From 50303f9c184b05545c82f850d7b505259bf2f35f Mon Sep 17 00:00:00 2001 From: "Sorawis Nilparuk (Bo)" Date: Fri, 20 Jun 2025 14:50:51 -0700 Subject: [PATCH] bosorawis cherrypick authtoken.TestRoleGrantsForToken removal (#5872) * bosorawis remove TestRoleGrantsForToken (#5840) * refactor auth method grants tests * refactor credential libraries grants tests * refactor hosts grants tests * refactor roles grants tests * refactor scopes grants tests * refactor tcp targets grants tests * refactor users grants tests * refactor worker grants tests * fix authmethod test broken during the refactor * remove authtoken.TestRoleGrantsForToken * add pinned ID test * correct event name * fix make gen and lint # Conflicts: # internal/daemon/controller/handlers/roles/grants_test.go # internal/daemon/controller/handlers/scopes/grants_test.go # internal/daemon/controller/handlers/targets/tcp/grants_test.go # internal/daemon/controller/handlers/workers/grants_test.go * remove one forgotten reference --- internal/authtoken/testing.go | 36 ------------------- .../handlers/accounts/grants_test.go | 24 +++++++------ 2 files changed, 14 insertions(+), 46 deletions(-) diff --git a/internal/authtoken/testing.go b/internal/authtoken/testing.go index 1956033b8..2d89bc24e 100644 --- a/internal/authtoken/testing.go +++ b/internal/authtoken/testing.go @@ -11,7 +11,6 @@ import ( "github.com/hashicorp/boundary/internal/db" "github.com/hashicorp/boundary/internal/iam" "github.com/hashicorp/boundary/internal/kms" - "github.com/hashicorp/go-uuid" "github.com/stretchr/testify/require" ) @@ -47,38 +46,3 @@ func TestAuthToken(t testing.TB, conn *db.DB, kms *kms.Kms, scopeId string, opt require.NoError(t, err) return at } - -// TestRoleGrantsForToken contains information used by TestAuthTokenWithRoles to create -// roles and their associated grants (with grant scopes) -type TestRoleGrantsForToken struct { - RoleScopeId string - GrantStrings []string - GrantScopes []string -} - -// TestAuthTokenWithRoles creates auth token associated with roles as requested by the caller along -// with any required resources to achieve said token -func TestAuthTokenWithRoles(t testing.TB, conn *db.DB, kms *kms.Kms, scopeId string, roles []TestRoleGrantsForToken) *AuthToken { - t.Helper() - ctx := context.Background() - rw := db.New(conn) - atRepo, err := NewRepository(ctx, rw, rw, kms) - require.NoError(t, err) - - iamRepo, err := iam.NewRepository(ctx, rw, rw, kms) - require.NoError(t, err) - - authMethod := password.TestAuthMethods(t, conn, scopeId, 1)[0] - - loginName, err := uuid.GenerateUUID() - require.NoError(t, err) - acct := password.TestAccount(t, conn, authMethod.GetPublicId(), loginName) - user := iam.TestUser(t, iamRepo, scopeId, iam.WithAccountIds(acct.GetPublicId())) - for _, r := range roles { - role := iam.TestRoleWithGrants(t, conn, r.RoleScopeId, r.GrantScopes, r.GrantStrings) - _ = iam.TestUserRole(t, conn, role.PublicId, user.PublicId) - } - fullGrantToken, err := atRepo.CreateAuthToken(ctx, user, acct.GetPublicId()) - require.NoError(t, err) - return fullGrantToken -} diff --git a/internal/daemon/controller/handlers/accounts/grants_test.go b/internal/daemon/controller/handlers/accounts/grants_test.go index ad39940f0..06123cbfa 100644 --- a/internal/daemon/controller/handlers/accounts/grants_test.go +++ b/internal/daemon/controller/handlers/accounts/grants_test.go @@ -42,18 +42,18 @@ func TestListPassword_Grants(t *testing.T) { oidcRepoFn := func() (*oidc.Repository, error) { return oidc.NewRepository(ctx, rw, rw, kms) } - ldapRepoFn := func() (*ldap.Repository, error) { return ldap.NewRepository(ctx, rw, rw, kms) } - + atRepo, err := authtoken.NewRepository(ctx, rw, rw, kms) + require.NoError(t, err) org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrap)) orgAM := password.TestAuthMethod(t, conn, org.GetPublicId()) orgPWAccounts := password.TestMultipleAccounts(t, conn, orgAM.GetPublicId(), 3) testcases := []struct { name string - roleRequest []authtoken.TestRoleGrantsForToken + userAcountFunc func(t *testing.T) func() (*iam.User, authdomain.Account) input *pbs.ListAccountsRequest wantAccountIDs []string wantErr error @@ -64,12 +64,14 @@ func TestListPassword_Grants(t *testing.T) { AuthMethodId: orgAM.PublicId, PageSize: 100, }, - roleRequest: []authtoken.TestRoleGrantsForToken{ - { - RoleScopeId: globals.GlobalPrefix, - GrantStrings: []string{"ids=*;type=*;actions=list,read"}, - GrantScopes: []string{globals.GrantScopeChildren}, - }, + userAcountFunc: func(t *testing.T) func() (*iam.User, authdomain.Account) { + return iam.TestUserDirectGrantsFunc(t, conn, kms, globals.GlobalPrefix, password.TestAuthMethodWithAccount, []iam.TestRoleGrantsRequest{ + { + RoleScopeId: globals.GlobalPrefix, + Grants: []string{"ids=*;type=*;actions=list,read"}, + GrantScopes: []string{globals.GrantScopeChildren}, + }, + }) }, wantAccountIDs: []string{orgPWAccounts[0].PublicId, orgPWAccounts[1].PublicId, orgPWAccounts[2].PublicId}, wantErr: nil, @@ -80,7 +82,9 @@ func TestListPassword_Grants(t *testing.T) { t.Run(tc.name, func(t *testing.T) { s, err := accounts.NewService(ctx, pwRepoFn, oidcRepoFn, ldapRepoFn, 1000) require.NoError(t, err, "Couldn't create new user service.") - tok := authtoken.TestAuthTokenWithRoles(t, conn, kms, globals.GlobalPrefix, tc.roleRequest) + user, account := tc.userAcountFunc(t)() + tok, err := atRepo.CreateAuthToken(ctx, user, account.GetPublicId()) + require.NoError(t, err) fullGrantAuthCtx := auth.TestAuthContextFromToken(t, conn, wrap, tok, iamRepo) got, gErr := s.ListAccounts(fullGrantAuthCtx, tc.input) if tc.wantErr != nil {