Source identity
| Field | Recorded value |
|---|---|
| Source type | GitHub source |
| Original record | Janady13/missionmatch / internal/platform/security/tools_test.go |
| Date | Not specified in source |
| Repository | Janady13/missionmatch |
| Revision | 720d47fae476b0d38477ae4401697d372b1ea2bc |
| Branch | feature/opportunity-to-outcome |
| Path or archive member | internal/platform/security/tools_test.go |
| Original SHA-256 | e4d6c8e196ec3ceeeb19135a72dac56c5d70d9a43eb7ccd93e7669e2f306c124 |
| Git blob SHA | 5a9f2fd5894be9f40fa91ba748fe87bb0fb519da |
| Reading-copy SHA-256 | e4d6c8e196ec3ceeeb19135a72dac56c5d70d9a43eb7ccd93e7669e2f306c124 |
Recovered source transcript
Download complete source text ↓183 lines · 7.6 KB
package security
import (
"net/http"
"net/http/httptest"
"reflect"
"testing"
"github.com/missionworkforce/missionmatch/internal/platform/tenant"
)
// TestOnlySuperuserCanMintSuperuser is the rule the whole tier exists for. Every other role is unable to
// reproduce itself; superuser is the single exception, and nothing below it may reach the tier at all.
func TestOnlySuperuserCanMintSuperuser(t *testing.T) {
for _, actor := range []Role{RoleViewer, RoleMember, RoleRecruiter, RoleManager, RoleAdmin, RoleOwner} {
if CanGrantRole(actor, RoleSuperuser) {
t.Errorf("%s was allowed to grant superuser; only a superuser may", actor)
}
}
if !CanGrantRole(RoleSuperuser, RoleSuperuser) {
t.Error("a superuser must be able to grant superuser, or the tier cannot survive its holders")
}
}
// TestNoOtherRoleCanReproduceItself pins the separation of duties that superuser is the exception to. If
// this ever passes for admin or owner, the exception has leaked into the general rule.
func TestNoOtherRoleCanReproduceItself(t *testing.T) {
for _, r := range []Role{RoleViewer, RoleMember, RoleRecruiter, RoleManager, RoleAdmin, RoleOwner} {
if CanGrantRole(r, r) {
t.Errorf("%s may grant its own tier; only superuser may", r)
}
}
}
// TestGrantIsStrictlyDownward: the ladder holds in both directions for every pair.
func TestGrantIsStrictlyDownward(t *testing.T) {
ladder := []Role{RoleViewer, RoleMember, RoleRecruiter, RoleManager, RoleAdmin, RoleOwner, RoleSuperuser}
for i, actor := range ladder {
for j, target := range ladder {
want := i > j
if actor == RoleSuperuser && target == RoleSuperuser {
want = true // the documented exception
}
if got := CanGrantRole(actor, target); got != want {
t.Errorf("CanGrantRole(%s, %s) = %v, want %v", actor, target, got, want)
}
}
}
}
// TestOwnerCanGrantEverythingBelowButNotItsOwnTier is the concrete shape the operator asked for: an owner
// builds out the organization but cannot create a peer, and cannot reach above.
func TestOwnerCanGrantEverythingBelowButNotItsOwnTier(t *testing.T) {
for _, below := range []Role{RoleViewer, RoleMember, RoleRecruiter, RoleManager, RoleAdmin} {
if !CanGrantRole(RoleOwner, below) {
t.Errorf("owner should be able to grant %s", below)
}
}
if CanGrantRole(RoleOwner, RoleOwner) {
t.Error("owner must not mint another owner")
}
if CanGrantRole(RoleOwner, RoleSuperuser) {
t.Error("owner must not reach above itself")
}
}
// TestSuperuserHoldsEveryTenantCapability. Amendment 6 narrowed superuser's by rule grant to WITHIN ITS
// TENANT, so it holds every capability except the platform ones, which moved behind operator. Operator is
// asserted here too, because the tier that holds everything everywhere is the one whose gaps cost most.
func TestSuperuserHoldsEveryTenantCapability(t *testing.T) {
for cap := range capabilityRoles {
if platformCapabilities[cap] {
if Has(RoleSuperuser, cap) {
t.Errorf("superuser holds the PLATFORM capability %s, which is not tenant scoped", cap)
}
if !Has(RoleOperator, cap) {
t.Errorf("operator does not hold the platform capability %s", cap)
}
continue
}
if !Has(RoleSuperuser, cap) {
t.Errorf("superuser does not hold the tenant capability %s", cap)
}
if !Has(RoleOperator, cap) {
t.Errorf("operator does not hold %s", cap)
}
}
if got, want := len(CapabilitiesOf(RoleSuperuser)), len(capabilityRoles)-len(platformCapabilities); got != want {
t.Errorf("CapabilitiesOf(superuser) returned %d capabilities, want the %d tenant scoped ones", got, want)
}
if got, want := len(CapabilitiesOf(RoleOperator)), len(capabilityRoles); got != want {
t.Errorf("CapabilitiesOf(operator) returned %d capabilities, want all %d", got, want)
}
// A capability must still be a real one; the blanket grant is not a wildcard for nonsense.
if Has(RoleSuperuser, Capability("")) {
t.Error("superuser holds the empty capability")
}
}
// TestCanGrantToolsRequiresOutrankingAndPossession is the two part rule. The second part is the one that
// is easy to omit and expensive to omit: without it an admin can widen their own access through an
// account they control.
func TestCanGrantToolsRequiresOutrankingAndPossession(t *testing.T) {
adminTools := []string{"recruitmatch", "slatematch"}
if !CanGrantTools(RoleAdmin, RoleRecruiter, adminTools, []string{"recruitmatch"}) {
t.Error("an admin holding recruitmatch should be able to grant it to a recruiter")
}
// Holds two, tries to grant a third they do not have.
if CanGrantTools(RoleAdmin, RoleRecruiter, adminTools, []string{"screenmatch"}) {
t.Error("an actor granted a tool they do not hold; possession must bound what can be spread")
}
// Correct role, correct tools, but the target is a peer.
if CanGrantTools(RoleAdmin, RoleAdmin, adminTools, []string{"recruitmatch"}) {
t.Error("an actor edited a peer's tools")
}
// And a superior.
if CanGrantTools(RoleAdmin, RoleOwner, adminTools, []string{"recruitmatch"}) {
t.Error("an actor edited a superior's tools")
}
// Unknown tools are refused rather than silently dropped on a write path.
if CanGrantTools(RoleOwner, RoleAdmin, []string{"recruitmatch"}, []string{"nonexistent"}) {
t.Error("an unknown tool was accepted for a grant")
}
}
func TestToolsOfNormalizes(t *testing.T) {
got := ToolsOf([]string{"slatematch", "recruitmatch", "slatematch", "bogus", ""})
want := []string{"recruitmatch", "slatematch"}
if !reflect.DeepEqual(got, want) {
t.Fatalf("ToolsOf = %v, want %v (sorted, deduplicated, unknown values dropped)", got, want)
}
// Never nil, so the JSON is [] and a client can iterate without a null check.
if got := ToolsOf(nil); got == nil || len(got) != 0 {
t.Fatalf("ToolsOf(nil) = %v, want an empty slice", got)
}
}
// TestRequireToolGatesTheAPINotJustTheNavigation is the point of the middleware. Hiding a link is
// presentation; a bookmark, a stale tab, or reading the bundle all reach the handler directly.
func TestRequireToolGatesTheAPINotJustTheNavigation(t *testing.T) {
reached := false
inner := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { reached = true })
call := func(tools []string, present bool) int {
reached = false
req := httptest.NewRequest(http.MethodGet, "/api/recruitmatch/clients", nil)
if present {
req = req.WithContext(tenant.WithUser(req.Context(),
tenant.Principal{UserID: "u", Role: "recruiter", Tools: tools}))
}
rec := httptest.NewRecorder()
RequireTool(ToolRecruitMatch)(inner).ServeHTTP(rec, req)
return rec.Code
}
if code := call([]string{"recruitmatch"}, true); code != http.StatusOK || !reached {
t.Fatalf("entitled caller: code=%d reached=%v, want 200 and the handler reached", code, reached)
}
// Not entitled: 404 rather than 403, so an unentitled account cannot enumerate which products the
// organization has by reading status codes.
if code := call([]string{"slatematch"}, true); code != http.StatusNotFound || reached {
t.Fatalf("unentitled caller: code=%d reached=%v, want 404 and the handler NOT reached", code, reached)
}
// No principal at all fails closed the same way.
if code := call(nil, false); code != http.StatusNotFound || reached {
t.Fatalf("anonymous caller: code=%d reached=%v, want 404 and the handler NOT reached", code, reached)
}
}
// TestEmptyEntitlementSeesNothing pins the fail closed default. An account created without grants must
// see no product, because the opposite default silently exposes every product to a new account.
func TestEmptyEntitlementSeesNothing(t *testing.T) {
for _, tool := range AllTools {
if HasTool(nil, tool) {
t.Errorf("an account with no grants reached %s", tool)
}
if HasTool([]string{}, tool) {
t.Errorf("an account with an empty grant set reached %s", tool)
}
}
}