Skip to content

Commit

Permalink
Address review feedback
Browse files Browse the repository at this point in the history
  • Loading branch information
@jefferai
jefferai committed Sep 12, 2024
1 parent c1c40f2 commit ddd0d60
Show file tree
Hide file tree
Showing 2 changed files with 5 additions and 151 deletions.
10 changes: 5 additions & 5 deletions internal/perms/acl.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -313,10 +313,10 @@ func (a ACL) Allowed(r Resource, aType action.Type, userId string, opt ...Option

found = true

// Case 3: type=<resource.Typee>;actions=<action> when action is list or
// Case 3: type=<resource.Type>;actions=<action> when action is list or
// create (cannot be a wildcard). Must be a top level collection,
// otherwise must be one of the two formats specified in cases 4 or 5.
// Or, type=resource.Typee;output_fields=<fields> and no action. This is
// Or, type=resource.Type;output_fields=<fields> and no action. This is
// more of a semantic difference compared to 4 more than a security
// difference; this type is for clarity as it ties more closely to the
// concept of create and list as actions on a collection, operating on a
Expand All @@ -339,9 +339,9 @@ func (a ACL) Allowed(r Resource, aType action.Type, userId string, opt ...Option
found = true

// Case 4:
// id=*;type=<resource.Typee>;actions=<action> where type cannot be
// id=*;type=<resource.Type>;actions=<action> where type cannot be
// unknown but can be a wildcard to allow any resource at all; or
// id=*;type=<resource.Typee>;output_fields=<fields> with no action.
// id=*;type=<resource.Type>;output_fields=<fields> with no action.
case grant.Id == "*" &&
grant.Type != resource.Unknown &&
(grant.Type == r.Type ||
Expand All @@ -350,7 +350,7 @@ func (a ACL) Allowed(r Resource, aType action.Type, userId string, opt ...Option
found = true

// Case 5:
// id=<pin>;type=<resource.Typee>;actions=<action> where type can be a
// id=<pin>;type=<resource.Type>;actions=<action> where type can be a
// wildcard and this this is operating on a non-top-level type. Same for
// output fields only.
case grant.Id != "" &&
Expand Down
146 changes: 0 additions & 146 deletions internal/perms/grants_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -636,152 +636,6 @@ func Test_Parse(t *testing.T) {
}

tests := []input{
/*
{
name: "empty",
err: `perms.Parse: missing grant string: parameter violation: error #100`,
},
{
name: "bad json",
input: "{2:193}",
err: `perms.Parse: unable to parse JSON grant string: perms.(Grant).unmarshalJSON: error occurred during decode, encoding issue: error #303: invalid character '2' looking for beginning of object key string`,
},
{
name: "bad text",
input: "id=foo=bar",
err: `perms.Parse: unable to parse grant string: perms.(Grant).unmarshalText: segment "id=foo=bar" not formatted correctly, wrong number of equal signs: parameter violation: error #100`,
},
{
name: "bad type",
input: "ids=s_foobar;type=barfoo;actions=read",
err: `perms.Parse: unable to parse grant string: perms.(Grant).unmarshalText: unknown type specifier "barfoo": parameter violation: error #100`,
},
{
name: "bad actions",
input: "ids=hcst_foobar;type=host-catalog;actions=createread",
err: `perms.Parse: perms.(Grant).parseAndValidateActions: unknown action "createread": parameter violation: error #100`,
},
{
name: "bad id type",
input: "id=foobar;actions=read",
err: `perms.Parse: parsed grant string "id=foobar;actions=read" contains an id "foobar" of an unknown resource type: parameter violation: error #100`,
},
{
name: "bad ids type first position",
input: "ids=foobar,hcst_foobar;actions=read",
err: `perms.Parse: input grant string "ids=foobar,hcst_foobar;actions=read" contains ids of differently-typed resources: parameter violation: error #100`,
},
{
name: "bad ids type second position",
input: "ids=hcst_foobar,foobar;actions=read",
err: `perms.Parse: input grant string "ids=hcst_foobar,foobar;actions=read" contains ids of differently-typed resources: parameter violation: error #100`,
},
{
name: "bad create action for ids",
input: "ids=u_foobar;actions=create",
err: `perms.Parse: parsed grant string "ids=u_foobar;actions=create" contains create or list action in a format that does not allow these: parameter violation: error #100`,
},
{
name: "bad create action for ids with other perms",
input: "ids=u_foobar;actions=read,create",
err: `perms.Parse: parsed grant string "ids=u_foobar;actions=create,read" contains create or list action in a format that does not allow these: parameter violation: error #100`,
},
{
name: "bad list action for id",
input: "id=u_foobar;actions=list",
err: `perms.Parse: parsed grant string "id=u_foobar;actions=list" contains create or list action in a format that does not allow these: parameter violation: error #100`,
},
{
name: "bad list action for type with other perms",
input: "type=host-catalog;actions=list,read",
err: `perms.Parse: parsed grant string "type=host-catalog;actions=list,read" contains non-create or non-list action in a format that only allows these: parameter violation: error #100`,
},
{
name: "wildcard id and actions without collection",
input: "id=*;actions=read",
err: `perms.Parse: parsed grant string "id=*;actions=read" contains wildcard id and no specified type: parameter violation: error #100`,
},
{
name: "wildcard ids and actions without collection",
input: "ids=*;actions=read",
err: `perms.Parse: parsed grant string "ids=*;actions=read" contains wildcard id and no specified type: parameter violation: error #100`,
},
{
name: "wildcard id and actions with list",
input: "id=*;actions=read,list",
err: `perms.Parse: parsed grant string "id=*;actions=list,read" contains wildcard id and no specified type: parameter violation: error #100`,
},
{
name: "wildcard ids and actions with list",
input: "ids=*;actions=read,list",
err: `perms.Parse: parsed grant string "ids=*;actions=list,read" contains wildcard id and no specified type: parameter violation: error #100`,
},
{
name: "wildcard type with no ids",
input: "type=*;actions=read,list",
err: `perms.Parse: parsed grant string "type=*;actions=list,read" contains wildcard type with no id value: parameter violation: error #100`,
},
{
name: "mixed wildcard and non wildcard ids first position",
input: "ids=*,u_foobar;actions=read,list",
err: `perms.Parse: input grant string "ids=*,u_foobar;actions=read,list" contains both wildcard and non-wildcard values in "ids" field: parameter violation: error #100`,
},
{
name: "mixed wildcard and non wildcard ids second position",
input: "ids=u_foobar,*;actions=read,list",
err: `perms.Parse: input grant string "ids=u_foobar,*;actions=read,list" contains both wildcard and non-wildcard values in "ids" field: parameter violation: error #100`,
},
{
name: "empty ids and type",
input: "actions=create",
err: `perms.Parse: parsed grant string "actions=create" contains no id or type: parameter violation: error #100`,
},
{
name: "wildcard type non child id",
input: "id=ttcp_1234567890;type=*;actions=create",
err: `perms.Parse: parsed grant string "id=ttcp_1234567890;type=*;actions=create" contains an id that does not support child types: parameter violation: error #100`,
},
{
name: "wildcard type non child ids first position",
input: "ids=ttcp_1234567890,ttcp_1234567890;type=*;actions=create",
err: `perms.Parse: parsed grant string "ids=ttcp_1234567890,ttcp_1234567890;type=*;actions=create" contains an id that does not support child types: parameter violation: error #100`,
},
{
name: "wildcard type non child ids second position",
input: "ids=ttcp_1234567890,ttcp_1234567890;type=*;actions=create",
err: `perms.Parse: parsed grant string "ids=ttcp_1234567890,ttcp_1234567890;type=*;actions=create" contains an id that does not support child types: parameter violation: error #100`,
},
{
name: "specified resource type non child id",
input: "id=hcst_1234567890;type=account;actions=read",
err: `perms.Parse: parsed grant string "id=hcst_1234567890;type=account;actions=read" contains type account that is not a child type of the type (host-catalog) of the specified id: parameter violation: error #100`,
},
{
name: "specified resource type non child ids first position",
input: "ids=hcst_1234567890,hcst_1234567890;type=account;actions=read",
err: `perms.Parse: parsed grant string "ids=hcst_1234567890,hcst_1234567890;type=account;actions=read" contains type account that is not a child type of the type (host-catalog) of the specified id: parameter violation: error #100`,
},
{
name: "specified resource type non child ids second position",
input: "ids=hcst_1234567890,hcst_1234567890;type=account;actions=read",
err: `perms.Parse: parsed grant string "ids=hcst_1234567890,hcst_1234567890;type=account;actions=read" contains type account that is not a child type of the type (host-catalog) of the specified id: parameter violation: error #100`,
},
{
name: "no id with one bad action",
input: "type=host-set;actions=read",
err: `perms.Parse: parsed grant string "type=host-set;actions=read" contains non-create or non-list action in a format that only allows these: parameter violation: error #100`,
},
{
name: "no id with two bad action",
input: "type=host-set;actions=read,create",
err: `perms.Parse: parsed grant string "type=host-set;actions=create,read" contains non-create or non-list action in a format that only allows these: parameter violation: error #100`,
},
{
name: "no id with three bad action",
input: "type=host-set;actions=list,read,create",
err: `perms.Parse: parsed grant string "type=host-set;actions=create,list,read" contains non-create or non-list action in a format that only allows these: parameter violation: error #100`,
},
*/
{
name: "empty output fields",
input: "id=*;type=*;actions=read,list;output_fields=",
Expand Down

0 comments on commit ddd0d60

Please sign in to comment.