61 lines
2.3 KiB
Go
61 lines
2.3 KiB
Go
package rbac
|
|
|
|
import "testing"
|
|
|
|
func TestCan(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
role Role
|
|
action Action
|
|
want bool
|
|
}{
|
|
{name: "owner can manage project", role: RoleOwner, action: ActionProjectManage, want: true},
|
|
{name: "owner can read audit", role: RoleOwner, action: ActionAuditRead, want: true},
|
|
{name: "admin can delete vm", role: RoleAdmin, action: ActionVMDelete, want: true},
|
|
{name: "admin can manage ssh keys", role: RoleAdmin, action: ActionSSHKeyManage, want: true},
|
|
{name: "member can create vm", role: RoleMember, action: ActionVMCreate, want: true},
|
|
{name: "member cannot delete vm", role: RoleMember, action: ActionVMDelete, want: false},
|
|
{name: "member cannot read audit", role: RoleMember, action: ActionAuditRead, want: false},
|
|
{name: "viewer can read vm", role: RoleViewer, action: ActionVMRead, want: true},
|
|
{name: "viewer can open console", role: RoleViewer, action: ActionVMConsole, want: true},
|
|
{name: "viewer cannot power vm", role: RoleViewer, action: ActionVMPower, want: false},
|
|
{name: "viewer cannot create vm", role: RoleViewer, action: ActionVMCreate, want: false},
|
|
{name: "tenant roles cannot manage cluster", role: RoleOwner, action: ActionClusterManage, want: false},
|
|
{name: "operator can manage cluster", role: RoleOperator, action: ActionClusterManage, want: true},
|
|
{name: "operator cannot read tenant vms", role: RoleOperator, action: ActionVMRead, want: false},
|
|
{name: "unknown role denied", role: Role("unknown"), action: ActionVMRead, want: false},
|
|
{name: "unknown action denied", role: RoleOwner, action: Action("unknown.action"), want: false},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
if got := Can(tt.role, tt.action); got != tt.want {
|
|
t.Fatalf("Can(%q, %q) = %v, want %v", tt.role, tt.action, got, tt.want)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestPolicyMatrix(t *testing.T) {
|
|
roles := []Role{RoleOwner, RoleAdmin, RoleMember, RoleViewer, RoleOperator}
|
|
actions := []Action{
|
|
ActionVMRead,
|
|
ActionVMPower,
|
|
ActionVMCreate,
|
|
ActionVMDelete,
|
|
ActionVMConsole,
|
|
ActionProjectRead,
|
|
ActionProjectManage,
|
|
ActionSSHKeyRead,
|
|
ActionSSHKeyManage,
|
|
ActionAuditRead,
|
|
ActionClusterManage,
|
|
}
|
|
|
|
for _, role := range roles {
|
|
for _, action := range actions {
|
|
_ = Can(role, action)
|
|
}
|
|
}
|
|
}
|