IAM: Implement update method in team API (#111660)

* implement team update in legacy store * add unit tests * add integration test * set permissions for user in integration tests * add more integration tests for update * update validations * add unit tests for ValidateOnUpdate() func * fix integration test
2025-10-03 12:48:38 +03:00
parent 76d467f285
commit 0f60e2208e
13 changed files with 484 additions and 7 deletions
@@ -115,3 +115,213 @@ func TestValidateOnCreate(t *testing.T) {
 		})
 	}
 }
+
+func TestValidateOnUpdate(t *testing.T) {
+	tests := []struct {
+		name      string
+		requester *identity.StaticRequester
+		obj       *iamv0alpha1.Team
+		old       *iamv0alpha1.Team
+		want      error
+	}{
+		{
+			name: "valid update - no changes to provisioned status",
+			requester: &identity.StaticRequester{
+				Type:    types.TypeUser,
+				OrgRole: identity.RoleAdmin,
+			},
+			obj: &iamv0alpha1.Team{
+				Spec: iamv0alpha1.TeamSpec{
+					Title: "updated title",
+					Email: "updated@test.com",
+				},
+			},
+			old: &iamv0alpha1.Team{
+				Spec: iamv0alpha1.TeamSpec{
+					Title: "original title",
+					Email: "original@test.com",
+				},
+			},
+			want: nil,
+		},
+		{
+			name: "valid update - service account changing to provisioned",
+			requester: &identity.StaticRequester{
+				Type:    types.TypeServiceAccount,
+				OrgRole: identity.RoleAdmin,
+			},
+			obj: &iamv0alpha1.Team{
+				Spec: iamv0alpha1.TeamSpec{
+					Title:       "updated title",
+					Email:       "updated@test.com",
+					Provisioned: true,
+					ExternalUID: "test-uid",
+				},
+			},
+			old: &iamv0alpha1.Team{
+				Spec: iamv0alpha1.TeamSpec{
+					Title: "original title",
+					Email: "original@test.com",
+				},
+			},
+			want: nil,
+		},
+		{
+			name: "valid update - already provisioned team",
+			requester: &identity.StaticRequester{
+				Type:    types.TypeServiceAccount,
+				OrgRole: identity.RoleAdmin,
+			},
+			obj: &iamv0alpha1.Team{
+				Spec: iamv0alpha1.TeamSpec{
+					Title:       "updated title",
+					Email:       "updated@test.com",
+					Provisioned: true,
+					ExternalUID: "updated-uid",
+				},
+			},
+			old: &iamv0alpha1.Team{
+				Spec: iamv0alpha1.TeamSpec{
+					Title:       "original title",
+					Email:       "original@test.com",
+					Provisioned: true,
+					ExternalUID: "original-uid",
+				},
+			},
+			want: nil,
+		},
+		{
+			name: "invalid update - no title",
+			requester: &identity.StaticRequester{
+				Type:    types.TypeUser,
+				OrgRole: identity.RoleAdmin,
+			},
+			obj: &iamv0alpha1.Team{
+				Spec: iamv0alpha1.TeamSpec{
+					Title: "",
+					Email: "updated@test.com",
+				},
+			},
+			old: &iamv0alpha1.Team{
+				Spec: iamv0alpha1.TeamSpec{
+					Title: "original title",
+					Email: "original@test.com",
+				},
+			},
+			want: apierrors.NewBadRequest("the team must have a title"),
+		},
+		{
+			name: "invalid update - user trying to change to provisioned",
+			requester: &identity.StaticRequester{
+				Type:    types.TypeUser,
+				OrgRole: identity.RoleAdmin,
+			},
+			obj: &iamv0alpha1.Team{
+				Spec: iamv0alpha1.TeamSpec{
+					Title:       "updated title",
+					Email:       "updated@test.com",
+					Provisioned: true,
+					ExternalUID: "test-uid",
+				},
+			},
+			old: &iamv0alpha1.Team{
+				Spec: iamv0alpha1.TeamSpec{
+					Title: "original title",
+					Email: "original@test.com",
+				},
+			},
+			want: apierrors.NewBadRequest("provisioned teams are only allowed for service accounts"),
+		},
+		{
+			name: "invalid update - changing from provisioned to non-provisioned",
+			requester: &identity.StaticRequester{
+				Type:    types.TypeServiceAccount,
+				OrgRole: identity.RoleAdmin,
+			},
+			obj: &iamv0alpha1.Team{
+				Spec: iamv0alpha1.TeamSpec{
+					Title: "updated title",
+					Email: "updated@test.com",
+				},
+			},
+			old: &iamv0alpha1.Team{
+				Spec: iamv0alpha1.TeamSpec{
+					Title:       "original title",
+					Email:       "original@test.com",
+					Provisioned: true,
+					ExternalUID: "original-uid",
+				},
+			},
+			want: apierrors.NewBadRequest("provisioned teams cannot be updated to non-provisioned teams"),
+		},
+		{
+			name: "invalid update - has externalUID but not provisioned",
+			requester: &identity.StaticRequester{
+				Type:    types.TypeUser,
+				OrgRole: identity.RoleAdmin,
+			},
+			obj: &iamv0alpha1.Team{
+				Spec: iamv0alpha1.TeamSpec{
+					Title:       "updated title",
+					Email:       "updated@test.com",
+					ExternalUID: "test-uid",
+				},
+			},
+			old: &iamv0alpha1.Team{
+				Spec: iamv0alpha1.TeamSpec{
+					Title: "original title",
+					Email: "original@test.com",
+				},
+			},
+			want: apierrors.NewBadRequest("externalUID is only allowed for provisioned teams"),
+		},
+		{
+			name:      "invalid update - no requester in context",
+			requester: nil,
+			obj: &iamv0alpha1.Team{
+				Spec: iamv0alpha1.TeamSpec{
+					Title: "updated title",
+					Email: "updated@test.com",
+				},
+			},
+			old: &iamv0alpha1.Team{
+				Spec: iamv0alpha1.TeamSpec{
+					Title: "original title",
+					Email: "original@test.com",
+				},
+			},
+			want: apierrors.NewUnauthorized("no identity found"),
+		},
+		{
+			name: "valid update - adding externalUID to provisioned team",
+			requester: &identity.StaticRequester{
+				Type:    types.TypeServiceAccount,
+				OrgRole: identity.RoleAdmin,
+			},
+			obj: &iamv0alpha1.Team{
+				Spec: iamv0alpha1.TeamSpec{
+					Title:       "updated title",
+					Email:       "updated@test.com",
+					Provisioned: true,
+					ExternalUID: "new-uid",
+				},
+			},
+			old: &iamv0alpha1.Team{
+				Spec: iamv0alpha1.TeamSpec{
+					Title:       "original title",
+					Email:       "original@test.com",
+					Provisioned: true,
+				},
+			},
+			want: nil,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			ctx := identity.WithRequester(context.Background(), test.requester)
+			err := ValidateOnUpdate(ctx, test.obj, test.old)
+			assert.Equal(t, test.want, err)
+		})
+	}
+}