def test_policy_binding_does_not_match_blacklist_rules(self):
"""Test that a policy binding does not match the blacklist.
Setup:
* Create a test policy binding.
* Create a test rule binding.
* Create a blacklist rule with the test rules.
Expected results:
No policy bindings found in the blacklist.
"""
test_binding = {
'role': 'roles/owner',
'members': [
'user:[email protected]',
]
}
rule_bindings = [{
'role':
'roles/owner',
'members': [
'user:*@company.com',
'user:abc@*.somewhere.com',
'group:*@googlegroups.com',
'serviceAccount:*@*.gserviceaccount.com',
]
}]
rule = Rule('test rule', 0, rule_bindings, mode='blacklist')
resource_rule = ResourceRules(rules=[rule])
results = list(
resource_rule.find_mismatches(self.project1, test_binding))
self.assertEqual(0, len(results))
def test_add_single_rule_builds_correct_map(self):
"""Test that adding a single rule builds the correct map."""
rule_book = OrgRuleBook(self.RULES1)
actual_rules = rule_book.resource_rules_map
# expected
rule_bindings = [{
'role': 'roles/*',
'members': ['user:*@company.com']
}]
rule = Rule('my rule', 0, rule_bindings, mode='whitelist')
expected_org_rules = ResourceRules(self.org789,
rules=set([rule]),
applies_to='self_and_children')
expected_proj1_rules = ResourceRules(self.project1,
rules=set([rule]),
applies_to='self')
expected_proj2_rules = ResourceRules(self.project2,
rules=set([rule]),
applies_to='self')
expected_rules = {
self.org789: expected_org_rules,
self.project1: expected_proj1_rules,
self.project2: expected_proj2_rules
}
self.assertEqual(expected_rules, actual_rules)
def test_one_member_mismatch(self):
"""Test a policy where one member mismatches the whitelist.
Setup:
* Create a RuleBook and add self.RULES1.
* Create the policy binding.
* Create the Rule and rule bindings.
* Create the resource association for the Rule.
Expected results:
One policy binding member missing from the whitelist.
"""
# actual
rule_book = OrgRuleBook()
rule_book._add_rules(self.RULES1)
policy_bindings = [{
'role':
'roles/editor',
'members': ['user:[email protected]', 'user:[email protected]']
}]
actual_violations = list(
rule_book.find_violations(self.project1, policy_bindings[0]))
# expected
rule_bindings = [{
'role': 'roles/*',
'members': ['user:*@company.com']
}]
rule = Rule('my rule', 0, rule_bindings, mode='whitelist')
expected_outstanding = {
'roles/editor':
[IamPolicyMember.create_from('user:[email protected]')]
}
expected_violations = [
RuleViolation(resource_type=self.project1.resource_type,
resource_id=self.project1.resource_id,
rule_name=rule.rule_name,
rule_index=rule.rule_index,
role='roles/editor',
violation_type=RULE_VIOLATION_TYPE.get(rule.mode),
members=expected_outstanding['roles/editor'])
]
self.assertEqual(expected_violations, actual_violations)
def test_policy_binding_matches_whitelist_rules(self):
"""Test that a policy binding matches the whitelist rules.
Setup:
* Create a test policy binding.
* Create a test rule binding.
* Create a whitelist rule with the test rules.
Expected results:
All policy binding members are in the whitelist.
"""
test_binding = {
'role':
'roles/owner',
'members': [
'user:[email protected]',
'user:[email protected]',
'group:[email protected]',
'serviceAccount:[email protected]',
]
}
rule_bindings = [{
'role':
'roles/owner',
'members': [
'user:*@company.com',
'user:abc@*.somewhere.com',
'group:*@googlegroups.com',
'serviceAccount:*@*.gserviceaccount.com',
]
}]
rule = Rule('test rule', 0, rule_bindings, mode='whitelist')
resource_rule = ResourceRules(rules=[rule])
results = list(
resource_rule.find_mismatches(self.project1, test_binding))
self.assertEqual(0, len(results))
def test_policy_binding_mismatches_required_rules(self):
"""Test that a required list of members mismatches policy binding.
Setup:
* Create a test policy binding.
* Create a test rule binding.
* Create a required rule with the test rules.
Expected results:
All required members are found in the policy.
"""
test_binding = {
'role':
'roles/owner',
'members': [
'user:[email protected]',
'group:[email protected]',
'serviceAccount:[email protected]',
]
}
rule_bindings = [{
'role':
'roles/owner',
'members': [
'user:[email protected]',
'user:[email protected]',
]
}]
rule = Rule('test rule', 0, rule_bindings, mode='required')
resource_rule = ResourceRules(resource=self.project1)
resource_rule.rules.add(rule)
results = list(
resource_rule.find_mismatches(self.project1, test_binding))
self.assertEqual(1, len(results))
def test_invalid_rule_mode_raises_when_create_rule(self):
"""Test that creating a Rule with invalid rule mode raises error."""
with self.assertRaises(InvalidRulesSchemaError):
Rule('exception', 0, [])