68 lines
2.8 KiB
Rust
68 lines
2.8 KiB
Rust
use super::{database::ERROR, package::packages};
|
|
use dever::{compiler::model::Program, syntax::diagnostic::Diagnostic};
|
|
|
|
#[path = "../authorization/mod.rs"]
|
|
mod capability;
|
|
mod effects;
|
|
mod request;
|
|
mod rest;
|
|
|
|
const APP: &str = "type Identity { id: Text\nuser_id: model.id?\ntenant_id: model.id? }\nverify(claims: dever.auth.Claims) (identity: Identity) { account = model.first({ where = subject == claims.subject and session == claims.session })\nidentity = identity(account) }\nidentity(account: model.Account) (identity: Identity) { identity = Identity { id = account.subject, user_id = account.id, tenant_id = null } }\nidentity(account: null) (identity: Identity) { fail(dever.api.Error.Unauthorized) }\nhealth() (value: Bool) { value = true }";
|
|
|
|
fn checked(model: &str, app: &str) -> Result<Program, Diagnostic> {
|
|
packages(&[
|
|
("dever.database", ERROR),
|
|
("dever.api", "public type Error { error Unauthorized }"),
|
|
(
|
|
"dever.auth",
|
|
"public type Claims { subject: Text\nsession: Text\ntenant: Text?\nsite: Text }",
|
|
),
|
|
("demo.account.model", model),
|
|
("demo.account.app", app),
|
|
("demo.account.api", "public get health = app.health"),
|
|
])
|
|
}
|
|
|
|
#[test]
|
|
fn provider_identity_is_a_compiled_app_entry_with_global_reads() {
|
|
let program = checked("global type Account { subject: Text\nsession: Text }", APP).unwrap();
|
|
let verifier = &program.verifiers[0];
|
|
assert_eq!(verifier.name, "demo.account.verify");
|
|
assert!(program.models[0].global);
|
|
assert!(program.entries().any(|entry| entry == verifier.function));
|
|
assert!(program.api_snapshot().contains("global=true"));
|
|
assert_eq!(
|
|
checked("type Account { subject: Text\nsession: Text }", APP)
|
|
.unwrap_err()
|
|
.code,
|
|
"C014"
|
|
);
|
|
assert_eq!(
|
|
packages(&[("main", "global type Value { number: Int }")])
|
|
.unwrap_err()
|
|
.code,
|
|
"C006"
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn provider_cannot_write_or_replace_nominal_identity_with_permissions() {
|
|
let model = "global type Account { subject: Text\nsession: Text }";
|
|
let writing = APP.replace(
|
|
"model.first({ where = subject == claims.subject and session == claims.session })",
|
|
"model.create({ subject = claims.subject, session = claims.session })",
|
|
);
|
|
assert_eq!(checked(model, &writing).unwrap_err().code, "C014");
|
|
let invalid = APP
|
|
.replace("user_id: model.id?", "user_id: Int?")
|
|
.replace("user_id = account.id", "user_id = 1");
|
|
assert_eq!(checked(model, &invalid).unwrap_err().code, "C005");
|
|
let invalid = APP
|
|
.replace(
|
|
"tenant_id: model.id?",
|
|
"tenant_id: model.id?\npermissions: List<Text>",
|
|
)
|
|
.replace("tenant_id = null", "tenant_id = null, permissions = []");
|
|
assert_eq!(checked(model, &invalid).unwrap_err().code, "C005");
|
|
}
|