def test_domain_syncacl_user_overwrites_user_permissions(self):
"""
Given a existing context with subcriptions
When a bunch of users and groups acls are synced
And a user from a group acl is also in users acl
And both group and user has the same role
Then the action with more permissions is preserved
"""
from .mockers.syncacl import batch_subscribe_request4
from .mockers.syncacl import context as context
from .mockers.syncacl import initial_subscriptions as subscriptions
http_mock_get_context(context)
http_mock_get_context_subscriptions(subscriptions)
self.testapp.post('/api/domains/test/services/syncacl'.format(),
json.dumps(batch_subscribe_request4),
headers=oauth2Header(test_user),
status=200)
# Index by username to be able to make asserts
# This is mandatory, as we cannot assume the order of the queue
messages = self.assertMessagesInQueue('syncacl', retries=3, expected=1)
# Test subscribed user revoke permission, preserves most important role
self.assertItemsEqual(messages['testuser.creator']['d']['tasks'],
['grant'])
self.assertItemsEqual(
messages['testuser.creator']['d']['tasks']['grant'], ['flag'])
self.assertIn('context', messages['testuser.creator']['d'])
def test_create_deployment(self):
from .mockers.deployments import test_deployment
res = self.testapp.post('/api/deployments',
json.dumps(test_deployment),
headers=oauth2Header(test_user),
status=201)
self.assertEqual(res.json['name'], test_deployment['name'])
self.assertEqual(res.json['title'], test_deployment['title'])
def test_add_component_maxcluster(self):
from .mockers.deployments import test_deployment
from .mockers.deployments import test_maxcluster_component as component
self.create_deployment(test_deployment)
res = self.testapp.post('/api/deployments/{}/components'.format(
test_deployment['name']),
json.dumps(component),
headers=oauth2Header(test_user),
status=201)
self.assertEqual(res.json['server'], component['params']['server'])
def test_get_deployment(self):
from .mockers.deployments import test_deployment
self.create_deployment(test_deployment)
res = self.testapp.get('/api/deployments/{}'.format(
test_deployment['name']),
'',
headers=oauth2Header(test_user),
status=200)
self.assertEqual(res.json['name'], test_deployment['name'])
self.assertEqual(res.json['title'], test_deployment['title'])
def test_register_domain(self):
from .mockers.domains import test_domain
res = self.testapp.post('/api/domains',
json.dumps(test_domain),
oauth2Header(test_user),
status=201)
self.assertEqual(res.json['name'], test_domain['name'])
self.assertEqual(res.json['title'], test_domain['title'])
self.assertEqual(res.json['max'], None)
self.assertEqual(res.json['oauth'], None)
def test_assign_component(self):
from .mockers.domains import test_domain
self.create_domain(test_domain)
res = self.testapp.post(
'/api/domains/{}/components'.format(test_domain['name']),
json.dumps({'component_id': 'test/maxserver:testmaxserver1'}),
oauth2Header(test_user),
status=201)
self.assertEqual(res.json['name'], test_domain['name'])
self.assertEqual(res.json['title'], test_domain['title'])
self.assertEqual(res.json['max'], 'http://localhost:8081')
self.assertEqual(res.json['oauth'], 'https://oauth.upcnet.es')
def test_add_component_maxserver(self):
from .mockers.deployments import test_deployment
from .mockers.deployments import test_maxcluster_component as max_cluster
from .mockers.deployments import test_maxserver_component as component
http_mock_info()
self.create_deployment(test_deployment)
self.add_component(test_deployment, max_cluster)
res = self.testapp.post('/api/deployments/{}/components'.format(
test_deployment['name']),
json.dumps(component),
headers=oauth2Header(test_user),
status=201)
self.assertEqual(res.json['url'], component['params']['url'])
res = self.testapp.get('/api/deployments/{}'.format(
test_deployment['name']),
'',
headers=oauth2Header(test_user),
status=200)
self.assertEqual(
res.json['components']['testmaxcluster']['components']
['testmaxserver1']['url'], component['params']['url'])
def test_domain_syncacl_bad_context_permissions(self):
"""
Given I'm a user without enough context permissions on max
When I try to execute the service
I get a Forbidden exception
"""
from .mockers.syncacl import batch_subscribe_request
from .mockers.syncacl import context as context
from .mockers.syncacl import initial_subscriptions as subscriptions
http_mock_get_context(context, status=403)
http_mock_get_context_subscriptions(subscriptions)
self.testapp.post('/api/domains/test/services/syncacl'.format(),
json.dumps(batch_subscribe_request),
headers=oauth2Header(test_user),
status=403)
def test_domain_syncacl_user_overwrites_group_permissions(self):
"""
Given a existing context with subcriptions
When a bunch of users and groups acls are synced
And a user from a group acl is also in users acl
And both group and user has the same role
Then the same and only action is generated
"""
from .mockers.syncacl import batch_subscribe_request3
from .mockers.syncacl import context as context
from .mockers.syncacl import initial_subscriptions as subscriptions
from .mockers.syncacl import ldap_test_group4
http_mock_get_context(context)
http_mock_get_context_subscriptions(subscriptions)
self.add_patch(ldap_patch_connect())
self.add_patch(ldap_patch_disconnect())
self.add_patch(
ldap_patch_group_search({'TestGroup4': ldap_test_group4}))
self.testapp.post('/api/domains/test/services/syncacl'.format(),
json.dumps(batch_subscribe_request3),
headers=oauth2Header(test_user),
status=200)
# Index by username to be able to make asserts
# This is mandatory, as we cannot assume the order of the queue
messages = self.assertMessagesInQueue('syncacl', retries=3, expected=2)
self.assertItemsEqual(messages['groupuser1']['d']['tasks'],
['grant', 'subscribe'])
self.assertItemsEqual(messages['groupuser1']['d']['tasks']['grant'],
['write', 'flag'])
self.assertIn('context', messages['groupuser1']['d'])
# Test subscribed user revoke permission
self.assertItemsEqual(messages['testuser.creator']['d']['tasks'],
['grant'])
self.assertItemsEqual(
messages['testuser.creator']['d']['tasks']['grant'], ['flag'])
self.assertIn('context', messages['testuser.creator']['d'])
def test_syncldapgroup(self):
"""
"""
from .mockers.syncgroup import update_group_request
from .mockers.syncacl import context
from .mockers.syncacl import initial_subscriptions as subscriptions
from .mockers.syncacl import ldap_test_group4
http_mock_group_communities([{
'url': context['url'],
'groups': [],
'users': ['testuser1.creator']
}])
http_mock_get_context(context)
http_mock_get_context_subscriptions(subscriptions)
self.add_patch(ldap_patch_connect())
self.add_patch(ldap_patch_disconnect())
self.add_patch(ldap_patch_group_search({
'group4': ldap_test_group4,
}))
self.testapp.post(
'/api/deployments/{deployment}/components/{component}/services/{service}'
.format(deployment='test',
component='testldap',
service='syncldapgroup'),
json.dumps(update_group_request),
headers=oauth2Header(test_user),
status=200)
# Index by username to be able to make asserts
# This is mandatory, as we cannot assume the order of the queue
messages = self.assertMessagesInQueue('syncacl', retries=3, expected=1)
# Test subscribed user revoke permission, preserves most important role
self.assertItemsEqual(messages['groupuser1']['d']['tasks'],
['subscribe'])
self.assertIn('context', messages['groupuser1']['d'])
def test_domain_syncacl_change_acls(self):
"""
Given a existing context with subcriptions
When a bunch of users and groups acls are synced
Then a set of actions is generated to update thouse users subscriptions
And the users that have been removed from acl are unsubscribed
"""
from .mockers.syncacl import batch_subscribe_request2
from .mockers.syncacl import context as context
from .mockers.syncacl import existing_subscriptions as subscriptions
from .mockers.syncacl import ldap_test_group, ldap_test_group2, ldap_test_group3
http_mock_get_context(context)
http_mock_get_context_subscriptions(subscriptions)
self.add_patch(ldap_patch_connect())
self.add_patch(ldap_patch_disconnect())
self.add_patch(
ldap_patch_group_search({
'TestGroup': ldap_test_group,
'TestGroup2': ldap_test_group2,
'TestGroup3': ldap_test_group3
}))
self.testapp.post('/api/domains/test/services/syncacl'.format(),
json.dumps(batch_subscribe_request2),
headers=oauth2Header(test_user),
status=200)
# Index by username to be able to make asserts
# This is mandatory, as we cannot assume the order of the queue
messages = self.assertMessagesInQueue('syncacl', retries=3, expected=6)
# Testuser1 remains untouched
self.assertNotIn('testuser1', messages)
# Users from gropu 2 remains untouched
self.assertNotIn('groupuser3', messages)
self.assertNotIn('groupuser4', messages)
# Test subscribed group users revoke permission
self.assertItemsEqual(messages['groupuser1']['d']['tasks'], ['revoke'])
self.assertItemsEqual(messages['groupuser1']['d']['tasks']['revoke'],
['write'])
self.assertIn('context', messages['groupuser1']['d'])
self.assertItemsEqual(messages['groupuser2']['d']['tasks'], ['revoke'])
self.assertItemsEqual(messages['groupuser2']['d']['tasks']['revoke'],
['write'])
self.assertIn('context', messages['groupuser2']['d'])
# Test subscribed group users unsubscribe
self.assertItemsEqual(messages['groupuser5']['d']['tasks'],
['unsubscribe'])
self.assertIn('context', messages['groupuser5']['d'])
self.assertItemsEqual(messages['groupuser6']['d']['tasks'],
['unsubscribe'])
self.assertIn('context', messages['groupuser6']['d'])
# Test subscribed single user unsubscribe
self.assertItemsEqual(messages['testowner']['d']['tasks'],
['unsubscribe'])
self.assertIn('context', messages['testowner']['d'])
# Test subscribed user revoke permission
self.assertItemsEqual(messages['testuser.creator']['d']['tasks'],
['revoke'])
self.assertItemsEqual(
messages['testuser.creator']['d']['tasks']['revoke'], ['flag'])
self.assertIn('context', messages['testuser.creator']['d'])
def test_domain_syncacl_initial_subscriptions(self):
"""
Given a newly created context
When a bunch of users and groups acls are synced
Then a set of actions is generated to generate needed subscriptions grants and revokes for new subscriptors
"""
from .mockers.syncacl import batch_subscribe_request
from .mockers.syncacl import context as context
from .mockers.syncacl import initial_subscriptions as subscriptions
from .mockers.syncacl import ldap_test_group, ldap_test_group2, ldap_test_group3
http_mock_get_context(context)
http_mock_get_context_subscriptions(subscriptions)
self.add_patch(ldap_patch_connect())
self.add_patch(ldap_patch_disconnect())
self.add_patch(
ldap_patch_group_search({
'TestGroup': ldap_test_group,
'TestGroup2': ldap_test_group2,
'TestGroup3': ldap_test_group3
}))
self.testapp.post('/api/domains/test/services/syncacl'.format(),
json.dumps(batch_subscribe_request),
headers=oauth2Header(test_user),
status=200)
# Index by username to be able to make asserts
# This is mandatory, as we cannot assume the order of the queue
messages = self.assertMessagesInQueue('syncacl', retries=3, expected=9)
# Test group users new subscription without grants
self.assertItemsEqual(messages['groupuser1']['d']['tasks'],
['subscribe'])
self.assertIn('context', messages['groupuser1']['d'])
self.assertItemsEqual(messages['groupuser2']['d']['tasks'],
['subscribe'])
self.assertIn('context', messages['groupuser2']['d'])
# Test group users new subscription with single grant
self.assertItemsEqual(messages['groupuser3']['d']['tasks'],
['subscribe', 'grant'])
self.assertItemsEqual(messages['groupuser3']['d']['tasks']['grant'],
['write'])
self.assertIn('context', messages['groupuser3']['d'])
self.assertItemsEqual(messages['groupuser4']['d']['tasks'],
['subscribe', 'grant'])
self.assertItemsEqual(messages['groupuser4']['d']['tasks']['grant'],
['write'])
self.assertIn('context', messages['groupuser4']['d'])
# Test group users new subscription with single revoke
self.assertItemsEqual(messages['groupuser5']['d']['tasks'],
['subscribe', 'revoke'])
self.assertItemsEqual(messages['groupuser5']['d']['tasks']['revoke'],
['unsubscribe'])
self.assertIn('context', messages['groupuser5']['d'])
self.assertItemsEqual(messages['groupuser6']['d']['tasks'],
['subscribe', 'revoke'])
self.assertItemsEqual(messages['groupuser6']['d']['tasks']['revoke'],
['unsubscribe'])
self.assertIn('context', messages['groupuser6']['d'])
# Test single user new subscription with single grant
self.assertItemsEqual(messages['testuser1']['d']['tasks'],
['subscribe', 'grant'])
self.assertItemsEqual(messages['testuser1']['d']['tasks']['grant'],
['write'])
self.assertIn('context', messages['testuser1']['d'])
# Test single user new subscription with multiple grant
self.assertItemsEqual(messages['testowner']['d']['tasks'],
['subscribe', 'grant'])
self.assertItemsEqual(messages['testowner']['d']['tasks']['grant'],
['write', 'flag'])
self.assertIn('context', messages['testowner']['d'])
# Test cretor grant
self.assertItemsEqual(messages['testuser.creator']['d']['tasks'],
['grant'])
self.assertItemsEqual(
messages['testuser.creator']['d']['tasks']['grant'], ['flag'])
self.assertIn('context', messages['testuser1']['d'])