Skip to content

Commit 393ec70

Browse files
AndrienkoAleksandrAndrienkoAleksandr
committed
fix(rbac): add more unit tests
Signed-off-by: Oleksandr Andriienko <[email protected]>
1 parent 32b3854 commit 393ec70

File tree

3 files changed

+263
-4
lines changed

3 files changed

+263
-4
lines changed

‎plugins/rbac-backend/src/conditional-aliases/alias-resolver.test.ts

Lines changed: 262 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,262 @@
1+
import {
2+
PermissionCondition,
3+
PermissionCriteria,
4+
PermissionRuleParams,
5+
} from '@backstage/plugin-permission-common';
6+
7+
import { replaceAliases } from './alias-resolver';
8+
9+
describe('replaceAliases', () => {
10+
it('should replace aliases without criteria', () => {
11+
const conditionParam: PermissionCriteria<
12+
PermissionCondition<string, PermissionRuleParams>
13+
> = {
14+
rule: 'IS_ENTITY_OWNER',
15+
resourceType: 'catalog-entity',
16+
params: {
17+
claims: ['$currentUser'],
18+
},
19+
};
20+
21+
replaceAliases(conditionParam, [
22+
'user:default/tim',
23+
'group:default/team-a',
24+
]);
25+
26+
expect(conditionParam).toEqual({
27+
rule: 'IS_ENTITY_OWNER',
28+
resourceType: 'catalog-entity',
29+
params: {
30+
claims: ['user:default/tim', 'group:default/team-a'],
31+
},
32+
});
33+
});
34+
35+
it('should replace aliases with criteria not', () => {
36+
const conditionParam: PermissionCriteria<
37+
PermissionCondition<string, PermissionRuleParams>
38+
> = {
39+
not: {
40+
rule: 'IS_ENTITY_OWNER',
41+
resourceType: 'catalog-entity',
42+
params: {
43+
claims: ['$currentUser'],
44+
},
45+
},
46+
};
47+
48+
replaceAliases(conditionParam, [
49+
'user:default/tim',
50+
'group:default/team-a',
51+
]);
52+
53+
expect(conditionParam).toEqual({
54+
not: {
55+
rule: 'IS_ENTITY_OWNER',
56+
resourceType: 'catalog-entity',
57+
params: {
58+
claims: ['user:default/tim', 'group:default/team-a'],
59+
},
60+
},
61+
});
62+
});
63+
64+
it('should replace aliases with criteria anyOf', () => {
65+
const conditionParam: PermissionCriteria<
66+
PermissionCondition<string, PermissionRuleParams>
67+
> = {
68+
anyOf: [
69+
{
70+
rule: 'IS_ENTITY_OWNER',
71+
resourceType: 'catalog-entity',
72+
params: {
73+
claims: ['$currentUser'],
74+
},
75+
},
76+
],
77+
};
78+
79+
replaceAliases(conditionParam, [
80+
'user:default/tim',
81+
'group:default/team-a',
82+
]);
83+
84+
expect(conditionParam).toEqual({
85+
anyOf: [
86+
{
87+
rule: 'IS_ENTITY_OWNER',
88+
resourceType: 'catalog-entity',
89+
params: {
90+
claims: ['user:default/tim', 'group:default/team-a'],
91+
},
92+
},
93+
],
94+
});
95+
});
96+
97+
it('should replace aliases with criteria anyOf and few values', () => {
98+
const conditionParam: PermissionCriteria<
99+
PermissionCondition<string, PermissionRuleParams>
100+
> = {
101+
anyOf: [
102+
{
103+
rule: 'IS_ENTITY_OWNER',
104+
resourceType: 'catalog-entity',
105+
params: {
106+
claims: ['$currentUser'],
107+
},
108+
},
109+
{
110+
rule: 'IS_ENTITY_KIND',
111+
resourceType: 'catalog-entity',
112+
params: { kinds: ['Group', 'User'] },
113+
},
114+
],
115+
};
116+
117+
replaceAliases(conditionParam, [
118+
'user:default/tim',
119+
'group:default/team-a',
120+
]);
121+
122+
expect(conditionParam).toEqual({
123+
anyOf: [
124+
{
125+
rule: 'IS_ENTITY_OWNER',
126+
resourceType: 'catalog-entity',
127+
params: {
128+
claims: ['user:default/tim', 'group:default/team-a'],
129+
},
130+
},
131+
{
132+
rule: 'IS_ENTITY_KIND',
133+
resourceType: 'catalog-entity',
134+
params: { kinds: ['Group', 'User'] },
135+
},
136+
],
137+
});
138+
});
139+
140+
it('should replace aliases with criteria allOf', () => {
141+
const conditionParam: PermissionCriteria<
142+
PermissionCondition<string, PermissionRuleParams>
143+
> = {
144+
allOf: [
145+
{
146+
rule: 'IS_ENTITY_OWNER',
147+
resourceType: 'catalog-entity',
148+
params: {
149+
claims: ['$currentUser'],
150+
},
151+
},
152+
],
153+
};
154+
155+
replaceAliases(conditionParam, [
156+
'user:default/tim',
157+
'group:default/team-a',
158+
]);
159+
160+
expect(conditionParam).toEqual({
161+
allOf: [
162+
{
163+
rule: 'IS_ENTITY_OWNER',
164+
resourceType: 'catalog-entity',
165+
params: {
166+
claims: ['user:default/tim', 'group:default/team-a'],
167+
},
168+
},
169+
],
170+
});
171+
});
172+
173+
it('should replace aliases with criteria allOf and few values', () => {
174+
const conditionParam: PermissionCriteria<
175+
PermissionCondition<string, PermissionRuleParams>
176+
> = {
177+
allOf: [
178+
{
179+
rule: 'IS_ENTITY_OWNER',
180+
resourceType: 'catalog-entity',
181+
params: {
182+
claims: ['$currentUser'],
183+
},
184+
},
185+
{
186+
rule: 'IS_ENTITY_KIND',
187+
resourceType: 'catalog-entity',
188+
params: { kinds: ['Group', 'User'] },
189+
},
190+
],
191+
};
192+
193+
replaceAliases(conditionParam, [
194+
'user:default/tim',
195+
'group:default/team-a',
196+
]);
197+
198+
expect(conditionParam).toEqual({
199+
allOf: [
200+
{
201+
rule: 'IS_ENTITY_OWNER',
202+
resourceType: 'catalog-entity',
203+
params: {
204+
claims: ['user:default/tim', 'group:default/team-a'],
205+
},
206+
},
207+
{
208+
rule: 'IS_ENTITY_KIND',
209+
resourceType: 'catalog-entity',
210+
params: { kinds: ['Group', 'User'] },
211+
},
212+
],
213+
});
214+
});
215+
216+
it('should replace aliases with nested criteria', () => {
217+
const conditionParam: PermissionCriteria<
218+
PermissionCondition<string, PermissionRuleParams>
219+
> = {
220+
allOf: [
221+
{
222+
not: {
223+
rule: 'IS_ENTITY_OWNER',
224+
resourceType: 'catalog-entity',
225+
params: {
226+
claims: ['$currentUser'],
227+
},
228+
},
229+
},
230+
{
231+
rule: 'IS_ENTITY_KIND',
232+
resourceType: 'catalog-entity',
233+
params: { kinds: ['Group', 'User'] },
234+
},
235+
],
236+
};
237+
238+
replaceAliases(conditionParam, [
239+
'user:default/tim',
240+
'group:default/team-a',
241+
]);
242+
243+
expect(conditionParam).toEqual({
244+
allOf: [
245+
{
246+
not: {
247+
rule: 'IS_ENTITY_OWNER',
248+
resourceType: 'catalog-entity',
249+
params: {
250+
claims: ['user:default/tim', 'group:default/team-a'],
251+
},
252+
},
253+
},
254+
{
255+
rule: 'IS_ENTITY_KIND',
256+
resourceType: 'catalog-entity',
257+
params: { kinds: ['Group', 'User'] },
258+
},
259+
],
260+
});
261+
});
262+
});

‎plugins/rbac-backend/src/conditional-aliases/alias-resolver.ts

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -44,9 +44,6 @@ function replaceAliasWithValue<K extends string>(
4444
return { ...params, [key]: nonAliasValues };
4545
}
4646

47-
// if (predicate(params[key])) {
48-
// return { ...params, [key]: newValue };
49-
// }
5047
return params;
5148
}
5249

‎plugins/rbac-backend/src/service/permission-policy.test.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2235,7 +2235,7 @@ describe('Policy checks for conditional policies', () => {
22352235
});
22362236
});
22372237

2238-
it('should execute condition policy with current user alias, when params contains array', async () => {
2238+
it('should execute condition policy with current user alias', async () => {
22392239
const entityMock: Entity = {
22402240
apiVersion: 'v1',
22412241
kind: 'Group',

0 commit comments

Comments
 (0)