From 48f415e24bc030cfbfdded8e9d5063cd06116c2d Mon Sep 17 00:00:00 2001 From: Roberto Jimenez Sanchez Date: Mon, 15 Dec 2025 17:04:31 +0100 Subject: [PATCH] Remove some tests --- .../apis/provisioning/authorization_test.go | 122 ------------------ 1 file changed, 122 deletions(-) diff --git a/pkg/tests/apis/provisioning/authorization_test.go b/pkg/tests/apis/provisioning/authorization_test.go index 3240d0e43d2..1ee79530aab 100644 --- a/pkg/tests/apis/provisioning/authorization_test.go +++ b/pkg/tests/apis/provisioning/authorization_test.go @@ -3,12 +3,10 @@ package provisioning import ( "context" "encoding/json" - "net/http" "testing" "github.com/stretchr/testify/require" apierrors "k8s.io/apimachinery/pkg/api/errors" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1" ) @@ -249,123 +247,3 @@ func TestIntegrationProvisioning_FilesAuthorization(t *testing.T) { require.True(t, apierrors.IsForbidden(result.Error()), "should return Forbidden error") }) } - -// TestIntegrationProvisioning_FilesAuthorizationConfiguredBranch tests that -// single file/folder operations are blocked on the configured branch -func TestIntegrationProvisioning_FilesAuthorizationConfiguredBranch(t *testing.T) { - if testing.Short() { - t.Skip("skipping integration test") - } - - helper := runGrafana(t) - ctx := context.Background() - - // Create a repository with a dashboard - const repo = "configured-branch-test" - helper.CreateRepo(t, TestRepo{ - Name: repo, - Path: helper.ProvisioningPath, - Target: "instance", - SkipResourceAssertions: true, // We validate authorization, not resource creation - Copies: map[string]string{ - "testdata/all-panels.json": "dashboard1.json", - }, - }) - - t.Run("DELETE file on configured branch - should return MethodNotAllowed", func(t *testing.T) { - // Note: Using raw HTTP request because k8s client doesn't support empty ref - addr := helper.GetEnv().Server.HTTPServer.Listener.Addr().String() - url := "http://admin:admin@" + addr + "/apis/provisioning.grafana.app/v0alpha1/namespaces/default/repositories/" + repo + "/files/dashboard1.json" - - req, err := http.NewRequest(http.MethodDelete, url, nil) - require.NoError(t, err) - - resp, err := http.DefaultClient.Do(req) - require.NoError(t, err) - defer resp.Body.Close() - - require.Equal(t, http.StatusMethodNotAllowed, resp.StatusCode, - "delete on configured branch should return MethodNotAllowed") - }) - - t.Run("MOVE file on configured branch - should return MethodNotAllowed", func(t *testing.T) { - addr := helper.GetEnv().Server.HTTPServer.Listener.Addr().String() - url := "http://admin:admin@" + addr + "/apis/provisioning.grafana.app/v0alpha1/namespaces/default/repositories/" + repo + "/files/moved.json?originalPath=dashboard1.json" - - dashboardContent := helper.LoadFile("testdata/all-panels.json") - req, err := http.NewRequest(http.MethodPost, url, http.NoBody) - require.NoError(t, err) - req.Body = http.NoBody - req.ContentLength = int64(len(dashboardContent)) - - resp, err := http.DefaultClient.Do(req) - require.NoError(t, err) - defer resp.Body.Close() - - require.Equal(t, http.StatusMethodNotAllowed, resp.StatusCode, - "move on configured branch should return MethodNotAllowed") - }) - - t.Run("DELETE file on branch - should check authorization first", func(t *testing.T) { - // Even though delete is allowed on branches, authorization should be checked first - result := helper.ViewerREST.Delete(). - Namespace("default"). - Resource("repositories"). - Name(repo). - SubResource("files", "dashboard1.json"). - Param("ref", "test-branch"). - Do(ctx) - - require.Error(t, result.Error(), "should check authorization before branch validation") - require.True(t, apierrors.IsForbidden(result.Error()), "should return Forbidden (not MethodNotAllowed)") - }) -} - -// TestIntegrationProvisioning_ProvisioningServiceIdentity verifies that the -// provisioning service itself (operating with service identity) has full access -func TestIntegrationProvisioning_ProvisioningServiceIdentity(t *testing.T) { - if testing.Short() { - t.Skip("skipping integration test") - } - - helper := runGrafana(t) - ctx := context.Background() - - // Create a repository - const repo = "service-identity-test" - helper.CreateRepo(t, TestRepo{ - Name: repo, - Path: helper.ProvisioningPath, - Target: "instance", - Copies: map[string]string{ - "testdata/all-panels.json": "dashboard1.json", - }, - // Don't skip assertions here - we want to verify sync worked - }) - - // Verify that sync succeeded - this proves service identity has full access - dashboards, err := helper.DashboardsV1.Resource.List(ctx, metav1.ListOptions{}) - require.NoError(t, err) - require.Len(t, dashboards.Items, 1, "sync via service identity should have created dashboard") - - t.Run("Service identity can create resources", func(t *testing.T) { - // Copy another file and sync - helper.CopyToProvisioningPath(t, "testdata/timeline-demo.json", "dashboard2.json") - helper.SyncAndWait(t, repo, nil) - - dashboards, err := helper.DashboardsV1.Resource.List(ctx, metav1.ListOptions{}) - require.NoError(t, err) - require.Len(t, dashboards.Items, 2, "service identity should be able to create resources") - }) - - t.Run("Service identity can update resources", func(t *testing.T) { - // Modify existing file and sync - helper.CopyToProvisioningPath(t, "testdata/all-panels.json", "dashboard1.json") - helper.SyncAndWait(t, repo, nil) - - // Verify update succeeded - dashboards, err := helper.DashboardsV1.Resource.List(ctx, metav1.ListOptions{}) - require.NoError(t, err) - require.Len(t, dashboards.Items, 2, "service identity should be able to update resources") - }) -}