1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
|
package controlplane
import "testing"
func TestConsoleRolePermissions(t *testing.T) {
tests := []struct {
role, permission string
want bool
}{
{RolePlatformAdmin, "platform.write", true},
{RolePlatformViewer, "platform.read", true},
{RolePlatformViewer, "platform.write", false},
{RoleTenantAdmin, "keys.write", true},
{RoleTenantAdmin, "limits.write", false},
{RoleTenantBilling, "billing.topup", true},
{RoleTenantBilling, "keys.read", false},
{RoleTenantDeveloper, "keys.write", true},
{RoleTenantDeveloper, "billing.read", false},
{RoleTenantViewer, "usage.read", true},
{RoleTenantViewer, "users.read", false},
}
for _, test := range tests {
t.Run(test.role+"/"+test.permission, func(t *testing.T) {
if got := (ConsoleActor{Role: test.role}).Can(test.permission); got != test.want {
t.Fatalf("Can(%q) = %v, want %v", test.permission, got, test.want)
}
})
}
}
func TestTenantRoleNeverGetsPlatformPermissions(t *testing.T) {
roles := []string{RoleTenantAdmin, RoleTenantBilling, RoleTenantDeveloper, RoleTenantViewer}
for _, role := range roles {
actor := ConsoleActor{Role: role}
if actor.Can("platform.read") || actor.Can("platform.write") {
t.Fatalf("role %s received platform access", role)
}
}
}
|
