Source identity
| Field | Recorded value |
|---|---|
| Source type | GitHub source |
| Original record | Janady13/missionmatch / internal/platform/security/platform_gate_test.go |
| Date | Not specified in source |
| Repository | Janady13/missionmatch |
| Revision | 720d47fae476b0d38477ae4401697d372b1ea2bc |
| Branch | feature/opportunity-to-outcome |
| Path or archive member | internal/platform/security/platform_gate_test.go |
| Original SHA-256 | 604d369fd3c4affd2200a9e7bc76b09e9246bd7f5c994e255533fe361aaa0760 |
| Git blob SHA | f00e0b376e37fc8708ee7c8b694c11cb832d137a |
| Reading-copy SHA-256 | 604d369fd3c4affd2200a9e7bc76b09e9246bd7f5c994e255533fe361aaa0760 |
Recovered source transcript
Download complete source text ↓109 lines · 4.9 KB
package security
import (
"net/http"
"net/http/httptest"
"testing"
"github.com/missionworkforce/missionmatch/internal/platform/tenant"
)
// The platform plane, amendment 6 section 2 item 2 and Track U gate item 4.
//
// Two things are asserted, and the second matters as much as the first: the operator reaches a platform
// surface, and EVERY other role, tenant superuser included, receives 404 rather than 403. A 403 would
// confirm the cross tenant control plane exists, which is the exact shape of the reported defect: a
// client's top seat shown platform controls that refuse her.
func platformProbe(role string, withPrincipal bool) *httptest.ResponseRecorder {
reached := false
h := RequirePlatform()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
reached = true
w.WriteHeader(http.StatusOK)
}))
r := httptest.NewRequest(http.MethodGet, "/compliance/curation/proposals", nil)
if withPrincipal {
r = r.WithContext(tenant.WithUser(r.Context(), tenant.Principal{UserID: "u1", Role: role}))
}
w := httptest.NewRecorder()
h.ServeHTTP(w, r)
if !reached && w.Code == http.StatusOK {
panic("handler reported OK without running")
}
return w
}
func TestPlatformSurfaceIsReachableOnlyByOperator(t *testing.T) {
if got := platformProbe(string(RoleOperator), true).Code; got != http.StatusOK {
t.Fatalf("operator was refused a platform surface: got %d, want 200", got)
}
}
func TestPlatformSurfaceAnswers404ToEveryNonOperator(t *testing.T) {
// Superuser is listed first and deliberately: the whole point of amendment 6 is that the tenant top
// seat is NOT the platform plane, so if any role in this list were going to leak through it is that
// one.
for _, role := range []Role{RoleSuperuser, RoleOwner, RoleAdmin, RoleManager, RoleRecruiter, RoleMember, RoleViewer} {
w := platformProbe(string(role), true)
if w.Code != http.StatusNotFound {
t.Fatalf("%s received %d from a platform surface, want 404: a platform surface must be indistinguishable from a path that does not exist", role, w.Code)
}
}
}
func TestPlatformSurfaceFailsClosedWithNoPrincipal(t *testing.T) {
if got := platformProbe("", false).Code; got != http.StatusNotFound {
t.Fatalf("an unauthenticated request reached a platform surface with %d, want 404", got)
}
}
func TestPlatformSurfaceRejectsAnUnknownRole(t *testing.T) {
// A role value that is not in the ladder at all (a stale row, a typo in a migration) must not pass.
// Fail closed is the rule everywhere else in this package and it holds here.
if got := platformProbe("root", true).Code; got != http.StatusNotFound {
t.Fatalf("an unknown role reached a platform surface with %d, want 404", got)
}
}
// The org side of NO SILENT GREY, amendment 6 decision 13. The two reasons must be DISTINCT, because they
// have different fixes: buy the product, versus ask someone who holds it. A single shared string would be
// the silent grey with extra steps.
func TestToolDisabledReasonsAreDistinctAndOrdered(t *testing.T) {
all := OrgEntitledTools("11111111-1111-1111-1111-111111111111")
if len(all) != len(AllTools) {
t.Fatalf("org entitlement returned %d tools, want %d", len(all), len(AllTools))
}
// Organization not entitled outranks the actor's own holding: if the tenant never bought it, whether
// the actor holds it is beside the point.
if got := ToolDisabledReason(ToolRecruitMatch, []string{"missionmatch"}, []string{"recruitmatch"}); got != ReasonOrgNotEntitled {
t.Fatalf("an unentitled organization gave the wrong reason: %q", got)
}
if got := ToolDisabledReason(ToolRecruitMatch, all, []string{"missionmatch"}); got != ReasonActorLacksTool {
t.Fatalf("an actor without the tool gave the wrong reason: %q", got)
}
if got := ToolDisabledReason(ToolRecruitMatch, all, []string{"recruitmatch"}); got != "" {
t.Fatalf("an enabled control still carried a reason: %q", got)
}
if ReasonOrgNotEntitled == ReasonActorLacksTool {
t.Fatal("the two disabled reasons are the same string, so the control cannot state which applies")
}
}
// The by rule top seats, amendment 6 decision 12. The design partner's account is the fixture: role
// superuser, ZERO tool grants. Before the rule it saw nothing and every entitlement control was locked.
func TestTopSeatsHoldToolsByRuleWithNoGrants(t *testing.T) {
for _, role := range []Role{RoleOperator, RoleSuperuser} {
got := EffectiveTools(role, nil)
if len(got) != len(AllTools) {
t.Fatalf("%s with no grants resolved to %v, want all %d tools by rule", role, got, len(AllTools))
}
}
// Every role below is unchanged and still grant driven, because confer only what you hold is the
// ceiling that stops an actor widening their own access through an account they control.
for _, role := range []Role{RoleOwner, RoleAdmin, RoleManager, RoleRecruiter, RoleMember, RoleViewer} {
if got := EffectiveTools(role, nil); len(got) != 0 {
t.Fatalf("%s with no grants resolved to %v, want nothing: only the top seats hold by rule", role, got)
}
}
}