759 lines
31 KiB
Rust
759 lines
31 KiB
Rust
mod parse;
|
|
use parse::Parse;
|
|
|
|
mod helpers;
|
|
use helpers::*;
|
|
|
|
#[macro_use]
|
|
mod util;
|
|
|
|
use std::collections::HashMap;
|
|
|
|
use surrealdb::dbs::Session;
|
|
use surrealdb::err::Error;
|
|
use surrealdb::iam::Role;
|
|
use surrealdb::kvs::{LockType::*, TransactionType::*};
|
|
use surrealdb::sql::Value;
|
|
|
|
#[tokio::test]
|
|
async fn remove_statement_table() -> Result<(), Error> {
|
|
let sql = "
|
|
DEFINE TABLE test SCHEMALESS;
|
|
REMOVE TABLE test;
|
|
INFO FOR DB;
|
|
";
|
|
let dbs = new_ds().await?;
|
|
let ses = Session::owner().with_ns("test").with_db("test");
|
|
let res = &mut dbs.execute(sql, &ses, None).await?;
|
|
assert_eq!(res.len(), 3);
|
|
//
|
|
let tmp = res.remove(0).result;
|
|
assert!(tmp.is_ok());
|
|
//
|
|
let tmp = res.remove(0).result;
|
|
assert!(tmp.is_ok());
|
|
//
|
|
let tmp = res.remove(0).result?;
|
|
let val = Value::parse(
|
|
"{
|
|
analyzers: {},
|
|
tokens: {},
|
|
functions: {},
|
|
params: {},
|
|
scopes: {},
|
|
tables: {},
|
|
users: {}
|
|
}",
|
|
);
|
|
assert_eq!(tmp, val);
|
|
Ok(())
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn remove_statement_analyzer() -> Result<(), Error> {
|
|
let sql = "
|
|
DEFINE ANALYZER english TOKENIZERS blank,class FILTERS lowercase,snowball(english);
|
|
REMOVE ANALYZER english;
|
|
INFO FOR DB;
|
|
";
|
|
let dbs = new_ds().await?;
|
|
let ses = Session::owner().with_ns("test").with_db("test");
|
|
let res = &mut dbs.execute(sql, &ses, None).await?;
|
|
assert_eq!(res.len(), 3);
|
|
// Analyzer is defined
|
|
let tmp = res.remove(0).result;
|
|
assert!(tmp.is_ok());
|
|
// Analyzer is removed
|
|
let tmp = res.remove(0).result;
|
|
assert!(tmp.is_ok());
|
|
// Check infos output
|
|
let tmp = res.remove(0).result?;
|
|
let val = Value::parse(
|
|
"{
|
|
analyzers: {},
|
|
tokens: {},
|
|
functions: {},
|
|
params: {},
|
|
scopes: {},
|
|
tables: {},
|
|
users: {}
|
|
}",
|
|
);
|
|
assert_eq!(tmp, val);
|
|
Ok(())
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn remove_statement_index() -> Result<(), Error> {
|
|
let sql = "
|
|
DEFINE INDEX uniq_isbn ON book FIELDS isbn UNIQUE;
|
|
DEFINE INDEX idx_author ON book FIELDS author;
|
|
DEFINE ANALYZER simple TOKENIZERS blank,class FILTERS lowercase;
|
|
DEFINE INDEX ft_title ON book FIELDS title SEARCH ANALYZER simple BM25 HIGHLIGHTS;
|
|
CREATE book:1 SET title = 'Rust Web Programming', isbn = '978-1803234694', author = 'Maxwell Flitton';
|
|
REMOVE INDEX uniq_isbn ON book;
|
|
REMOVE INDEX idx_author ON book;
|
|
REMOVE INDEX ft_title ON book;
|
|
INFO FOR TABLE book;
|
|
";
|
|
let dbs = new_ds().await?;
|
|
let ses = Session::owner().with_ns("test").with_db("test");
|
|
let res = &mut dbs.execute(sql, &ses, None).await?;
|
|
assert_eq!(res.len(), 9);
|
|
for _ in 0..8 {
|
|
let tmp = res.remove(0).result;
|
|
assert!(tmp.is_ok());
|
|
}
|
|
// Check infos output
|
|
let tmp = res.remove(0).result?;
|
|
let val = Value::parse(
|
|
"{
|
|
events: {},
|
|
fields: {},
|
|
indexes: {},
|
|
tables: {},
|
|
lives: {},
|
|
}",
|
|
);
|
|
assert_eq!(tmp, val);
|
|
|
|
let mut tx = dbs.transaction(Read, Optimistic).await?;
|
|
for ix in ["uniq_isbn", "idx_author", "ft_title"] {
|
|
assert_empty_prefix!(&mut tx, surrealdb::key::index::all::new("test", "test", "book", ix));
|
|
}
|
|
Ok(())
|
|
}
|
|
|
|
//
|
|
// Permissions
|
|
//
|
|
|
|
#[tokio::test]
|
|
async fn permissions_checks_remove_ns() {
|
|
let scenario = HashMap::from([
|
|
("prepare", "DEFINE NAMESPACE NS"),
|
|
("test", "REMOVE NAMESPACE NS"),
|
|
("check", "INFO FOR ROOT"),
|
|
]);
|
|
|
|
// Define the expected results for the check statement when the test statement succeeded and when it failed
|
|
let check_results = [
|
|
vec!["{ namespaces: { }, users: { } }"],
|
|
vec!["{ namespaces: { NS: 'DEFINE NAMESPACE NS' }, users: { } }"],
|
|
];
|
|
|
|
let test_cases = [
|
|
// Root level
|
|
((().into(), Role::Owner), ("NS", "DB"), true),
|
|
((().into(), Role::Editor), ("NS", "DB"), true),
|
|
((().into(), Role::Viewer), ("NS", "DB"), false),
|
|
// Namespace level
|
|
((("NS",).into(), Role::Owner), ("NS", "DB"), false),
|
|
((("NS",).into(), Role::Owner), ("OTHER_NS", "DB"), false),
|
|
((("NS",).into(), Role::Editor), ("NS", "DB"), false),
|
|
((("NS",).into(), Role::Editor), ("OTHER_NS", "DB"), false),
|
|
((("NS",).into(), Role::Viewer), ("NS", "DB"), false),
|
|
((("NS",).into(), Role::Viewer), ("OTHER_NS", "DB"), false),
|
|
// Database level
|
|
((("NS", "DB").into(), Role::Owner), ("NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Owner), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Owner), ("OTHER_NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("OTHER_NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("OTHER_NS", "DB"), false),
|
|
];
|
|
|
|
let res = iam_check_cases(test_cases.iter(), &scenario, check_results).await;
|
|
assert!(res.is_ok(), "{}", res.unwrap_err());
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn permissions_checks_remove_db() {
|
|
let scenario = HashMap::from([
|
|
("prepare", "DEFINE DATABASE DB"),
|
|
("test", "REMOVE DATABASE DB"),
|
|
("check", "INFO FOR NS"),
|
|
]);
|
|
|
|
// Define the expected results for the check statement when the test statement succeeded and when it failed
|
|
let check_results = [
|
|
vec!["{ databases: { }, tokens: { }, users: { } }"],
|
|
vec!["{ databases: { DB: 'DEFINE DATABASE DB' }, tokens: { }, users: { } }"],
|
|
];
|
|
|
|
let test_cases = [
|
|
// Root level
|
|
((().into(), Role::Owner), ("NS", "DB"), true),
|
|
((().into(), Role::Editor), ("NS", "DB"), true),
|
|
((().into(), Role::Viewer), ("NS", "DB"), false),
|
|
// Namespace level
|
|
((("NS",).into(), Role::Owner), ("NS", "DB"), true),
|
|
((("NS",).into(), Role::Owner), ("OTHER_NS", "DB"), false),
|
|
((("NS",).into(), Role::Editor), ("NS", "DB"), true),
|
|
((("NS",).into(), Role::Editor), ("OTHER_NS", "DB"), false),
|
|
((("NS",).into(), Role::Viewer), ("NS", "DB"), false),
|
|
((("NS",).into(), Role::Viewer), ("OTHER_NS", "DB"), false),
|
|
// Database level
|
|
((("NS", "DB").into(), Role::Owner), ("NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Owner), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Owner), ("OTHER_NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("OTHER_NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("OTHER_NS", "DB"), false),
|
|
];
|
|
|
|
let res = iam_check_cases(test_cases.iter(), &scenario, check_results).await;
|
|
assert!(res.is_ok(), "{}", res.unwrap_err());
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn permissions_checks_remove_function() {
|
|
let scenario = HashMap::from([
|
|
("prepare", "DEFINE FUNCTION fn::greet() {RETURN \"Hello\";}"),
|
|
("test", "REMOVE FUNCTION fn::greet()"),
|
|
("check", "INFO FOR DB"),
|
|
]);
|
|
|
|
// Define the expected results for the check statement when the test statement succeeded and when it failed
|
|
let check_results = [
|
|
vec!["{ analyzers: { }, functions: { }, params: { }, scopes: { }, tables: { }, tokens: { }, users: { } }"],
|
|
vec!["{ analyzers: { }, functions: { greet: \"DEFINE FUNCTION fn::greet() { RETURN 'Hello'; }\" }, params: { }, scopes: { }, tables: { }, tokens: { }, users: { } }"],
|
|
];
|
|
|
|
let test_cases = [
|
|
// Root level
|
|
((().into(), Role::Owner), ("NS", "DB"), true),
|
|
((().into(), Role::Editor), ("NS", "DB"), true),
|
|
((().into(), Role::Viewer), ("NS", "DB"), false),
|
|
// Namespace level
|
|
((("NS",).into(), Role::Owner), ("NS", "DB"), true),
|
|
((("NS",).into(), Role::Owner), ("OTHER_NS", "DB"), false),
|
|
((("NS",).into(), Role::Editor), ("NS", "DB"), true),
|
|
((("NS",).into(), Role::Editor), ("OTHER_NS", "DB"), false),
|
|
((("NS",).into(), Role::Viewer), ("NS", "DB"), false),
|
|
((("NS",).into(), Role::Viewer), ("OTHER_NS", "DB"), false),
|
|
// Database level
|
|
((("NS", "DB").into(), Role::Owner), ("NS", "DB"), true),
|
|
((("NS", "DB").into(), Role::Owner), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Owner), ("OTHER_NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("NS", "DB"), true),
|
|
((("NS", "DB").into(), Role::Editor), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("OTHER_NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("OTHER_NS", "DB"), false),
|
|
];
|
|
|
|
let res = iam_check_cases(test_cases.iter(), &scenario, check_results).await;
|
|
assert!(res.is_ok(), "{}", res.unwrap_err());
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn permissions_checks_remove_analyzer() {
|
|
let scenario = HashMap::from([
|
|
("prepare", "DEFINE ANALYZER analyzer TOKENIZERS BLANK"),
|
|
("test", "REMOVE ANALYZER analyzer"),
|
|
("check", "INFO FOR DB"),
|
|
]);
|
|
|
|
// Define the expected results for the check statement when the test statement succeeded and when it failed
|
|
let check_results = [
|
|
vec!["{ analyzers: { }, functions: { }, params: { }, scopes: { }, tables: { }, tokens: { }, users: { } }"],
|
|
vec!["{ analyzers: { analyzer: 'DEFINE ANALYZER analyzer TOKENIZERS BLANK' }, functions: { }, params: { }, scopes: { }, tables: { }, tokens: { }, users: { } }"],
|
|
];
|
|
|
|
let test_cases = [
|
|
// Root level
|
|
((().into(), Role::Owner), ("NS", "DB"), true),
|
|
((().into(), Role::Editor), ("NS", "DB"), true),
|
|
((().into(), Role::Viewer), ("NS", "DB"), false),
|
|
// Namespace level
|
|
((("NS",).into(), Role::Owner), ("NS", "DB"), true),
|
|
((("NS",).into(), Role::Owner), ("OTHER_NS", "DB"), false),
|
|
((("NS",).into(), Role::Editor), ("NS", "DB"), true),
|
|
((("NS",).into(), Role::Editor), ("OTHER_NS", "DB"), false),
|
|
((("NS",).into(), Role::Viewer), ("NS", "DB"), false),
|
|
((("NS",).into(), Role::Viewer), ("OTHER_NS", "DB"), false),
|
|
// Database level
|
|
((("NS", "DB").into(), Role::Owner), ("NS", "DB"), true),
|
|
((("NS", "DB").into(), Role::Owner), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Owner), ("OTHER_NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("NS", "DB"), true),
|
|
((("NS", "DB").into(), Role::Editor), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("OTHER_NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("OTHER_NS", "DB"), false),
|
|
];
|
|
|
|
let res = iam_check_cases(test_cases.iter(), &scenario, check_results).await;
|
|
assert!(res.is_ok(), "{}", res.unwrap_err());
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn permissions_checks_remove_ns_token() {
|
|
let scenario = HashMap::from([
|
|
("prepare", "DEFINE TOKEN token ON NS TYPE HS512 VALUE 'secret'"),
|
|
("test", "REMOVE TOKEN token ON NS"),
|
|
("check", "INFO FOR NS"),
|
|
]);
|
|
|
|
// Define the expected results for the check statement when the test statement succeeded and when it failed
|
|
let check_results = [
|
|
vec!["{ databases: { }, tokens: { }, users: { } }"],
|
|
vec!["{ databases: { }, tokens: { token: \"DEFINE TOKEN token ON NAMESPACE TYPE HS512 VALUE 'secret'\" }, users: { } }"],
|
|
];
|
|
|
|
let test_cases = [
|
|
// Root level
|
|
((().into(), Role::Owner), ("NS", "DB"), true),
|
|
((().into(), Role::Editor), ("NS", "DB"), false),
|
|
((().into(), Role::Viewer), ("NS", "DB"), false),
|
|
// Namespace level
|
|
((("NS",).into(), Role::Owner), ("NS", "DB"), true),
|
|
((("NS",).into(), Role::Owner), ("OTHER_NS", "DB"), false),
|
|
((("NS",).into(), Role::Editor), ("NS", "DB"), false),
|
|
((("NS",).into(), Role::Editor), ("OTHER_NS", "DB"), false),
|
|
((("NS",).into(), Role::Viewer), ("NS", "DB"), false),
|
|
((("NS",).into(), Role::Viewer), ("OTHER_NS", "DB"), false),
|
|
// Database level
|
|
((("NS", "DB").into(), Role::Owner), ("NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Owner), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Owner), ("OTHER_NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("OTHER_NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("OTHER_NS", "DB"), false),
|
|
];
|
|
|
|
let res = iam_check_cases(test_cases.iter(), &scenario, check_results).await;
|
|
assert!(res.is_ok(), "{}", res.unwrap_err());
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn permissions_checks_remove_db_token() {
|
|
let scenario = HashMap::from([
|
|
("prepare", "DEFINE TOKEN token ON DB TYPE HS512 VALUE 'secret'"),
|
|
("test", "REMOVE TOKEN token ON DB"),
|
|
("check", "INFO FOR DB"),
|
|
]);
|
|
|
|
// Define the expected results for the check statement when the test statement succeeded and when it failed
|
|
let check_results = [
|
|
vec!["{ analyzers: { }, functions: { }, params: { }, scopes: { }, tables: { }, tokens: { }, users: { } }"],
|
|
vec!["{ analyzers: { }, functions: { }, params: { }, scopes: { }, tables: { }, tokens: { token: \"DEFINE TOKEN token ON DATABASE TYPE HS512 VALUE 'secret'\" }, users: { } }"],
|
|
];
|
|
|
|
let test_cases = [
|
|
// Root level
|
|
((().into(), Role::Owner), ("NS", "DB"), true),
|
|
((().into(), Role::Editor), ("NS", "DB"), false),
|
|
((().into(), Role::Viewer), ("NS", "DB"), false),
|
|
// Namespace level
|
|
((("NS",).into(), Role::Owner), ("NS", "DB"), true),
|
|
((("NS",).into(), Role::Owner), ("OTHER_NS", "DB"), false),
|
|
((("NS",).into(), Role::Editor), ("NS", "DB"), false),
|
|
((("NS",).into(), Role::Editor), ("OTHER_NS", "DB"), false),
|
|
((("NS",).into(), Role::Viewer), ("NS", "DB"), false),
|
|
((("NS",).into(), Role::Viewer), ("OTHER_NS", "DB"), false),
|
|
// Database level
|
|
((("NS", "DB").into(), Role::Owner), ("NS", "DB"), true),
|
|
((("NS", "DB").into(), Role::Owner), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Owner), ("OTHER_NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("OTHER_NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("OTHER_NS", "DB"), false),
|
|
];
|
|
|
|
let res = iam_check_cases(test_cases.iter(), &scenario, check_results).await;
|
|
assert!(res.is_ok(), "{}", res.unwrap_err());
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn permissions_checks_remove_root_user() {
|
|
let scenario = HashMap::from([
|
|
("prepare", "DEFINE USER user ON ROOT PASSHASH 'secret' ROLES VIEWER"),
|
|
("test", "REMOVE USER user ON ROOT"),
|
|
("check", "INFO FOR ROOT"),
|
|
]);
|
|
|
|
// Define the expected results for the check statement when the test statement succeeded and when it failed
|
|
let check_results = [
|
|
vec!["{ namespaces: { }, users: { } }"],
|
|
vec!["{ namespaces: { }, users: { user: \"DEFINE USER user ON ROOT PASSHASH 'secret' ROLES VIEWER\" } }"],
|
|
];
|
|
|
|
let test_cases = [
|
|
// Root level
|
|
((().into(), Role::Owner), ("NS", "DB"), true),
|
|
((().into(), Role::Editor), ("NS", "DB"), false),
|
|
((().into(), Role::Viewer), ("NS", "DB"), false),
|
|
// Namespace level
|
|
((("NS",).into(), Role::Owner), ("NS", "DB"), false),
|
|
((("NS",).into(), Role::Owner), ("OTHER_NS", "DB"), false),
|
|
((("NS",).into(), Role::Editor), ("NS", "DB"), false),
|
|
((("NS",).into(), Role::Editor), ("OTHER_NS", "DB"), false),
|
|
((("NS",).into(), Role::Viewer), ("NS", "DB"), false),
|
|
((("NS",).into(), Role::Viewer), ("OTHER_NS", "DB"), false),
|
|
// Database level
|
|
((("NS", "DB").into(), Role::Owner), ("NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Owner), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Owner), ("OTHER_NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("OTHER_NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("OTHER_NS", "DB"), false),
|
|
];
|
|
|
|
let res = iam_check_cases(test_cases.iter(), &scenario, check_results).await;
|
|
assert!(res.is_ok(), "{}", res.unwrap_err());
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn permissions_checks_remove_ns_user() {
|
|
let scenario = HashMap::from([
|
|
("prepare", "DEFINE USER user ON NS PASSHASH 'secret' ROLES VIEWER"),
|
|
("test", "REMOVE USER user ON NS"),
|
|
("check", "INFO FOR NS"),
|
|
]);
|
|
|
|
// Define the expected results for the check statement when the test statement succeeded and when it failed
|
|
let check_results = [
|
|
vec!["{ databases: { }, tokens: { }, users: { } }"],
|
|
vec!["{ databases: { }, tokens: { }, users: { user: \"DEFINE USER user ON NAMESPACE PASSHASH 'secret' ROLES VIEWER\" } }"],
|
|
];
|
|
|
|
let test_cases = [
|
|
// Root level
|
|
((().into(), Role::Owner), ("NS", "DB"), true),
|
|
((().into(), Role::Editor), ("NS", "DB"), false),
|
|
((().into(), Role::Viewer), ("NS", "DB"), false),
|
|
// Namespace level
|
|
((("NS",).into(), Role::Owner), ("NS", "DB"), true),
|
|
((("NS",).into(), Role::Owner), ("OTHER_NS", "DB"), false),
|
|
((("NS",).into(), Role::Editor), ("NS", "DB"), false),
|
|
((("NS",).into(), Role::Editor), ("OTHER_NS", "DB"), false),
|
|
((("NS",).into(), Role::Viewer), ("NS", "DB"), false),
|
|
((("NS",).into(), Role::Viewer), ("OTHER_NS", "DB"), false),
|
|
// Database level
|
|
((("NS", "DB").into(), Role::Owner), ("NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Owner), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Owner), ("OTHER_NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("OTHER_NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("OTHER_NS", "DB"), false),
|
|
];
|
|
|
|
let res = iam_check_cases(test_cases.iter(), &scenario, check_results).await;
|
|
assert!(res.is_ok(), "{}", res.unwrap_err());
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn permissions_checks_remove_db_user() {
|
|
let scenario = HashMap::from([
|
|
("prepare", "DEFINE USER user ON DB PASSHASH 'secret' ROLES VIEWER"),
|
|
("test", "REMOVE USER user ON DB"),
|
|
("check", "INFO FOR DB"),
|
|
]);
|
|
|
|
// Define the expected results for the check statement when the test statement succeeded and when it failed
|
|
let check_results = [
|
|
vec!["{ analyzers: { }, functions: { }, params: { }, scopes: { }, tables: { }, tokens: { }, users: { } }"],
|
|
vec!["{ analyzers: { }, functions: { }, params: { }, scopes: { }, tables: { }, tokens: { }, users: { user: \"DEFINE USER user ON DATABASE PASSHASH 'secret' ROLES VIEWER\" } }"],
|
|
];
|
|
|
|
let test_cases = [
|
|
// Root level
|
|
((().into(), Role::Owner), ("NS", "DB"), true),
|
|
((().into(), Role::Editor), ("NS", "DB"), false),
|
|
((().into(), Role::Viewer), ("NS", "DB"), false),
|
|
// Namespace level
|
|
((("NS",).into(), Role::Owner), ("NS", "DB"), true),
|
|
((("NS",).into(), Role::Owner), ("OTHER_NS", "DB"), false),
|
|
((("NS",).into(), Role::Editor), ("NS", "DB"), false),
|
|
((("NS",).into(), Role::Editor), ("OTHER_NS", "DB"), false),
|
|
((("NS",).into(), Role::Viewer), ("NS", "DB"), false),
|
|
((("NS",).into(), Role::Viewer), ("OTHER_NS", "DB"), false),
|
|
// Database level
|
|
((("NS", "DB").into(), Role::Owner), ("NS", "DB"), true),
|
|
((("NS", "DB").into(), Role::Owner), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Owner), ("OTHER_NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("OTHER_NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("OTHER_NS", "DB"), false),
|
|
];
|
|
|
|
let res = iam_check_cases(test_cases.iter(), &scenario, check_results).await;
|
|
assert!(res.is_ok(), "{}", res.unwrap_err());
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn permissions_checks_remove_scope() {
|
|
let scenario = HashMap::from([
|
|
("prepare", "DEFINE SCOPE account SESSION 1h;"),
|
|
("test", "REMOVE SCOPE account"),
|
|
("check", "INFO FOR DB"),
|
|
]);
|
|
|
|
// Define the expected results for the check statement when the test statement succeeded and when it failed
|
|
let check_results = [
|
|
vec!["{ analyzers: { }, functions: { }, params: { }, scopes: { }, tables: { }, tokens: { }, users: { } }"],
|
|
vec!["{ analyzers: { }, functions: { }, params: { }, scopes: { account: 'DEFINE SCOPE account SESSION 1h' }, tables: { }, tokens: { }, users: { } }"],
|
|
];
|
|
|
|
let test_cases = [
|
|
// Root level
|
|
((().into(), Role::Owner), ("NS", "DB"), true),
|
|
((().into(), Role::Editor), ("NS", "DB"), true),
|
|
((().into(), Role::Viewer), ("NS", "DB"), false),
|
|
// Namespace level
|
|
((("NS",).into(), Role::Owner), ("NS", "DB"), true),
|
|
((("NS",).into(), Role::Owner), ("OTHER_NS", "DB"), false),
|
|
((("NS",).into(), Role::Editor), ("NS", "DB"), true),
|
|
((("NS",).into(), Role::Editor), ("OTHER_NS", "DB"), false),
|
|
((("NS",).into(), Role::Viewer), ("NS", "DB"), false),
|
|
((("NS",).into(), Role::Viewer), ("OTHER_NS", "DB"), false),
|
|
// Database level
|
|
((("NS", "DB").into(), Role::Owner), ("NS", "DB"), true),
|
|
((("NS", "DB").into(), Role::Owner), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Owner), ("OTHER_NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("NS", "DB"), true),
|
|
((("NS", "DB").into(), Role::Editor), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("OTHER_NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("OTHER_NS", "DB"), false),
|
|
];
|
|
|
|
let res = iam_check_cases(test_cases.iter(), &scenario, check_results).await;
|
|
assert!(res.is_ok(), "{}", res.unwrap_err());
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn permissions_checks_remove_param() {
|
|
let scenario = HashMap::from([
|
|
("prepare", "DEFINE PARAM $param VALUE 'foo'"),
|
|
("test", "REMOVE PARAM $param"),
|
|
("check", "INFO FOR DB"),
|
|
]);
|
|
|
|
// Define the expected results for the check statement when the test statement succeeded and when it failed
|
|
let check_results = [
|
|
vec!["{ analyzers: { }, functions: { }, params: { }, scopes: { }, tables: { }, tokens: { }, users: { } }"],
|
|
vec!["{ analyzers: { }, functions: { }, params: { param: \"DEFINE PARAM $param VALUE 'foo'\" }, scopes: { }, tables: { }, tokens: { }, users: { } }"],
|
|
];
|
|
|
|
let test_cases = [
|
|
// Root level
|
|
((().into(), Role::Owner), ("NS", "DB"), true),
|
|
((().into(), Role::Editor), ("NS", "DB"), true),
|
|
((().into(), Role::Viewer), ("NS", "DB"), false),
|
|
// Namespace level
|
|
((("NS",).into(), Role::Owner), ("NS", "DB"), true),
|
|
((("NS",).into(), Role::Owner), ("OTHER_NS", "DB"), false),
|
|
((("NS",).into(), Role::Editor), ("NS", "DB"), true),
|
|
((("NS",).into(), Role::Editor), ("OTHER_NS", "DB"), false),
|
|
((("NS",).into(), Role::Viewer), ("NS", "DB"), false),
|
|
((("NS",).into(), Role::Viewer), ("OTHER_NS", "DB"), false),
|
|
// Database level
|
|
((("NS", "DB").into(), Role::Owner), ("NS", "DB"), true),
|
|
((("NS", "DB").into(), Role::Owner), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Owner), ("OTHER_NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("NS", "DB"), true),
|
|
((("NS", "DB").into(), Role::Editor), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("OTHER_NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("OTHER_NS", "DB"), false),
|
|
];
|
|
|
|
let res = iam_check_cases(test_cases.iter(), &scenario, check_results).await;
|
|
assert!(res.is_ok(), "{}", res.unwrap_err());
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn permissions_checks_remove_table() {
|
|
let scenario = HashMap::from([
|
|
("prepare", "DEFINE TABLE TB"),
|
|
("test", "REMOVE TABLE TB"),
|
|
("check", "INFO FOR DB"),
|
|
]);
|
|
|
|
// Define the expected results for the check statement when the test statement succeeded and when it failed
|
|
let check_results = [
|
|
vec!["{ analyzers: { }, functions: { }, params: { }, scopes: { }, tables: { }, tokens: { }, users: { } }"],
|
|
vec!["{ analyzers: { }, functions: { }, params: { }, scopes: { }, tables: { TB: 'DEFINE TABLE TB SCHEMALESS' }, tokens: { }, users: { } }"],
|
|
];
|
|
|
|
let test_cases = [
|
|
// Root level
|
|
((().into(), Role::Owner), ("NS", "DB"), true),
|
|
((().into(), Role::Editor), ("NS", "DB"), true),
|
|
((().into(), Role::Viewer), ("NS", "DB"), false),
|
|
// Namespace level
|
|
((("NS",).into(), Role::Owner), ("NS", "DB"), true),
|
|
((("NS",).into(), Role::Owner), ("OTHER_NS", "DB"), false),
|
|
((("NS",).into(), Role::Editor), ("NS", "DB"), true),
|
|
((("NS",).into(), Role::Editor), ("OTHER_NS", "DB"), false),
|
|
((("NS",).into(), Role::Viewer), ("NS", "DB"), false),
|
|
((("NS",).into(), Role::Viewer), ("OTHER_NS", "DB"), false),
|
|
// Database level
|
|
((("NS", "DB").into(), Role::Owner), ("NS", "DB"), true),
|
|
((("NS", "DB").into(), Role::Owner), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Owner), ("OTHER_NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("NS", "DB"), true),
|
|
((("NS", "DB").into(), Role::Editor), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("OTHER_NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("OTHER_NS", "DB"), false),
|
|
];
|
|
|
|
let res = iam_check_cases(test_cases.iter(), &scenario, check_results).await;
|
|
assert!(res.is_ok(), "{}", res.unwrap_err());
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn permissions_checks_remove_event() {
|
|
let scenario = HashMap::from([
|
|
("prepare", "DEFINE EVENT event ON TABLE TB WHEN true THEN RETURN 'foo'"),
|
|
("test", "REMOVE EVENT event ON TABLE TB"),
|
|
("check", "INFO FOR TABLE TB"),
|
|
]);
|
|
|
|
// Define the expected results for the check statement when the test statement succeeded and when it failed
|
|
let check_results = [
|
|
vec!["{ events: { }, fields: { }, indexes: { }, lives: { }, tables: { } }"],
|
|
vec!["{ events: { event: \"DEFINE EVENT event ON TB WHEN true THEN (RETURN 'foo')\" }, fields: { }, indexes: { }, lives: { }, tables: { } }"],
|
|
];
|
|
|
|
let test_cases = [
|
|
// Root level
|
|
((().into(), Role::Owner), ("NS", "DB"), true),
|
|
((().into(), Role::Editor), ("NS", "DB"), true),
|
|
((().into(), Role::Viewer), ("NS", "DB"), false),
|
|
// Namespace level
|
|
((("NS",).into(), Role::Owner), ("NS", "DB"), true),
|
|
((("NS",).into(), Role::Owner), ("OTHER_NS", "DB"), false),
|
|
((("NS",).into(), Role::Editor), ("NS", "DB"), true),
|
|
((("NS",).into(), Role::Editor), ("OTHER_NS", "DB"), false),
|
|
((("NS",).into(), Role::Viewer), ("NS", "DB"), false),
|
|
((("NS",).into(), Role::Viewer), ("OTHER_NS", "DB"), false),
|
|
// Database level
|
|
((("NS", "DB").into(), Role::Owner), ("NS", "DB"), true),
|
|
((("NS", "DB").into(), Role::Owner), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Owner), ("OTHER_NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("NS", "DB"), true),
|
|
((("NS", "DB").into(), Role::Editor), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("OTHER_NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("OTHER_NS", "DB"), false),
|
|
];
|
|
|
|
let res = iam_check_cases(test_cases.iter(), &scenario, check_results).await;
|
|
assert!(res.is_ok(), "{}", res.unwrap_err());
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn permissions_checks_remove_field() {
|
|
let scenario = HashMap::from([
|
|
("prepare", "DEFINE FIELD field ON TABLE TB"),
|
|
("test", "REMOVE FIELD field ON TABLE TB"),
|
|
("check", "INFO FOR TABLE TB"),
|
|
]);
|
|
|
|
// Define the expected results for the check statement when the test statement succeeded and when it failed
|
|
let check_results = [
|
|
vec!["{ events: { }, fields: { }, indexes: { }, lives: { }, tables: { } }"],
|
|
vec!["{ events: { }, fields: { field: 'DEFINE FIELD field ON TB' }, indexes: { }, lives: { }, tables: { } }"],
|
|
];
|
|
|
|
let test_cases = [
|
|
// Root level
|
|
((().into(), Role::Owner), ("NS", "DB"), true),
|
|
((().into(), Role::Editor), ("NS", "DB"), true),
|
|
((().into(), Role::Viewer), ("NS", "DB"), false),
|
|
// Namespace level
|
|
((("NS",).into(), Role::Owner), ("NS", "DB"), true),
|
|
((("NS",).into(), Role::Owner), ("OTHER_NS", "DB"), false),
|
|
((("NS",).into(), Role::Editor), ("NS", "DB"), true),
|
|
((("NS",).into(), Role::Editor), ("OTHER_NS", "DB"), false),
|
|
((("NS",).into(), Role::Viewer), ("NS", "DB"), false),
|
|
((("NS",).into(), Role::Viewer), ("OTHER_NS", "DB"), false),
|
|
// Database level
|
|
((("NS", "DB").into(), Role::Owner), ("NS", "DB"), true),
|
|
((("NS", "DB").into(), Role::Owner), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Owner), ("OTHER_NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("NS", "DB"), true),
|
|
((("NS", "DB").into(), Role::Editor), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("OTHER_NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("OTHER_NS", "DB"), false),
|
|
];
|
|
|
|
let res = iam_check_cases(test_cases.iter(), &scenario, check_results).await;
|
|
assert!(res.is_ok(), "{}", res.unwrap_err());
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn permissions_checks_remove_index() {
|
|
let scenario = HashMap::from([
|
|
("prepare", "DEFINE INDEX index ON TABLE TB FIELDS field"),
|
|
("test", "REMOVE INDEX index ON TABLE TB"),
|
|
("check", "INFO FOR TABLE TB"),
|
|
]);
|
|
|
|
// Define the expected results for the check statement when the test statement succeeded and when it failed
|
|
let check_results = [
|
|
vec!["{ events: { }, fields: { }, indexes: { }, lives: { }, tables: { } }"],
|
|
vec!["{ events: { }, fields: { }, indexes: { index: 'DEFINE INDEX index ON TB FIELDS field' }, lives: { }, tables: { } }"],
|
|
];
|
|
|
|
let test_cases = [
|
|
// Root level
|
|
((().into(), Role::Owner), ("NS", "DB"), true),
|
|
((().into(), Role::Editor), ("NS", "DB"), true),
|
|
((().into(), Role::Viewer), ("NS", "DB"), false),
|
|
// Namespace level
|
|
((("NS",).into(), Role::Owner), ("NS", "DB"), true),
|
|
((("NS",).into(), Role::Owner), ("OTHER_NS", "DB"), false),
|
|
((("NS",).into(), Role::Editor), ("NS", "DB"), true),
|
|
((("NS",).into(), Role::Editor), ("OTHER_NS", "DB"), false),
|
|
((("NS",).into(), Role::Viewer), ("NS", "DB"), false),
|
|
((("NS",).into(), Role::Viewer), ("OTHER_NS", "DB"), false),
|
|
// Database level
|
|
((("NS", "DB").into(), Role::Owner), ("NS", "DB"), true),
|
|
((("NS", "DB").into(), Role::Owner), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Owner), ("OTHER_NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("NS", "DB"), true),
|
|
((("NS", "DB").into(), Role::Editor), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Editor), ("OTHER_NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("NS", "DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("NS", "OTHER_DB"), false),
|
|
((("NS", "DB").into(), Role::Viewer), ("OTHER_NS", "DB"), false),
|
|
];
|
|
|
|
let res = iam_check_cases(test_cases.iter(), &scenario, check_results).await;
|
|
assert!(res.is_ok(), "{}", res.unwrap_err());
|
|
}
|