Chore: remove tests for legacy AC, update other tests to work with RBAC (#68895)
* remove tests for legacy AC, update other tests to work with RBAC * update usage stat tests to use RBAC
This commit is contained in:
Ieva
+5
-353
@@ -18,45 +18,7 @@ import (
|
||||
"github.com/grafana/grafana/pkg/web/webtest"
|
||||
)
|
||||
|
||||
func TestAPIEndpoint_GetCurrentOrg_LegacyAccessControl(t *testing.T) {
|
||||
type testCase struct {
|
||||
desc string
|
||||
user *user.SignedInUser
|
||||
expectedCode int
|
||||
}
|
||||
|
||||
tests := []testCase{
|
||||
{
|
||||
desc: "viewer can view current org",
|
||||
user: &user.SignedInUser{OrgID: 1, OrgRole: org.RoleViewer},
|
||||
expectedCode: http.StatusOK,
|
||||
},
|
||||
{
|
||||
desc: "unauthenticated request cannot view current org",
|
||||
expectedCode: http.StatusUnauthorized,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.desc, func(t *testing.T) {
|
||||
server := SetupAPITestServer(t, func(hs *HTTPServer) {
|
||||
hs.orgService = &orgtest.FakeOrgService{ExpectedOrg: &org.Org{}}
|
||||
})
|
||||
|
||||
req := server.NewGetRequest("/api/org/")
|
||||
if tt.user != nil {
|
||||
req = webtest.RequestWithSignedInUser(req, tt.user)
|
||||
}
|
||||
|
||||
res, err := server.Send(req)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, tt.expectedCode, res.StatusCode)
|
||||
require.NoError(t, res.Body.Close())
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestAPIEndpoint_GetCurrentOrg_RBAC(t *testing.T) {
|
||||
func TestAPIEndpoint_GetCurrentOrg(t *testing.T) {
|
||||
type testCase struct {
|
||||
desc string
|
||||
expectedCode int
|
||||
@@ -92,139 +54,7 @@ func TestAPIEndpoint_GetCurrentOrg_RBAC(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
func TestAPIEndpoint_UpdateOrg_LegacyAccessControl(t *testing.T) {
|
||||
type testCase struct {
|
||||
desc string
|
||||
path string
|
||||
body string
|
||||
role org.RoleType
|
||||
isGrafanaAdmin bool
|
||||
expectedCode int
|
||||
}
|
||||
|
||||
tests := []testCase{
|
||||
{
|
||||
desc: "viewer cannot update current org",
|
||||
path: "/api/org",
|
||||
body: `{"name": "test"}`,
|
||||
role: org.RoleViewer,
|
||||
expectedCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
desc: "editor cannot update current org",
|
||||
path: "/api/org",
|
||||
body: `{"name": "test"}`,
|
||||
role: org.RoleEditor,
|
||||
expectedCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
desc: "admin can update current org",
|
||||
path: "/api/org",
|
||||
body: `{"name": "test"}`,
|
||||
role: org.RoleAdmin,
|
||||
expectedCode: http.StatusOK,
|
||||
},
|
||||
{
|
||||
desc: "viewer cannot update address of current org",
|
||||
path: "/api/org/address",
|
||||
body: `{}`,
|
||||
role: org.RoleViewer,
|
||||
expectedCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
desc: "editor cannot update address of current org",
|
||||
path: "/api/org/address",
|
||||
body: `{}`,
|
||||
role: org.RoleEditor,
|
||||
expectedCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
desc: "admin can update address of current org",
|
||||
path: "/api/org/address",
|
||||
body: `{}`,
|
||||
role: org.RoleAdmin,
|
||||
expectedCode: http.StatusOK,
|
||||
},
|
||||
{
|
||||
desc: "viewer cannot update target org",
|
||||
path: "/api/orgs/1",
|
||||
body: `{}`,
|
||||
role: org.RoleViewer,
|
||||
expectedCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
desc: "editor cannot update target org",
|
||||
path: "/api/orgs/1",
|
||||
body: `{}`,
|
||||
role: org.RoleEditor,
|
||||
expectedCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
desc: "admin cannot update target org",
|
||||
path: "/api/orgs/1",
|
||||
body: `{}`,
|
||||
role: org.RoleAdmin,
|
||||
expectedCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
desc: "grafana admin can update target org",
|
||||
path: "/api/orgs/1",
|
||||
body: `{"name": "test"}`,
|
||||
role: org.RoleAdmin,
|
||||
isGrafanaAdmin: true,
|
||||
expectedCode: http.StatusOK,
|
||||
},
|
||||
{
|
||||
desc: "viewer cannot update address of target org",
|
||||
path: "/api/orgs/1/address",
|
||||
body: `{}`,
|
||||
role: org.RoleViewer,
|
||||
expectedCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
desc: "editor cannot update address of target org",
|
||||
path: "/api/orgs/1/address",
|
||||
body: `{}`,
|
||||
role: org.RoleEditor,
|
||||
expectedCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
desc: "admin cannot update address of target org",
|
||||
path: "/api/orgs/1/address",
|
||||
body: `{}`,
|
||||
role: org.RoleAdmin,
|
||||
expectedCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
desc: "grafana admin can update address of target org",
|
||||
path: "/api/orgs/1/address",
|
||||
body: `{}`,
|
||||
role: org.RoleAdmin,
|
||||
isGrafanaAdmin: true,
|
||||
expectedCode: http.StatusOK,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.desc, func(t *testing.T) {
|
||||
server := SetupAPITestServer(t, func(hs *HTTPServer) {
|
||||
hs.orgService = &orgtest.FakeOrgService{ExpectedOrg: &org.Org{}}
|
||||
})
|
||||
|
||||
req := webtest.RequestWithSignedInUser(server.NewRequest(http.MethodPut, tt.path, strings.NewReader(tt.body)), &user.SignedInUser{
|
||||
OrgID: 1,
|
||||
OrgRole: tt.role,
|
||||
IsGrafanaAdmin: tt.isGrafanaAdmin,
|
||||
})
|
||||
res, err := server.SendJSON(req)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, tt.expectedCode, res.StatusCode)
|
||||
require.NoError(t, res.Body.Close())
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestAPIEndpoint_UpdateOrg_RBAC(t *testing.T) {
|
||||
func TestAPIEndpoint_UpdateOrg(t *testing.T) {
|
||||
type testCase struct {
|
||||
desc string
|
||||
path string
|
||||
@@ -317,72 +147,7 @@ func TestAPIEndpoint_UpdateOrg_RBAC(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
func TestAPIEndpoint_CreateOrgs_LegacyAccessControl(t *testing.T) {
|
||||
type testCase struct {
|
||||
desc string
|
||||
role org.RoleType
|
||||
isGrafanaAdmin bool
|
||||
anyoneCanCreate bool
|
||||
expectedCode int
|
||||
}
|
||||
|
||||
tests := []testCase{
|
||||
{
|
||||
desc: "viewer cannot create org",
|
||||
role: org.RoleViewer,
|
||||
expectedCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
desc: "editor cannot create org",
|
||||
role: org.RoleEditor,
|
||||
expectedCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
desc: "admin cannot create org",
|
||||
role: org.RoleAdmin,
|
||||
expectedCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
desc: "grafana admin can create org",
|
||||
role: org.RoleViewer,
|
||||
isGrafanaAdmin: true,
|
||||
expectedCode: http.StatusOK,
|
||||
},
|
||||
{
|
||||
desc: "viewer can create org when AllowUserOrgCreate is set to true",
|
||||
role: org.RoleViewer,
|
||||
isGrafanaAdmin: true,
|
||||
anyoneCanCreate: true,
|
||||
expectedCode: http.StatusOK,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.desc, func(t *testing.T) {
|
||||
server := SetupAPITestServer(t, func(hs *HTTPServer) {
|
||||
hs.orgService = &orgtest.FakeOrgService{ExpectedOrg: &org.Org{}}
|
||||
})
|
||||
|
||||
prev := setting.AllowUserOrgCreate
|
||||
defer func() {
|
||||
setting.AllowUserOrgCreate = prev
|
||||
}()
|
||||
setting.AllowUserOrgCreate = tt.anyoneCanCreate
|
||||
|
||||
req := webtest.RequestWithSignedInUser(server.NewPostRequest("/api/orgs", strings.NewReader(`{"name": "test"}`)), &user.SignedInUser{
|
||||
OrgID: 1,
|
||||
OrgRole: tt.role,
|
||||
IsGrafanaAdmin: tt.isGrafanaAdmin,
|
||||
})
|
||||
res, err := server.SendJSON(req)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, tt.expectedCode, res.StatusCode)
|
||||
require.NoError(t, res.Body.Close())
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestAPIEndpoint_CreateOrgs_RBAC(t *testing.T) {
|
||||
func TestAPIEndpoint_CreateOrgs(t *testing.T) {
|
||||
type testCase struct {
|
||||
desc string
|
||||
permission []accesscontrol.Permission
|
||||
@@ -422,58 +187,7 @@ func TestAPIEndpoint_CreateOrgs_RBAC(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
func TestAPIEndpoint_DeleteOrgs_LegacyAccessControl2(t *testing.T) {
|
||||
type testCase struct {
|
||||
desc string
|
||||
role org.RoleType
|
||||
isGrafanaAdmin bool
|
||||
expectedCode int
|
||||
}
|
||||
|
||||
tests := []testCase{
|
||||
{
|
||||
desc: "viewer cannot delete org",
|
||||
role: org.RoleViewer,
|
||||
expectedCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
desc: "editor cannot delete org",
|
||||
role: org.RoleEditor,
|
||||
expectedCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
desc: "admin cannot delete org",
|
||||
role: org.RoleAdmin,
|
||||
expectedCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
desc: "grafana admin can delete org",
|
||||
role: org.RoleViewer,
|
||||
isGrafanaAdmin: true,
|
||||
expectedCode: http.StatusOK,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.desc, func(t *testing.T) {
|
||||
server := SetupAPITestServer(t, func(hs *HTTPServer) {
|
||||
hs.orgService = &orgtest.FakeOrgService{ExpectedOrg: &org.Org{}}
|
||||
})
|
||||
|
||||
req := webtest.RequestWithSignedInUser(server.NewRequest(http.MethodDelete, "/api/orgs/1", nil), &user.SignedInUser{
|
||||
OrgID: 2,
|
||||
OrgRole: tt.role,
|
||||
IsGrafanaAdmin: tt.isGrafanaAdmin,
|
||||
})
|
||||
res, err := server.Send(req)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, tt.expectedCode, res.StatusCode)
|
||||
require.NoError(t, res.Body.Close())
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestAPIEndpoint_DeleteOrgs_RBAC(t *testing.T) {
|
||||
func TestAPIEndpoint_DeleteOrgs(t *testing.T) {
|
||||
type testCase struct {
|
||||
desc string
|
||||
permission []accesscontrol.Permission
|
||||
@@ -511,69 +225,7 @@ func TestAPIEndpoint_DeleteOrgs_RBAC(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
func TestAPIEndpoint_GetOrg_LegacyAccessControl(t *testing.T) {
|
||||
type testCase struct {
|
||||
desc string
|
||||
role org.RoleType
|
||||
isGrafanaAdmin bool
|
||||
expectedCode int
|
||||
}
|
||||
|
||||
tests := []testCase{
|
||||
{
|
||||
desc: "should not be able to fetch org as viewer",
|
||||
role: org.RoleViewer,
|
||||
isGrafanaAdmin: false,
|
||||
expectedCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
desc: "should not be able to fetch org as editor",
|
||||
role: org.RoleEditor,
|
||||
isGrafanaAdmin: false,
|
||||
expectedCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
desc: "should not be able to search org as amin",
|
||||
role: org.RoleAdmin,
|
||||
isGrafanaAdmin: false,
|
||||
expectedCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
desc: "should be able to fetch org as grafana admin",
|
||||
role: org.RoleViewer,
|
||||
isGrafanaAdmin: true,
|
||||
expectedCode: http.StatusOK,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.desc, func(t *testing.T) {
|
||||
server := SetupAPITestServer(t, func(hs *HTTPServer) {
|
||||
hs.orgService = &orgtest.FakeOrgService{ExpectedOrg: &org.Org{}}
|
||||
})
|
||||
|
||||
verify := func(path string) {
|
||||
req := webtest.RequestWithSignedInUser(server.NewGetRequest(path), &user.SignedInUser{
|
||||
OrgID: 1,
|
||||
OrgRole: tt.role,
|
||||
IsGrafanaAdmin: tt.isGrafanaAdmin,
|
||||
})
|
||||
res, err := server.Send(req)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, tt.expectedCode, res.StatusCode)
|
||||
require.NoError(t, res.Body.Close())
|
||||
}
|
||||
// search orgs
|
||||
verify("/api/orgs")
|
||||
// fetch by id
|
||||
verify("/api/orgs/1")
|
||||
// fetch by name
|
||||
verify("/api/orgs/name/test")
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestAPIEndpoint_GetOrg_RBAC(t *testing.T) {
|
||||
func TestAPIEndpoint_GetOrg(t *testing.T) {
|
||||
type testCase struct {
|
||||
desc string
|
||||
permissions []accesscontrol.Permission
|
||||
|
||||
Reference in New Issue
Block a user