perms_test.go 5.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289
  1. // Copyright 2020 The Gogs Authors. All rights reserved.
  2. // Use of this source code is governed by a MIT-style
  3. // license that can be found in the LICENSE file.
  4. package db
  5. import (
  6. "testing"
  7. "github.com/stretchr/testify/assert"
  8. )
  9. func Test_perms(t *testing.T) {
  10. if testing.Short() {
  11. t.Skip()
  12. }
  13. t.Parallel()
  14. tables := []interface{}{new(Access)}
  15. db := &perms{
  16. DB: initTestDB(t, "perms", tables...),
  17. }
  18. for _, tc := range []struct {
  19. name string
  20. test func(*testing.T, *perms)
  21. }{
  22. {"AccessMode", test_perms_AccessMode},
  23. {"Authorize", test_perms_Authorize},
  24. {"SetRepoPerms", test_perms_SetRepoPerms},
  25. } {
  26. t.Run(tc.name, func(t *testing.T) {
  27. t.Cleanup(func() {
  28. err := clearTables(db.DB, tables...)
  29. if err != nil {
  30. t.Fatal(err)
  31. }
  32. })
  33. tc.test(t, db)
  34. })
  35. }
  36. }
  37. func test_perms_AccessMode(t *testing.T, db *perms) {
  38. // Set up permissions
  39. err := db.SetRepoPerms(1, map[int64]AccessMode{
  40. 2: AccessModeWrite,
  41. 3: AccessModeAdmin,
  42. })
  43. if err != nil {
  44. t.Fatal(err)
  45. }
  46. err = db.SetRepoPerms(2, map[int64]AccessMode{
  47. 1: AccessModeRead,
  48. })
  49. if err != nil {
  50. t.Fatal(err)
  51. }
  52. publicRepo := &Repository{
  53. ID: 1,
  54. OwnerID: 98,
  55. }
  56. privateRepo := &Repository{
  57. ID: 2,
  58. OwnerID: 99,
  59. IsPrivate: true,
  60. }
  61. tests := []struct {
  62. name string
  63. userID int64
  64. repo *Repository
  65. expAccessMode AccessMode
  66. }{
  67. {
  68. name: "nil repository",
  69. expAccessMode: AccessModeNone,
  70. },
  71. {
  72. name: "anonymous user has read access to public repository",
  73. repo: publicRepo,
  74. expAccessMode: AccessModeRead,
  75. },
  76. {
  77. name: "anonymous user has no access to private repository",
  78. repo: privateRepo,
  79. expAccessMode: AccessModeNone,
  80. },
  81. {
  82. name: "user is the owner",
  83. userID: 98,
  84. repo: publicRepo,
  85. expAccessMode: AccessModeOwner,
  86. },
  87. {
  88. name: "user 1 has read access to public repo",
  89. userID: 1,
  90. repo: publicRepo,
  91. expAccessMode: AccessModeRead,
  92. },
  93. {
  94. name: "user 2 has write access to public repo",
  95. userID: 2,
  96. repo: publicRepo,
  97. expAccessMode: AccessModeWrite,
  98. },
  99. {
  100. name: "user 3 has admin access to public repo",
  101. userID: 3,
  102. repo: publicRepo,
  103. expAccessMode: AccessModeAdmin,
  104. },
  105. {
  106. name: "user 1 has read access to private repo",
  107. userID: 1,
  108. repo: privateRepo,
  109. expAccessMode: AccessModeRead,
  110. },
  111. {
  112. name: "user 2 has no access to private repo",
  113. userID: 2,
  114. repo: privateRepo,
  115. expAccessMode: AccessModeNone,
  116. },
  117. {
  118. name: "user 3 has no access to private repo",
  119. userID: 3,
  120. repo: privateRepo,
  121. expAccessMode: AccessModeNone,
  122. },
  123. }
  124. for _, test := range tests {
  125. t.Run(test.name, func(t *testing.T) {
  126. mode := db.AccessMode(test.userID, test.repo)
  127. assert.Equal(t, test.expAccessMode, mode)
  128. })
  129. }
  130. }
  131. func test_perms_Authorize(t *testing.T, db *perms) {
  132. // Set up permissions
  133. err := db.SetRepoPerms(1, map[int64]AccessMode{
  134. 1: AccessModeRead,
  135. 2: AccessModeWrite,
  136. 3: AccessModeAdmin,
  137. })
  138. if err != nil {
  139. t.Fatal(err)
  140. }
  141. repo := &Repository{
  142. ID: 1,
  143. OwnerID: 98,
  144. }
  145. tests := []struct {
  146. name string
  147. userID int64
  148. desired AccessMode
  149. expAuthorized bool
  150. }{
  151. {
  152. name: "user 1 has read and wants read",
  153. userID: 1,
  154. desired: AccessModeRead,
  155. expAuthorized: true,
  156. },
  157. {
  158. name: "user 1 has read and wants write",
  159. userID: 1,
  160. desired: AccessModeWrite,
  161. expAuthorized: false,
  162. },
  163. {
  164. name: "user 2 has write and wants read",
  165. userID: 2,
  166. desired: AccessModeRead,
  167. expAuthorized: true,
  168. },
  169. {
  170. name: "user 2 has write and wants write",
  171. userID: 2,
  172. desired: AccessModeWrite,
  173. expAuthorized: true,
  174. },
  175. {
  176. name: "user 2 has write and wants admin",
  177. userID: 2,
  178. desired: AccessModeAdmin,
  179. expAuthorized: false,
  180. },
  181. {
  182. name: "user 3 has admin and wants read",
  183. userID: 3,
  184. desired: AccessModeRead,
  185. expAuthorized: true,
  186. },
  187. {
  188. name: "user 3 has admin and wants write",
  189. userID: 3,
  190. desired: AccessModeWrite,
  191. expAuthorized: true,
  192. },
  193. {
  194. name: "user 3 has admin and wants admin",
  195. userID: 3,
  196. desired: AccessModeAdmin,
  197. expAuthorized: true,
  198. },
  199. }
  200. for _, test := range tests {
  201. t.Run(test.name, func(t *testing.T) {
  202. authorized := db.Authorize(test.userID, repo, test.desired)
  203. assert.Equal(t, test.expAuthorized, authorized)
  204. })
  205. }
  206. }
  207. func test_perms_SetRepoPerms(t *testing.T, db *perms) {
  208. for _, update := range []struct {
  209. repoID int64
  210. accessMap map[int64]AccessMode
  211. }{
  212. {
  213. repoID: 1,
  214. accessMap: map[int64]AccessMode{
  215. 1: AccessModeWrite,
  216. 2: AccessModeWrite,
  217. 3: AccessModeAdmin,
  218. 4: AccessModeWrite,
  219. },
  220. },
  221. {
  222. repoID: 2,
  223. accessMap: map[int64]AccessMode{
  224. 1: AccessModeWrite,
  225. 2: AccessModeRead,
  226. 4: AccessModeWrite,
  227. 5: AccessModeWrite,
  228. },
  229. },
  230. {
  231. repoID: 1,
  232. accessMap: map[int64]AccessMode{
  233. 2: AccessModeWrite,
  234. 3: AccessModeAdmin,
  235. },
  236. },
  237. {
  238. repoID: 2,
  239. accessMap: map[int64]AccessMode{
  240. 1: AccessModeWrite,
  241. 2: AccessModeRead,
  242. 5: AccessModeWrite,
  243. },
  244. },
  245. } {
  246. err := db.SetRepoPerms(update.repoID, update.accessMap)
  247. if err != nil {
  248. t.Fatal(err)
  249. }
  250. }
  251. var accesses []*Access
  252. err := db.Order("user_id, repo_id").Find(&accesses).Error
  253. if err != nil {
  254. t.Fatal(err)
  255. }
  256. // Ignore ID fields
  257. for _, a := range accesses {
  258. a.ID = 0
  259. }
  260. expAccesses := []*Access{
  261. {UserID: 1, RepoID: 2, Mode: AccessModeWrite},
  262. {UserID: 2, RepoID: 1, Mode: AccessModeWrite},
  263. {UserID: 2, RepoID: 2, Mode: AccessModeRead},
  264. {UserID: 3, RepoID: 1, Mode: AccessModeAdmin},
  265. {UserID: 5, RepoID: 2, Mode: AccessModeWrite},
  266. }
  267. assert.Equal(t, expAccesses, accesses)
  268. }