77 lines
3.0 KiB
Go
77 lines
3.0 KiB
Go
package service
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
"gorm.io/driver/sqlite"
|
|
"gorm.io/gorm"
|
|
"gorm.io/gorm/logger"
|
|
|
|
"github.com/gochat/gochat/internal/auth"
|
|
"github.com/gochat/gochat/internal/model"
|
|
)
|
|
|
|
func setupRBACCustomRoleTest(t *testing.T) (*RBACService, *gorm.DB) {
|
|
t.Helper()
|
|
db, err := gorm.Open(sqlite.Open("file::memory:"), &gorm.Config{Logger: logger.Default.LogMode(logger.Silent)})
|
|
require.NoError(t, err)
|
|
require.NoError(t, db.AutoMigrate(&model.Account{}, &model.User{}, &model.AccountUser{}, &model.CustomRole{}))
|
|
t.Cleanup(func() {
|
|
sqlDB, _ := db.DB()
|
|
sqlDB.Close()
|
|
})
|
|
return NewRBACService(db), db
|
|
}
|
|
|
|
func TestRBACService_CustomRoleUsesAgentRoleAndCustomRoleID(t *testing.T) {
|
|
svc, db := setupRBACCustomRoleTest(t)
|
|
account := &model.Account{Name: "RBAC Custom Role", Active: true}
|
|
require.NoError(t, db.Create(account).Error)
|
|
user := &model.User{AccountID: account.ID, Name: "Custom Agent", Email: "custom-agent@example.com", Password: "pw", Active: true}
|
|
require.NoError(t, db.Create(user).Error)
|
|
role := &model.CustomRole{AccountID: account.ID, Name: "Reporter"}
|
|
require.NoError(t, role.SetPermissionKeys([]model.PermissionDimension{model.DimensionReportManage}))
|
|
require.NoError(t, db.Create(role).Error)
|
|
|
|
au, err := svc.AddAccountUser(user.ID, account.ID, "custom_role", role.ID, 0)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "agent", au.Role)
|
|
assert.Equal(t, role.ID, au.CustomRoleID)
|
|
|
|
pc, err := svc.BuildPolicyContext(user.ID, account.ID)
|
|
require.NoError(t, err)
|
|
assert.True(t, pc.IsCustomRole())
|
|
assert.True(t, pc.Can("read", "report"))
|
|
assert.True(t, pc.Can("manage", "report"))
|
|
assert.False(t, pc.Can("manage", "contact"))
|
|
}
|
|
|
|
func TestRBACService_UpdateAccountUserRoleStoresAgentForCustomRole(t *testing.T) {
|
|
svc, db := setupRBACCustomRoleTest(t)
|
|
account := &model.Account{Name: "RBAC Update Role", Active: true}
|
|
require.NoError(t, db.Create(account).Error)
|
|
user := &model.User{AccountID: account.ID, Name: "Update Agent", Email: "update-agent@example.com", Password: "pw", Active: true}
|
|
require.NoError(t, db.Create(user).Error)
|
|
role := &model.CustomRole{AccountID: account.ID, Name: "Contact Manager"}
|
|
require.NoError(t, role.SetPermissionKeys([]model.PermissionDimension{model.DimensionContactManage}))
|
|
require.NoError(t, db.Create(role).Error)
|
|
require.NoError(t, db.Create(&model.AccountUser{AccountID: account.ID, UserID: user.ID, Role: "agent"}).Error)
|
|
|
|
au, err := svc.UpdateAccountUserRole(user.ID, account.ID, "custom_role", role.ID)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "agent", au.Role)
|
|
assert.Equal(t, role.ID, au.CustomRoleID)
|
|
}
|
|
|
|
func TestRBACService_CustomRoleConversationPermissionKeys(t *testing.T) {
|
|
pc := auth.NewPolicyContext(1, 1, "custom_role", 7, auth.PermissionMatrixMap{
|
|
auth.DimensionConversationUnassignedManage: auth.PermissionFull,
|
|
})
|
|
assert.True(t, pc.Can("read", "conversation"))
|
|
assert.True(t, pc.Can("manage", "conversation"))
|
|
assert.True(t, pc.Can("create", "message"))
|
|
assert.False(t, pc.Can("delete", "conversation"))
|
|
}
|