Skip to content

Commit 21b31ad

Browse files
divy9881divy9881
committed
feat: Add RBAC API test.
Signed-off-by: DivyPatel9881 <[email protected]>
1 parent f858d19 commit 21b31ad

File tree

4 files changed

+236
-1
lines changed

4 files changed

+236
-1
lines changed

‎test/test.vcxproj‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -171,6 +171,7 @@
171171
<ClCompile Include="test_management_api.cpp" />
172172
<ClCompile Include="test_model.cpp" />
173173
<ClCompile Include="test_model_enforcer.cpp" />
174+
<ClCompile Include="test_rbac_api.cpp" />
174175
<ClCompile Include="test_role_manager.cpp" />
175176
<ClCompile Include="test_util.cpp" />
176177
</ItemGroup>

‎test/test.vcxproj.filters‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,9 @@
4242
<ClCompile Include="test_management_api.cpp">
4343
<Filter>Source Files</Filter>
4444
</ClCompile>
45+
<ClCompile Include="test_rbac_api.cpp">
46+
<Filter>Source Files</Filter>
47+
</ClCompile>
4548
</ItemGroup>
4649
<ItemGroup>
4750
<ClInclude Include="pch.h">

‎test/test_rbac_api.cpp‎

Lines changed: 231 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,231 @@
1+
#pragma once
2+
3+
#include "pch.h"
4+
5+
#include <direct.h>
6+
#include <algorithm>
7+
#include <fstream>
8+
9+
#include <enforcer.h>
10+
#include <rbac.h>
11+
#include <util.h>
12+
13+
using namespace std;
14+
15+
namespace test_rbac_api
16+
{
17+
TEST_CLASS(TestRBACAPI)
18+
{
19+
public:
20+
21+
TEST_METHOD(TestRoleAPI) {
22+
Enforcer* e = Enforcer::NewEnforcer("../../examples/rbac_model.conf", "../../examples/rbac_policy.csv");
23+
24+
Assert::IsTrue(ArrayEquals(vector<string>{ "data2_admin" }, e->GetRolesForUser("alice", vector<string>{})));
25+
Assert::IsTrue(ArrayEquals(vector<string>{ }, e->GetRolesForUser("bob", vector<string>{})));
26+
Assert::IsTrue(ArrayEquals(vector<string>{ }, e->GetRolesForUser("data2_admin", vector<string>{})));
27+
Assert::IsTrue(ArrayEquals(vector<string>{ }, e->GetRolesForUser("non_exist", vector<string>{})));
28+
29+
Assert::IsFalse(e->HasRoleForUser("alice", "data1_admin"));
30+
Assert::IsTrue(e->HasRoleForUser("alice", "data2_admin"));
31+
32+
e->AddRoleForUser("alice", "data1_admin");
33+
34+
Assert::IsTrue(ArrayEquals(vector<string>{ "data1_admin", "data2_admin" }, e->GetRolesForUser("alice", vector<string>{})));
35+
Assert::IsTrue(ArrayEquals(vector<string>{ }, e->GetRolesForUser("bob", vector<string>{})));
36+
Assert::IsTrue(ArrayEquals(vector<string>{ }, e->GetRolesForUser("data2_admin", vector<string>{})));
37+
38+
e->DeleteRoleForUser("alice", "data1_admin");
39+
40+
Assert::IsTrue(ArrayEquals(vector<string>{ "data2_admin" }, e->GetRolesForUser("alice", vector<string>{})));
41+
Assert::IsTrue(ArrayEquals(vector<string>{ }, e->GetRolesForUser("bob", vector<string>{})));
42+
Assert::IsTrue(ArrayEquals(vector<string>{ }, e->GetRolesForUser("data2_admin", vector<string>{})));
43+
44+
e->DeleteRolesForUser("alice");
45+
46+
Assert::IsTrue(ArrayEquals(vector<string>{ }, e->GetRolesForUser("alice", vector<string>{})));
47+
Assert::IsTrue(ArrayEquals(vector<string>{ }, e->GetRolesForUser("bob", vector<string>{})));
48+
Assert::IsTrue(ArrayEquals(vector<string>{ }, e->GetRolesForUser("data2_admin", vector<string>{})));
49+
50+
e->AddRoleForUser("alice", "data1_admin");
51+
e->DeleteUser("alice");
52+
53+
Assert::IsTrue(ArrayEquals(vector<string>{ }, e->GetRolesForUser("alice", vector<string>{})));
54+
Assert::IsTrue(ArrayEquals(vector<string>{ }, e->GetRolesForUser("bob", vector<string>{})));
55+
Assert::IsTrue(ArrayEquals(vector<string>{ }, e->GetRolesForUser("data2_admin", vector<string>{})));
56+
57+
e->AddRoleForUser("alice", "data2_admin");
58+
59+
Assert::IsFalse(e->Enforce({ "alice", "data1", "read" }));
60+
Assert::IsFalse(e->Enforce({ "alice", "data1", "write" }));
61+
Assert::IsTrue(e->Enforce({ "alice", "data2", "read" }));
62+
Assert::IsTrue(e->Enforce({ "alice", "data2", "write" }));
63+
Assert::IsFalse(e->Enforce({ "bob", "data1", "read" }));
64+
Assert::IsFalse(e->Enforce({ "bob", "data1", "write" }));
65+
Assert::IsFalse(e->Enforce({ "bob", "data2", "read" }));
66+
Assert::IsTrue(e->Enforce({ "bob", "data2", "write" }));
67+
68+
e->DeleteRole("data2_admin");
69+
70+
Assert::IsFalse(e->Enforce({ "alice", "data1", "read" }));
71+
Assert::IsFalse(e->Enforce({ "alice", "data1", "write" }));
72+
Assert::IsFalse(e->Enforce({ "alice", "data2", "read" }));
73+
Assert::IsFalse(e->Enforce({ "alice", "data2", "write" }));
74+
Assert::IsFalse(e->Enforce({ "bob", "data1", "read" }));
75+
Assert::IsFalse(e->Enforce({ "bob", "data1", "write" }));
76+
Assert::IsFalse(e->Enforce({ "bob", "data2", "read" }));
77+
Assert::IsTrue(e->Enforce({ "bob", "data2", "write" }));
78+
}
79+
80+
TEST_METHOD(TestEnforcer_AddRolesForUser) {
81+
Enforcer* e = Enforcer::NewEnforcer("../../examples/rbac_model.conf", "../../examples/rbac_policy.csv");
82+
83+
e->AddRolesForUser("alice", vector<string>{ "data1_admin", "data2_admin", "data3_admin" });
84+
Assert::IsTrue(ArrayEquals(vector<string>{ "data1_admin", "data2_admin", "data3_admin" }, e->GetRolesForUser("alice", vector<string>{})));
85+
86+
Assert::IsTrue(e->Enforce({ "alice", "data1", "read" }));
87+
Assert::IsTrue(e->Enforce({ "alice", "data2", "read" }));
88+
Assert::IsTrue(e->Enforce({ "alice", "data2", "write" }));
89+
}
90+
91+
void TestGetPermissions(Enforcer* e, string name, vector<vector<string>> res) {
92+
vector<vector<string>> my_res = e->GetPermissionsForUser(name);
93+
94+
int count = 0;
95+
for (int i = 0; i < my_res.size(); i++) {
96+
for (int j = 0; j < res.size(); j++) {
97+
if (ArrayEquals(res[j], my_res[i])) {
98+
count += 1;
99+
break;
100+
}
101+
}
102+
}
103+
104+
Assert::AreEqual(int(res.size()), count);
105+
}
106+
107+
TEST_METHOD(TestPermissionAPI) {
108+
Enforcer* e = Enforcer::NewEnforcer("../../examples/basic_without_resources_model.conf", "../../examples/basic_without_resources_policy.csv");
109+
110+
Assert::IsTrue(e->Enforce(vector<string>{ "alice", "read" }));
111+
Assert::IsFalse(e->Enforce(vector<string>{ "alice", "write" }));
112+
Assert::IsFalse(e->Enforce(vector<string>{ "bob", "read" }));
113+
Assert::IsTrue(e->Enforce(vector<string>{ "bob", "write" }));
114+
115+
TestGetPermissions(e, "alice", vector<vector<string>>{ {"alice", "read"} });
116+
TestGetPermissions(e, "bob", vector<vector<string>>{ {"bob", "write"} });
117+
118+
Assert::IsTrue(e->HasPermissionForUser("alice", { "read" }));
119+
Assert::IsFalse(e->HasPermissionForUser("alice", { "write" }));
120+
Assert::IsFalse(e->HasPermissionForUser("bob", { "read" }));
121+
Assert::IsTrue(e->HasPermissionForUser("bob", { "write" }));
122+
123+
e->DeletePermission({ "read" });
124+
125+
Assert::IsFalse(e->Enforce(vector<string>{ "alice", "read" }));
126+
Assert::IsFalse(e->Enforce(vector<string>{ "alice", "write" }));
127+
Assert::IsFalse(e->Enforce(vector<string>{ "bob", "read" }));
128+
Assert::IsTrue(e->Enforce(vector<string>{ "bob", "write" }));
129+
130+
e->AddPermissionForUser("bob", { "read" });
131+
132+
Assert::IsFalse(e->Enforce(vector<string>{ "alice", "read" }));
133+
Assert::IsFalse(e->Enforce(vector<string>{ "alice", "write" }));
134+
Assert::IsTrue(e->Enforce(vector<string>{ "bob", "read" }));
135+
Assert::IsTrue(e->Enforce(vector<string>{ "bob", "write" }));
136+
137+
e->DeletePermissionForUser("bob", { "read" });
138+
139+
Assert::IsFalse(e->Enforce(vector<string>{ "alice", "read" }));
140+
Assert::IsFalse(e->Enforce(vector<string>{ "alice", "write" }));
141+
Assert::IsFalse(e->Enforce(vector<string>{ "bob", "read" }));
142+
Assert::IsTrue(e->Enforce(vector<string>{ "bob", "write" }));
143+
144+
e->DeletePermissionsForUser("bob");
145+
146+
Assert::IsFalse(e->Enforce(vector<string>{ "alice", "read" }));
147+
Assert::IsFalse(e->Enforce(vector<string>{ "alice", "write" }));
148+
Assert::IsFalse(e->Enforce(vector<string>{ "bob", "read" }));
149+
Assert::IsFalse(e->Enforce(vector<string>{ "bob", "write" }));
150+
}
151+
152+
TEST_METHOD(TestImplicitRoleAPI) {
153+
Enforcer* e = Enforcer::NewEnforcer("../../examples/rbac_model.conf", "../../examples/rbac_with_hierarchy_policy.csv");
154+
155+
TestGetPermissions(e, "alice", vector<vector<string>>{ {"alice", "data1", "read"} });
156+
TestGetPermissions(e, "bob", vector<vector<string>>{ {"bob", "data2", "write"} });
157+
158+
Assert::IsTrue(ArrayEquals(vector<string>{ "admin", "data1_admin", "data2_admin" }, e->GetImplicitRolesForUser("alice", {})));
159+
Assert::IsTrue(ArrayEquals(vector<string>{ }, e->GetImplicitRolesForUser("bob", {})));
160+
161+
e = Enforcer::NewEnforcer("../../examples/rbac_with_pattern_model.conf", "../../examples/rbac_with_pattern_policy.csv");
162+
163+
dynamic_cast<DefaultRoleManager*>(e->GetRoleManager())->AddMatchingFunc(KeyMatch);
164+
165+
Assert::IsTrue(ArrayEquals(vector<string>{ "/book/1/2/3/4/5", "pen_admin", "/book/*", "book_group" }, e->GetImplicitRolesForUser("cathy", {})));
166+
Assert::IsTrue(ArrayEquals(vector<string>{ "/book/1/2/3/4/5", "pen_admin" }, e->GetRolesForUser("cathy", vector<string>{})));
167+
}
168+
169+
void TestGetImplicitPermissions(Enforcer* e, string name, vector<vector<string>> res) {
170+
vector<vector<string>> my_res = e->GetImplicitPermissionsForUser(name, {});
171+
172+
int count = 0;
173+
for (int i = 0; i < my_res.size(); i++) {
174+
for (int j = 0; j < res.size(); j++) {
175+
if (ArrayEquals(res[j], my_res[i])) {
176+
count += 1;
177+
break;
178+
}
179+
}
180+
}
181+
182+
Assert::AreEqual(int(res.size()), count);
183+
}
184+
185+
void TestGetImplicitPermissionsWithDomain(Enforcer* e, string name, string domain, vector<vector<string>> res) {
186+
vector<vector<string>> my_res = e->GetImplicitPermissionsForUser(name, { domain });
187+
188+
int count = 0;
189+
for (int i = 0; i < my_res.size(); i++) {
190+
for (int j = 0; j < res.size(); j++) {
191+
if (ArrayEquals(res[j], my_res[i])) {
192+
count += 1;
193+
break;
194+
}
195+
}
196+
}
197+
198+
Assert::AreEqual(int(res.size()), count);
199+
}
200+
201+
TEST_METHOD(TestImplicitPermissionAPI) {
202+
Enforcer* e = Enforcer::NewEnforcer("../../examples/rbac_model.conf", "../../examples/rbac_with_hierarchy_policy.csv");
203+
204+
TestGetPermissions(e, "alice", vector<vector<string>>{ {"alice", "data1", "read"} });
205+
TestGetPermissions(e, "bob", vector<vector<string>>{ {"bob", "data2", "write"} });
206+
207+
TestGetImplicitPermissions(e, "alice", vector<vector<string>>{ {"alice", "data1", "read"}, { "data1_admin", "data1", "read" }, { "data1_admin", "data1", "write" }, { "data2_admin", "data2", "read" }, { "data2_admin", "data2", "write" } });
208+
TestGetImplicitPermissions(e, "bob", vector<vector<string>>{ {"bob", "data2", "write"} });
209+
}
210+
211+
TEST_METHOD(TestImplicitPermissionAPIWithDomain) {
212+
Enforcer* e = Enforcer::NewEnforcer("../../examples/rbac_with_domains_model.conf", "../../examples/rbac_with_hierarchy_with_domains_policy.csv");
213+
TestGetImplicitPermissionsWithDomain(e, "alice", "domain1", vector<vector<string>>{ {"alice", "domain1", "data2", "read"}, { "role:reader", "domain1", "data1", "read" }, { "role:writer", "domain1", "data1", "write" } });
214+
}
215+
216+
TEST_METHOD(TestImplicitUserAPI) {
217+
Enforcer* e = Enforcer::NewEnforcer("../../examples/rbac_model.conf", "../../examples/rbac_with_hierarchy_policy.csv");
218+
219+
Assert::IsTrue(ArrayEquals(vector<string>{ "alice" }, e->GetImplicitUsersForPermission({ "data1", "read" })));
220+
Assert::IsTrue(ArrayEquals(vector<string>{ "alice" }, e->GetImplicitUsersForPermission({ "data1", "write" })));
221+
Assert::IsTrue(ArrayEquals(vector<string>{ "alice" }, e->GetImplicitUsersForPermission({ "data2", "read" })));
222+
Assert::IsTrue(ArrayEquals(vector<string>{ "alice", "bob" }, e->GetImplicitUsersForPermission({ "data2", "write" })));
223+
224+
e->ClearPolicy();
225+
e->AddPolicy({ "admin", "data1", "read" });
226+
e->AddPolicy({ "bob", "data1", "read" });
227+
e->AddGroupingPolicy({ "alice", "admin" });
228+
Assert::IsTrue(ArrayEquals(vector<string>{ "alice", "bob" }, e->GetImplicitUsersForPermission({ "data1", "read" })));
229+
}
230+
};
231+
}

‎test/test_util.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ namespace test_util
5454
TEST_METHOD(TestArrayEquals) {
5555
TestArrayEquals(vector<string> {"a", "b", "c"}, vector<string> {"a", "b", "c"}, true);
5656
TestArrayEquals(vector<string> {"a", "b", "c"}, vector<string> {"a", "b"}, false);
57-
TestArrayEquals(vector<string> {"a", "b", "c"}, vector<string> {"a", "c", "b"}, false);
57+
TestArrayEquals(vector<string> {"a", "b", "c"}, vector<string> {"a", "c", "b"}, true);
5858
TestArrayEquals(vector<string> {"a", "b", "c"}, vector<string> {}, false);
5959
}
6060
};

0 commit comments

Comments
 (0)