Initial Dever 0.0.1

test/rust/native/application/auth/roles.rs

@@ -0,0 +1,159 @@
+use super::{execute, request, token};
+use serde_json::{Value, json};
+use std::path::Path;
+
+fn get(port: u16, action: &str, credentials: &str) -> (u16, Value) {
+    let (status, body) = request(
+        port,
+        "GET",
+        &format!("/demo/account/admin/roles/{action}"),
+        "fixture.test",
+        credentials,
+        "",
+    );
+    (status, serde_json::from_str(&body).unwrap())
+}
+
+fn post(port: u16, action: &str, credentials: &str, input: Value) -> (u16, Value) {
+    let (status, body) = request(
+        port,
+        "POST",
+        &format!("/demo/account/admin/roles/{action}"),
+        "fixture.test",
+        &format!("{credentials}Content-Type: application/json\r\n"),
+        &input.to_string(),
+    );
+    (status, serde_json::from_str(&body).unwrap())
+}
+
+pub(super) fn check(binary: &Path, port: u16, owner: &str) {
+    assert_eq!(get(port, "protected_me?unexpected=1", owner).0, 403);
+    assert_eq!(
+        post(port, "save_role", owner, json!({"unexpected":1})).0,
+        403
+    );
+    assert_eq!(get(port, "current_permissions", owner).1["data"], json!([]));
+    let bootstrap = execute(
+        binary,
+        "dever.auth.owner",
+        r#"{"site":"admin","user_id":1}"#,
+    );
+    assert!(
+        bootstrap.status.success(),
+        "{}",
+        String::from_utf8_lossy(&bootstrap.stderr)
+    );
+    assert_eq!(get(port, "protected_me", owner).0, 200);
+    assert_eq!(get(port, "protected_me?unexpected=1", owner).0, 400);
+    assert_eq!(get(port, "is_owner?user_id=1", owner).1["data"], true);
+    let directory = get(port, "permissions", owner).1["data"]
+        .as_array()
+        .unwrap()
+        .clone();
+    assert!(
+        directory
+            .iter()
+            .any(|entry| entry["key"] == "demo.account.admin.protected_me")
+    );
+    assert!(
+        !directory
+            .iter()
+            .any(|entry| entry["key"] == "demo.account.admin.me")
+    );
+    assert_eq!(
+        get(port, "current_permissions", owner).1["data"],
+        json!(directory)
+    );
+    for (action, input) in [
+        ("delete_role", json!({"role_id":"owner"})),
+        ("disable_role", json!({"role_id":"owner"})),
+        ("revoke_role", json!({"role_id":"owner","user_id":1})),
+        ("grant_role", json!({"role_id":"owner","user_id":2})),
+        (
+            "save_role",
+            json!({"id":"owner","name":"changed","all_permissions":false,"permission_keys":[]}),
+        ),
+    ] {
+        assert_eq!(post(port, action, owner, input).0, 403, "{action}");
+    }
+    let seeded = execute(
+        binary,
+        "demo.account.seed",
+        r#"{"subject":"reader","session":"reader-session"}"#,
+    );
+    assert!(seeded.status.success());
+    let reader = format!(
+        "Authorization: Bearer {}\r\n",
+        token("reader", "reader-session")
+    );
+    assert_eq!(get(port, "protected_me", &reader).0, 403);
+    let role = json!({"id":"reader","name":"Reader","all_permissions":false,"permission_keys":["demo.account.admin.protected_me"]});
+    assert_eq!(post(port, "save_role", owner, role.clone()).0, 200);
+    assert_eq!(
+        post(
+            port,
+            "grant_role",
+            owner,
+            json!({"user_id":2,"role_id":"reader"})
+        )
+        .0,
+        200
+    );
+    assert_eq!(get(port, "protected_me", &reader).0, 200);
+    assert_eq!(
+        get(port, "user_roles?user_id=2", &reader).1["data"][0]["permission_keys"],
+        json!(["demo.account.admin.protected_me"])
+    );
+    assert_eq!(get(port, "is_owner?user_id=2", &reader).1["data"], false);
+    assert_eq!(post(port, "save_role", &reader, role.clone()).0, 403);
+    let mut invalid = role.clone();
+    invalid["permission_keys"] = json!(["demo.account.admin.unknown"]);
+    assert_eq!(post(port, "save_role", owner, invalid).0, 400);
+    assert_eq!(get(port, "protected_me", &reader).0, 200);
+    assert_eq!(
+        post(port, "role_fail", owner, json!({"id":"rolled_back"})).0,
+        409
+    );
+    assert!(get(port, "role?id=rolled_back", owner).1["data"].is_null());
+    assert_eq!(
+        post(port, "disable_role", owner, json!({"role_id":"reader"})).0,
+        200
+    );
+    assert_eq!(get(port, "protected_me", &reader).0, 403);
+    assert_eq!(
+        get(port, "role?id=reader", owner).1["data"]["enabled"],
+        false
+    );
+    assert_eq!(post(port, "save_role", owner, role).0, 200);
+    assert_eq!(get(port, "protected_me", &reader).0, 200);
+    assert_eq!(
+        post(
+            port,
+            "revoke_role",
+            owner,
+            json!({"user_id":2,"role_id":"reader"})
+        )
+        .0,
+        200
+    );
+    assert_eq!(get(port, "protected_me", &reader).0, 403);
+    assert_eq!(
+        post(
+            port,
+            "grant_role",
+            owner,
+            json!({"user_id":2,"role_id":"reader"})
+        )
+        .0,
+        200
+    );
+    assert_eq!(
+        post(port, "delete_role", owner, json!({"role_id":"reader"})).0,
+        200
+    );
+    assert_eq!(
+        get(port, "user_roles?user_id=2", owner).1["data"],
+        json!([])
+    );
+    assert_eq!(get(port, "protected_me", &reader).0, 403);
+}