Source identity
| Field | Recorded value |
|---|---|
| Source type | GitHub source |
| Original record | Janady13/missionmatch / internal/platform/orgsettings/scope_test.go |
| Date | Not specified in source |
| Repository | Janady13/missionmatch |
| Revision | 720d47fae476b0d38477ae4401697d372b1ea2bc |
| Branch | feature/opportunity-to-outcome |
| Path or archive member | internal/platform/orgsettings/scope_test.go |
| Original SHA-256 | 95d0ceea3ebc70579416627682a00936d43edbd27888a29686ad41ee53b5269a |
| Git blob SHA | 63da6da29fd682d208c966fb7bce26a57b50580b |
| Reading-copy SHA-256 | 95d0ceea3ebc70579416627682a00936d43edbd27888a29686ad41ee53b5269a |
Recovered source transcript
Download complete source text ↓126 lines · 4.3 KB
package orgsettings
import (
"strings"
"testing"
"github.com/google/uuid"
"github.com/missionworkforce/missionmatch/internal/platform/security"
)
func uid(b byte) uuid.UUID { var u uuid.UUID; u[0] = b; return u }
// An unrestricted filter must append NOTHING, so an organization on the shipped defaults runs exactly the
// query it ran before this feature existed.
func TestUnrestrictedFilterAppendsNothing(t *testing.T) {
f := Filter{Scope: security.ScopeOrganization, IncludeUnowned: true}
sql, args, err := f.SQL("owner_user_id", 3)
if err != nil || sql != "" || len(args) != 0 {
t.Errorf("an unrestricted filter must produce no predicate, got %q args=%d err=%v", sql, len(args), err)
}
if !f.Allows(nil) {
t.Error("an unrestricted filter must allow an unowned record")
}
other := uid(9)
if !f.Allows(&other) {
t.Error("an unrestricted filter must allow anybody's record")
}
}
func TestOwnScopePredicate(t *testing.T) {
me := uid(1)
f := Filter{Scope: security.ScopeOwn, OwnerIDs: []uuid.UUID{me}, IncludeUnowned: true}
sql, args, err := f.SQL("owner_user_id", 4)
if err != nil {
t.Fatalf("unexpected error: %v", err)
}
if !strings.Contains(sql, "$4") {
t.Errorf("the predicate must bind at the position the caller asked for, got %q", sql)
}
if !strings.Contains(sql, "IS NULL") {
t.Errorf("with unowned records visible the predicate must admit them, got %q", sql)
}
if len(args) != 1 {
t.Fatalf("expected one bound argument, got %d", len(args))
}
if !f.Allows(&me) {
t.Error("own scope must allow my own record")
}
other := uid(2)
if f.Allows(&other) {
t.Error("own scope must NOT allow somebody else's record")
}
if !f.Allows(nil) {
t.Error("unowned records are visible in this filter and must be allowed")
}
}
func TestUnownedExcluded(t *testing.T) {
f := Filter{Scope: security.ScopeOwn, OwnerIDs: []uuid.UUID{uid(1)}, IncludeUnowned: false}
sql, _, err := f.SQL("owner_user_id", 1)
if err != nil {
t.Fatalf("unexpected error: %v", err)
}
if strings.Contains(sql, "IS NULL") {
t.Errorf("with unowned records hidden the predicate must not admit them, got %q", sql)
}
if f.Allows(nil) {
t.Error("an unowned record must be refused when unowned records are hidden")
}
}
// THE CASE THAT MUST NOT SILENTLY SHOW EVERYTHING. An empty owner set with unowned records hidden means
// nothing is visible, and it has to say so unambiguously rather than producing a predicate that a NULL owner
// slips through.
func TestEmptyFilterShowsNothing(t *testing.T) {
f := Filter{Scope: security.ScopeOwn, OwnerIDs: nil, IncludeUnowned: false}
sql, args, err := f.SQL("owner_user_id", 1)
if err != nil {
t.Fatalf("unexpected error: %v", err)
}
if sql != "false" {
t.Errorf("an empty filter must be literally false, got %q", sql)
}
if len(args) != 0 {
t.Errorf("a false predicate needs no arguments, got %d", len(args))
}
if f.Allows(nil) || f.Allows(&[]uuid.UUID{uid(1)}[0]) {
t.Error("an empty filter must allow nothing")
}
}
// The column name is the one thing here that is not a bound parameter, so it is validated rather than
// trusted. These are the shapes an injection would take.
func TestColumnNameIsValidated(t *testing.T) {
f := Filter{Scope: security.ScopeOwn, OwnerIDs: []uuid.UUID{uid(1)}, IncludeUnowned: true}
for _, bad := range []string{
"", "owner_user_id; DROP TABLE users", "owner user id", "Owner_User_Id",
"owner_user_id)--", "*", "owner_user_id OR 1=1", "u.owner_user_id",
} {
if _, _, err := f.SQL(bad, 1); err == nil {
t.Errorf("column name %q must be refused", bad)
}
}
for _, good := range []string{"owner_user_id", "capture_owner_user_id", "assigned_to", "owner2"} {
if _, _, err := f.SQL(good, 1); err != nil {
t.Errorf("column name %q should be accepted: %v", good, err)
}
}
}
func TestTeamScopeAllowsPeers(t *testing.T) {
me, peer, stranger := uid(1), uid(2), uid(3)
f := Filter{Scope: security.ScopeTeam, OwnerIDs: []uuid.UUID{me, peer}, IncludeUnowned: true}
if !f.Allows(&me) || !f.Allows(&peer) {
t.Error("team scope must allow the caller and their peers")
}
if f.Allows(&stranger) {
t.Error("team scope must not allow somebody on no shared team")
}
sql, args, err := f.SQL("owner_user_id", 2)
if err != nil || len(args) != 1 || !strings.Contains(sql, "ANY($2)") {
t.Errorf("team predicate wrong: %q args=%d err=%v", sql, len(args), err)
}
}