def test_rules_only_(self):
config_rules_only = """
[[rules]]
allow = [
['user1', 'res_a', 'GET'],
]
deny = [
['user1', 'res_a', 'POST'],
]
"""
ac = AccessControl(config_rules_only)
is_allowed, reason = ac.check('user1', 'res_a', 'GET')
self.assertEqual(is_allowed, True)
self.assertEqual(reason, '[rules.1] "user1" is allowed to do "GET" on "res_a"')
is_allowed, reason = ac.check('user1', 'res_a', 'POST')
self.assertEqual(is_allowed, False)
self.assertEqual(reason, '[rules.1] "user1" is not allowed to do "POST" on "res_a"')
def test_first_match_deny_(self):
ac = AccessControl(config_first_match)
is_allowed, reason = ac.check('user3', 'part_c', 'PUT')
self.assertEqual(is_allowed, False)
self.assertEqual(reason, '[rules.r2] "reader" is not allowed to do "PUT" on "res2"')
def test_first_match_allow_(self):
ac = AccessControl(config_first_match)
is_allowed, reason = ac.check('user1', 'part_b', 'GET')
self.assertEqual(is_allowed, True)
self.assertEqual(reason, '[rules.r1] "admin" is allowed to do "any action" on "res1"')
def test_rule_mismatch_(self):
ac = AccessControl(config_first_match)
is_allowed, reason = ac.check('user1', 'part_c', 'GET')
self.assertEqual(is_allowed, True)
self.assertEqual(reason, 'No matched rule found, use mismatch_decision: True')
def test_any_allow_deny_(self):
ac = AccessControl(config_any_allow)
is_allowed, reason = ac.check('user5', 'part_c', 'POST')
self.assertEqual(is_allowed, False)
self.assertEqual(reason, 'All matched rules denied')
def test_any_allow_allow_(self):
ac = AccessControl(config_any_allow)
is_allowed, reason = ac.check('user1', 'part_a', 'POST')
self.assertEqual(is_allowed, True)
self.assertEqual(reason, '[rules.r1] "admin" is allowed to do "*" on "res1"')
def test_all_allow_deny_(self):
ac = AccessControl(config_all_allow)
is_allowed, reason = ac.check('user5', 'part_a', 'POST')
self.assertEqual(is_allowed, False)
self.assertEqual(reason, '[rules.r2] "reader" is not allowed to do "POST" on "res2"')
def test_all_allow_allow_(self):
ac = AccessControl(config_all_allow)
is_allowed, reason = ac.check('user1', 'part_a', 'PUT')
self.assertEqual(is_allowed, True)
self.assertEqual(reason, 'All matched rules allowed')