From d7bd7f4f7264bcead9e2052b2282dd7edc728d61 Mon Sep 17 00:00:00 2001 From: Alexander Zobnin Date: Mon, 15 Dec 2025 13:48:19 +0100 Subject: [PATCH] Zanzana: Add tests for folder action sets --- .../authz/zanzana/server/server_check_test.go | 42 +++++++++++++++++++ .../authz/zanzana/server/server_test.go | 2 + 2 files changed, 44 insertions(+) diff --git a/pkg/services/authz/zanzana/server/server_check_test.go b/pkg/services/authz/zanzana/server/server_check_test.go index d8e8fa01526..c741f04d699 100644 --- a/pkg/services/authz/zanzana/server/server_check_test.go +++ b/pkg/services/authz/zanzana/server/server_check_test.go @@ -224,4 +224,46 @@ func testCheck(t *testing.T, server *Server) { require.NoError(t, err) assert.Equal(t, true, res.GetAllowed()) }) + + t.Run("user:19 should be able to view folder 4 and all subfolders", func(t *testing.T) { + res, err := server.Check(newContextWithNamespace(), newReq("user:19", utils.VerbGet, folderGroup, folderResource, "", "", "4")) + require.NoError(t, err) + assert.True(t, res.GetAllowed()) + + res, err = server.Check(newContextWithNamespace(), newReq("user:19", utils.VerbGet, folderGroup, folderResource, "", "", "5")) + require.NoError(t, err) + assert.True(t, res.GetAllowed()) + + res, err = server.Check(newContextWithNamespace(), newReq("user:19", utils.VerbGet, folderGroup, folderResource, "", "", "6")) + require.NoError(t, err) + assert.True(t, res.GetAllowed()) + }) + + t.Run("user:19 should be able to edit folder 4 and all subfolders", func(t *testing.T) { + res, err := server.Check(newContextWithNamespace(), newReq("user:19", utils.VerbDelete, folderGroup, folderResource, "", "", "4")) + require.NoError(t, err) + assert.True(t, res.GetAllowed()) + + res, err = server.Check(newContextWithNamespace(), newReq("user:19", utils.VerbDelete, folderGroup, folderResource, "", "", "5")) + require.NoError(t, err) + assert.True(t, res.GetAllowed()) + + res, err = server.Check(newContextWithNamespace(), newReq("user:19", utils.VerbDelete, folderGroup, folderResource, "", "", "6")) + require.NoError(t, err) + assert.True(t, res.GetAllowed()) + }) + + t.Run("user:20 should be able to view folder 4 and all subfolders", func(t *testing.T) { + res, err := server.Check(newContextWithNamespace(), newReq("user:20", utils.VerbGet, folderGroup, folderResource, "", "", "4")) + require.NoError(t, err) + assert.True(t, res.GetAllowed()) + + res, err = server.Check(newContextWithNamespace(), newReq("user:20", utils.VerbGet, folderGroup, folderResource, "", "", "5")) + require.NoError(t, err) + assert.True(t, res.GetAllowed()) + + res, err = server.Check(newContextWithNamespace(), newReq("user:20", utils.VerbGet, folderGroup, folderResource, "", "", "6")) + require.NoError(t, err) + assert.True(t, res.GetAllowed()) + }) } diff --git a/pkg/services/authz/zanzana/server/server_test.go b/pkg/services/authz/zanzana/server/server_test.go index 3f3a7e2cad6..51586a32c77 100644 --- a/pkg/services/authz/zanzana/server/server_test.go +++ b/pkg/services/authz/zanzana/server/server_test.go @@ -73,6 +73,8 @@ func setup(t *testing.T, srv *Server) *Server { common.NewFolderTuple("user:17", common.RelationSetView, "4"), common.NewFolderTuple("user:18", common.RelationCreate, "general"), common.NewFolderResourceTuple("user:18", common.RelationCreate, dashboardGroup, dashboardResource, "", "general"), + common.NewFolderTuple("user:19", common.RelationSetAdmin, "4"), + common.NewFolderTuple("user:20", common.RelationSetEdit, "4"), } return setupOpenFGADatabase(t, srv, tuples)