Coverage for tests/test_rbac.py: 98%

107 statements  

« prev     ^ index     » next       coverage.py v7.5.1, created at 2024-05-22 15:42 +0200

1import tempfile 

2import uuid 

3 

4import dotmap 

5import pytest 

6from pydal import DAL 

7 

8from src.edwh_auth_rbac.migrations import rbac_migrations 

9from src.edwh_auth_rbac.model import define_auth_rbac_model 

10from src.edwh_auth_rbac.rbac import AuthRbac 

11 

12namespace = uuid.UUID("84f5c757-4be0-49c8-a3ba-4f4d79167839") 

13 

14 

15@pytest.fixture(scope="module") 

16def tmpdir(): 

17 with tempfile.TemporaryDirectory() as tmpdirname: 

18 print("new tempdir") 

19 yield tmpdirname 

20 

21 

22@pytest.fixture(scope="module") 

23def database(tmpdir): 

24 class Database: 

25 def __enter__(self): 

26 self.db = DAL("sqlite://auth_rbac.sqlite", folder=tmpdir) 

27 

28 settings = dict(allowed_types=["user", "group"], migrate=True) 

29 

30 define_auth_rbac_model(self.db, settings) 

31 rbac_migrations(self.db) 

32 return self.db 

33 

34 def __exit__(self, exc_type, exc_value, traceback): 

35 self.db.close() 

36 

37 return Database() 

38 

39 

40@pytest.fixture(scope="module") 

41def rbac(database): 

42 with database as db: 

43 yield AuthRbac(db) 

44 

45 

46@pytest.fixture(scope="module") 

47def store(_=dotmap.DotMap()): 

48 print("store", _) 

49 return _ 

50 

51 

52@pytest.mark.incremental 

53class TestSequentially: 

54 def test_drop_all_test_users(self, database): 

55 with database as db: 

56 users = db(db.identity.email.contains("@test.nl")).select() 

57 db(db.identity.email.contains("@test.nl")).delete() 

58 for user in users: 

59 db((db.membership.member_of == user.object_id) | (db.membership.subject == user.object_id)).delete() 

60 db( 

61 (db.permission.identity_object_id == user.object_id) 

62 | (db.permission.target_object_id == user.object_id) 

63 ).delete() 

64 db.commit() 

65 assert db(db.identity.email.contains("@test.nl")).count() == 0, "Howcome @test.nl still exist?" 

66 

67 def test_user_creation(self, rbac, store): 

68 store.remco = rbac.add_user("remco@test.nl", "remco", "remco test", "secret", [])["object_id"] 

69 store.pietje = rbac.add_user("pietje@test.nl", "pietje", "pietje test", "secret", [])["object_id"] 

70 store.truus = rbac.add_user("truus@test.nl", "truus", "truus test", "secret", [])["object_id"] 

71 

72 def test_group_creation(self, rbac, store): 

73 store.articles = rbac.add_group("articles@test.nl", "articles", [])["object_id"] 

74 store.all = rbac.add_group("all@test.nl", "all", [])["object_id"] 

75 store.users = rbac.add_group("users@test.nl", "users", [])["object_id"] 

76 store.admins = rbac.add_group("admins@test.nl", "admins", [])["object_id"] 

77 

78 def test_item_creation(self, rbac, store): 

79 for name in "abcde": 

80 store[name] = rbac.add_user("article_" + name + "@test.nl", name, "article", "", [])["object_id"] 

81 

82 def test_stash_users_in_groups(self, rbac, store): 

83 rbac.add_membership(store.remco, store.admins) 

84 rbac.add_membership(store.pietje, store.users) 

85 rbac.add_membership(store.truus, store.users) 

86 rbac.add_membership(store.users, store.all) 

87 rbac.add_membership(store.admins, store.all) 

88 

89 def test_stash_items_in_groups(self, rbac, store): 

90 for name in "abcde": 

91 rbac.add_membership(store[name], store.articles) 

92 

93 def test_add_some_permissions(self, rbac, store): 

94 rbac.add_permission(store.admins, store.articles, "read") 

95 rbac.add_permission(store.admins, store.articles, "write") 

96 rbac.add_permission(store.users, store.articles, "read") 

97 

98 def test_first_level_memberships(self, rbac, store): 

99 assert rbac.has_membership(store.remco, store.admins) is True 

100 assert rbac.has_membership(store.pietje, store.users) is True 

101 assert rbac.has_membership(store.remco, store.users) is False 

102 assert rbac.has_membership(store.pietje, store.admins) is False 

103 

104 def test_second_level_memberships(self, rbac, store): 

105 assert rbac.has_membership(store.remco, store.all) is True 

106 assert rbac.has_membership(store.pietje, store.all) is True 

107 

108 def test_first_level_permissions(self, rbac, store): 

109 assert rbac.has_permission(store.admins, store.articles, "read") is True 

110 assert rbac.has_permission(store.admins, store.articles, "write") is True 

111 assert rbac.has_permission(store.users, store.articles, "read") is True 

112 assert rbac.has_permission(store.users, store.articles, "write") is False 

113 

114 def test_second_to_first_level_permissions(self, rbac, store): 

115 assert rbac.has_permission(store.remco, store.articles, "read") is True 

116 assert rbac.has_permission(store.remco, store.articles, "write") is True 

117 assert rbac.has_permission(store.pietje, store.articles, "read") is True 

118 assert rbac.has_permission(store.pietje, store.articles, "write") is False 

119 

120 def test_second_to_second_level_permissions(self, rbac, store): 

121 assert rbac.has_permission(store.remco, store.a, "read") is True 

122 assert rbac.has_permission(store.remco, store.a, "write") is True 

123 assert rbac.has_permission(store.pietje, store.a, "read") is True 

124 assert rbac.has_permission(store.pietje, store.a, "write") is False 

125 

126 def test_deeper_group_nesting(self, rbac, store): 

127 store.subadmins = rbac.add_group("sub_admins@test.nl", "subadmins", [])["object_id"] 

128 store.subarticles = rbac.add_group("sub_articles@test.nl", "subarticles", [])["object_id"] 

129 rbac.add_membership(store.subarticles, store.articles) 

130 rbac.add_membership(store.subadmins, store.admins) 

131 store.nested_admin = rbac.add_user("nested_admin@test.nl", "nested_admin", "nested_admin test", "secret", [])[ 

132 "object_id" 

133 ] 

134 rbac.add_membership(store.nested_admin, store.subadmins) 

135 for name in "stuvw": 

136 store[name] = rbac.add_user("article_" + name + "@test.nl", name, "subarticle", "", [])["object_id"] 

137 rbac.add_membership(store[name], store.subarticles) 

138 assert rbac.has_permission(store.nested_admin, store.s, "read") is True 

139 

140 def test_removing_a_nested_group(self, rbac, store): 

141 rbac.remove_membership(store.nested_admin, store.subadmins) 

142 assert rbac.has_permission(store.nested_admin, store.s, "read") is False