Janady13/missionmatch / internal/platform/security/rbac_test.go

Source identity

Field	Recorded value
Source type	GitHub source
Original record	Janady13/missionmatch / internal/platform/security/rbac_test.go
Date	Not specified in source
Repository	Janady13/missionmatch
Revision	720d47fae476b0d38477ae4401697d372b1ea2bc
Branch	feature/opportunity-to-outcome
Path or archive member	internal/platform/security/rbac_test.go
Original SHA-256	8d0685d9717b4880fd93730fcad9f4d9a9dec018636465e422d638906bad9209
Git blob SHA	0e305c352ae3998f9c6b942a54d604fe114eafeb
Reading-copy SHA-256	8d0685d9717b4880fd93730fcad9f4d9a9dec018636465e422d638906bad9209

Original source ↗

Every recorded occurrence

These 2 records contain identical original source bytes. Their paths and revisions remain part of the archive.

Original record	Branch or archive	Revision / identifier	Original location
Janady13/missionmatch / internal/platform/security/rbac_test.go	feature/opportunity-to-outcome	720d47fae476b0d38477ae4401697d372b1ea2bc	Open original
Janady13/missionmatch / internal/platform/security/rbac_test.go	feature/aioe-upgrade	2178e7298d0e5d9af83afa12402fd587f0ba6ed8	Open original

Recovered source transcript

Download complete source text ↓102 lines · 3.0 KB

package security

import "testing"

// TestOwnerHoldsEveryTenantCapability. Owner is the top of an ORGANIZATION and holds everything scoped to
// one, which is every capability except global ontology curation. Curation writes a skill graph shared by
// all tenants, so it belongs to the platform tier; an owner holding it would let one customer change what
// another customer is scored against.
func TestOwnerHoldsEveryTenantCapability(t *testing.T) {
	for cap := range capabilityRoles {
		if cap == CapCurationCurate {
			continue
		}
		if !Has(RoleOwner, cap) {
			t.Fatalf("owner missing capability %q", cap)
		}
	}
	if Has(RoleOwner, CapCurationCurate) {
		t.Error("owner holds curation.curate: a tenant owner must not rewrite the shared ontology")
	}
}

func TestCapabilityMatrix(t *testing.T) {
	cases := []struct {
		role Role
		cap  Capability
		want bool
	}{
		{RoleViewer, CapCandidateRead, true},
		{RoleViewer, CapCandidateWrite, false},
		{RoleMember, CapCandidateWrite, false},
		{RoleRecruiter, CapCandidateWrite, true},
		{RoleRecruiter, CapSourcingRead, true},
		{RoleRecruiter, CapPrivacyErase, false},
		{RoleAdmin, CapPrivacyErase, true},
		{RoleAdmin, CapSourcingRead, true},
		{RoleRecruiter, CapUserInvite, false},
		{RoleAdmin, CapUserInvite, true},
		{RoleAdmin, CapOrgSettings, false},
		{RoleOwner, CapOrgSettings, true},
		{RoleAdmin, CapAuditRead, true},
		{RoleMember, CapAuditRead, false},
	}
	for _, c := range cases {
		if got := Has(c.role, c.cap); got != c.want {
			t.Errorf("Has(%q, %q) = %v, want %v", c.role, c.cap, got, c.want)
		}
	}
}

func TestAtLeast(t *testing.T) {
	cases := []struct {
		role, min Role
		want      bool
	}{
		{RoleOwner, RoleOwner, true},
		{RoleAdmin, RoleRecruiter, true},
		{RoleRecruiter, RoleAdmin, false},
		{RoleViewer, RoleMember, false},
		{RoleMember, RoleViewer, true},
		{"bogus", RoleViewer, false},
	}
	for _, c := range cases {
		if got := AtLeast(c.role, c.min); got != c.want {
			t.Errorf("AtLeast(%q, %q) = %v, want %v", c.role, c.min, got, c.want)
		}
	}
}

func TestCanInvite(t *testing.T) {
	cases := []struct {
		actor, invited Role
		want           bool
	}{
		{RoleAdmin, RoleRecruiter, true},
		{RoleAdmin, RoleMember, true},
		{RoleAdmin, RoleAdmin, false}, // cannot invite a peer
		{RoleAdmin, RoleOwner, false}, // cannot invite up
		{RoleOwner, RoleAdmin, true},  // only an owner can invite an admin
		{RoleOwner, RoleOwner, false}, // owners are provisioned, never invited
		{RoleViewer, RoleViewer, false},
		{"bogus", RoleViewer, false},
	}
	for _, c := range cases {
		if got := CanInvite(c.actor, c.invited); got != c.want {
			t.Errorf("CanInvite(%q, %q) = %v, want %v", c.actor, c.invited, got, c.want)
		}
	}
}

func TestValidRole(t *testing.T) {
	for _, r := range []Role{RoleSuperuser, RoleOwner, RoleAdmin, RoleManager, RoleRecruiter, RoleMember, RoleViewer} {
		if !ValidRole(r) {
			t.Errorf("ValidRole(%q) = false", r)
		}
	}
	// superuser is now a real tier; something outside the vocabulary still is not.
	if ValidRole("root") {
		t.Error("ValidRole(root) = true")
	}
}