DenozordecandCursor
4d83b8d673
CI / changes (push) Successful in 6s
CI / commitlint (push) Skipped
CI / openapi (push) Successful in 27s
CI / web (push) Successful in 51s
CI / go (push) Successful in 2m19s
CI / bird2 (push) Successful in 13s
CI / release (push) Successful in 4m24s
Added support for portal JWT authentication, enabling single sign-on (SSO) capabilities. Updated the application to handle JWT claims for user permissions and roles, enhancing security and access control. Refactored relevant components and API routes to accommodate the new authentication flow, ensuring a seamless user experience. Updated documentation to reflect the new authentication requirements and configurations. Co-authored-by: Cursor <[email protected]>
68 lines
1.6 KiB
Go
68 lines
1.6 KiB
Go
package store
|
|
|
|
import "testing"
|
|
|
|
func TestSeesAllOwned(t *testing.T) {
|
|
if !SeesAllOwned("apikey", false) {
|
|
t.Fatal("api keys must see all rows")
|
|
}
|
|
if !SeesAllOwned("jwt", true) {
|
|
t.Fatal("admin jwt must see all rows")
|
|
}
|
|
if SeesAllOwned("jwt", false) {
|
|
t.Fatal("non-admin jwt must not see all rows")
|
|
}
|
|
}
|
|
|
|
func TestCanAccessOwned(t *testing.T) {
|
|
if !CanAccessOwned("apikey", false, "", "someone") {
|
|
t.Fatal("api key must access any owner")
|
|
}
|
|
if !CanAccessOwned("jwt", true, "admin", "user-1") {
|
|
t.Fatal("admin jwt must access any owner")
|
|
}
|
|
if !CanAccessOwned("jwt", false, "user-1", "user-1") {
|
|
t.Fatal("owner must access their resource")
|
|
}
|
|
if CanAccessOwned("jwt", false, "user-1", "user-2") {
|
|
t.Fatal("non-owner must not access foreign resource")
|
|
}
|
|
if CanAccessOwned("jwt", false, "user-1", "") {
|
|
t.Fatal("non-admin jwt must not see legacy rows without owner")
|
|
}
|
|
}
|
|
|
|
type ownRow struct {
|
|
id string
|
|
owner string
|
|
}
|
|
|
|
func TestFilterOwned(t *testing.T) {
|
|
rows := []ownRow{
|
|
{"a", "user-1"},
|
|
{"b", "user-2"},
|
|
{"c", ""},
|
|
}
|
|
get := func(r ownRow) string { return r.owner }
|
|
|
|
got := FilterOwned(rows, get, "apikey", false, "")
|
|
if len(got) != 3 {
|
|
t.Fatalf("apikey filter: got=%d want 3", len(got))
|
|
}
|
|
|
|
got = FilterOwned(rows, get, "jwt", true, "any")
|
|
if len(got) != 3 {
|
|
t.Fatalf("admin jwt filter: got=%d want 3", len(got))
|
|
}
|
|
|
|
got = FilterOwned(rows, get, "jwt", false, "user-1")
|
|
if len(got) != 1 || got[0].id != "a" {
|
|
t.Fatalf("user-1 filter: got=%+v want [a]", got)
|
|
}
|
|
|
|
got = FilterOwned(rows, get, "jwt", false, "user-3")
|
|
if len(got) != 0 {
|
|
t.Fatalf("unknown user filter: got=%+v want []", got)
|
|
}
|
|
}
|