Initial Dever 0.0.1

test/rust/runtime/authorization/mutations.rs

@@ -0,0 +1,89 @@
+use super::*;
+
+#[test]
+fn capability_directory_includes_permissions_beyond_the_model_page_limit() {
+    let fixture = Fixture::new();
+    let post = request("POST");
+    Runtime::new(Default::default())
+        .unwrap()
+        .run(async |scope| {
+            let database = fixture.database(scope, "pages", true).await;
+            let mut executor = database.executor().await.unwrap();
+            crate::authorization::owner(&mut executor, scope, "admin", 7)
+                .await
+                .unwrap();
+            let mut tenant = Tenant {
+                executor: &mut executor,
+                id: 1,
+            };
+            let context = fixture.context(&post, "admin", Some(1), Some(("news", "article")));
+            for value in 1u128..=101 {
+                register_capability(&mut tenant, scope, &context, value.to_be_bytes())
+                    .await
+                    .unwrap();
+            }
+            for current in [false, true] {
+                let entries = capabilities(&mut tenant, scope, &context, current)
+                    .await
+                    .unwrap();
+                assert_eq!(entries.len(), 101);
+                assert!(entries.windows(2).all(|pair| pair[0].key < pair[1].key));
+            }
+        })
+        .unwrap();
+}
+
+#[test]
+fn removal_is_atomic_clears_all_grants_and_reregistration_does_not_restore_them() {
+    let fixture = Fixture::new();
+    let post = request("POST");
+    Runtime::new(Default::default()).unwrap().run(async |scope| {
+        let database = fixture.database(scope, "removal", true).await;
+        let mut executor = database.executor().await.unwrap();
+        let mut tenant = Tenant { executor: &mut executor, id: 1 };
+        let context = fixture.context(&post, "admin", Some(1), Some(("news", "article")));
+        register_capability(&mut tenant, scope, &context, ID).await.unwrap();
+        tenant.executor.initialize(scope, "INSERT INTO _dever_role VALUES ('admin','reader','Reader',0,1,0),('admin','second','Second',0,1,0); INSERT INTO _dever_user_role VALUES ('admin',7,'reader');").await.unwrap();
+        for role in ["reader", "second"] {
+            tenant.executor.execute(scope, "INSERT INTO _dever_role_permission VALUES ('admin',$1,$2)", vec![Parameter::Text(role.into()), Parameter::Text(KEY.into())]).await.unwrap();
+        }
+        assert_eq!(capabilities(&mut tenant, scope, &context, true).await.unwrap().len(), 1);
+        let owner = tenant.executor.begin(scope).await.unwrap();
+        remove_capability(&mut tenant, scope, &context, ID).await.unwrap();
+        assert!(capabilities(&mut tenant, scope, &context, true).await.unwrap().is_empty());
+        tenant.executor.finish(scope, owner, false).await.unwrap();
+        assert_eq!(capabilities(&mut tenant, scope, &context, true).await.unwrap().len(), 1);
+        remove_capability(&mut tenant, scope, &context, ID).await.unwrap();
+        remove_capability(&mut tenant, scope, &context, ID).await.unwrap();
+        let counts = tenant.executor.query(scope, "SELECT COUNT(*) FROM _dever_role_permission", vec![], 1, |row| row.get::<_, i64>(0)).await.unwrap();
+        assert_eq!(counts, [0]);
+        register_capability(&mut tenant, scope, &context, ID).await.unwrap();
+        assert!(capabilities(&mut tenant, scope, &context, true).await.unwrap().is_empty());
+        assert_eq!(capabilities(&mut tenant, scope, &context, false).await.unwrap().len(), 1);
+    }).unwrap();
+}
+
+#[test]
+fn registration_and_models_share_rollback_and_failed_removal_keeps_the_catalog_active() {
+    let fixture = Fixture::new();
+    let post = request("POST");
+    Runtime::new(Default::default()).unwrap().run(async |scope| {
+        let database = fixture.database(scope, "rollback", true).await;
+        let mut executor = database.executor().await.unwrap();
+        executor.initialize(scope, "CREATE TABLE article(id BIGINT PRIMARY KEY);").await.unwrap();
+        let mut tenant = Tenant { executor: &mut executor, id: 1 };
+        let context = fixture.context(&post, "admin", Some(1), Some(("news", "article")));
+        let owner = tenant.executor.begin(scope).await.unwrap();
+        tenant.executor.execute(scope, "INSERT INTO article VALUES (1)", vec![]).await.unwrap();
+        register_capability(&mut tenant, scope, &context, ID).await.unwrap();
+        tenant.executor.finish(scope, owner, false).await.unwrap();
+        assert!(capabilities(&mut tenant, scope, &context, false).await.unwrap().is_empty());
+        assert_eq!(tenant.executor.query(scope, "SELECT COUNT(*) FROM article", vec![], 1, |row| row.get::<_, i64>(0)).await.unwrap(), [0]);
+        register_capability(&mut tenant, scope, &context, ID).await.unwrap();
+        tenant.executor.initialize(scope, "CREATE TRIGGER reject_removal BEFORE DELETE ON _dever_role_permission BEGIN SELECT RAISE(ABORT, 'test-only failure'); END; INSERT INTO _dever_role VALUES ('admin','reader','Reader',0,1,0);").await.unwrap();
+        tenant.executor.execute(scope, "INSERT INTO _dever_role_permission VALUES ('admin','reader',$1)", vec![Parameter::Text(KEY.into())]).await.unwrap();
+        assert!(matches!(remove_capability(&mut tenant, scope, &context, ID).await, Err(Failure::Database(_))));
+        assert_eq!(capabilities(&mut tenant, scope, &context, false).await.unwrap().len(), 1);
+        assert_eq!(tenant.executor.query(scope, "SELECT COUNT(*) FROM _dever_role_permission", vec![], 1, |row| row.get::<_, i64>(0)).await.unwrap(), [1]);
+    }).unwrap();
+}