CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Swap id field in grants to ids since that's now standardized (#4250)

Browse Source 
* Swap id field in grants to ids since that's now standardized

* Fix some tests I missed

* Update generated resource table
This commit is contained in:
Jeff Mitchell authored and GitHub committed 2024-01-17 23:54:49 -08:00
1 parent 962f9bd638
commit 253d79116c
43 files changed
+392 -392
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/perms/acl_test.go
+31 -31
View File
@@ -48,27 +48,27 @@ func Test_ACLAllowed(t *testing.T) {
scope: "o_a",
grants: []string{
"ids=ampw_bar,ampw_baz;actions=read,update",
"id=ampw_bop;actions=read:self,update",
"ids=ampw_bop;actions=read:self,update",
"type=host-catalog;actions=create",
"type=target;actions=list",
"id=*;type=host-set;actions=list,create",
"ids=*;type=host-set;actions=list,create",
},
},
{
scope: "o_b",
grants: []string{
"id=*;type=host-set;actions=list,create",
"ids=*;type=host-set;actions=list,create",
"ids=hcst_mypin;type=host;actions=*;output_fields=name,description",
"id=*;type=*;actions=authenticate",
"id=*;type=*;output_fields=id",
"ids=*;type=*;actions=authenticate",
"ids=*;type=*;output_fields=id",
},
},
{
scope: "o_d",
grants: []string{
"id=*;type=*;actions=create,update",
"id=*;type=session;actions=*",
"id=*;type=account;actions=update;output_fields=id,version",
"ids=*;type=*;actions=create,update",
"ids=*;type=session;actions=*",
"ids=*;type=account;actions=update;output_fields=id,version",
},
},
}
@@ -76,8 +76,8 @@ func Test_ACLAllowed(t *testing.T) {
{
scope: "o_c",
grants: []string{
"id={{user.id }};actions=read,update",
"id={{ account.id}};actions=change-password",
"ids={{user.id }};actions=read,update",
"ids={{ account.id}};actions=change-password",
},
},
}
@@ -432,7 +432,7 @@ func TestACL_ListPermissions(t *testing.T) {
aclGrants: []scopeGrant{
{
scope: "o_1",
grants: []string{"id=*;type=session;actions=list,read"},
grants: []string{"ids=*;type=session;actions=list,read"},
},
},
scopes: map[string]*scopes.ScopeInfo{
@@ -448,7 +448,7 @@ func TestACL_ListPermissions(t *testing.T) {
aclGrants: []scopeGrant{
{
scope: "o_1",
grants: []string{"id=*;type=target;actions=list,read"}, // List & Read for all Targets
grants: []string{"ids=*;type=target;actions=list,read"}, // List & Read for all Targets
},
},
scopes: map[string]*scopes.ScopeInfo{"o_1": nil},
@@ -461,7 +461,7 @@ func TestACL_ListPermissions(t *testing.T) {
aclGrants: []scopeGrant{
{
scope: "o_1",
grants: []string{"id=*;type=session;actions=delete"},
grants: []string{"ids=*;type=session;actions=delete"},
},
},
scopes: map[string]*scopes.ScopeInfo{"o_1": nil},
@@ -488,7 +488,7 @@ func TestACL_ListPermissions(t *testing.T) {
aclGrants: []scopeGrant{
{
scope: "o_1",
grants: []string{"id=*;type=session;actions=list,read"},
grants: []string{"ids=*;type=session;actions=list,read"},
},
},
scopes: map[string]*scopes.ScopeInfo{"o_1": nil},
@@ -510,7 +510,7 @@ func TestACL_ListPermissions(t *testing.T) {
aclGrants: []scopeGrant{
{
scope: "o_1",
grants: []string{"id=*;type=session;actions=list,read:self"},
grants: []string{"ids=*;type=session;actions=list,read:self"},
},
},
scopes: map[string]*scopes.ScopeInfo{"o_1": nil},
@@ -533,7 +533,7 @@ func TestACL_ListPermissions(t *testing.T) {
{
scope: "o_1",
grants: []string{
"id=s_1;type=session;actions=list,read",
"ids=s_1;type=session;actions=list,read",
"ids=s_2,s_3;type=session;actions=list,read",
},
},
@@ -557,7 +557,7 @@ func TestACL_ListPermissions(t *testing.T) {
aclGrants: []scopeGrant{
{
scope: "o_1",
grants: []string{"id=*;type=*;actions=list,read:self"},
grants: []string{"ids=*;type=*;actions=list,read:self"},
},
},
scopes: map[string]*scopes.ScopeInfo{"o_1": nil},
@@ -579,7 +579,7 @@ func TestACL_ListPermissions(t *testing.T) {
aclGrants: []scopeGrant{
{
scope: "o_1",
grants: []string{"id=*;type=session;actions=list,no-op"},
grants: []string{"ids=*;type=session;actions=list,no-op"},
},
},
scopes: map[string]*scopes.ScopeInfo{"o_1": nil},
@@ -601,7 +601,7 @@ func TestACL_ListPermissions(t *testing.T) {
aclGrants: []scopeGrant{
{
scope: "o_1",
grants: []string{"id=*;type=session;actions=list,no-op"},
grants: []string{"ids=*;type=session;actions=list,no-op"},
},
},
scopes: map[string]*scopes.ScopeInfo{"o_1": nil},
@@ -615,7 +615,7 @@ func TestACL_ListPermissions(t *testing.T) {
{
scope: "o_1",
grants: []string{
"id=s_1;type=session;actions=list,no-op",
"ids=s_1;type=session;actions=list,no-op",
"ids=s_2,s_3;type=session;actions=list,no-op",
},
},
@@ -639,7 +639,7 @@ func TestACL_ListPermissions(t *testing.T) {
aclGrants: []scopeGrant{
{
scope: "o_1",
grants: []string{"id=*;type=*;actions=list,read:self"},
grants: []string{"ids=*;type=*;actions=list,read:self"},
},
},
scopes: map[string]*scopes.ScopeInfo{"o_1": nil},
@@ -662,8 +662,8 @@ func TestACL_ListPermissions(t *testing.T) {
{
scope: "o_1",
grants: []string{
"id=*;type=*;actions=*",
"id=*;type=session;actions=cancel:self,list,read:self",
"ids=*;type=*;actions=*",
"ids=*;type=session;actions=cancel:self,list,read:self",
},
},
},
@@ -686,7 +686,7 @@ func TestACL_ListPermissions(t *testing.T) {
aclGrants: []scopeGrant{
{
scope: "o_1",
grants: []string{"id=*;type=*;actions=*"},
grants: []string{"ids=*;type=*;actions=*"},
},
},
scopes: map[string]*scopes.ScopeInfo{"o_1": nil},
@@ -708,7 +708,7 @@ func TestACL_ListPermissions(t *testing.T) {
aclGrants: []scopeGrant{
{
scope: "o_1",
grants: []string{"id=*;type=*;actions=*"},
grants: []string{"ids=*;type=*;actions=*"},
},
},
scopes: map[string]*scopes.ScopeInfo{"o_1": nil},
@@ -731,13 +731,13 @@ func TestACL_ListPermissions(t *testing.T) {
{
scope: "o_1",
grants: []string{
"id=s_1;type=session;actions=list,read",
"ids=s_1;type=session;actions=list,read",
"ids=s_2,s_3;type=session;actions=list,read",
},
},
{
scope: "o_2",
grants: []string{"id=*;type=session;actions=list,read:self"},
grants: []string{"ids=*;type=session;actions=list,read:self"},
},
},
scopes: map[string]*scopes.ScopeInfo{"o_1": nil, "o_2": nil},
@@ -822,7 +822,7 @@ func TestACL_ListPermissions(t *testing.T) {
scope: "p_1",
grants: []string{
"type=target;actions=list",
"id=ttcp_1234567890;actions=read",
"ids=ttcp_1234567890;actions=read",
},
},
},
@@ -891,7 +891,7 @@ func Test_AnonRestrictions(t *testing.T) {
tests := []input{
{
name: "id-specific",
grant: "id=foobar;actions=%s",
grant: "ids=foobar;actions=%s",
},
{
name: "ids-specific",
@@ -899,7 +899,7 @@ func Test_AnonRestrictions(t *testing.T) {
},
{
name: "wildcard-id",
grant: "id=*;type=%s;actions=%s",
grant: "ids=*;type=%s;actions=%s",
templatedType: true,
shouldHaveSuccess: true,
},
@@ -911,7 +911,7 @@ func Test_AnonRestrictions(t *testing.T) {
},
{
name: "wildcard-id-and-type",
grant: "id=*;type=*;actions=%s",
grant: "ids=*;type=*;actions=%s",
},
{
name: "wildcard-ids-and-type",
internal/perms/output_fields_test.go
+18 -18
View File
@@ -151,13 +151,13 @@ func Test_ACLOutputFields(t *testing.T) {
name: "default",
resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role},
action: action.Read,
grants: []string{"id=u_bar;actions=read,update"},
grants: []string{"ids=u_bar;actions=read,update"},
authorized: true,
},
{
name: "single value",
resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role},
grants: []string{"id=u_bar;actions=read,update;output_fields=id"},
grants: []string{"ids=u_bar;actions=read,update;output_fields=id"},
action: action.Read,
fields: []string{"id"},
authorized: true,
@@ -166,8 +166,8 @@ func Test_ACLOutputFields(t *testing.T) {
name: "compound no overlap",
resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role},
grants: []string{
"id=u_bar;actions=read,update;output_fields=id",
"id=*;type=host-catalog;actions=read,update;output_fields=version",
"ids=u_bar;actions=read,update;output_fields=id",
"ids=*;type=host-catalog;actions=read,update;output_fields=version",
},
action: action.Read,
fields: []string{"id"},
@@ -177,8 +177,8 @@ func Test_ACLOutputFields(t *testing.T) {
name: "compound",
resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role},
grants: []string{
"id=u_bar;actions=read,update;output_fields=id",
"id=*;type=role;output_fields=version",
"ids=u_bar;actions=read,update;output_fields=id",
"ids=*;type=role;output_fields=version",
},
action: action.Read,
fields: []string{"id", "version"},
@@ -188,8 +188,8 @@ func Test_ACLOutputFields(t *testing.T) {
name: "wildcard with type",
resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role},
grants: []string{
"id=u_bar;actions=read,update;output_fields=read",
"id=*;type=role;output_fields=*",
"ids=u_bar;actions=read,update;output_fields=read",
"ids=*;type=role;output_fields=*",
},
action: action.Read,
fields: []string{"*"},
@@ -199,8 +199,8 @@ func Test_ACLOutputFields(t *testing.T) {
name: "wildcard with wildcard type",
resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role},
grants: []string{
"id=u_bar;actions=read,update;output_fields=read",
"id=*;type=*;output_fields=*",
"ids=u_bar;actions=read,update;output_fields=read",
"ids=*;type=*;output_fields=*",
},
action: action.Read,
fields: []string{"*"},
@@ -210,7 +210,7 @@ func Test_ACLOutputFields(t *testing.T) {
name: "subaction exact",
resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role},
grants: []string{
"id=u_bar;actions=read:self,update;output_fields=version",
"ids=u_bar;actions=read:self,update;output_fields=version",
},
action: action.ReadSelf,
fields: []string{"version"},
@@ -222,8 +222,8 @@ func Test_ACLOutputFields(t *testing.T) {
name: "subaction parent action",
resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role},
grants: []string{
"id=u_bar;actions=read,update;output_fields=version",
"id=u_bar;actions=read:self;output_fields=id",
"ids=u_bar;actions=read,update;output_fields=version",
"ids=u_bar;actions=read:self;output_fields=id",
},
action: action.ReadSelf,
fields: []string{"id", "version"},
@@ -237,8 +237,8 @@ func Test_ACLOutputFields(t *testing.T) {
name: "subaction child action",
resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role},
grants: []string{
"id=u_bar;actions=read:self,update;output_fields=version",
"id=u_bar;actions=read;output_fields=id",
"ids=u_bar;actions=read:self,update;output_fields=version",
"ids=u_bar;actions=read;output_fields=id",
},
action: action.Read,
fields: []string{"id"},
@@ -248,8 +248,8 @@ func Test_ACLOutputFields(t *testing.T) {
name: "initial grant unauthorized with star",
resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role},
grants: []string{
"id=u_bar;output_fields=*",
"id=u_bar;actions=delete;output_fields=id",
"ids=u_bar;output_fields=*",
"ids=u_bar;actions=delete;output_fields=id",
},
action: action.Delete,
fields: []string{"*"},
@@ -259,7 +259,7 @@ func Test_ACLOutputFields(t *testing.T) {
name: "unauthorized id only",
resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role},
grants: []string{
"id=u_bar;output_fields=name",
"ids=u_bar;output_fields=name",
},
action: action.Delete,
fields: []string{"name"},
internal/perms/testdata/fuzz/FuzzParse/6bfe75c429073a6a
Vendored
+1 -1
View File
@@ -1,2 +1,2 @@
go test fuzz v1
string("id=,;output_fields=0")
string("ids=,;output_fields=0")
internal/perms/testdata/fuzz/FuzzParse/9b33c3b84320755d
Vendored
+1 -1
View File
@@ -1,2 +1,2 @@
go test fuzz v1
string("id=,0;output_fields=0")
string("ids=,0;output_fields=0")