergrant for project without Organization ID, ok",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
),
expectFilter(
eventFromEventPusher(
user.NewHumanAddedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"username1",
"firstname1",
"lastname1",
"nickname1",
"displayname1",
language.German,
domain.GenderMale,
"email1",
true,
),
),
eventFromEventPusher(
project.NewProjectAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectname1", true, true, true,
domain.PrivateLabelingSettingUnspecified,
),
),
eventFromEventPusher(
project.NewRoleAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"rolekey1",
"rolekey",
"",
),
),
eventFromEventPusher(
project.NewRoleAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"rolekey2",
"rolekey 2",
"",
),
),
),
expectPush(
usergrant.NewUserGrantChangedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
[]string{"rolekey1", "rolekey2"},
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrant: &domain.UserGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "usergrant1",
},
UserID: "user1",
ProjectID: "project1",
RoleKeys: []string{"rolekey1", "rolekey2"},
},
},
res: res{
want: &domain.UserGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "usergrant1",
ResourceOwner: "org1",
},
UserID: "user1",
ProjectID: "project1",
RoleKeys: []string{"rolekey1", "rolekey2"},
State: domain.UserGrantStateActive,
},
},
},
{
name: "usergrant for project with passed succeeding permission check, ok",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
),
expectFilter(
eventFromEventPusher(
user.NewHumanAddedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"username1",
"firstname1",
"lastname1",
"nickname1",
"displayname1",
language.German,
domain.GenderMale,
"email1",
true,
),
),
eventFromEventPusher(
project.NewProjectAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectname1", true, true, true,
domain.PrivateLabelingSettingUnspecified,
),
),
eventFromEventPusher(
project.NewRoleAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"rolekey1",
"rolekey",
"",
),
),
eventFromEventPusher(
project.NewRoleAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"rolekey2",
"rolekey 2",
"",
),
),
),
expectPush(
usergrant.NewUserGrantChangedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
[]string{"rolekey1", "rolekey2"},
),
),
),
},
args: args{
ctx: context.Background(),
userGrant: &domain.UserGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "usergrant1",
ResourceOwner: "org1",
},
UserID: "user1",
ProjectID: "project1",
RoleKeys: []string{"rolekey1", "rolekey2"},
},
permissionCheck: succeedingUserGrantPermissionCheck,
},
res: res{
want: &domain.UserGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "usergrant1",
ResourceOwner: "org1",
},
UserID: "user1",
ProjectID: "project1",
RoleKeys: []string{"rolekey1", "rolekey2"},
State: domain.UserGrantStateActive,
},
},
},
{
name: "usergrant for project with passed failing permission check, error",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
),
expectFilter(
eventFromEventPusher(
user.NewHumanAddedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"username1",
"firstname1",
"lastname1",
"nickname1",
"displayname1",
language.German,
domain.GenderMale,
"email1",
true,
),
),
eventFromEventPusher(
project.NewProjectAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectname1", true, true, true,
domain.PrivateLabelingSettingUnspecified,
),
),
eventFromEventPusher(
project.NewRoleAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"rolekey1",
"rolekey",
"",
),
),
eventFromEventPusher(
project.NewRoleAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"rolekey2",
"rolekey 2",
"",
),
),
),
),
},
args: args{
ctx: context.Background(),
userGrant: &domain.UserGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "usergrant1",
ResourceOwner: "org1",
},
UserID: "user1",
ProjectID: "project1",
RoleKeys: []string{"rolekey1", "rolekey2"},
},
permissionCheck: failingUserGrantPermissionCheck,
},
res: res{
want: &domain.UserGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "usergrant1",
ResourceOwner: "org1",
},
UserID: "user1",
ProjectID: "project1",
RoleKeys: []string{"rolekey1", "rolekey2"},
State: domain.UserGrantStateActive,
},
err: isMockedPermissionCheckErr,
},
},
{
name: "usergrant roles not changed, ignore unchanged, ok",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"", []string{"rolekey1", "rolekey2"}),
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrant: &domain.UserGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "usergrant1",
ResourceOwner: "org1",
},
UserID: "user1",
ProjectID: "project1",
RoleKeys: []string{"rolekey1", "rolekey2"},
},
ignoreUnchanged: true,
},
res: res{
want: &domain.UserGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "usergrant1",
ResourceOwner: "org1",
},
UserID: "user1",
ProjectID: "project1",
RoleKeys: []string{"rolekey1", "rolekey2"},
State: domain.UserGrantStateActive,
},
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
r := &Commands{
eventstore: tt.fields.eventstore(t),
}
got, err := r.ChangeUserGrant(tt.args.ctx, tt.args.userGrant, tt.args.cascade, tt.args.ignoreUnchanged, tt.args.permissionCheck)
if tt.res.err == nil {
assert.NoError(t, err)
}
if tt.res.err != nil && !tt.res.err(err) {
t.Errorf("got wrong err: %v ", err)
}
if tt.res.err == nil {
assert.Equal(t, tt.res.want, got)
}
})
}
}
func TestCommandSide_DeactivateUserGrant(t *testing.T) {
type fields struct {
eventstore func(t *testing.T) *eventstore.Eventstore
}
type args struct {
ctx context.Context
userGrantID string
resourceOwner string
check UserGrantPermissionCheck
}
type res struct {
want *domain.ObjectDetails
err func(error) bool
}
tests := []struct {
name string
fields fields
args args
res res
}{
{
name: "invalid usergrantID, error",
fields: fields{
eventstore: expectEventstore(),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
resourceOwner: "org1",
},
res: res{
err: zerrors.IsErrorInvalidArgument,
},
},
{
name: "not provided resourceOwner, ok",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
),
expectPush(
usergrant.NewUserGrantDeactivatedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org").Aggregate,
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrantID: "usergrant1",
},
res: res{
want: &domain.ObjectDetails{
ResourceOwner: "org",
},
},
},
{
name: "usergrant not existing, not found error",
fields: fields{
eventstore: expectEventstore(
expectFilter(),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrantID: "usergrant1",
resourceOwner: "org1",
},
res: res{
err: zerrors.IsNotFound,
},
},
{
name: "usergrant removed, not found error",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
eventFromEventPusher(
usergrant.NewUserGrantRemovedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org").Aggregate,
"user1",
"project1",
""),
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrantID: "usergrant1",
resourceOwner: "org1",
},
res: res{
err: zerrors.IsNotFound,
},
},
{
name: "no permissions, permission denied error",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
),
),
},
args: args{
ctx: context.Background(),
userGrantID: "usergrant1",
resourceOwner: "org1",
},
res: res{
err: zerrors.IsPermissionDenied,
},
},
{
name: "already deactivated, ignore, ok",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
eventFromEventPusher(
usergrant.NewUserGrantDeactivatedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org").Aggregate),
),
),
),
},
args: args{
ctx: context.Background(),
userGrantID: "usergrant1",
resourceOwner: "org1",
},
res: res{
want: &domain.ObjectDetails{
ResourceOwner: "org",
},
},
},
{
name: "deactivated, ok",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
),
expectPush(
usergrant.NewUserGrantDeactivatedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrantID: "usergrant1",
resourceOwner: "org1",
},
res: res{
want: &domain.ObjectDetails{
ResourceOwner: "org1",
},
},
},
{
name: "with passed succeeding permission check, ok",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
),
expectPush(
usergrant.NewUserGrantDeactivatedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
),
),
),
},
args: args{
ctx: context.Background(),
userGrantID: "usergrant1",
resourceOwner: "org1",
check: succeedingUserGrantPermissionCheck,
},
res: res{
want: &domain.ObjectDetails{
ResourceOwner: "org1",
},
},
},
{
name: "with passed failing permission check, error",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
),
),
},
args: args{
ctx: context.Background(),
userGrantID: "usergrant1",
resourceOwner: "org1",
check: failingUserGrantPermissionCheck,
},
res: res{
err: isMockedPermissionCheckErr,
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
r := &Commands{
eventstore: tt.fields.eventstore(t),
}
got, err := r.DeactivateUserGrant(tt.args.ctx, tt.args.userGrantID, tt.args.resourceOwner, tt.args.check)
if tt.res.err == nil {
assert.NoError(t, err)
}
if tt.res.err != nil && !tt.res.err(err) {
t.Errorf("got wrong err: %v ", err)
}
if tt.res.err == nil {
assertObjectDetails(t, tt.res.want, got)
}
})
}
}
func TestCommandSide_ReactivateUserGrant(t *testing.T) {
type fields struct {
eventstore func(t *testing.T) *eventstore.Eventstore
}
type args struct {
ctx context.Context
userGrantID string
resourceOwner string
check UserGrantPermissionCheck
}
type res struct {
want *domain.ObjectDetails
err func(error) bool
}
tests := []struct {
name string
fields fields
args args
res res
}{
{
name: "invalid usergrantID, error",
fields: fields{
eventstore: expectEventstore(),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
resourceOwner: "org1",
},
res: res{
err: zerrors.IsErrorInvalidArgument,
},
},
{
name: "not provided resourceOwner, ok",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
eventFromEventPusher(
usergrant.NewUserGrantDeactivatedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org").Aggregate),
),
),
expectPush(
usergrant.NewUserGrantReactivatedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org").Aggregate,
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrantID: "usergrant1",
},
res: res{
want: &domain.ObjectDetails{
ResourceOwner: "org",
},
},
},
{
name: "usergrant not existing, not found error",
fields: fields{
eventstore: expectEventstore(
expectFilter(),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrantID: "usergrant1",
resourceOwner: "org1",
},
res: res{
err: zerrors.IsNotFound,
},
},
{
name: "usergrant removed, not found error",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
eventFromEventPusher(
usergrant.NewUserGrantRemovedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org").Aggregate,
"user1",
"project1",
""),
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrantID: "usergrant1",
resourceOwner: "org1",
},
res: res{
err: zerrors.IsNotFound,
},
},
{
name: "no permissions, permission denied error",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
eventFromEventPusher(
usergrant.NewUserGrantDeactivatedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org").Aggregate),
),
),
),
},
args: args{
ctx: context.Background(),
userGrantID: "usergrant1",
resourceOwner: "org1",
},
res: res{
err: zerrors.IsPermissionDenied,
},
},
{
name: "already active, ignore, ok",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrantID: "usergrant1",
resourceOwner: "org1",
},
res: res{
want: &domain.ObjectDetails{
ResourceOwner: "org",
},
},
},
{
name: "reactivated, ok",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
eventFromEventPusher(
usergrant.NewUserGrantDeactivatedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org").Aggregate),
),
),
expectPush(
usergrant.NewUserGrantReactivatedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrantID: "usergrant1",
resourceOwner: "org1",
},
res: res{
want: &domain.ObjectDetails{
ResourceOwner: "org1",
},
},
},
{
name: "with passed succeeding permission check, ok",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
eventFromEventPusher(
usergrant.NewUserGrantDeactivatedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org").Aggregate),
),
),
expectPush(
usergrant.NewUserGrantReactivatedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
),
),
),
},
args: args{
ctx: context.Background(),
userGrantID: "usergrant1",
resourceOwner: "org1",
check: succeedingUserGrantPermissionCheck,
},
res: res{
want: &domain.ObjectDetails{
ResourceOwner: "org1",
},
},
},
{
name: "with passed failing permission check, error",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
eventFromEventPusher(
usergrant.NewUserGrantDeactivatedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org").Aggregate),
),
),
),
},
args: args{
ctx: context.Background(),
userGrantID: "usergrant1",
resourceOwner: "org1",
check: failingUserGrantPermissionCheck,
},
res: res{
err: isMockedPermissionCheckErr,
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
r := &Commands{
eventstore: tt.fields.eventstore(t),
}
got, err := r.ReactivateUserGrant(tt.args.ctx, tt.args.userGrantID, tt.args.resourceOwner, tt.args.check)
if tt.res.err == nil {
assert.NoError(t, err)
}
if tt.res.err != nil && !tt.res.err(err) {
t.Errorf("got wrong err: %v ", err)
}
if tt.res.err == nil {
assertObjectDetails(t, tt.res.want, got)
}
})
}
}
func TestCommandSide_RemoveUserGrant(t *testing.T) {
type fields struct {
eventstore func(t *testing.T) *eventstore.Eventstore
}
type args struct {
ctx context.Context
userGrantID string
resourceOwner string
ignoreNotFound bool
check UserGrantPermissionCheck
}
type res struct {
want *domain.ObjectDetails
err func(error) bool
}
tests := []struct {
name string
fields fields
args args
res res
}{
{
name: "invalid usergrantID, error",
fields: fields{
eventstore: expectEventstore(),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
resourceOwner: "org1",
},
res: res{
err: zerrors.IsErrorInvalidArgument,
},
},
{
name: "usergrant not existing, not found error",
fields: fields{
eventstore: expectEventstore(
expectFilter(),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrantID: "usergrant1",
resourceOwner: "org1",
},
res: res{
err: zerrors.IsNotFound,
},
},
{
name: "usergrant not existing, ignore, ok",
fields: fields{
eventstore: expectEventstore(
expectFilter(),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrantID: "usergrant1",
resourceOwner: "org1",
ignoreNotFound: true,
},
res: res{
want: &domain.ObjectDetails{
ResourceOwner: "org1",
},
},
},
{
name: "usergrant removed, not found error",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
eventFromEventPusher(
usergrant.NewUserGrantRemovedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org").Aggregate,
"user1",
"project1",
""),
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrantID: "usergrant1",
resourceOwner: "org1",
},
res: res{
err: zerrors.IsNotFound,
},
},
{
name: "no permissions, permission denied error",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
eventFromEventPusher(
usergrant.NewUserGrantDeactivatedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org").Aggregate),
),
),
),
},
args: args{
ctx: context.Background(),
userGrantID: "usergrant1",
resourceOwner: "org1",
},
res: res{
err: zerrors.IsPermissionDenied,
},
},
{
name: "remove usergrant project, ok",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
),
expectPush(
usergrant.NewUserGrantRemovedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"",
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrantID: "usergrant1",
resourceOwner: "org1",
},
res: res{
want: &domain.ObjectDetails{
ResourceOwner: "org1",
},
},
},
{
name: "not provided resourceOwner, ok",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
),
expectPush(
usergrant.NewUserGrantRemovedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"",
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrantID: "usergrant1",
},
res: res{
want: &domain.ObjectDetails{
ResourceOwner: "org1",
},
},
},
{
name: "remove usergrant projectgrant, ok",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"projectgrant1", []string{"rolekey1"}),
),
),
expectPush(
usergrant.NewUserGrantRemovedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"projectgrant1",
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrantID: "usergrant1",
resourceOwner: "org1",
},
res: res{
want: &domain.ObjectDetails{
ResourceOwner: "org1",
},
},
},
{
name: "with passed succeeding permission check, ok",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"projectgrant1", []string{"rolekey1"}),
),
),
expectPush(
usergrant.NewUserGrantRemovedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"projectgrant1",
),
),
),
},
args: args{
ctx: context.Background(),
userGrantID: "usergrant1",
resourceOwner: "org1",
check: succeedingUserGrantPermissionCheck,
},
res: res{
want: &domain.ObjectDetails{
ResourceOwner: "org1",
},
},
},
{
name: "with passed failing permission check, error",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"projectgrant1", []string{"rolekey1"}),
),
),
),
},
args: args{
ctx: context.Background(),
userGrantID: "usergrant1",
resourceOwner: "org1",
check: failingUserGrantPermissionCheck,
},
res: res{
err: isMockedPermissionCheckErr,
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
r := &Commands{
eventstore: tt.fields.eventstore(t),
}
got, err := r.RemoveUserGrant(tt.args.ctx, tt.args.userGrantID, tt.args.resourceOwner, tt.args.ignoreNotFound, tt.args.check)
if tt.res.err == nil {
assert.NoError(t, err)
}
if tt.res.err != nil && !tt.res.err(err) {
t.Errorf("got wrong err: %v ", err)
}
if tt.res.err == nil {
assertObjectDetails(t, tt.res.want, got)
}
})
}
}
func TestCommandSide_BulkRemoveUserGrant(t *testing.T) {
type fields struct {
eventstore *eventstore.Eventstore
}
type args struct {
ctx context.Context
userGrantIDs []string
resourceOwner string
}
type res struct {
want *domain.ObjectDetails
err func(error) bool
}
tests := []struct {
name string
fields fields
args args
res res
}{
{
name: "empty usergrantid list, error",
fields: fields{
eventstore: eventstoreExpect(t),
},
args: args{
ctx: context.Background(),
resourceOwner: "org1",
},
res: res{
err: zerrors.IsErrorInvalidArgument,
},
},
{
name: "usergrant not existing, not found error",
fields: fields{
eventstore: eventstoreExpect(
t,
expectFilter(),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrantIDs: []string{"usergrant1", "usergrant2"},
resourceOwner: "org1",
},
res: res{
err: zerrors.IsNotFound,
},
},
{
name: "usergrant removed, not found error",
fields: fields{
eventstore: eventstoreExpect(
t,
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
eventFromEventPusher(
usergrant.NewUserGrantRemovedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org").Aggregate,
"user1",
"project1",
""),
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrantIDs: []string{"usergrant1", "usergrant2"},
resourceOwner: "org1",
},
res: res{
err: zerrors.IsNotFound,
},
},
{
name: "no permissions, permisison denied error",
fields: fields{
eventstore: eventstoreExpect(
t,
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
),
),
},
args: args{
ctx: context.Background(),
userGrantIDs: []string{"usergrant1", "usergrant2"},
resourceOwner: "org1",
},
res: res{
err: zerrors.IsPermissionDenied,
},
},
{
name: "remove usergrants project, ok",
fields: fields{
eventstore: eventstoreExpect(
t,
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"", []string{"rolekey1"}),
),
),
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant2", "org1").Aggregate,
"user2",
"project2",
"", []string{"rolekey1"}),
),
),
expectPush(
usergrant.NewUserGrantRemovedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"",
),
usergrant.NewUserGrantRemovedEvent(context.Background(),
&usergrant.NewAggregate("usergrant2", "org1").Aggregate,
"user2",
"project2",
"",
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrantIDs: []string{"usergrant1", "usergrant2"},
resourceOwner: "org1",
},
res: res{},
},
{
name: "remove usergrants projectgrant, ok",
fields: fields{
eventstore: eventstoreExpect(
t,
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"projectgrant1", []string{"rolekey1"}),
),
),
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(context.Background(),
&usergrant.NewAggregate("usergrant2", "org1").Aggregate,
"user2",
"project2",
"projectgrant2", []string{"rolekey1"}),
),
),
expectPush(
usergrant.NewUserGrantRemovedEvent(context.Background(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"projectgrant1",
),
usergrant.NewUserGrantRemovedEvent(context.Background(),
&usergrant.NewAggregate("usergrant2", "org1").Aggregate,
"user2",
"project2",
"projectgrant2",
),
),
),
},
args: args{
ctx: authz.NewMockContextWithPermissions("", "", "", []string{domain.RoleProjectOwner}),
userGrantIDs: []string{"usergrant1", "usergrant2"},
resourceOwner: "org1",
},
res: res{},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
r := &Commands{
eventstore: tt.fields.eventstore,
}
err := r.BulkRemoveUserGrant(tt.args.ctx, tt.args.userGrantIDs, tt.args.resourceOwner)
if tt.res.err == nil {
assert.NoError(t, err)
}
if tt.res.err != nil && !tt.res.err(err) {
t.Errorf("got wrong err: %v ", err)
}
})
}
}
// PoC for GHSA-v859-c572-qh5p
// Each case asserts the CORRECT post-removal RoleKeys;
// against faulty implementations these assertions fail.
func TestCommandSide_removeRoleFromUserGrant(t *testing.T) {
t.Parallel()
tests := []struct {
name string
existingRoleKeys []string
roleKeysToRemove map[string]bool
want []string
}{
{
name: "advisory scenario, remove two adjacent leading roles",
existingRoleKeys: []string{"admin", "viewer", "editor"},
roleKeysToRemove: map[string]bool{"admin": true, "viewer": true},
want: []string{"editor"},
},
{
name: "remove first two of four",
existingRoleKeys: []string{"a", "b", "c", "d"},
roleKeysToRemove: map[string]bool{"a": true, "b": true},
want: []string{"c", "d"},
},
{
name: "remove two adjacent middle roles",
existingRoleKeys: []string{"a", "b", "c", "d"},
roleKeysToRemove: map[string]bool{"b": true, "c": true},
want: []string{"a", "d"},
},
{
name: "remove two non-adjacent roles",
existingRoleKeys: []string{"a", "b", "c", "d"},
roleKeysToRemove: map[string]bool{"a": true, "c": true},
want: []string{"b", "d"},
},
{
name: "remove all roles",
existingRoleKeys: []string{"x", "y", "z"},
roleKeysToRemove: map[string]bool{"x": true, "y": true, "z": true},
want: []string{},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
t.Parallel()
r := &Commands{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
usergrant.NewUserGrantAddedEvent(t.Context(),
&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
"user1",
"project1",
"",
tt.existingRoleKeys,
),
),
),
)(t),
}
cmd, err := r.removeRoleFromUserGrant(t.Context(), "usergrant1", tt.roleKeysToRemove, true)
require.NoError(t, err)
event, ok := cmd.(*usergrant.UserGrantCascadeChangedEvent)
require.True(t, ok, "expected *usergrant.UserGrantCascadeChangedEvent, got %T", cmd)
assert.Equal(t, tt.want, event.RoleKeys)
})
}
}
Reference in New Issue View Git Blame Copy Permalink