Skip to content

Commit 6846a26

Browse files
Leopold-CramerLeopold-Cramer
committed
add tests for added security endpoints
1 parent 422bd4b commit 6846a26

File tree

3 files changed

+216
-0
lines changed

3 files changed

+216
-0
lines changed

‎dataset/src/integrationTest/kotlin/com/cosmotech/dataset/service/DatasetServiceIntegrationTest.kt‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -494,6 +494,23 @@ class DatasetServiceIntegrationTest : CsmRedisTestBase() {
494494
}
495495
}
496496

497+
@Test
498+
fun `test security endpoints`() {
499+
organizationSaved = organizationApiService.registerOrganization(organization)
500+
datasetSaved = datasetApiService.createDataset(organizationSaved.id!!, dataset)
501+
logger.info("should return the current security")
502+
val datasetSecurity =
503+
datasetApiService.getDatasetSecurity(organizationSaved.id!!, datasetSaved.id!!)
504+
assertEquals(datasetSaved.security, datasetSecurity)
505+
506+
logger.info("should update the default security and assert it worked")
507+
val datasetDefaultSecurity =
508+
datasetApiService.setDatasetDefaultSecurity(
509+
organizationSaved.id!!, datasetSaved.id!!, DatasetRole(ROLE_VIEWER))
510+
datasetSaved = datasetApiService.findDatasetById(organizationSaved.id!!, datasetSaved.id!!)
511+
assertEquals(datasetSaved.security!!, datasetDefaultSecurity)
512+
}
513+
497514
@TestFactory
498515
fun `test RBAC twingraphBatchUpdate`() =
499516
mapOf(
@@ -1595,6 +1612,95 @@ class DatasetServiceIntegrationTest : CsmRedisTestBase() {
15951612
}
15961613
}
15971614

1615+
@TestFactory
1616+
fun `test RBAC getDatasetSecurity`() =
1617+
mapOf(
1618+
ROLE_VIEWER to false,
1619+
ROLE_EDITOR to false,
1620+
ROLE_USER to false,
1621+
ROLE_NONE to true,
1622+
ROLE_ADMIN to false,
1623+
)
1624+
.map { (role, shouldThrow) ->
1625+
DynamicTest.dynamicTest("Test RBAC getDatasetSecurity : $role") {
1626+
every { getCurrentAccountIdentifier(any()) } returns CONNECTED_ADMIN_USER
1627+
1628+
val organization = makeOrganizationWithRole()
1629+
organizationSaved = organizationApiService.registerOrganization(organization)
1630+
val dataset = makeDatasetWithRole(role = role)
1631+
datasetSaved = datasetApiService.createDataset(organizationSaved.id!!, dataset)
1632+
materializeTwingraph()
1633+
1634+
every { getCurrentAccountIdentifier(any()) } returns TEST_USER_MAIL
1635+
1636+
if (shouldThrow) {
1637+
val exception =
1638+
assertThrows<CsmAccessForbiddenException> {
1639+
datasetApiService.getDatasetSecurity(
1640+
organizationSaved.id!!, datasetSaved.id!!)
1641+
}
1642+
if (role == ROLE_NONE) {
1643+
assertEquals(
1644+
"RBAC ${datasetSaved.id!!} - User does not have permission $PERMISSION_READ",
1645+
exception.message)
1646+
} else {
1647+
assertEquals(
1648+
"RBAC ${datasetSaved.id!!} - User does not have permission $PERMISSION_READ_SECURITY",
1649+
exception.message)
1650+
}
1651+
} else {
1652+
assertDoesNotThrow {
1653+
datasetApiService.getDatasetSecurity(organizationSaved.id!!, datasetSaved.id!!)
1654+
}
1655+
}
1656+
}
1657+
}
1658+
1659+
@TestFactory
1660+
fun `test RBAC setDatasetDefaultSecurity`() =
1661+
mapOf(
1662+
ROLE_VIEWER to true,
1663+
ROLE_EDITOR to true,
1664+
ROLE_USER to true,
1665+
ROLE_NONE to true,
1666+
ROLE_ADMIN to false,
1667+
)
1668+
.map { (role, shouldThrow) ->
1669+
DynamicTest.dynamicTest("Test RBAC setDatasetDefaultSecurity : $role") {
1670+
every { getCurrentAccountIdentifier(any()) } returns CONNECTED_ADMIN_USER
1671+
1672+
val organization = makeOrganizationWithRole()
1673+
organizationSaved = organizationApiService.registerOrganization(organization)
1674+
val dataset = makeDatasetWithRole(role = role)
1675+
datasetSaved = datasetApiService.createDataset(organizationSaved.id!!, dataset)
1676+
materializeTwingraph()
1677+
1678+
every { getCurrentAccountIdentifier(any()) } returns TEST_USER_MAIL
1679+
1680+
if (shouldThrow) {
1681+
val exception =
1682+
assertThrows<CsmAccessForbiddenException> {
1683+
datasetApiService.setDatasetDefaultSecurity(
1684+
organizationSaved.id!!, datasetSaved.id!!, DatasetRole(ROLE_VIEWER))
1685+
}
1686+
if (role == ROLE_NONE) {
1687+
assertEquals(
1688+
"RBAC ${datasetSaved.id!!} - User does not have permission $PERMISSION_READ",
1689+
exception.message)
1690+
} else {
1691+
assertEquals(
1692+
"RBAC ${datasetSaved.id!!} - User does not have permission $PERMISSION_WRITE_SECURITY",
1693+
exception.message)
1694+
}
1695+
} else {
1696+
assertDoesNotThrow {
1697+
datasetApiService.setDatasetDefaultSecurity(
1698+
organizationSaved.id!!, datasetSaved.id!!, DatasetRole(ROLE_VIEWER))
1699+
}
1700+
}
1701+
}
1702+
}
1703+
15981704
private fun materializeTwingraph(
15991705
dataset: Dataset = datasetSaved,
16001706
createTwingraph: Boolean = true

‎solution/src/integrationTest/kotlin/com/cosmotech/solution/service/SolutionServiceIntegrationTest.kt‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import com.cosmotech.api.exceptions.CsmAccessForbiddenException
88
import com.cosmotech.api.exceptions.CsmResourceNotFoundException
99
import com.cosmotech.api.rbac.ROLE_ADMIN
1010
import com.cosmotech.api.rbac.ROLE_NONE
11+
import com.cosmotech.api.rbac.ROLE_VIEWER
1112
import com.cosmotech.api.security.ROLE_PLATFORM_ADMIN
1213
import com.cosmotech.api.tests.CsmRedisTestBase
1314
import com.cosmotech.api.utils.getCurrentAccountIdentifier
@@ -23,6 +24,7 @@ import com.cosmotech.solution.domain.RunTemplateParameter
2324
import com.cosmotech.solution.domain.RunTemplateParameterGroup
2425
import com.cosmotech.solution.domain.Solution
2526
import com.cosmotech.solution.domain.SolutionAccessControl
27+
import com.cosmotech.solution.domain.SolutionRole
2628
import com.cosmotech.solution.domain.SolutionSecurity
2729
import com.redis.om.spring.RediSearchIndexer
2830
import io.mockk.every
@@ -390,6 +392,23 @@ class SolutionServiceIntegrationTest : CsmRedisTestBase() {
390392
solutionApiService.findAllSolutions(organizationRegistered.id!!, 0, -1)
391393
}
392394
}
395+
396+
@Test
397+
fun `test security endpoints`() {
398+
logger.info("should return the current security")
399+
val solutionSecurity =
400+
solutionApiService.getSolutionSecurity(organizationRegistered.id!!, solutionRegistered.id!!)
401+
assertEquals(solutionRegistered.security, solutionSecurity)
402+
403+
logger.info("should update the default security and assert it worked")
404+
val solutionDefaultSecurity =
405+
solutionApiService.setSolutionDefaultSecurity(
406+
organizationRegistered.id!!, solutionRegistered.id!!, SolutionRole(ROLE_VIEWER))
407+
solutionRegistered =
408+
solutionApiService.findSolutionById(organizationRegistered.id!!, solutionRegistered.id!!)
409+
assertEquals(solutionRegistered.security!!, solutionDefaultSecurity)
410+
}
411+
393412
fun makeOrganization(id: String = "organization_id"): Organization {
394413
return Organization(
395414
id = id,

‎solution/src/integrationTest/kotlin/com/cosmotech/solution/service/SolutionServiceRBACTest.kt‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1030,6 +1030,97 @@ class SolutionServiceRBACTest : CsmRedisTestBase() {
10301030
}
10311031
}
10321032

1033+
@TestFactory
1034+
fun `test RBAC getSolutionSecurity`() =
1035+
mapOf(
1036+
ROLE_VIEWER to false,
1037+
ROLE_EDITOR to false,
1038+
ROLE_USER to false,
1039+
ROLE_NONE to true,
1040+
ROLE_ADMIN to false,
1041+
)
1042+
.map { (role, shouldThrow) ->
1043+
DynamicTest.dynamicTest("Test RBAC getSolutionSecurity : $role") {
1044+
every { getCurrentAccountIdentifier(any()) } returns CONNECTED_ADMIN_USER
1045+
1046+
val organization =
1047+
makeOrganizationWithRole(userName = TEST_USER_MAIL, role = ROLE_ADMIN)
1048+
organizationSaved = organizationApiService.registerOrganization(organization)
1049+
val solution =
1050+
makeSolutionWithRole(organizationSaved.id!!, TEST_USER_MAIL, role = role)
1051+
solutionSaved = solutionApiService.createSolution(organizationSaved.id!!, solution)
1052+
1053+
every { getCurrentAccountIdentifier(any()) } returns TEST_USER_MAIL
1054+
1055+
if (shouldThrow) {
1056+
val exception =
1057+
assertThrows<CsmAccessForbiddenException> {
1058+
solutionApiService.getSolutionSecurity(
1059+
organizationSaved.id!!, solutionSaved.id!!)
1060+
}
1061+
if (role == ROLE_NONE) {
1062+
assertEquals(
1063+
"RBAC ${solutionSaved.id!!} - User does not have permission $PERMISSION_READ",
1064+
exception.message)
1065+
} else {
1066+
assertEquals(
1067+
"RBAC ${solutionSaved.id!!} - User does not have permission $PERMISSION_READ_SECURITY",
1068+
exception.message)
1069+
}
1070+
} else {
1071+
assertDoesNotThrow {
1072+
solutionApiService.getSolutionSecurity(organizationSaved.id!!, solutionSaved.id!!)
1073+
}
1074+
}
1075+
}
1076+
}
1077+
1078+
@TestFactory
1079+
fun `test RBAC setSolutionDefaultSecurity`() =
1080+
mapOf(
1081+
ROLE_VIEWER to true,
1082+
ROLE_EDITOR to true,
1083+
ROLE_USER to true,
1084+
ROLE_NONE to true,
1085+
ROLE_ADMIN to false,
1086+
)
1087+
.map { (role, shouldThrow) ->
1088+
DynamicTest.dynamicTest("Test RBAC setSolutionDefaultSecurity : $role") {
1089+
every { getCurrentAccountIdentifier(any()) } returns CONNECTED_ADMIN_USER
1090+
1091+
val organization =
1092+
makeOrganizationWithRole(userName = TEST_USER_MAIL, role = ROLE_ADMIN)
1093+
organizationSaved = organizationApiService.registerOrganization(organization)
1094+
val solution =
1095+
makeSolutionWithRole(organizationSaved.id!!, TEST_USER_MAIL, role = role)
1096+
solutionSaved = solutionApiService.createSolution(organizationSaved.id!!, solution)
1097+
1098+
every { getCurrentAccountIdentifier(any()) } returns TEST_USER_MAIL
1099+
1100+
if (shouldThrow) {
1101+
val exception =
1102+
assertThrows<CsmAccessForbiddenException> {
1103+
solutionApiService.setSolutionDefaultSecurity(
1104+
organizationSaved.id!!, solutionSaved.id!!, SolutionRole(ROLE_VIEWER))
1105+
}
1106+
if (role == ROLE_NONE) {
1107+
assertEquals(
1108+
"RBAC ${solutionSaved.id!!} - User does not have permission $PERMISSION_READ",
1109+
exception.message)
1110+
} else {
1111+
assertEquals(
1112+
"RBAC ${solutionSaved.id!!} - User does not have permission $PERMISSION_WRITE_SECURITY",
1113+
exception.message)
1114+
}
1115+
} else {
1116+
assertDoesNotThrow {
1117+
solutionApiService.setSolutionDefaultSecurity(
1118+
organizationSaved.id!!, solutionSaved.id!!, SolutionRole(ROLE_VIEWER))
1119+
}
1120+
}
1121+
}
1122+
}
1123+
10331124
fun makeOrganizationWithRole(
10341125
id: String = "organization_id",
10351126
userName: String,

0 commit comments

Comments
 (0)