70 lines
3.5 KiB
Rust
70 lines
3.5 KiB
Rust
use super::request::{configured, request};
|
|
use dever_runtime::{
|
|
auth::{Error, Identity},
|
|
authorization::{self, Failure},
|
|
database::{Context as DatabaseContext, Registry, Sql},
|
|
task::Runtime,
|
|
};
|
|
|
|
struct Directory(std::path::PathBuf);
|
|
impl Drop for Directory {
|
|
fn drop(&mut self) {
|
|
std::fs::remove_dir_all(&self.0).unwrap();
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn entry_namespace_requires_role_authorization_and_ignores_request_coordinates() {
|
|
let service = configured(Some("https://unit.test"), "user.account.verify").unwrap();
|
|
let cookie = super::request::cookie(&service);
|
|
let request = request(
|
|
"POST",
|
|
&[
|
|
("Host", "unit.test"),
|
|
("Origin", "https://unit.test"),
|
|
("Cookie", &cookie),
|
|
("X-Component", "forged"),
|
|
("X-Domain", "forged"),
|
|
],
|
|
);
|
|
let (mut context, _) = service.prepare("admin", &request, false, 100).unwrap();
|
|
assert_eq!(context.entry_namespace().unwrap_err(), Error::Forbidden);
|
|
context
|
|
.establish(Identity {
|
|
id: "user".into(),
|
|
user_id: Some(7),
|
|
tenant_id: None,
|
|
})
|
|
.unwrap();
|
|
assert_eq!(context.entry_namespace().unwrap_err(), Error::Forbidden);
|
|
|
|
let unique = std::time::SystemTime::now()
|
|
.duration_since(std::time::UNIX_EPOCH)
|
|
.unwrap()
|
|
.as_nanos();
|
|
let name = format!("dever-entry-{}-{unique}", std::process::id());
|
|
let executable = std::env::current_exe().unwrap();
|
|
let directory = Directory(executable.parent().unwrap().join(&name));
|
|
std::fs::create_dir(&directory.0).unwrap();
|
|
let settings = directory.0.join("setting.json");
|
|
std::fs::write(&settings, serde_json::json!({"database":{"default":{"type":"sqlite","path":format!("{name}/entry.db"),"max_connections":1}}}).to_string()).unwrap();
|
|
Runtime::new(Default::default()).unwrap().run(async |scope| {
|
|
let registry = Registry::load(&settings, &authorization::schema::BINDINGS, scope).await.unwrap();
|
|
let mut database = DatabaseContext::new(registry);
|
|
let executor = database.on(1, scope).await.unwrap();
|
|
executor.execute(scope, Sql::same("INSERT INTO _dever_permission(key,component,domain,site,action,method,kind,active) VALUES ('news.article.admin.create','news','article','admin','create','POST','http',1)"), vec![]).await.unwrap();
|
|
assert!(matches!(authorization::authorize_entry(&mut database, 1, scope, &mut context, "news", "article", "create").await, Err(Failure::Access(403))));
|
|
assert_eq!(context.entry_namespace().unwrap_err(), Error::Forbidden);
|
|
authorization::owner(database.on(1, scope).await.unwrap(), scope, "admin", 7).await.unwrap();
|
|
let transaction = database.enter();
|
|
authorization::authorize_entry(&mut database, 1, scope, &mut context, "news", "article", "create").await.unwrap();
|
|
assert_eq!(authorization::permissions(&mut database, 1, scope, &context, true).await.unwrap().len(), 1);
|
|
database.finish(scope, transaction, true).await.unwrap();
|
|
assert_eq!(context.entry_namespace().unwrap(), ("news", "article"));
|
|
assert_eq!(context.site(), "admin");
|
|
database.on(1, scope).await.unwrap().execute(scope, "UPDATE _dever_permission SET active=0", vec![]).await.unwrap();
|
|
assert!(authorization::permissions(&mut database, 1, scope, &context, true).await.unwrap().is_empty());
|
|
assert!(matches!(authorization::authorize_key(&mut database, 1, scope, &context, "news.article.admin.create").await, Err(Failure::Access(403))));
|
|
}).unwrap();
|
|
}
|