Skip to content

Commit 8d3713a

Browse files
bosorawisbosorawis
authored
bosorawis remove TestRoleGrantsForToken (#5840)
* refactor auth method grants tests * refactor credential libraries grants tests * refactor hosts grants tests * refactor roles grants tests * refactor scopes grants tests * refactor tcp targets grants tests * refactor users grants tests * refactor worker grants tests * fix authmethod test broken during the refactor * remove authtoken.TestRoleGrantsForToken * add pinned ID test * correct event name * fix make gen and lint
1 parent efd0639 commit 8d3713a

File tree

10 files changed

+872
-703
lines changed

10 files changed

+872
-703
lines changed

‎internal/auth/ldap/testing.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,8 @@ import (
2424
"github.com/hashicorp/boundary/internal/db"
2525
"github.com/hashicorp/boundary/internal/kms"
2626
wrapping "github.com/hashicorp/go-kms-wrapping/v2"
27-
"github.com/hashicorp/go-uuid"
2827
"github.com/hashicorp/go-secure-stdlib/parseutil"
28+
"github.com/hashicorp/go-uuid"
2929
"github.com/stretchr/testify/require"
3030
)
3131

‎internal/authtoken/testing.go

Lines changed: 0 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@ import (
1111
"github.com/hashicorp/boundary/internal/db"
1212
"github.com/hashicorp/boundary/internal/iam"
1313
"github.com/hashicorp/boundary/internal/kms"
14-
"github.com/hashicorp/go-uuid"
1514
"github.com/stretchr/testify/require"
1615
)
1716

@@ -47,38 +46,3 @@ func TestAuthToken(t testing.TB, conn *db.DB, kms *kms.Kms, scopeId string, opt
4746
require.NoError(t, err)
4847
return at
4948
}
50-
51-
// TestRoleGrantsForToken contains information used by TestAuthTokenWithRoles to create
52-
// roles and their associated grants (with grant scopes)
53-
type TestRoleGrantsForToken struct {
54-
RoleScopeId string
55-
GrantStrings []string
56-
GrantScopes []string
57-
}
58-
59-
// TestAuthTokenWithRoles creates auth token associated with roles as requested by the caller along
60-
// with any required resources to achieve said token
61-
func TestAuthTokenWithRoles(t testing.TB, conn *db.DB, kms *kms.Kms, scopeId string, roles []TestRoleGrantsForToken) *AuthToken {
62-
t.Helper()
63-
ctx := context.Background()
64-
rw := db.New(conn)
65-
atRepo, err := NewRepository(ctx, rw, rw, kms)
66-
require.NoError(t, err)
67-
68-
iamRepo, err := iam.NewRepository(ctx, rw, rw, kms)
69-
require.NoError(t, err)
70-
71-
authMethod := password.TestAuthMethods(t, conn, scopeId, 1)[0]
72-
73-
loginName, err := uuid.GenerateUUID()
74-
require.NoError(t, err)
75-
acct := password.TestAccount(t, conn, authMethod.GetPublicId(), loginName)
76-
user := iam.TestUser(t, iamRepo, scopeId, iam.WithAccountIds(acct.GetPublicId()))
77-
for _, r := range roles {
78-
role := iam.TestRoleWithGrants(t, conn, r.RoleScopeId, r.GrantScopes, r.GrantStrings)
79-
_ = iam.TestUserRole(t, conn, role.PublicId, user.PublicId)
80-
}
81-
fullGrantToken, err := atRepo.CreateAuthToken(ctx, user, acct.GetPublicId())
82-
require.NoError(t, err)
83-
return fullGrantToken
84-
}

‎internal/daemon/controller/handlers/authmethods/grants_test.go

Lines changed: 648 additions & 485 deletions
Large diffs are not rendered by default.

‎internal/daemon/controller/handlers/credentiallibraries/grants_test.go

Lines changed: 24 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,11 @@ import (
88
"testing"
99

1010
"github.com/hashicorp/boundary/globals"
11+
"github.com/hashicorp/boundary/internal/auth"
12+
"github.com/hashicorp/boundary/internal/auth/oidc"
1113
"github.com/hashicorp/boundary/internal/authtoken"
1214
"github.com/hashicorp/boundary/internal/credential/vault"
13-
"github.com/hashicorp/boundary/internal/daemon/controller/auth"
15+
controllerauth "github.com/hashicorp/boundary/internal/daemon/controller/auth"
1416
"github.com/hashicorp/boundary/internal/daemon/controller/handlers/credentiallibraries"
1517
"github.com/hashicorp/boundary/internal/db"
1618
pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
@@ -31,6 +33,8 @@ func TestGrants_ReadActions(t *testing.T) {
3133
}
3234
kmsCache := kms.TestKms(t, conn, wrap)
3335
sche := scheduler.TestScheduler(t, conn, wrap)
36+
atRepo, err := authtoken.NewRepository(ctx, rw, rw, kmsCache)
37+
require.NoError(t, err)
3438

3539
vaultRepoFn := func() (*vault.Repository, error) {
3640
return vault.NewRepository(ctx, rw, rw, kmsCache, sche)
@@ -45,24 +49,24 @@ func TestGrants_ReadActions(t *testing.T) {
4549

4650
t.Run("List", func(t *testing.T) {
4751
testcases := []struct {
48-
name string
49-
input *pbs.ListCredentialLibrariesRequest
50-
rolesToCreate []authtoken.TestRoleGrantsForToken
51-
wantErr error
52-
wantIDs []string
52+
name string
53+
input *pbs.ListCredentialLibrariesRequest
54+
userFunc func() (*iam.User, auth.Account)
55+
wantErr error
56+
wantIDs []string
5357
}{
5458
{
5559
name: "global role grant descendant returns all credentials library",
5660
input: &pbs.ListCredentialLibrariesRequest{
5761
CredentialStoreId: proj1CredStore[0].GetPublicId(),
5862
},
59-
rolesToCreate: []authtoken.TestRoleGrantsForToken{
63+
userFunc: iam.TestUserManagedGroupGrantsFunc(t, conn, kmsCache, globals.GlobalPrefix, oidc.TestAuthMethodWithAccountInManagedGroup, []iam.TestRoleGrantsRequest{
6064
{
61-
RoleScopeId: globals.GlobalPrefix,
62-
GrantStrings: []string{"ids=*;type=credential-library;actions=list,read"},
63-
GrantScopes: []string{globals.GrantScopeThis, globals.GrantScopeDescendants},
65+
RoleScopeId: globals.GlobalPrefix,
66+
Grants: []string{"ids=*;type=credential-library;actions=list,read"},
67+
GrantScopes: []string{globals.GrantScopeThis, globals.GrantScopeDescendants},
6468
},
65-
},
69+
}),
6670
wantErr: nil,
6771
wantIDs: []string{proj1Libs[0].GetPublicId(), proj1Libs[1].GetPublicId(), proj1Libs[2].GetPublicId()},
6872
},
@@ -71,22 +75,24 @@ func TestGrants_ReadActions(t *testing.T) {
7175
input: &pbs.ListCredentialLibrariesRequest{
7276
CredentialStoreId: proj1CredStore[0].GetPublicId(),
7377
},
74-
rolesToCreate: []authtoken.TestRoleGrantsForToken{
78+
userFunc: iam.TestUserManagedGroupGrantsFunc(t, conn, kmsCache, globals.GlobalPrefix, oidc.TestAuthMethodWithAccountInManagedGroup, []iam.TestRoleGrantsRequest{
7579
{
76-
RoleScopeId: org.GetPublicId(),
77-
GrantStrings: []string{"ids=*;type=credential-library;actions=list,read"},
78-
GrantScopes: []string{globals.GrantScopeThis, globals.GrantScopeChildren},
80+
RoleScopeId: org.GetPublicId(),
81+
Grants: []string{"ids=*;type=credential-library;actions=list,read"},
82+
GrantScopes: []string{globals.GrantScopeThis, globals.GrantScopeChildren},
7983
},
80-
},
84+
}),
8185
wantErr: nil,
8286
wantIDs: []string{proj1Libs[0].GetPublicId(), proj1Libs[1].GetPublicId(), proj1Libs[2].GetPublicId()},
8387
},
8488
}
8589

8690
for _, tc := range testcases {
8791
t.Run(tc.name, func(t *testing.T) {
88-
tok := authtoken.TestAuthTokenWithRoles(t, conn, kmsCache, globals.GlobalPrefix, tc.rolesToCreate)
89-
fullGrantAuthCtx := auth.TestAuthContextFromToken(t, conn, wrap, tok, iamRepo)
92+
user, account := tc.userFunc()
93+
tok, err := atRepo.CreateAuthToken(ctx, user, account.GetPublicId())
94+
require.NoError(t, err)
95+
fullGrantAuthCtx := controllerauth.TestAuthContextFromToken(t, conn, wrap, tok, iamRepo)
9096
got, finalErr := s.ListCredentialLibraries(fullGrantAuthCtx, tc.input)
9197
if tc.wantErr != nil {
9298
require.ErrorIs(t, finalErr, tc.wantErr)

‎internal/daemon/controller/handlers/hosts/grants_test.go

Lines changed: 29 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,10 @@ import (
88
"testing"
99

1010
"github.com/hashicorp/boundary/globals"
11+
"github.com/hashicorp/boundary/internal/auth"
12+
"github.com/hashicorp/boundary/internal/auth/password"
1113
"github.com/hashicorp/boundary/internal/authtoken"
12-
"github.com/hashicorp/boundary/internal/daemon/controller/auth"
14+
controllerauth "github.com/hashicorp/boundary/internal/daemon/controller/auth"
1315
"github.com/hashicorp/boundary/internal/daemon/controller/handlers/hosts"
1416
"github.com/hashicorp/boundary/internal/db"
1517
pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
@@ -52,6 +54,8 @@ func TestGrants_ReadActions(t *testing.T) {
5254
}
5355
s, err := hosts.NewService(ctx, repoFn, pluginRepoFn, 1000)
5456
require.NoError(t, err)
57+
atRepo, err := authtoken.NewRepository(ctx, rw, rw, kmsCache)
58+
require.NoError(t, err)
5559

5660
org, proj := iam.TestScopes(t, iamRepo)
5761

@@ -68,24 +72,24 @@ func TestGrants_ReadActions(t *testing.T) {
6872

6973
t.Run("List", func(t *testing.T) {
7074
testcases := []struct {
71-
name string
72-
input *pbs.ListHostsRequest
73-
rolesToCreate []authtoken.TestRoleGrantsForToken
74-
wantErr error
75-
wantIDs []string
75+
name string
76+
input *pbs.ListHostsRequest
77+
userFunc func() (*iam.User, auth.Account)
78+
wantErr error
79+
wantIDs []string
7680
}{
7781
{
7882
name: "global role grant this returns all created hosts",
7983
input: &pbs.ListHostsRequest{
8084
HostCatalogId: hc.GetPublicId(),
8185
},
82-
rolesToCreate: []authtoken.TestRoleGrantsForToken{
86+
userFunc: iam.TestUserGroupGrantsFunc(t, conn, kmsCache, globals.GlobalPrefix, password.TestAuthMethodWithAccount, []iam.TestRoleGrantsRequest{
8387
{
84-
RoleScopeId: globals.GlobalPrefix,
85-
GrantStrings: []string{"ids=*;type=host;actions=list,read"},
86-
GrantScopes: []string{globals.GrantScopeThis, globals.GrantScopeDescendants},
88+
RoleScopeId: globals.GlobalPrefix,
89+
Grants: []string{"ids=*;type=host;actions=list,read"},
90+
GrantScopes: []string{globals.GrantScopeThis, globals.GrantScopeDescendants},
8791
},
88-
},
92+
}),
8993
wantErr: nil,
9094
wantIDs: wantHs,
9195
},
@@ -94,13 +98,13 @@ func TestGrants_ReadActions(t *testing.T) {
9498
input: &pbs.ListHostsRequest{
9599
HostCatalogId: hc.GetPublicId(),
96100
},
97-
rolesToCreate: []authtoken.TestRoleGrantsForToken{
101+
userFunc: iam.TestUserGroupGrantsFunc(t, conn, kmsCache, globals.GlobalPrefix, password.TestAuthMethodWithAccount, []iam.TestRoleGrantsRequest{
98102
{
99-
RoleScopeId: org.PublicId,
100-
GrantStrings: []string{"ids=*;type=host;actions=list,read"},
101-
GrantScopes: []string{globals.GrantScopeThis, globals.GrantScopeChildren},
103+
RoleScopeId: org.PublicId,
104+
Grants: []string{"ids=*;type=host;actions=list,read"},
105+
GrantScopes: []string{globals.GrantScopeThis, globals.GrantScopeChildren},
102106
},
103-
},
107+
}),
104108
wantErr: nil,
105109
wantIDs: wantHs,
106110
},
@@ -109,22 +113,24 @@ func TestGrants_ReadActions(t *testing.T) {
109113
input: &pbs.ListHostsRequest{
110114
HostCatalogId: hc.GetPublicId(),
111115
},
112-
rolesToCreate: []authtoken.TestRoleGrantsForToken{
116+
userFunc: iam.TestUserGroupGrantsFunc(t, conn, kmsCache, globals.GlobalPrefix, password.TestAuthMethodWithAccount, []iam.TestRoleGrantsRequest{
113117
{
114-
RoleScopeId: proj.PublicId,
115-
GrantStrings: []string{"ids=*;type=host;actions=list,read"},
116-
GrantScopes: []string{globals.GrantScopeThis},
118+
RoleScopeId: proj.PublicId,
119+
Grants: []string{"ids=*;type=host;actions=list,read"},
120+
GrantScopes: []string{globals.GrantScopeThis},
117121
},
118-
},
122+
}),
119123
wantErr: nil,
120124
wantIDs: wantHs,
121125
},
122126
}
123127

124128
for _, tc := range testcases {
125129
t.Run(tc.name, func(t *testing.T) {
126-
tok := authtoken.TestAuthTokenWithRoles(t, conn, kmsCache, globals.GlobalPrefix, tc.rolesToCreate)
127-
fullGrantAuthCtx := auth.TestAuthContextFromToken(t, conn, wrap, tok, iamRepo)
130+
user, account := tc.userFunc()
131+
tok, err := atRepo.CreateAuthToken(ctx, user, account.GetPublicId())
132+
require.NoError(t, err)
133+
fullGrantAuthCtx := controllerauth.TestAuthContextFromToken(t, conn, wrap, tok, iamRepo)
128134
got, finalErr := s.ListHosts(fullGrantAuthCtx, tc.input)
129135
if tc.wantErr != nil {
130136
require.ErrorIs(t, finalErr, tc.wantErr)

‎internal/daemon/controller/handlers/roles/grants_test.go

Lines changed: 26 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,10 @@ import (
88
"testing"
99

1010
"github.com/hashicorp/boundary/globals"
11+
"github.com/hashicorp/boundary/internal/auth"
12+
"github.com/hashicorp/boundary/internal/auth/oidc"
1113
"github.com/hashicorp/boundary/internal/authtoken"
12-
"github.com/hashicorp/boundary/internal/daemon/controller/auth"
14+
controllerauth "github.com/hashicorp/boundary/internal/daemon/controller/auth"
1315
"github.com/hashicorp/boundary/internal/daemon/controller/handlers/roles"
1416
"github.com/hashicorp/boundary/internal/db"
1517
pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
@@ -46,21 +48,24 @@ func TestGrants_ReadActions(t *testing.T) {
4648
kmsCache := kms.TestKms(t, conn, wrap)
4749
s, err := roles.NewService(ctx, repoFn, 1000)
4850
require.NoError(t, err)
51+
rw := db.New(conn)
52+
atRepo, err := authtoken.NewRepository(ctx, rw, rw, kmsCache)
53+
require.NoError(t, err)
4954

5055
org1, _ := iam.TestScopes(t, iamRepo)
5156
org2, proj2 := iam.TestScopes(t, iamRepo)
5257
proj3 := iam.TestProject(t, iamRepo, org2.PublicId)
5358

5459
var defaultOrg1Roles []string
55-
org1Roles, err := s.ListRoles(auth.DisabledAuthTestContext(repoFn, org1.GetPublicId()), &pbs.ListRolesRequest{
60+
org1Roles, err := s.ListRoles(controllerauth.DisabledAuthTestContext(repoFn, org1.GetPublicId()), &pbs.ListRolesRequest{
5661
ScopeId: org1.GetPublicId(),
5762
})
5863
require.NoError(t, err)
5964
for _, r := range org1Roles.Items {
6065
defaultOrg1Roles = append(defaultOrg1Roles, r.GetId())
6166
}
6267

63-
org2Roles, err := s.ListRoles(auth.DisabledAuthTestContext(repoFn, org2.GetPublicId()), &pbs.ListRolesRequest{
68+
org2Roles, err := s.ListRoles(controllerauth.DisabledAuthTestContext(repoFn, org2.GetPublicId()), &pbs.ListRolesRequest{
6469
ScopeId: org2.GetPublicId(),
6570
})
6671
require.NoError(t, err)
@@ -69,7 +74,7 @@ func TestGrants_ReadActions(t *testing.T) {
6974
defaultOrg2Roles = append(defaultOrg2Roles, r.GetId())
7075
}
7176

72-
proj2Roles, err := s.ListRoles(auth.DisabledAuthTestContext(repoFn, proj2.GetPublicId()), &pbs.ListRolesRequest{
77+
proj2Roles, err := s.ListRoles(controllerauth.DisabledAuthTestContext(repoFn, proj2.GetPublicId()), &pbs.ListRolesRequest{
7378
ScopeId: proj2.GetPublicId(),
7479
})
7580
require.NoError(t, err)
@@ -78,7 +83,7 @@ func TestGrants_ReadActions(t *testing.T) {
7883
defaultProj2Roles = append(defaultProj2Roles, r.GetId())
7984
}
8085

81-
proj3Roles, err := s.ListRoles(auth.DisabledAuthTestContext(repoFn, proj3.GetPublicId()), &pbs.ListRolesRequest{
86+
proj3Roles, err := s.ListRoles(controllerauth.DisabledAuthTestContext(repoFn, proj3.GetPublicId()), &pbs.ListRolesRequest{
8287
ScopeId: proj3.GetPublicId(),
8388
})
8489
require.NoError(t, err)
@@ -97,7 +102,7 @@ func TestGrants_ReadActions(t *testing.T) {
97102
testcases := []struct {
98103
name string
99104
input *pbs.ListRolesRequest
100-
rolesToCreate []authtoken.TestRoleGrantsForToken
105+
userFunc func() (*iam.User, auth.Account)
101106
wantErr error
102107
addRolesAtThisScope bool
103108
wantIDs []string
@@ -108,13 +113,13 @@ func TestGrants_ReadActions(t *testing.T) {
108113
ScopeId: globals.GlobalPrefix,
109114
Recursive: true,
110115
},
111-
rolesToCreate: []authtoken.TestRoleGrantsForToken{
116+
userFunc: iam.TestUserManagedGroupGrantsFunc(t, conn, kmsCache, globals.GlobalPrefix, oidc.TestAuthMethodWithAccountInManagedGroup, []iam.TestRoleGrantsRequest{
112117
{
113-
RoleScopeId: globals.GlobalPrefix,
114-
GrantStrings: []string{"ids=*;type=role;actions=list,read"},
115-
GrantScopes: []string{globals.GrantScopeThis, globals.GrantScopeChildren},
118+
RoleScopeId: globals.GlobalPrefix,
119+
Grants: []string{"ids=*;type=role;actions=list,read"},
120+
GrantScopes: []string{globals.GrantScopeThis, globals.GrantScopeChildren},
116121
},
117-
},
122+
}),
118123
addRolesAtThisScope: true,
119124
wantErr: nil,
120125
wantIDs: append(append([]string{
@@ -128,13 +133,13 @@ func TestGrants_ReadActions(t *testing.T) {
128133
ScopeId: org2.PublicId,
129134
Recursive: true,
130135
},
131-
rolesToCreate: []authtoken.TestRoleGrantsForToken{
136+
userFunc: iam.TestUserManagedGroupGrantsFunc(t, conn, kmsCache, globals.GlobalPrefix, oidc.TestAuthMethodWithAccountInManagedGroup, []iam.TestRoleGrantsRequest{
132137
{
133-
RoleScopeId: org2.PublicId,
134-
GrantStrings: []string{"ids=*;type=role;actions=list,read"},
135-
GrantScopes: []string{globals.GrantScopeThis, globals.GrantScopeChildren},
138+
RoleScopeId: org2.PublicId,
139+
Grants: []string{"ids=*;type=role;actions=list,read"},
140+
GrantScopes: []string{globals.GrantScopeThis, globals.GrantScopeChildren},
136141
},
137-
},
142+
}),
138143
addRolesAtThisScope: true,
139144
wantErr: nil,
140145
wantIDs: append(append([]string{
@@ -146,15 +151,17 @@ func TestGrants_ReadActions(t *testing.T) {
146151

147152
for _, tc := range testcases {
148153
t.Run(tc.name, func(t *testing.T) {
149-
tok := authtoken.TestAuthTokenWithRoles(t, conn, kmsCache, globals.GlobalPrefix, tc.rolesToCreate)
150-
fullGrantAuthCtx := auth.TestAuthContextFromToken(t, conn, wrap, tok, iamRepo)
154+
user, account := tc.userFunc()
155+
tok, err := atRepo.CreateAuthToken(ctx, user, account.GetPublicId())
156+
require.NoError(t, err)
157+
fullGrantAuthCtx := controllerauth.TestAuthContextFromToken(t, conn, wrap, tok, iamRepo)
151158

152159
// TestAuthTokenWithRoles creates a default role, so we need to add it to the expected list
153160
// if the grant scope contains 'this'
154161
// This will add the default roles to the expected list of roles
155162
if tc.addRolesAtThisScope {
156163
var rolesAtThisScope []string
157-
rolesAtThisScopeList, err := s.ListRoles(auth.DisabledAuthTestContext(repoFn, tc.input.ScopeId), &pbs.ListRolesRequest{
164+
rolesAtThisScopeList, err := s.ListRoles(controllerauth.DisabledAuthTestContext(repoFn, tc.input.ScopeId), &pbs.ListRolesRequest{
158165
ScopeId: tc.input.ScopeId,
159166
})
160167
require.NoError(t, err)

0 commit comments

Comments
 (0)