core/test/rust/native/application/auth/roles.rs

use super::{execute, request, token};
use serde_json::{Value, json};
use std::path::Path;

fn get(port: u16, action: &str, credentials: &str) -> (u16, Value) {
    let (status, body) = request(
        port,
        "GET",
        &format!("/demo/account/admin/roles/{action}"),
        "fixture.test",
        credentials,
        "",
    );
    (status, serde_json::from_str(&body).unwrap())
}

fn post(port: u16, action: &str, credentials: &str, input: Value) -> (u16, Value) {
    let (status, body) = request(
        port,
        "POST",
        &format!("/demo/account/admin/roles/{action}"),
        "fixture.test",
        &format!("{credentials}Content-Type: application/json\r\n"),
        &input.to_string(),
    );
    (status, serde_json::from_str(&body).unwrap())
}

pub(super) fn check(binary: &Path, port: u16, owner: &str) {
    assert_eq!(get(port, "protected_me?unexpected=1", owner).0, 403);
    assert_eq!(
        post(port, "save_role", owner, json!({"unexpected":1})).0,
        403
    );
    assert_eq!(get(port, "current_permissions", owner).1["data"], json!([]));
    let bootstrap = execute(
        binary,
        "dever.auth.owner",
        r#"{"site":"admin","user_id":1}"#,
    );
    assert!(
        bootstrap.status.success(),
        "{}",
        String::from_utf8_lossy(&bootstrap.stderr)
    );
    assert_eq!(get(port, "protected_me", owner).0, 200);
    assert_eq!(get(port, "protected_me?unexpected=1", owner).0, 400);
    assert_eq!(get(port, "is_owner?user_id=1", owner).1["data"], true);
    let directory = get(port, "permissions", owner).1["data"]
        .as_array()
        .unwrap()
        .clone();
    assert!(
        directory
            .iter()
            .any(|entry| entry["key"] == "demo.account.admin.protected_me")
    );
    assert!(
        !directory
            .iter()
            .any(|entry| entry["key"] == "demo.account.admin.me")
    );
    assert_eq!(
        get(port, "current_permissions", owner).1["data"],
        json!(directory)
    );
    for (action, input) in [
        ("delete_role", json!({"role_id":"owner"})),
        ("disable_role", json!({"role_id":"owner"})),
        ("revoke_role", json!({"role_id":"owner","user_id":1})),
        ("grant_role", json!({"role_id":"owner","user_id":2})),
        (
            "save_role",
            json!({"id":"owner","name":"changed","all_permissions":false,"permission_keys":[]}),
        ),
    ] {
        assert_eq!(post(port, action, owner, input).0, 403, "{action}");
    }
    let seeded = execute(
        binary,
        "demo.account.seed",
        r#"{"subject":"reader","session":"reader-session"}"#,
    );
    assert!(seeded.status.success());
    let reader = format!(
        "Authorization: Bearer {}\r\n",
        token("reader", "reader-session")
    );
    assert_eq!(get(port, "protected_me", &reader).0, 403);
    let role = json!({"id":"reader","name":"Reader","all_permissions":false,"permission_keys":["demo.account.admin.protected_me"]});
    assert_eq!(post(port, "save_role", owner, role.clone()).0, 200);
    assert_eq!(
        post(
            port,
            "grant_role",
            owner,
            json!({"user_id":2,"role_id":"reader"})
        )
        .0,
        200
    );
    assert_eq!(get(port, "protected_me", &reader).0, 200);
    assert_eq!(
        get(port, "user_roles?user_id=2", &reader).1["data"][0]["permission_keys"],
        json!(["demo.account.admin.protected_me"])
    );
    assert_eq!(get(port, "is_owner?user_id=2", &reader).1["data"], false);
    assert_eq!(post(port, "save_role", &reader, role.clone()).0, 403);
    let mut invalid = role.clone();
    invalid["permission_keys"] = json!(["demo.account.admin.unknown"]);
    assert_eq!(post(port, "save_role", owner, invalid).0, 400);
    assert_eq!(get(port, "protected_me", &reader).0, 200);
    assert_eq!(
        post(port, "role_fail", owner, json!({"id":"rolled_back"})).0,
        409
    );
    assert!(get(port, "role?id=rolled_back", owner).1["data"].is_null());
    assert_eq!(
        post(port, "disable_role", owner, json!({"role_id":"reader"})).0,
        200
    );
    assert_eq!(get(port, "protected_me", &reader).0, 403);
    assert_eq!(
        get(port, "role?id=reader", owner).1["data"]["enabled"],
        false
    );
    assert_eq!(post(port, "save_role", owner, role).0, 200);
    assert_eq!(get(port, "protected_me", &reader).0, 200);
    assert_eq!(
        post(
            port,
            "revoke_role",
            owner,
            json!({"user_id":2,"role_id":"reader"})
        )
        .0,
        200
    );
    assert_eq!(get(port, "protected_me", &reader).0, 403);
    assert_eq!(
        post(
            port,
            "grant_role",
            owner,
            json!({"user_id":2,"role_id":"reader"})
        )
        .0,
        200
    );
    assert_eq!(
        post(port, "delete_role", owner, json!({"role_id":"reader"})).0,
        200
    );
    assert_eq!(
        get(port, "user_roles?user_id=2", owner).1["data"],
        json!([])
    );
    assert_eq!(get(port, "protected_me", &reader).0, 403);
}