Jim
769416c2ff
* refactor (controller): Use a grpc server for the grpc-gateway This starts a grpc server for the grpc-gateway. The new gateway server uses an in-memory listener which also supports "dialing", so the http proxy can connect to the in-memory listener. This change allows us to use all grpc server features and was in part motivated by a need for an interceptor of inbound requests. With that said, having a "proper" grpc server for the gateway will provide a lot more flexibility and capabilities moving forward. The request context will still be verified via middleware in the http proxy (see wrapHandlerWithCommonFuncs). This verified context will be serialized into a protobuf and sent along to the grpc-gateway via metadata where an interceptor will add the verified request info to the request's context (see requestCtxInterceptor). The interceptor will verify the serialized request info via a shared ticket with it's companion in-memory http proxy. FYI: the ticket is simply random base62 string (see db.NewPrivateId). This change also necessitated a minor change to services. We need to return an empty response instead of nil, nil when there are no errors and the response is empty. * refactor (handlers): Rename gRPC Gateway filter Originally, this was called an OutgoingInterceptor, which is an unfortunate name since it's not an interceptor. Now that we're refactoring the gateway stuff and have proper interceptors, renaming this should remove ambiguity * refactor: Rework how 204 with empty msg is handled Recent changes to grpc gateway has necessitated a change to how 204s are handled by the gateway * tests (bats): Check status codes for delete operations
115 lines
3.1 KiB
Bash
115 lines
3.1 KiB
Bash
#!/usr/bin/env bats
|
|
|
|
load _accounts
|
|
load _auth
|
|
load _roles
|
|
load _helpers
|
|
|
|
export NEW_ROLE='test'
|
|
export NEW_GRANT='id=*;type=*;actions=create,read,update,delete,list'
|
|
|
|
@test "boundary/login: can login as default principal" {
|
|
run login $DEFAULT_LOGIN
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "boundary/roles: can add $NEW_ROLE role to global scope granting rights in default org scope" {
|
|
run create_role 'global' $NEW_ROLE $DEFAULT_O_ID
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "boundary/roles: can not add already created $NEW_ROLE role" {
|
|
run create_role 'global' $NEW_ROLE $DEFAULT_O_ID
|
|
echo "$output"
|
|
[ "$status" -eq 1 ]
|
|
}
|
|
|
|
@test "boundary/roles: can read $NEW_ROLE role" {
|
|
local rid=$(role_id $NEW_ROLE $DEFAULT_GLOBAL)
|
|
run read_role $rid
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "boundary/roles: the $NEW_ROLE role contains default authorized-actions" {
|
|
local rid=$(role_id $NEW_ROLE $DEFAULT_GLOBAL)
|
|
local out=$(read_role $rid)
|
|
|
|
run has_default_role_actions "$out"
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "boundary/role/add-principals: can associate $NEW_ROLE role with default principal" {
|
|
local rid=$(role_id $NEW_ROLE $DEFAULT_GLOBAL)
|
|
run assoc_role_principal $DEFAULT_USER $rid
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "boundary/role/add-principals: $NEW_ROLE role contains default principal" {
|
|
local rid=$(role_id $NEW_ROLE $DEFAULT_GLOBAL)
|
|
run role_has_principal_id $rid $DEFAULT_USER
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "boundary/role/remove-principals: can remove default principal from $NEW_ROLE role" {
|
|
local rid=$(role_id $NEW_ROLE $DEFAULT_GLOBAL)
|
|
run remove_role_principal $DEFAULT_USER $rid
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "boundary/role/remove-principals: $NEW_ROLE role no longer contains default principal" {
|
|
local rid=$(role_id $NEW_ROLE $DEFAULT_GLOBAL)
|
|
run role_has_principal_id $rid $DEFAULT_USER
|
|
echo "$output"
|
|
[ "$status" -eq 1 ]
|
|
}
|
|
|
|
@test "boundary/role/add-grants: can associate $NEW_ROLE role with $NEW_GRANT grant" {
|
|
local rid=$(role_id $NEW_ROLE $DEFAULT_GLOBAL)
|
|
run assoc_role_grant $NEW_GRANT $rid
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "boundary/role/add-grantss: $NEW_ROLE role contains $NEW_GRANT grant" {
|
|
local rid=$(role_id $NEW_ROLE $DEFAULT_GLOBAL)
|
|
run role_has_grant $rid $NEW_GRANT
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "boundary/role/remove-grants: can remove $NEW_GRANT grant from $NEW_ROLE role" {
|
|
local rid=$(role_id $NEW_ROLE $DEFAULT_GLOBAL)
|
|
run remove_role_grant $NEW_GRANT $rid
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "boundary/role/remove-grants: $NEW_ROLE role no longer contains $NEW_GRANT grant" {
|
|
local rid=$(role_id $NEW_ROLE $DEFAULT_GLOBAL)
|
|
run role_has_grant $rid $NEW_GRANT
|
|
echo "$output"
|
|
[ "$status" -eq 1 ]
|
|
}
|
|
|
|
@test "boundary/role: can delete $NEW_ROLE role" {
|
|
local rid=$(role_id $NEW_ROLE $DEFAULT_GLOBAL)
|
|
run delete_role $rid
|
|
echo "$output"
|
|
run has_status_code "$output" "204"
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "boundary/roles: can not read deleted $NEW_ROLE role" {
|
|
local rid=$(role_id $NEW_ROLE $DEFAULT_GLOBAL)
|
|
run read_role $rid
|
|
echo "$output"
|
|
[ "$status" -eq 1 ]
|
|
}
|