Coverage for tests/test_rbac.py: 98%
107 statements
« prev ^ index » next coverage.py v7.5.1, created at 2024-05-22 15:42 +0200
« prev ^ index » next coverage.py v7.5.1, created at 2024-05-22 15:42 +0200
1import tempfile
2import uuid
4import dotmap
5import pytest
6from pydal import DAL
8from src.edwh_auth_rbac.migrations import rbac_migrations
9from src.edwh_auth_rbac.model import define_auth_rbac_model
10from src.edwh_auth_rbac.rbac import AuthRbac
12namespace = uuid.UUID("84f5c757-4be0-49c8-a3ba-4f4d79167839")
15@pytest.fixture(scope="module")
16def tmpdir():
17 with tempfile.TemporaryDirectory() as tmpdirname:
18 print("new tempdir")
19 yield tmpdirname
22@pytest.fixture(scope="module")
23def database(tmpdir):
24 class Database:
25 def __enter__(self):
26 self.db = DAL("sqlite://auth_rbac.sqlite", folder=tmpdir)
28 settings = dict(allowed_types=["user", "group"], migrate=True)
30 define_auth_rbac_model(self.db, settings)
31 rbac_migrations(self.db)
32 return self.db
34 def __exit__(self, exc_type, exc_value, traceback):
35 self.db.close()
37 return Database()
40@pytest.fixture(scope="module")
41def rbac(database):
42 with database as db:
43 yield AuthRbac(db)
46@pytest.fixture(scope="module")
47def store(_=dotmap.DotMap()):
48 print("store", _)
49 return _
52@pytest.mark.incremental
53class TestSequentially:
54 def test_drop_all_test_users(self, database):
55 with database as db:
56 users = db(db.identity.email.contains("@test.nl")).select()
57 db(db.identity.email.contains("@test.nl")).delete()
58 for user in users:
59 db((db.membership.member_of == user.object_id) | (db.membership.subject == user.object_id)).delete()
60 db(
61 (db.permission.identity_object_id == user.object_id)
62 | (db.permission.target_object_id == user.object_id)
63 ).delete()
64 db.commit()
65 assert db(db.identity.email.contains("@test.nl")).count() == 0, "Howcome @test.nl still exist?"
67 def test_user_creation(self, rbac, store):
68 store.remco = rbac.add_user("remco@test.nl", "remco", "remco test", "secret", [])["object_id"]
69 store.pietje = rbac.add_user("pietje@test.nl", "pietje", "pietje test", "secret", [])["object_id"]
70 store.truus = rbac.add_user("truus@test.nl", "truus", "truus test", "secret", [])["object_id"]
72 def test_group_creation(self, rbac, store):
73 store.articles = rbac.add_group("articles@test.nl", "articles", [])["object_id"]
74 store.all = rbac.add_group("all@test.nl", "all", [])["object_id"]
75 store.users = rbac.add_group("users@test.nl", "users", [])["object_id"]
76 store.admins = rbac.add_group("admins@test.nl", "admins", [])["object_id"]
78 def test_item_creation(self, rbac, store):
79 for name in "abcde":
80 store[name] = rbac.add_user("article_" + name + "@test.nl", name, "article", "", [])["object_id"]
82 def test_stash_users_in_groups(self, rbac, store):
83 rbac.add_membership(store.remco, store.admins)
84 rbac.add_membership(store.pietje, store.users)
85 rbac.add_membership(store.truus, store.users)
86 rbac.add_membership(store.users, store.all)
87 rbac.add_membership(store.admins, store.all)
89 def test_stash_items_in_groups(self, rbac, store):
90 for name in "abcde":
91 rbac.add_membership(store[name], store.articles)
93 def test_add_some_permissions(self, rbac, store):
94 rbac.add_permission(store.admins, store.articles, "read")
95 rbac.add_permission(store.admins, store.articles, "write")
96 rbac.add_permission(store.users, store.articles, "read")
98 def test_first_level_memberships(self, rbac, store):
99 assert rbac.has_membership(store.remco, store.admins) is True
100 assert rbac.has_membership(store.pietje, store.users) is True
101 assert rbac.has_membership(store.remco, store.users) is False
102 assert rbac.has_membership(store.pietje, store.admins) is False
104 def test_second_level_memberships(self, rbac, store):
105 assert rbac.has_membership(store.remco, store.all) is True
106 assert rbac.has_membership(store.pietje, store.all) is True
108 def test_first_level_permissions(self, rbac, store):
109 assert rbac.has_permission(store.admins, store.articles, "read") is True
110 assert rbac.has_permission(store.admins, store.articles, "write") is True
111 assert rbac.has_permission(store.users, store.articles, "read") is True
112 assert rbac.has_permission(store.users, store.articles, "write") is False
114 def test_second_to_first_level_permissions(self, rbac, store):
115 assert rbac.has_permission(store.remco, store.articles, "read") is True
116 assert rbac.has_permission(store.remco, store.articles, "write") is True
117 assert rbac.has_permission(store.pietje, store.articles, "read") is True
118 assert rbac.has_permission(store.pietje, store.articles, "write") is False
120 def test_second_to_second_level_permissions(self, rbac, store):
121 assert rbac.has_permission(store.remco, store.a, "read") is True
122 assert rbac.has_permission(store.remco, store.a, "write") is True
123 assert rbac.has_permission(store.pietje, store.a, "read") is True
124 assert rbac.has_permission(store.pietje, store.a, "write") is False
126 def test_deeper_group_nesting(self, rbac, store):
127 store.subadmins = rbac.add_group("sub_admins@test.nl", "subadmins", [])["object_id"]
128 store.subarticles = rbac.add_group("sub_articles@test.nl", "subarticles", [])["object_id"]
129 rbac.add_membership(store.subarticles, store.articles)
130 rbac.add_membership(store.subadmins, store.admins)
131 store.nested_admin = rbac.add_user("nested_admin@test.nl", "nested_admin", "nested_admin test", "secret", [])[
132 "object_id"
133 ]
134 rbac.add_membership(store.nested_admin, store.subadmins)
135 for name in "stuvw":
136 store[name] = rbac.add_user("article_" + name + "@test.nl", name, "subarticle", "", [])["object_id"]
137 rbac.add_membership(store[name], store.subarticles)
138 assert rbac.has_permission(store.nested_admin, store.s, "read") is True
140 def test_removing_a_nested_group(self, rbac, store):
141 rbac.remove_membership(store.nested_admin, store.subadmins)
142 assert rbac.has_permission(store.nested_admin, store.s, "read") is False