From 86c1de8df65934a64df51888d3d2698aae2673e9 Mon Sep 17 00:00:00 2001 From: Mihaly Gyongyosi Date: Mon, 15 Sep 2025 14:25:06 +0200 Subject: [PATCH] Move test to enterprise --- .../iam/service_account_integration_test.go | 32 ++----------------- .../serviceaccount-test-higher-role-v0.yaml | 7 ---- 2 files changed, 3 insertions(+), 36 deletions(-) delete mode 100644 pkg/tests/apis/iam/testdata/serviceaccount-test-higher-role-v0.yaml diff --git a/pkg/tests/apis/iam/service_account_integration_test.go b/pkg/tests/apis/iam/service_account_integration_test.go index a248b21b387..929c66ba693 100644 --- a/pkg/tests/apis/iam/service_account_integration_test.go +++ b/pkg/tests/apis/iam/service_account_integration_test.go @@ -5,21 +5,18 @@ import ( "fmt" "testing" + "github.com/stretchr/testify/require" + "k8s.io/apimachinery/pkg/api/errors" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime/schema" "github.com/grafana/grafana/pkg/apiserver/rest" - "github.com/grafana/grafana/pkg/services/accesscontrol/resourcepermissions" "github.com/grafana/grafana/pkg/services/featuremgmt" - "github.com/grafana/grafana/pkg/services/org" "github.com/grafana/grafana/pkg/services/serviceaccounts" "github.com/grafana/grafana/pkg/setting" "github.com/grafana/grafana/pkg/tests/apis" "github.com/grafana/grafana/pkg/tests/testinfra" "github.com/grafana/grafana/pkg/util/testutil" - - "github.com/stretchr/testify/require" - "k8s.io/apimachinery/pkg/api/errors" - "k8s.io/apimachinery/pkg/runtime/schema" ) var gvrServiceAccounts = schema.GroupVersionResource{ @@ -145,29 +142,6 @@ func doServiceAccountCRUDTestsUsingTheNewAPIs(t *testing.T, helper *apis.K8sTest require.Contains(t, statusErr.ErrStatus.Message, "invalid role: InvalidRole") }) - t.Run("should not be able to create service account with higher role than the user", func(t *testing.T) { - ctx := context.Background() - - editorWithSACreate := helper.CreateUser("custom-editor", apis.Org1, org.RoleEditor, - []resourcepermissions.SetResourcePermissionCommand{ - {Actions: []string{serviceaccounts.ActionCreate}}, - }) - - saClient := helper.GetResourceClient(apis.ResourceClientArgs{ - User: editorWithSACreate, - GVR: gvrServiceAccounts, - }) - - saToCreate := helper.LoadYAMLOrJSONFile("testdata/serviceaccount-test-higher-role-v0.yaml") - - _, err := saClient.Resource.Create(ctx, saToCreate, metav1.CreateOptions{}) - require.Error(t, err) - var statusErr *errors.StatusError - require.ErrorAs(t, err, &statusErr) - require.Equal(t, int32(403), statusErr.ErrStatus.Code) - require.Contains(t, statusErr.ErrStatus.Message, "cannot assign a role higher than user's role") - }) - t.Run("should not be able to create service account without a title", func(t *testing.T) { ctx := context.Background() saClient := helper.GetResourceClient(apis.ResourceClientArgs{ diff --git a/pkg/tests/apis/iam/testdata/serviceaccount-test-higher-role-v0.yaml b/pkg/tests/apis/iam/testdata/serviceaccount-test-higher-role-v0.yaml deleted file mode 100644 index 59512f73bfe..00000000000 --- a/pkg/tests/apis/iam/testdata/serviceaccount-test-higher-role-v0.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: iam.grafana.app/v0alpha1 -kind: ServiceAccount -metadata: - name: sa-with-higher-role -spec: - title: SA with higher role - role: Admin