Initial Dever 0.0.1

test/rust/compiler/auth/mod.rs

@@ -0,0 +1,67 @@
+use super::{database::ERROR, package::packages};
+use dever::{compiler::model::Program, syntax::diagnostic::Diagnostic};
+
+#[path = "../authorization/mod.rs"]
+mod capability;
+mod effects;
+mod request;
+mod rest;
+
+const APP: &str = "type Identity { id: Text\nuser_id: model.id?\ntenant_id: model.id? }\nverify(claims: dever.auth.Claims) (identity: Identity) { account = model.first({ where = subject == claims.subject and session == claims.session })\nidentity = identity(account) }\nidentity(account: model.Account) (identity: Identity) { identity = Identity { id = account.subject, user_id = account.id, tenant_id = null } }\nidentity(account: null) (identity: Identity) { fail(dever.api.Error.Unauthorized) }\nhealth() (value: Bool) { value = true }";
+
+fn checked(model: &str, app: &str) -> Result<Program, Diagnostic> {
+    packages(&[
+        ("dever.database", ERROR),
+        ("dever.api", "public type Error { error Unauthorized }"),
+        (
+            "dever.auth",
+            "public type Claims { subject: Text\nsession: Text\ntenant: Text?\nsite: Text }",
+        ),
+        ("demo.account.model", model),
+        ("demo.account.app", app),
+        ("demo.account.api", "public get health = app.health"),
+    ])
+}
+
+#[test]
+fn provider_identity_is_a_compiled_app_entry_with_global_reads() {
+    let program = checked("global type Account { subject: Text\nsession: Text }", APP).unwrap();
+    let verifier = &program.verifiers[0];
+    assert_eq!(verifier.name, "demo.account.verify");
+    assert!(program.models[0].global);
+    assert!(program.entries().any(|entry| entry == verifier.function));
+    assert!(program.api_snapshot().contains("global=true"));
+    assert_eq!(
+        checked("type Account { subject: Text\nsession: Text }", APP)
+            .unwrap_err()
+            .code,
+        "C014"
+    );
+    assert_eq!(
+        packages(&[("main", "global type Value { number: Int }")])
+            .unwrap_err()
+            .code,
+        "C006"
+    );
+}
+
+#[test]
+fn provider_cannot_write_or_replace_nominal_identity_with_permissions() {
+    let model = "global type Account { subject: Text\nsession: Text }";
+    let writing = APP.replace(
+        "model.first({ where = subject == claims.subject and session == claims.session })",
+        "model.create({ subject = claims.subject, session = claims.session })",
+    );
+    assert_eq!(checked(model, &writing).unwrap_err().code, "C014");
+    let invalid = APP
+        .replace("user_id: model.id?", "user_id: Int?")
+        .replace("user_id = account.id", "user_id = 1");
+    assert_eq!(checked(model, &invalid).unwrap_err().code, "C005");
+    let invalid = APP
+        .replace(
+            "tenant_id: model.id?",
+            "tenant_id: model.id?\npermissions: List<Text>",
+        )
+        .replace("tenant_id = null", "tenant_id = null, permissions = []");
+    assert_eq!(checked(model, &invalid).unwrap_err().code, "C005");
+}