Jo
47 lines
1.3 KiB
Go
47 lines
1.3 KiB
Go
package server
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/grafana/grafana/pkg/services/sqlstore"
|
|
"github.com/grafana/grafana/pkg/setting"
|
|
"google.golang.org/grpc/codes"
|
|
"google.golang.org/grpc/status"
|
|
|
|
authzextv1 "github.com/grafana/grafana/pkg/services/authz/proto/v1"
|
|
"github.com/grafana/grafana/pkg/services/authz/zanzana/common"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestWriteAuthorization(t *testing.T) {
|
|
cfg := setting.NewCfg()
|
|
testStore := sqlstore.NewTestStore(t, sqlstore.WithCfg(cfg))
|
|
srv := setupOpenFGAServer(t, testStore, cfg)
|
|
setup(t, srv)
|
|
|
|
req := &authzextv1.WriteRequest{
|
|
Namespace: namespace,
|
|
Writes: &authzextv1.WriteRequestWrites{
|
|
TupleKeys: []*authzextv1.TupleKey{
|
|
{
|
|
// Folder parent tuples are valid without any relationship condition.
|
|
User: "folder:1",
|
|
Relation: common.RelationParent,
|
|
Object: "folder:write-authz-test",
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
t.Run("denies Write without zanzana:update", func(t *testing.T) {
|
|
_, err := srv.Write(newContextWithNamespace(), req)
|
|
require.Error(t, err)
|
|
require.Equal(t, codes.PermissionDenied, status.Code(err))
|
|
})
|
|
|
|
t.Run("allows Write with zanzana:update", func(t *testing.T) {
|
|
_, err := srv.Write(newContextWithZanzanaUpdatePermission(), req)
|
|
require.NoError(t, err)
|
|
})
|
|
}
|