Move rules.Verify to auth.VerifyAccess

2020-07-19 13:12:03 +01:00
parent 1838e4a1ee
commit 6920677f1e
4 changed files with 97 additions and 103 deletions
--- a/auth/rules_test.go
+++ b/auth/rules_test.go
@@ -0,0 +1,288 @@
+package auth
+
+import (
+	"testing"
+)
+
+func TestVerify(t *testing.T) {
+	srvResource := &Resource{
+		Type:     "service",
+		Name:     "go.micro.service.foo",
+		Endpoint: "Foo.Bar",
+	}
+
+	webResource := &Resource{
+		Type:     "service",
+		Name:     "go.micro.web.foo",
+		Endpoint: "/foo/bar",
+	}
+
+	catchallResource := &Resource{
+		Type:     "*",
+		Name:     "*",
+		Endpoint: "*",
+	}
+
+	tt := []struct {
+		Name     string
+		Rules    []*Rule
+		Account  *Account
+		Resource *Resource
+		Error    error
+	}{
+		{
+			Name:     "NoRules",
+			Rules:    []*Rule{},
+			Account:  nil,
+			Resource: srvResource,
+			Error:    ErrForbidden,
+		},
+		{
+			Name:     "CatchallPublicAccount",
+			Account:  &Account{},
+			Resource: srvResource,
+			Rules: []*Rule{
+				&Rule{
+					Scope:    "",
+					Resource: catchallResource,
+				},
+			},
+		},
+		{
+			Name:     "CatchallPublicNoAccount",
+			Resource: srvResource,
+			Rules: []*Rule{
+				&Rule{
+					Scope:    "",
+					Resource: catchallResource,
+				},
+			},
+		},
+		{
+			Name:     "CatchallPrivateAccount",
+			Account:  &Account{},
+			Resource: srvResource,
+			Rules: []*Rule{
+				&Rule{
+					Scope:    "*",
+					Resource: catchallResource,
+				},
+			},
+		},
+		{
+			Name:     "CatchallPrivateNoAccount",
+			Resource: srvResource,
+			Rules: []*Rule{
+				&Rule{
+					Scope:    "*",
+					Resource: catchallResource,
+				},
+			},
+			Error: ErrForbidden,
+		},
+		{
+			Name:     "CatchallServiceRuleMatch",
+			Resource: srvResource,
+			Account:  &Account{},
+			Rules: []*Rule{
+				&Rule{
+					Scope: "*",
+					Resource: &Resource{
+						Type:     srvResource.Type,
+						Name:     srvResource.Name,
+						Endpoint: "*",
+					},
+				},
+			},
+		},
+		{
+			Name:     "CatchallServiceRuleNoMatch",
+			Resource: srvResource,
+			Account:  &Account{},
+			Rules: []*Rule{
+				&Rule{
+					Scope: "*",
+					Resource: &Resource{
+						Type:     srvResource.Type,
+						Name:     "wrongname",
+						Endpoint: "*",
+					},
+				},
+			},
+			Error: ErrForbidden,
+		},
+		{
+			Name:     "ExactRuleValidScope",
+			Resource: srvResource,
+			Account: &Account{
+				Scopes: []string{"neededscope"},
+			},
+			Rules: []*Rule{
+				&Rule{
+					Scope:    "neededscope",
+					Resource: srvResource,
+				},
+			},
+		},
+		{
+			Name:     "ExactRuleInvalidScope",
+			Resource: srvResource,
+			Account: &Account{
+				Scopes: []string{"neededscope"},
+			},
+			Rules: []*Rule{
+				&Rule{
+					Scope:    "invalidscope",
+					Resource: srvResource,
+				},
+			},
+			Error: ErrForbidden,
+		},
+		{
+			Name:     "CatchallDenyWithAccount",
+			Resource: srvResource,
+			Account:  &Account{},
+			Rules: []*Rule{
+				&Rule{
+					Scope:    "*",
+					Resource: catchallResource,
+					Access:   AccessDenied,
+				},
+			},
+			Error: ErrForbidden,
+		},
+		{
+			Name:     "CatchallDenyWithNoAccount",
+			Resource: srvResource,
+			Account:  &Account{},
+			Rules: []*Rule{
+				&Rule{
+					Scope:    "*",
+					Resource: catchallResource,
+					Access:   AccessDenied,
+				},
+			},
+			Error: ErrForbidden,
+		},
+		{
+			Name:     "RulePriorityGrantFirst",
+			Resource: srvResource,
+			Account:  &Account{},
+			Rules: []*Rule{
+				&Rule{
+					Scope:    "*",
+					Resource: catchallResource,
+					Access:   AccessGranted,
+					Priority: 1,
+				},
+				&Rule{
+					Scope:    "*",
+					Resource: catchallResource,
+					Access:   AccessDenied,
+					Priority: 0,
+				},
+			},
+		},
+		{
+			Name:     "RulePriorityDenyFirst",
+			Resource: srvResource,
+			Account:  &Account{},
+			Rules: []*Rule{
+				&Rule{
+					Scope:    "*",
+					Resource: catchallResource,
+					Access:   AccessGranted,
+					Priority: 0,
+				},
+				&Rule{
+					Scope:    "*",
+					Resource: catchallResource,
+					Access:   AccessDenied,
+					Priority: 1,
+				},
+			},
+			Error: ErrForbidden,
+		},
+		{
+			Name:     "WebExactEndpointValid",
+			Resource: webResource,
+			Account:  &Account{},
+			Rules: []*Rule{
+				&Rule{
+					Scope:    "*",
+					Resource: webResource,
+				},
+			},
+		},
+		{
+			Name:     "WebExactEndpointInalid",
+			Resource: webResource,
+			Account:  &Account{},
+			Rules: []*Rule{
+				&Rule{
+					Scope: "*",
+					Resource: &Resource{
+						Type:     webResource.Type,
+						Name:     webResource.Name,
+						Endpoint: "invalidendpoint",
+					},
+				},
+			},
+			Error: ErrForbidden,
+		},
+		{
+			Name:     "WebWildcardEndpoint",
+			Resource: webResource,
+			Account:  &Account{},
+			Rules: []*Rule{
+				&Rule{
+					Scope: "*",
+					Resource: &Resource{
+						Type:     webResource.Type,
+						Name:     webResource.Name,
+						Endpoint: "*",
+					},
+				},
+			},
+		},
+		{
+			Name:     "WebWildcardPathEndpointValid",
+			Resource: webResource,
+			Account:  &Account{},
+			Rules: []*Rule{
+				&Rule{
+					Scope: "*",
+					Resource: &Resource{
+						Type:     webResource.Type,
+						Name:     webResource.Name,
+						Endpoint: "/foo/*",
+					},
+				},
+			},
+		},
+		{
+			Name:     "WebWildcardPathEndpointInvalid",
+			Resource: webResource,
+			Account:  &Account{},
+			Rules: []*Rule{
+				&Rule{
+					Scope: "*",
+					Resource: &Resource{
+						Type:     webResource.Type,
+						Name:     webResource.Name,
+						Endpoint: "/bar/*",
+					},
+				},
+			},
+			Error: ErrForbidden,
+		},
+	}
+
+	for _, tc := range tt {
+		t.Run(tc.Name, func(t *testing.T) {
+			if err := VerifyAccess(tc.Rules, tc.Account, tc.Resource); err != tc.Error {
+				t.Errorf("Expected %v but got %v", tc.Error, err)
+			}
+		})
+	}
+}