Compare commits
19 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
| 60795d413d | |||
| a2164c4beb | |||
| 90e028b173 | |||
| 6ce176b927 | |||
| 48a063eba2 | |||
| 5634c26039 | |||
| 429f45935a | |||
| 3c36225665 | |||
| f6417140cb | |||
| fb0273fe3c | |||
| eb147039b6 | |||
| c36ff4fa98 | |||
| 965d317a11 | |||
| 376278e2be | |||
| e0632f1895 | |||
| afc14717e3 | |||
| db43357ce0 | |||
| 1476170f88 | |||
| d1898339b1 |
+12
-21
@@ -1,18 +1,10 @@
|
|||||||
|
include:
|
||||||
|
- template: 'Workflows/MergeRequest-Pipelines.gitlab-ci.yml'
|
||||||
|
|
||||||
|
image: golang:1.15
|
||||||
|
|
||||||
variables:
|
variables:
|
||||||
GOCACHE: "${CI_PROJECT_DIR}/_go/cache"
|
GOFLAGS: -mod=readonly
|
||||||
|
|
||||||
before_script:
|
|
||||||
- mkdir -p ${CI_PROJECT_DIR}/_go/{pkg,bin,cache}
|
|
||||||
- rm -rf /go/pkg || true
|
|
||||||
- mkdir -p /go
|
|
||||||
- ln -s ${CI_PROJECT_DIR}/_go/pkg /go/pkg
|
|
||||||
- ln -s ${CI_PROJECT_DIR}/_go/bin /go/bin
|
|
||||||
|
|
||||||
cache:
|
|
||||||
key: "$CI_COMMIT_REF_NAME"
|
|
||||||
paths:
|
|
||||||
- _go
|
|
||||||
untracked: true
|
|
||||||
|
|
||||||
stages:
|
stages:
|
||||||
- deps
|
- deps
|
||||||
@@ -20,22 +12,21 @@ stages:
|
|||||||
|
|
||||||
deps:
|
deps:
|
||||||
stage: deps
|
stage: deps
|
||||||
image: golang:1.13
|
|
||||||
script:
|
script:
|
||||||
- go get -mod=readonly
|
- go mod download
|
||||||
|
|
||||||
test:
|
test:
|
||||||
stage: test
|
stage: test
|
||||||
dependencies:
|
dependencies:
|
||||||
- deps
|
- deps
|
||||||
image: golang:1.13
|
|
||||||
script:
|
script:
|
||||||
- go fmt $(go list ./...)
|
- go fmt $(go list ./...)
|
||||||
- go vet $(go list ./...)
|
- go vet $(go list ./...)
|
||||||
- unset "${!CI@}"
|
- CGO_ENABLED=1 go test -mod=readonly -race -coverprofile=coverage.txt -covermode=atomic -coverpkg=$(go list ./... | tr '\n' , | sed 's/,$//') ./...
|
||||||
- CGO_ENABLED=1 go test -p 1 -mod=readonly -race -coverprofile=.testCoverage.txt -covermode=atomic -coverpkg=$(go list ./... | tr '\n' , | sed 's/,$//') ./...
|
- go tool cover -html=coverage.txt -o coverage.html
|
||||||
- go tool cover -html=.testCoverage.txt -o coverage.html
|
- go tool cover -func=coverage.txt
|
||||||
- go tool cover -func=.testCoverage.txt
|
- bash <(curl -s https://codecov.io/bash)
|
||||||
artifacts:
|
artifacts:
|
||||||
paths:
|
paths:
|
||||||
- coverage.html
|
- coverage.html
|
||||||
|
- coverage.txt
|
||||||
|
|||||||
@@ -1,3 +1,4 @@
|
|||||||
# Shiny authz-client
|
# Shiny authz-client
|
||||||
|
|
||||||
[](https://gitlab.com/unboundsoftware/shiny/authz-client/commits/master)[](https://gitlab.com/unboundsoftware/shiny/authz-client/commits/master)
|
[](https://gitlab.com/unboundsoftware/shiny/authz_client/commits/main)
|
||||||
|
[](https://codecov.io/gl/unboundsoftware:shiny/authz_client)
|
||||||
|
|||||||
@@ -5,6 +5,9 @@ import (
|
|||||||
"fmt"
|
"fmt"
|
||||||
"io/ioutil"
|
"io/ioutil"
|
||||||
"net/http"
|
"net/http"
|
||||||
|
"reflect"
|
||||||
|
|
||||||
|
"gitlab.com/sparetimecoders/goamqp"
|
||||||
)
|
)
|
||||||
|
|
||||||
// CompanyPrivileges contains the privileges for a combination of email address and company id
|
// CompanyPrivileges contains the privileges for a combination of email address and company id
|
||||||
@@ -18,24 +21,11 @@ type CompanyPrivileges struct {
|
|||||||
Supplier bool `json:"supplier"`
|
Supplier bool `json:"supplier"`
|
||||||
}
|
}
|
||||||
|
|
||||||
// PrivilegeAdded is the event sent when a new privilege is added
|
|
||||||
type PrivilegeAdded struct {
|
|
||||||
Email string `json:"email"`
|
|
||||||
CompanyID string `json:"companyId"`
|
|
||||||
Admin bool `json:"admin"`
|
|
||||||
Company bool `json:"company"`
|
|
||||||
Consumer bool `json:"consumer"`
|
|
||||||
Time bool `json:"time"`
|
|
||||||
Invoicing bool `json:"invoicing"`
|
|
||||||
Accounting bool `json:"accounting"`
|
|
||||||
Supplier bool `json:"supplier"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// PrivilegeHandler processes PrivilegeAdded-events and fetches the initial set of privileges from an authz-service
|
// PrivilegeHandler processes PrivilegeAdded-events and fetches the initial set of privileges from an authz-service
|
||||||
type PrivilegeHandler struct {
|
type PrivilegeHandler struct {
|
||||||
client *http.Client
|
client *http.Client
|
||||||
baseURL string
|
baseURL string
|
||||||
privileges map[string]map[string]CompanyPrivileges
|
privileges map[string]map[string]*CompanyPrivileges
|
||||||
}
|
}
|
||||||
|
|
||||||
// OptsFunc is used to configure the PrivilegeHandler
|
// OptsFunc is used to configure the PrivilegeHandler
|
||||||
@@ -53,7 +43,7 @@ func New(opts ...OptsFunc) *PrivilegeHandler {
|
|||||||
handler := &PrivilegeHandler{
|
handler := &PrivilegeHandler{
|
||||||
client: &http.Client{},
|
client: &http.Client{},
|
||||||
baseURL: "http://authz-service",
|
baseURL: "http://authz-service",
|
||||||
privileges: map[string]map[string]CompanyPrivileges{},
|
privileges: map[string]map[string]*CompanyPrivileges{},
|
||||||
}
|
}
|
||||||
for _, opt := range opts {
|
for _, opt := range opts {
|
||||||
opt(handler)
|
opt(handler)
|
||||||
@@ -81,30 +71,60 @@ func (h *PrivilegeHandler) Fetch() error {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Process privilege-related events and update the internal state
|
// Process privilege-related events and update the internal state
|
||||||
func (h *PrivilegeHandler) Process(msg interface{}) bool {
|
func (h *PrivilegeHandler) Process(msg interface{}, _ goamqp.Headers) (interface{}, error) {
|
||||||
if ev, ok := msg.(*PrivilegeAdded); ok {
|
switch ev := msg.(type) {
|
||||||
h.setPrivileges(ev)
|
case *UserAdded:
|
||||||
return true
|
if priv, exists := h.privileges[ev.Email]; exists {
|
||||||
|
priv[ev.CompanyID] = &CompanyPrivileges{}
|
||||||
|
} else {
|
||||||
|
h.privileges[ev.Email] = map[string]*CompanyPrivileges{
|
||||||
|
ev.CompanyID: {},
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return nil, nil
|
||||||
|
case *UserRemoved:
|
||||||
|
if priv, exists := h.privileges[ev.Email]; exists {
|
||||||
|
delete(priv, ev.CompanyID)
|
||||||
|
}
|
||||||
|
return nil, nil
|
||||||
|
case *PrivilegeAdded:
|
||||||
|
h.setPrivileges(ev.Email, ev.CompanyID, ev.Privilege, true)
|
||||||
|
return nil, nil
|
||||||
|
case *PrivilegeRemoved:
|
||||||
|
h.setPrivileges(ev.Email, ev.CompanyID, ev.Privilege, false)
|
||||||
|
return nil, nil
|
||||||
|
default:
|
||||||
|
fmt.Printf("Got unexpected message type (%s): '%+v'\n", reflect.TypeOf(msg).String(), msg)
|
||||||
|
return nil, fmt.Errorf("unexpected event type: '%s'", reflect.TypeOf(msg))
|
||||||
}
|
}
|
||||||
return false
|
|
||||||
}
|
}
|
||||||
|
|
||||||
func (h *PrivilegeHandler) setPrivileges(ev *PrivilegeAdded) {
|
func (h *PrivilegeHandler) setPrivileges(email, companyId string, privilege Privilege, set bool) {
|
||||||
if priv, exists := h.privileges[ev.Email]; exists {
|
if priv, exists := h.privileges[email]; exists {
|
||||||
priv[ev.CompanyID] = CompanyPrivileges{
|
if c, exists := priv[companyId]; exists {
|
||||||
Admin: ev.Admin,
|
switch privilege {
|
||||||
Company: ev.Company,
|
case PrivilegeAdmin:
|
||||||
Consumer: ev.Consumer,
|
c.Admin = set
|
||||||
Time: ev.Time,
|
case PrivilegeCompany:
|
||||||
Invoicing: ev.Invoicing,
|
c.Company = set
|
||||||
Accounting: ev.Accounting,
|
case PrivilegeConsumer:
|
||||||
Supplier: ev.Supplier,
|
c.Consumer = set
|
||||||
|
case PrivilegeTime:
|
||||||
|
c.Time = set
|
||||||
|
case PrivilegeInvoicing:
|
||||||
|
c.Invoicing = set
|
||||||
|
case PrivilegeAccounting:
|
||||||
|
c.Accounting = set
|
||||||
|
case PrivilegeSupplier:
|
||||||
|
c.Supplier = set
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
priv[companyId] = &CompanyPrivileges{}
|
||||||
|
h.setPrivileges(email, companyId, privilege, set)
|
||||||
}
|
}
|
||||||
} else {
|
} else {
|
||||||
h.privileges[ev.Email] = map[string]CompanyPrivileges{
|
h.privileges[email] = map[string]*CompanyPrivileges{}
|
||||||
ev.CompanyID: {},
|
h.setPrivileges(email, companyId, privilege, set)
|
||||||
}
|
|
||||||
h.setPrivileges(ev)
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -113,10 +133,21 @@ func (h *PrivilegeHandler) CompaniesByUser(email string, predicate func(privileg
|
|||||||
var result []string
|
var result []string
|
||||||
if p, exists := h.privileges[email]; exists {
|
if p, exists := h.privileges[email]; exists {
|
||||||
for k, v := range p {
|
for k, v := range p {
|
||||||
if predicate(v) {
|
if predicate(*v) {
|
||||||
result = append(result, k)
|
result = append(result, k)
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
return result
|
return result
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// IsAllowed return true if the provided predicate return true for the privileges matching the provided email and companyID, return false otherwise
|
||||||
|
func (h *PrivilegeHandler) IsAllowed(email, companyID string, predicate func(privileges CompanyPrivileges) bool) bool {
|
||||||
|
if p, exists := h.privileges[email]; exists {
|
||||||
|
if v, exists := p[companyID]; exists {
|
||||||
|
return predicate(*v)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
|||||||
+185
-42
@@ -2,18 +2,97 @@ package client
|
|||||||
|
|
||||||
import (
|
import (
|
||||||
"fmt"
|
"fmt"
|
||||||
"github.com/stretchr/testify/assert"
|
|
||||||
"net/http"
|
"net/http"
|
||||||
"net/http/httptest"
|
"net/http/httptest"
|
||||||
|
"sort"
|
||||||
"testing"
|
"testing"
|
||||||
|
|
||||||
|
"github.com/stretchr/testify/assert"
|
||||||
|
"gitlab.com/sparetimecoders/goamqp"
|
||||||
)
|
)
|
||||||
|
|
||||||
func TestPrivilegeHandler_Process_InvalidType(t *testing.T) {
|
func TestPrivilegeHandler_Process_InvalidType(t *testing.T) {
|
||||||
handler := New(WithBaseURL("base"))
|
handler := New(WithBaseURL("base"))
|
||||||
|
|
||||||
result := handler.Process("abc")
|
result, err := handler.Process("abc", goamqp.Headers{})
|
||||||
|
|
||||||
assert.False(t, result)
|
assert.Nil(t, result)
|
||||||
|
assert.EqualError(t, err, "unexpected event type: 'string'")
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestPrivilegeHandler_Process_PrivilegeRemoved(t *testing.T) {
|
||||||
|
handler := New(WithBaseURL("base"))
|
||||||
|
|
||||||
|
result, err := handler.Process(&PrivilegeAdded{
|
||||||
|
Email: "jim@example.org",
|
||||||
|
CompanyID: "abc-123",
|
||||||
|
Privilege: PrivilegeAdmin,
|
||||||
|
}, goamqp.Headers{})
|
||||||
|
assert.Nil(t, result)
|
||||||
|
assert.NoError(t, err)
|
||||||
|
|
||||||
|
companies := handler.CompaniesByUser("jim@example.org", func(privileges CompanyPrivileges) bool {
|
||||||
|
return privileges.Admin
|
||||||
|
})
|
||||||
|
|
||||||
|
assert.Equal(t, []string{"abc-123"}, companies)
|
||||||
|
|
||||||
|
result, err = handler.Process(&PrivilegeRemoved{
|
||||||
|
Email: "jim@example.org",
|
||||||
|
CompanyID: "abc-123",
|
||||||
|
Privilege: PrivilegeAdmin,
|
||||||
|
}, goamqp.Headers{})
|
||||||
|
assert.Nil(t, result)
|
||||||
|
assert.NoError(t, err)
|
||||||
|
|
||||||
|
companies = handler.CompaniesByUser("jim@example.org", func(privileges CompanyPrivileges) bool {
|
||||||
|
return privileges.Admin
|
||||||
|
})
|
||||||
|
|
||||||
|
assert.Empty(t, companies)
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestPrivilegeHandler_Process_UserAdded_And_UserRemoved(t *testing.T) {
|
||||||
|
handler := New(WithBaseURL("base"))
|
||||||
|
|
||||||
|
result, err := handler.Process(&UserAdded{
|
||||||
|
Email: "jim@example.org",
|
||||||
|
CompanyID: "abc-123",
|
||||||
|
}, goamqp.Headers{})
|
||||||
|
assert.Nil(t, result)
|
||||||
|
assert.NoError(t, err)
|
||||||
|
|
||||||
|
result, err = handler.Process(&UserAdded{
|
||||||
|
Email: "jim@example.org",
|
||||||
|
CompanyID: "abc-456",
|
||||||
|
}, goamqp.Headers{})
|
||||||
|
assert.Nil(t, result)
|
||||||
|
assert.NoError(t, err)
|
||||||
|
|
||||||
|
companies := handler.CompaniesByUser("jim@example.org", func(privileges CompanyPrivileges) bool {
|
||||||
|
return true
|
||||||
|
})
|
||||||
|
sort.Strings(companies)
|
||||||
|
assert.Equal(t, []string{"abc-123", "abc-456"}, companies)
|
||||||
|
|
||||||
|
result, err = handler.Process(&UserRemoved{
|
||||||
|
Email: "jim@example.org",
|
||||||
|
CompanyID: "abc-123",
|
||||||
|
}, goamqp.Headers{})
|
||||||
|
assert.Nil(t, result)
|
||||||
|
assert.NoError(t, err)
|
||||||
|
|
||||||
|
result, err = handler.Process(&UserRemoved{
|
||||||
|
Email: "jim@example.org",
|
||||||
|
CompanyID: "abc-456",
|
||||||
|
}, goamqp.Headers{})
|
||||||
|
assert.Nil(t, result)
|
||||||
|
assert.NoError(t, err)
|
||||||
|
|
||||||
|
companies = handler.CompaniesByUser("jim@example.org", func(privileges CompanyPrivileges) bool {
|
||||||
|
return true
|
||||||
|
})
|
||||||
|
assert.Empty(t, companies)
|
||||||
}
|
}
|
||||||
|
|
||||||
func TestPrivilegeHandler_GetCompanies_Email_Not_Found(t *testing.T) {
|
func TestPrivilegeHandler_GetCompanies_Email_Not_Found(t *testing.T) {
|
||||||
@@ -29,41 +108,48 @@ func TestPrivilegeHandler_GetCompanies_Email_Not_Found(t *testing.T) {
|
|||||||
func TestPrivilegeHandler_GetCompanies_No_Companies_Found(t *testing.T) {
|
func TestPrivilegeHandler_GetCompanies_No_Companies_Found(t *testing.T) {
|
||||||
handler := New(WithBaseURL("base"))
|
handler := New(WithBaseURL("base"))
|
||||||
|
|
||||||
result := handler.Process(&PrivilegeAdded{
|
result, err := handler.Process(&UserAdded{
|
||||||
Email: "jim@example.org",
|
Email: "jim@example.org",
|
||||||
CompanyID: "abc-123",
|
CompanyID: "abc-123",
|
||||||
Admin: false,
|
}, goamqp.Headers{})
|
||||||
Company: false,
|
assert.Nil(t, result)
|
||||||
Consumer: false,
|
assert.NoError(t, err)
|
||||||
Time: false,
|
|
||||||
Invoicing: false,
|
|
||||||
Accounting: false,
|
|
||||||
Supplier: false,
|
|
||||||
})
|
|
||||||
assert.True(t, result)
|
|
||||||
|
|
||||||
companies := handler.CompaniesByUser("jim@example.org", func(privileges CompanyPrivileges) bool {
|
companies := handler.CompaniesByUser("jim@example.org", func(privileges CompanyPrivileges) bool {
|
||||||
return privileges.Admin
|
return privileges.Admin
|
||||||
})
|
})
|
||||||
|
|
||||||
assert.Empty(t, companies)
|
assert.Empty(t, companies)
|
||||||
|
|
||||||
|
companies = handler.CompaniesByUser("jim@example.org", func(privileges CompanyPrivileges) bool {
|
||||||
|
return true
|
||||||
|
})
|
||||||
|
|
||||||
|
assert.Equal(t, []string{"abc-123"}, companies)
|
||||||
|
|
||||||
|
result, err = handler.Process(&UserRemoved{
|
||||||
|
Email: "jim@example.org",
|
||||||
|
CompanyID: "abc-123",
|
||||||
|
}, goamqp.Headers{})
|
||||||
|
assert.Nil(t, result)
|
||||||
|
assert.NoError(t, err)
|
||||||
|
|
||||||
|
companies = handler.CompaniesByUser("jim@example.org", func(privileges CompanyPrivileges) bool {
|
||||||
|
return true
|
||||||
|
})
|
||||||
|
assert.Empty(t, companies)
|
||||||
}
|
}
|
||||||
|
|
||||||
func TestPrivilegeHandler_GetCompanies_Company_With_Company_Access_Found(t *testing.T) {
|
func TestPrivilegeHandler_GetCompanies_Company_With_Company_Access_Found(t *testing.T) {
|
||||||
handler := New(WithBaseURL("base"))
|
handler := New(WithBaseURL("base"))
|
||||||
|
|
||||||
result := handler.Process(&PrivilegeAdded{
|
result, err := handler.Process(&PrivilegeAdded{
|
||||||
Email: "jim@example.org",
|
Email: "jim@example.org",
|
||||||
CompanyID: "abc-123",
|
CompanyID: "abc-123",
|
||||||
Admin: false,
|
Privilege: PrivilegeCompany,
|
||||||
Company: true,
|
}, goamqp.Headers{})
|
||||||
Consumer: false,
|
assert.Nil(t, result)
|
||||||
Time: false,
|
assert.NoError(t, err)
|
||||||
Invoicing: false,
|
|
||||||
Accounting: false,
|
|
||||||
Supplier: false,
|
|
||||||
})
|
|
||||||
assert.True(t, result)
|
|
||||||
|
|
||||||
companies := handler.CompaniesByUser("jim@example.org", func(privileges CompanyPrivileges) bool {
|
companies := handler.CompaniesByUser("jim@example.org", func(privileges CompanyPrivileges) bool {
|
||||||
return privileges.Company
|
return privileges.Company
|
||||||
@@ -75,26 +161,83 @@ func TestPrivilegeHandler_GetCompanies_Company_With_Company_Access_Found(t *test
|
|||||||
func TestPrivilegeHandler_GetCompanies_Company_With_Admin_Access_Found(t *testing.T) {
|
func TestPrivilegeHandler_GetCompanies_Company_With_Admin_Access_Found(t *testing.T) {
|
||||||
handler := New(WithBaseURL("base"))
|
handler := New(WithBaseURL("base"))
|
||||||
|
|
||||||
result := handler.Process(&PrivilegeAdded{
|
result, err := handler.Process(&PrivilegeAdded{
|
||||||
Email: "jim@example.org",
|
Email: "jim@example.org",
|
||||||
CompanyID: "abc-123",
|
CompanyID: "abc-123",
|
||||||
Admin: true,
|
Privilege: PrivilegeConsumer,
|
||||||
Company: false,
|
}, goamqp.Headers{})
|
||||||
Consumer: false,
|
assert.Nil(t, result)
|
||||||
Time: false,
|
assert.NoError(t, err)
|
||||||
Invoicing: false,
|
|
||||||
Accounting: false,
|
|
||||||
Supplier: false,
|
|
||||||
})
|
|
||||||
assert.True(t, result)
|
|
||||||
|
|
||||||
companies := handler.CompaniesByUser("jim@example.org", func(privileges CompanyPrivileges) bool {
|
companies := handler.CompaniesByUser("jim@example.org", func(privileges CompanyPrivileges) bool {
|
||||||
return privileges.Admin
|
return privileges.Consumer
|
||||||
})
|
})
|
||||||
|
|
||||||
assert.Equal(t, []string{"abc-123"}, companies)
|
assert.Equal(t, []string{"abc-123"}, companies)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
func TestPrivilegeHandler_IsAllowed_Return_False_If_No_Privileges(t *testing.T) {
|
||||||
|
handler := New(WithBaseURL("base"))
|
||||||
|
|
||||||
|
result := handler.IsAllowed("jim@example.org", "abc-123", func(privileges CompanyPrivileges) bool {
|
||||||
|
return privileges.Company
|
||||||
|
})
|
||||||
|
|
||||||
|
assert.False(t, result)
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestPrivilegeHandler_IsAllowed_Return_True_If_Privilege_Exists(t *testing.T) {
|
||||||
|
handler := New(WithBaseURL("base"))
|
||||||
|
|
||||||
|
_, _ = handler.Process(&PrivilegeAdded{
|
||||||
|
Email: "jim@example.org",
|
||||||
|
CompanyID: "abc-123",
|
||||||
|
Privilege: PrivilegeTime,
|
||||||
|
}, goamqp.Headers{})
|
||||||
|
|
||||||
|
result := handler.IsAllowed("jim@example.org", "abc-123", func(privileges CompanyPrivileges) bool {
|
||||||
|
return privileges.Time
|
||||||
|
})
|
||||||
|
|
||||||
|
assert.True(t, result)
|
||||||
|
|
||||||
|
_, _ = handler.Process(&PrivilegeAdded{
|
||||||
|
Email: "jim@example.org",
|
||||||
|
CompanyID: "abc-123",
|
||||||
|
Privilege: PrivilegeInvoicing,
|
||||||
|
}, goamqp.Headers{})
|
||||||
|
|
||||||
|
result = handler.IsAllowed("jim@example.org", "abc-123", func(privileges CompanyPrivileges) bool {
|
||||||
|
return privileges.Invoicing
|
||||||
|
})
|
||||||
|
|
||||||
|
assert.True(t, result)
|
||||||
|
|
||||||
|
_, _ = handler.Process(&PrivilegeAdded{
|
||||||
|
Email: "jim@example.org",
|
||||||
|
CompanyID: "abc-123",
|
||||||
|
Privilege: PrivilegeAccounting,
|
||||||
|
}, goamqp.Headers{})
|
||||||
|
|
||||||
|
result = handler.IsAllowed("jim@example.org", "abc-123", func(privileges CompanyPrivileges) bool {
|
||||||
|
return privileges.Accounting
|
||||||
|
})
|
||||||
|
|
||||||
|
assert.True(t, result)
|
||||||
|
|
||||||
|
_, _ = handler.Process(&PrivilegeAdded{
|
||||||
|
Email: "jim@example.org",
|
||||||
|
CompanyID: "abc-123",
|
||||||
|
Privilege: PrivilegeSupplier,
|
||||||
|
}, goamqp.Headers{})
|
||||||
|
|
||||||
|
result = handler.IsAllowed("jim@example.org", "abc-123", func(privileges CompanyPrivileges) bool {
|
||||||
|
return privileges.Supplier
|
||||||
|
})
|
||||||
|
|
||||||
|
assert.True(t, result)
|
||||||
|
}
|
||||||
|
|
||||||
func TestPrivilegeHandler_Fetch_Error_Response(t *testing.T) {
|
func TestPrivilegeHandler_Fetch_Error_Response(t *testing.T) {
|
||||||
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||||
w.WriteHeader(500)
|
w.WriteHeader(500)
|
||||||
@@ -106,7 +249,7 @@ func TestPrivilegeHandler_Fetch_Error_Response(t *testing.T) {
|
|||||||
server.Close()
|
server.Close()
|
||||||
|
|
||||||
err := handler.Fetch()
|
err := handler.Fetch()
|
||||||
assert.EqualError(t, err, fmt.Sprintf("Get http://%s/authz: dial tcp %s: connect: connection refused", baseURL, baseURL))
|
assert.EqualError(t, err, fmt.Sprintf("Get \"http://%s/authz\": dial tcp %s: connect: connection refused", baseURL, baseURL))
|
||||||
}
|
}
|
||||||
|
|
||||||
func TestPrivilegeHandler_Fetch_Error_Unreadable_Body(t *testing.T) {
|
func TestPrivilegeHandler_Fetch_Error_Unreadable_Body(t *testing.T) {
|
||||||
@@ -160,7 +303,7 @@ func TestPrivilegeHandler_Fetch_Valid(t *testing.T) {
|
|||||||
|
|
||||||
err := handler.Fetch()
|
err := handler.Fetch()
|
||||||
assert.NoError(t, err)
|
assert.NoError(t, err)
|
||||||
expectedPrivileges := map[string]map[string]CompanyPrivileges{
|
expectedPrivileges := map[string]map[string]*CompanyPrivileges{
|
||||||
"jim@example.org": {
|
"jim@example.org": {
|
||||||
"00010203-0405-4607-8809-0a0b0c0d0e0f": {
|
"00010203-0405-4607-8809-0a0b0c0d0e0f": {
|
||||||
Admin: false,
|
Admin: false,
|
||||||
|
|||||||
@@ -0,0 +1,62 @@
|
|||||||
|
package client
|
||||||
|
|
||||||
|
// UserAdded is the event sent when a new user is added to a company
|
||||||
|
type UserAdded struct {
|
||||||
|
Email string `json:"email"`
|
||||||
|
CompanyID string `json:"companyId"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// UserRemoved is the event sent when a user is removed from a company
|
||||||
|
type UserRemoved struct {
|
||||||
|
Email string `json:"email"`
|
||||||
|
CompanyID string `json:"companyId"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// Privilege is an enumeration of all available privileges
|
||||||
|
type Privilege string
|
||||||
|
|
||||||
|
const (
|
||||||
|
PrivilegeAdmin = "ADMIN"
|
||||||
|
PrivilegeCompany = "COMPANY"
|
||||||
|
PrivilegeConsumer = "CONSUMER"
|
||||||
|
PrivilegeTime = "TIME"
|
||||||
|
PrivilegeInvoicing = "INVOICING"
|
||||||
|
PrivilegeAccounting = "ACCOUNTING"
|
||||||
|
PrivilegeSupplier = "SUPPLIER"
|
||||||
|
)
|
||||||
|
|
||||||
|
var AllPrivilege = []Privilege{
|
||||||
|
PrivilegeAdmin,
|
||||||
|
PrivilegeCompany,
|
||||||
|
PrivilegeConsumer,
|
||||||
|
PrivilegeTime,
|
||||||
|
PrivilegeInvoicing,
|
||||||
|
PrivilegeAccounting,
|
||||||
|
PrivilegeSupplier,
|
||||||
|
}
|
||||||
|
|
||||||
|
func (e Privilege) IsValid() bool {
|
||||||
|
switch e {
|
||||||
|
case PrivilegeAdmin, PrivilegeCompany, PrivilegeConsumer, PrivilegeTime, PrivilegeInvoicing, PrivilegeAccounting, PrivilegeSupplier:
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
|
||||||
|
func (e Privilege) String() string {
|
||||||
|
return string(e)
|
||||||
|
}
|
||||||
|
|
||||||
|
// PrivilegeAdded is the event sent when a new privilege is added
|
||||||
|
type PrivilegeAdded struct {
|
||||||
|
Email string `json:"email"`
|
||||||
|
CompanyID string `json:"companyId"`
|
||||||
|
Privilege Privilege `json:"privilege"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// PrivilegeRemoved is the event sent when a privilege is removed
|
||||||
|
type PrivilegeRemoved struct {
|
||||||
|
Email string `json:"email"`
|
||||||
|
CompanyID string `json:"companyId"`
|
||||||
|
Privilege Privilege `json:"privilege"`
|
||||||
|
}
|
||||||
+110
@@ -0,0 +1,110 @@
|
|||||||
|
package client
|
||||||
|
|
||||||
|
import "testing"
|
||||||
|
|
||||||
|
func TestPrivilege_IsValid(t *testing.T) {
|
||||||
|
tests := []struct {
|
||||||
|
name string
|
||||||
|
e Privilege
|
||||||
|
want bool
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
name: "Admin",
|
||||||
|
e: "ADMIN",
|
||||||
|
want: true,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "Company",
|
||||||
|
e: "COMPANY",
|
||||||
|
want: true,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "Consumer",
|
||||||
|
e: "CONSUMER",
|
||||||
|
want: true,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "Time",
|
||||||
|
e: "TIME",
|
||||||
|
want: true,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "Invoicing",
|
||||||
|
e: "INVOICING",
|
||||||
|
want: true,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "Accounting",
|
||||||
|
e: "ACCOUNTING",
|
||||||
|
want: true,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "Supplier",
|
||||||
|
e: "SUPPLIER",
|
||||||
|
want: true,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "Invalid",
|
||||||
|
e: "BLUTTI",
|
||||||
|
want: false,
|
||||||
|
},
|
||||||
|
}
|
||||||
|
for _, tt := range tests {
|
||||||
|
t.Run(tt.name, func(t *testing.T) {
|
||||||
|
if got := tt.e.IsValid(); got != tt.want {
|
||||||
|
t.Errorf("IsValid() = %v, want %v", got, tt.want)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestPrivilege_String(t *testing.T) {
|
||||||
|
tests := []struct {
|
||||||
|
name string
|
||||||
|
e Privilege
|
||||||
|
want string
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
name: "Admin",
|
||||||
|
e: "ADMIN",
|
||||||
|
want: "ADMIN",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "Company",
|
||||||
|
e: "COMPANY",
|
||||||
|
want: "COMPANY",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "Consumer",
|
||||||
|
e: "CONSUMER",
|
||||||
|
want: "CONSUMER",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "Time",
|
||||||
|
e: "TIME",
|
||||||
|
want: "TIME",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "Invoicing",
|
||||||
|
e: "INVOICING",
|
||||||
|
want: "INVOICING",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "Accounting",
|
||||||
|
e: "ACCOUNTING",
|
||||||
|
want: "ACCOUNTING",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "Supplier",
|
||||||
|
e: "SUPPLIER",
|
||||||
|
want: "SUPPLIER",
|
||||||
|
},
|
||||||
|
}
|
||||||
|
for _, tt := range tests {
|
||||||
|
t.Run(tt.name, func(t *testing.T) {
|
||||||
|
if got := tt.e.String(); got != tt.want {
|
||||||
|
t.Errorf("String() = %v, want %v", got, tt.want)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -2,4 +2,7 @@ module gitlab.com/unboundsoftware/shiny/authz_client
|
|||||||
|
|
||||||
go 1.13
|
go 1.13
|
||||||
|
|
||||||
require github.com/stretchr/testify v1.4.0
|
require (
|
||||||
|
github.com/stretchr/testify v1.4.0
|
||||||
|
gitlab.com/sparetimecoders/goamqp v0.3.1
|
||||||
|
)
|
||||||
|
|||||||
@@ -1,10 +1,20 @@
|
|||||||
|
github.com/caarlos0/env v3.5.0+incompatible/go.mod h1:tdCsowwCzMLdkqRYDlHpZCp2UooDD3MspDBjZ2AD02Y=
|
||||||
github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
|
github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
|
||||||
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||||
|
github.com/google/uuid v1.1.1 h1:Gkbcsh/GbpXz7lPftLA3P6TYMwjCLYm83jiFQZF/3gY=
|
||||||
|
github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||||
|
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
|
||||||
|
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
|
||||||
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
|
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
|
||||||
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||||
|
github.com/streadway/amqp v0.0.0-20190827072141-edfb9018d271 h1:WhxRHzgeVGETMlmVfqhRn8RIeeNoPr2Czh33I4Zdccw=
|
||||||
|
github.com/streadway/amqp v0.0.0-20190827072141-edfb9018d271/go.mod h1:AZpEONHx3DKn8O/DFsRAY58/XVQiIPMTMB1SddzLXVw=
|
||||||
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
|
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
|
||||||
|
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
|
||||||
github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
|
github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
|
||||||
github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
|
github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
|
||||||
|
gitlab.com/sparetimecoders/goamqp v0.3.1 h1:Pf5nANlKzCP6h5MVrKgfKknf3Vkz3psGh97Mh8Coxqs=
|
||||||
|
gitlab.com/sparetimecoders/goamqp v0.3.1/go.mod h1:Xci7oyW/j9kJXr0QRgLRGv8e0R91ZSksPhYCei5FK5U=
|
||||||
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
|
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
|
||||||
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||||
gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
|
gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
|
||||||
|
|||||||
Reference in New Issue
Block a user