From b8a953ba53b324ee140b7242797a9f98b995ef9a Mon Sep 17 00:00:00 2001
From: Jeff Mitchell <jeffrey.mitchell@gmail.com>
Date: Thu, 4 Feb 2021 15:54:40 -0500
Subject: [PATCH] Add anon listing test

---
 internal/tests/cluster/anon_listing_test.go | 59 +++++++++++++++++++++
 1 file changed, 59 insertions(+)
 create mode 100644 internal/tests/cluster/anon_listing_test.go

diff --git a/internal/tests/cluster/anon_listing_test.go b/internal/tests/cluster/anon_listing_test.go
new file mode 100644
index 000000000..88ee3fddd
--- /dev/null
+++ b/internal/tests/cluster/anon_listing_test.go
@@ -0,0 +1,59 @@
+package cluster
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/boundary/api/roles"
+	"github.com/hashicorp/boundary/api/scopes"
+	"github.com/hashicorp/boundary/internal/cmd/config"
+	"github.com/hashicorp/boundary/internal/servers/controller"
+	"github.com/hashicorp/boundary/internal/types/scope"
+	"github.com/hashicorp/go-hclog"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAnonListing(t *testing.T) {
+	require := require.New(t)
+	logger := hclog.New(&hclog.LoggerOptions{
+		Level: hclog.Trace,
+	})
+
+	conf, err := config.DevController()
+	require.NoError(err)
+
+	c1 := controller.NewTestController(t, &controller.TestControllerOpts{
+		Config:                 conf,
+		InitialResourcesSuffix: "1234567890",
+		Logger:                 logger,
+	})
+	defer c1.Shutdown()
+
+	// Should get no scopes back because anon user doesn't have permissions
+	client := c1.Client()
+	scps, err := scopes.NewClient(client).List(c1.Context(), scope.Global.String())
+	require.NoError(err)
+	require.Len(scps.Items, 0)
+
+	// Authenticate as admin
+	client.SetToken(c1.Token().Token)
+
+	// Should get an org scope back
+	scps, err = scopes.NewClient(client).List(c1.Context(), scope.Global.String())
+	require.NoError(err)
+	require.Len(scps.Items, 1)
+
+	// Create a new role, give read action on the scope, add u_anon
+	orgId := scps.Items[0].Id
+	role, err := roles.NewClient(client).Create(c1.Context(), scope.Global.String())
+	require.NoError(err)
+	_, err = roles.NewClient(client).AddGrants(c1.Context(), role.Item.Id, 0, []string{fmt.Sprintf("id=%s;actions=read", orgId)}, roles.WithAutomaticVersioning(true))
+	require.NoError(err)
+	_, err = roles.NewClient(client).AddPrincipals(c1.Context(), role.Item.Id, 0, []string{"u_anon"}, roles.WithAutomaticVersioning(true))
+	require.NoError(err)
+	// Go back to anonymous
+	client.SetToken("")
+	scps, err = scopes.NewClient(client).List(c1.Context(), scope.Global.String())
+	require.NoError(err)
+	require.Len(scps.Items, 1)
+}