Janady13/missionmatch / internal/platform/security/sensitivity_test.go

Source identity

Field	Recorded value
Source type	GitHub source
Original record	Janady13/missionmatch / internal/platform/security/sensitivity_test.go
Date	Not specified in source
Repository	Janady13/missionmatch
Revision	720d47fae476b0d38477ae4401697d372b1ea2bc
Branch	feature/opportunity-to-outcome
Path or archive member	internal/platform/security/sensitivity_test.go
Original SHA-256	d88861fc04201f70dabd9430cf8337e4f257be30832f70df569614faf4e4424b
Git blob SHA	e9ede795a9a1bbb548626b5c383696afe4d7e0be
Reading-copy SHA-256	d88861fc04201f70dabd9430cf8337e4f257be30832f70df569614faf4e4424b

Original source ↗

Recovered source transcript

Download complete source text ↓108 lines · 4.3 KB

package security

import "testing"

// The table is written as "who SHOULD see this", role by role, rather than as a loop over ranks, because a
// loop over ranks would pass even if the ranks themselves were wrong. These are the answers a customer would
// give if you read the setting name out loud to them.
func TestCanSeeFieldMatrix(t *testing.T) {
	cases := []struct {
		level Sensitivity
		allow []Role
		deny  []Role
	}{
		{SensitivityOwner,
			[]Role{RoleOwner},
			[]Role{RoleAdmin, RoleManager, RoleRecruiter, RoleMember, RoleViewer}},
		{SensitivityManagers,
			[]Role{RoleOwner, RoleAdmin, RoleManager},
			[]Role{RoleRecruiter, RoleMember, RoleViewer}},
		{SensitivityTeam,
			[]Role{RoleOwner, RoleAdmin, RoleManager, RoleRecruiter},
			[]Role{RoleMember, RoleViewer}},
		{SensitivityOrganization,
			[]Role{RoleOwner, RoleAdmin, RoleManager, RoleRecruiter, RoleMember, RoleViewer},
			nil},
	}
	for _, c := range cases {
		for _, r := range c.allow {
			if !CanSeeField(r, c.level) {
				t.Errorf("%s should see a %s field and cannot", r, c.level)
			}
		}
		for _, r := range c.deny {
			if CanSeeField(r, c.level) {
				t.Errorf("%s must NOT see a %s field and can", r, c.level)
			}
		}
	}
}

// The load bearing test. Every one of these inputs is a way the system can be wrong in production, and every
// one of them must hide the field rather than reveal it. An empty Sensitivity is the case that matters most:
// it is what a nil column, a missing row, or a struct nobody populated actually produces.
func TestCanSeeFieldFailsClosed(t *testing.T) {
	for _, bad := range []Sensitivity{"", "everyone", "public", "ORGANIZATION", "Managers", "all"} {
		if CanSeeField(RoleOwner, bad) {
			t.Errorf("unrecognised sensitivity %q granted access, it must deny", bad)
		}
	}
	if CanSeeField("", SensitivityOrganization) {
		t.Error("an empty role saw an organization wide field, it must deny")
	}
	if CanSeeField("superadmin", SensitivityOrganization) {
		t.Error("an unknown role saw an organization wide field, it must deny")
	}
}

func TestCanSeeOthersWork(t *testing.T) {
	// A manager sees the team's activity at EVERY level including private. Private stops recruiters watching
	// each other; it does not blind the person accountable for the desk.
	for _, v := range []WorkVisibility{VisibilityPrivate, VisibilityTeam, VisibilityOrganization} {
		for _, r := range []Role{RoleOwner, RoleAdmin, RoleManager} {
			if !CanSeeOthersWork(r, v) {
				t.Errorf("%s must see team activity at visibility %s", r, v)
			}
		}
	}
	if CanSeeOthersWork(RoleRecruiter, VisibilityPrivate) {
		t.Error("a recruiter saw another recruiter's activity under private visibility")
	}
	if !CanSeeOthersWork(RoleRecruiter, VisibilityTeam) {
		t.Error("a recruiter must see activity under team visibility, that is the double work control")
	}
	if CanSeeOthersWork(RoleViewer, VisibilityTeam) {
		t.Error("a viewer saw desk activity under team visibility")
	}
	if !CanSeeOthersWork(RoleViewer, VisibilityOrganization) {
		t.Error("a viewer must see activity under organization visibility")
	}
}

func TestCanSeeOthersWorkFailsClosed(t *testing.T) {
	// A recruiter, deliberately, not an owner: management is allowed through before the level is examined, so
	// testing with an owner would pass on the rank check and never exercise the unknown value path at all.
	for _, bad := range []WorkVisibility{"", "everyone", "ORGANIZATION", "public"} {
		if CanSeeOthersWork(RoleRecruiter, bad) {
			t.Errorf("unrecognised visibility %q granted access, it must deny", bad)
		}
	}
	if CanSeeOthersWork("ghost", VisibilityOrganization) {
		t.Error("an unknown role saw activity, it must deny")
	}
}

// Sensitivity may only ever narrow. This asserts the property directly: for every level, the set of roles
// that can see a field is a SUBSET of the roles that can read a candidate at all. If a future edit made a
// sensitivity level grant something the capability matrix withheld, this fails.
func TestSensitivityNeverWidensBeyondCapability(t *testing.T) {
	roles := []Role{RoleOwner, RoleAdmin, RoleManager, RoleRecruiter, RoleMember, RoleViewer}
	for _, level := range []Sensitivity{SensitivityOwner, SensitivityManagers, SensitivityTeam, SensitivityOrganization} {
		for _, r := range roles {
			if CanSeeField(r, level) && !Has(r, CapCandidateRead) {
				t.Errorf("%s can see a %s field but cannot read a candidate, sensitivity widened access", r, level)
			}
		}
	}
}