Something went wrong. Try again.
Monorepo for Tangled tangled.org
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462package knotacl
import ( "context" "encoding/json" "errors" "net/http" "net/http/httptest" "path/filepath" "slices" "strings" "sync" "testing"
"tangled.org/core/api/tangled" "tangled.org/core/appview/db" "tangled.org/core/appview/models" "tangled.org/core/consts" "tangled.org/core/orm" "tangled.org/core/rbac")
var capsKnotACL = []string{string(consts.CapKnotACL)}
type fakeKnot struct { version string capabilities []string members []string collaborators []string listStatus int
mu sync.Mutex listHits int}
func (k *fakeKnot) ServeHTTP(w http.ResponseWriter, r *http.Request) { switch { case strings.HasSuffix(r.URL.Path, tangled.KnotVersionNSID): if k.version == "" { http.Error(w, "version down", http.StatusInternalServerError) return } json.NewEncoder(w).Encode(tangled.KnotVersion_Output{Version: k.version, Capabilities: k.capabilities}) case strings.HasSuffix(r.URL.Path, tangled.KnotListMembersNSID): k.hit() if k.listStatus != 0 { http.Error(w, "list down", k.listStatus) return } json.NewEncoder(w).Encode(memberPage(k.members, "")) case strings.HasSuffix(r.URL.Path, tangled.RepoListCollaboratorsNSID): k.hit() if k.listStatus != 0 { http.Error(w, "list down", k.listStatus) return } json.NewEncoder(w).Encode(collabPage(k.collaborators, "")) default: http.NotFound(w, r) }}
func (k *fakeKnot) hit() { k.mu.Lock() k.listHits++ k.mu.Unlock()}
func (k *fakeKnot) hits() int { k.mu.Lock() defer k.mu.Unlock() return k.listHits}
func newServiceEnv(t *testing.T, knot *fakeKnot, seed func(e *rbac.Enforcer, host string)) (*Service, *db.DB, string) { t.Helper() srv := httptest.NewServer(knot) t.Cleanup(srv.Close) host := strings.TrimPrefix(srv.URL, "http://")
dir := t.TempDir() enforcer, err := rbac.NewEnforcer(filepath.Join(dir, "rbac.db")) if err != nil { t.Fatalf("NewEnforcer: %v", err) } if err := enforcer.AddKnot(host); err != nil { t.Fatalf("AddKnot: %v", err) } if err := enforcer.AddKnotOwner(host, testOwner); err != nil { t.Fatalf("AddKnotOwner: %v", err) } if seed != nil { seed(enforcer, host) }
d, err := db.Make(context.Background(), filepath.Join(dir, "appview.db")) if err != nil { t.Fatalf("db.Make: %v", err) }
return NewService(enforcer, d, true, testLogger()), d, host}
func testRepo(host string) *models.Repo { return &models.Repo{Did: testOwner, Knot: host, RepoDid: testRepoDid, Name: "anemone"}}
func seedRepoRow(t *testing.T, d *db.DB, repo *models.Repo) { t.Helper() tx, err := d.Begin() if err != nil { t.Fatalf("begin: %v", err) } if err := db.AddRepo(tx, repo); err != nil { t.Fatalf("AddRepo: %v", err) } if err := tx.Commit(); err != nil { t.Fatalf("commit: %v", err) }}
func seedRepoPolicies(t *testing.T, e *rbac.Enforcer, host string) { t.Helper() if err := e.AddRepo(testOwner, host, testRepoDid); err != nil { t.Fatalf("AddRepo: %v", err) } if err := e.AddCollaborator(testCollab, host, testRepoDid); err != nil { t.Fatalf("AddCollaborator: %v", err) }}
func sortedRoles(roles []string) []string { s := slices.Clone(roles) slices.Sort(s) return slices.Compact(s)}
func TestService_OldKnotUsesCasbinNoLiveQuery(t *testing.T) { ctx := context.Background() knot := &fakeKnot{version: "v1.14.0"} svc, _, host := newServiceEnv(t, knot, func(e *rbac.Enforcer, h string) { seedRepoPolicies(t, e, h) })
collab := svc.RolesInRepo(ctx, testRepo(host), testCollab) if !collab.IsCollaborator() || !collab.IsPushAllowed() { t.Errorf("collaborator roles = %v, want collaborator+push from casbin", collab.Roles) } if !svc.HasRepoPermission(ctx, testRepo(host), testOwner, "repo:owner") { t.Error("owner should hold repo:owner via casbin") } if knot.hits() != 0 { t.Errorf("listHits = %d, want 0; an old knot must never be live-queried", knot.hits()) }}
func TestService_ParityOldVsNew(t *testing.T) { ctx := context.Background() oldSvc, _, oldHost := newServiceEnv(t, &fakeKnot{version: "v1.14.0"}, func(e *rbac.Enforcer, h string) { seedRepoPolicies(t, e, h) }) newSvc, newDb, newHost := newServiceEnv(t, &fakeKnot{version: "v1.15.0", capabilities: capsKnotACL, collaborators: []string{testCollab}}, nil) seedRepoRow(t, newDb, testRepo(newHost))
for _, did := range []string{testOwner, testCollab} { oldRoles := sortedRoles(oldSvc.RolesInRepo(ctx, testRepo(oldHost), did).Roles) newRoles := sortedRoles(newSvc.RolesInRepo(ctx, testRepo(newHost), did).Roles) if !slices.Equal(oldRoles, newRoles) { t.Errorf("did %s: casbin roles %v != synth roles %v; synthesis has drifted from the policy grants", did, oldRoles, newRoles) } }}
func TestService_NewKnotOwnerFromRecord(t *testing.T) { ctx := context.Background() svc, _, host := newServiceEnv(t, &fakeKnot{version: "v1.15.0", capabilities: capsKnotACL}, nil)
owner := svc.RolesInRepo(ctx, testRepo(host), testOwner) if !owner.IsOwner() || !owner.IsPushAllowed() || !owner.SettingsAllowed() || !owner.RepoDeleteAllowed() { t.Errorf("owner roles = %v, want the full owner set derived from repo.Did", owner.Roles) } if stranger := svc.RolesInRepo(ctx, testRepo(host), testStrange); len(stranger.Roles) != 0 { t.Errorf("stranger roles = %v, want empty", stranger.Roles) }}
func TestService_NewKnotCollaboratorFromList(t *testing.T) { ctx := context.Background() svc, d, host := newServiceEnv(t, &fakeKnot{version: "v1.15.0", capabilities: capsKnotACL, collaborators: []string{testCollab}}, nil) seedRepoRow(t, d, testRepo(host))
collab := svc.RolesInRepo(ctx, testRepo(host), testCollab) if !collab.IsCollaborator() || !collab.IsPushAllowed() { t.Errorf("collaborator roles = %v, want collaborator+push from the live list", collab.Roles) } if collab.IsOwner() || collab.RepoDeleteAllowed() { t.Errorf("collaborator must not hold owner/delete: %v", collab.Roles) }}
func TestService_MixedFleet(t *testing.T) { ctx := context.Background() oldSvc, _, oldHost := newServiceEnv(t, &fakeKnot{version: "v1.14.0"}, func(e *rbac.Enforcer, h string) { seedRepoPolicies(t, e, h) }) newSvc, newDb, newHost := newServiceEnv(t, &fakeKnot{version: "v1.15.0", capabilities: capsKnotACL, collaborators: []string{testCollab}}, nil) seedRepoRow(t, newDb, testRepo(newHost))
if !newSvc.RolesInRepo(ctx, testRepo(newHost), testCollab).IsCollaborator() { t.Error("new-knot collaborator must resolve from the live query with an empty casbin") } if !newSvc.RolesInRepo(ctx, testRepo(newHost), testOwner).IsOwner() { t.Error("new-knot owner must resolve from repo.Did") } if !oldSvc.RolesInRepo(ctx, testRepo(oldHost), testCollab).IsCollaborator() { t.Error("old-knot collaborator must resolve from casbin") }}
func TestService_IsRepoCreateAllowed(t *testing.T) { ctx := context.Background()
oldSvc, _, oldHost := newServiceEnv(t, &fakeKnot{version: "v1.14.0"}, func(e *rbac.Enforcer, h string) { if _, err := e.TryAddKnotMember(h, testCollab); err != nil { t.Fatalf("TryAddKnotMember: %v", err) } }) if !oldSvc.IsRepoCreateAllowed(ctx, oldHost, testCollab) { t.Error("old-knot member should be allowed to create") } if oldSvc.IsRepoCreateAllowed(ctx, oldHost, testStrange) { t.Error("old-knot non-member should not be allowed to create") }
memberSvc, _, memberHost := newServiceEnv(t, &fakeKnot{version: "v1.15.0", capabilities: capsKnotACL, members: []string{testCollab}}, nil) if !memberSvc.IsRepoCreateAllowed(ctx, memberHost, testCollab) { t.Error("new-knot listed member should be allowed to create") }
ownerSvc, ownerDb, ownerHost := newServiceEnv(t, &fakeKnot{version: "v1.15.0", capabilities: capsKnotACL}, nil) if err := db.AddKnot(ownerDb, ownerHost, testOwner); err != nil { t.Fatalf("db.AddKnot: %v", err) } if err := db.MarkRegistered(ownerDb, orm.FilterEq("domain", ownerHost), orm.FilterEq("did", testOwner)); err != nil { t.Fatalf("MarkRegistered: %v", err) } if !ownerSvc.IsRepoCreateAllowed(ctx, ownerHost, testOwner) { t.Error("new-knot registered owner should be allowed to create even when absent from listMembers") } if ownerSvc.IsRepoCreateAllowed(ctx, ownerHost, testStrange) { t.Error("new-knot non-member non-owner should not be allowed to create") }}
func TestService_KnotDownDegrades(t *testing.T) { ctx := context.Background() knot := &fakeKnot{version: "v1.15.0", capabilities: capsKnotACL, listStatus: http.StatusInternalServerError} svc, _, host := newServiceEnv(t, knot, nil) repo := testRepo(host)
if !svc.RolesInRepo(ctx, repo, testOwner).IsOwner() { t.Error("owner must still resolve from repo.Did when the knot list is down") } if roles := svc.RolesInRepo(ctx, repo, testCollab); len(roles.Roles) != 0 { t.Errorf("non-owner roles when knot down = %v, want empty (degrade, not error)", roles.Roles) } if collabs := svc.Collaborators(ctx, repo); len(collabs) != 1 || collabs[0].Did != testOwner || collabs[0].Role != "owner" { t.Errorf("Collaborators when knot down = %v, want only the owner row", collabs) } if m := svc.KnotMembers(ctx, host); m != nil { t.Errorf("KnotMembers when knot down = %v, want nil", m) } if svc.IsRepoCreateAllowed(ctx, host, testStrange) { t.Error("create gate must be false when the knot is down and the user is not a registered owner") }}
func TestService_KnotOwnerForeignRepoParity(t *testing.T) { ctx := context.Background() foreignRepoDid := "did:plc:whelk"
oldSvc, _, oldHost := newServiceEnv(t, &fakeKnot{version: "v1.14.0"}, func(e *rbac.Enforcer, h string) { if err := e.AddRepo(testCollab, h, foreignRepoDid); err != nil { t.Fatalf("AddRepo: %v", err) } }) oldRepo := &models.Repo{Did: testCollab, Knot: oldHost, RepoDid: foreignRepoDid, Name: "barnacle"} oldRoles := sortedRoles(oldSvc.RolesInRepo(ctx, oldRepo, testOwner).Roles)
newSvc, newDb, newHost := newServiceEnv(t, &fakeKnot{version: "v1.15.0", capabilities: capsKnotACL}, nil) if err := db.AddKnot(newDb, newHost, testOwner); err != nil { t.Fatalf("db.AddKnot: %v", err) } if err := db.MarkRegistered(newDb, orm.FilterEq("domain", newHost), orm.FilterEq("did", testOwner)); err != nil { t.Fatalf("MarkRegistered: %v", err) } newRepo := &models.Repo{Did: testCollab, Knot: newHost, RepoDid: foreignRepoDid, Name: "barnacle"} newRoles := sortedRoles(newSvc.RolesInRepo(ctx, newRepo, testOwner).Roles)
if !slices.Equal(oldRoles, newRoles) { t.Errorf("knot operator on a member repo: old=%v new=%v; the appview gate must not diverge by knot version", oldRoles, newRoles) } if !slices.Contains(newRoles, "repo:delete") { t.Errorf("knot operator must retain repo:delete on a member repo, got %v", newRoles) } if newSvc.HasRepoPermission(ctx, newRepo, testStrange, "repo:delete") { t.Error("a stranger must not hold repo:delete on a foreign repo") }}
func TestService_KnotMembersIncludesOwner(t *testing.T) { ctx := context.Background() svc, d, host := newServiceEnv(t, &fakeKnot{version: "v1.15.0", capabilities: capsKnotACL, members: []string{testCollab}}, nil) if err := db.AddKnot(d, host, testOwner); err != nil { t.Fatalf("db.AddKnot: %v", err) } if err := db.MarkRegistered(d, orm.FilterEq("domain", host), orm.FilterEq("did", testOwner)); err != nil { t.Fatalf("MarkRegistered: %v", err) }
members := svc.KnotMembers(ctx, host) if !slices.Contains(members, testOwner) { t.Errorf("new-knot roster %v must include the registered owner so the dashboard renders the owner's repos", members) } if !slices.Contains(members, testCollab) { t.Errorf("new-knot roster %v must include listed members", members) }}
func TestService_CollaboratorsNewKnot(t *testing.T) { ctx := context.Background()
svc, d, host := newServiceEnv(t, &fakeKnot{version: "v1.15.0", capabilities: capsKnotACL, collaborators: []string{testCollab}}, nil) seedRepoRow(t, d, testRepo(host)) collabs := svc.Collaborators(ctx, testRepo(host)) if len(collabs) != 2 { t.Fatalf("Collaborators = %v, want owner + one collaborator", collabs) } if collabs[0].Did != testOwner || collabs[0].Role != "owner" { t.Errorf("first row = %v, want the owner", collabs[0]) } if collabs[1].Did != testCollab || collabs[1].Role != "collaborator" { t.Errorf("second row = %v, want the collaborator", collabs[1]) }
dupSvc, dupDb, dupHost := newServiceEnv(t, &fakeKnot{version: "v1.15.0", capabilities: capsKnotACL, collaborators: []string{testCollab, testOwner}}, nil) seedRepoRow(t, dupDb, testRepo(dupHost)) rows := dupSvc.Collaborators(ctx, testRepo(dupHost)) ownerRows := 0 for _, c := range rows { if c.Did == testOwner { ownerRows++ } } if ownerRows != 1 { t.Errorf("owner listed %d times, want exactly the single owner row: %v", ownerRows, rows) }}
func TestService_HasRepoPermissionErr_OwnerNeedsNoLiveQuery(t *testing.T) { ctx := context.Background() knot := &fakeKnot{version: "v1.15.0", capabilities: capsKnotACL, listStatus: http.StatusInternalServerError} svc, _, host := newServiceEnv(t, knot, nil)
ok, err := svc.HasRepoPermissionErr(ctx, testRepo(host), testOwner, "repo:push") if err != nil || !ok { t.Errorf("owner push = (%v, %v), want (true, nil) resolved from repo.Did with the list down", ok, err) } if knot.hits() != 0 { t.Errorf("listHits = %d, want 0; the owner must not trigger a live query", knot.hits()) }}
func TestService_HasRepoPermissionErr_KnotDownIsUndetermined(t *testing.T) { ctx := context.Background() knot := &fakeKnot{version: "v1.15.0", capabilities: capsKnotACL, listStatus: http.StatusInternalServerError} svc, _, host := newServiceEnv(t, knot, nil)
ok, err := svc.HasRepoPermissionErr(ctx, testRepo(host), testCollab, "repo:push") if !errors.Is(err, ErrKnotUnreachable) { t.Errorf("err = %v, want ErrKnotUnreachable so the ingester can fail open instead of dropping the record", err) } if ok { t.Error("ok must be false when the answer is undetermined") } if svc.HasRepoPermission(ctx, testRepo(host), testCollab, "repo:push") { t.Error("HasRepoPermission must fail closed when the knot is unreachable") }}
func TestService_HasRepoPermissionErr_DefinitiveDenyIsNotUndetermined(t *testing.T) { ctx := context.Background() svc, _, host := newServiceEnv(t, &fakeKnot{version: "v1.15.0", capabilities: capsKnotACL}, nil)
ok, err := svc.HasRepoPermissionErr(ctx, testRepo(host), testStrange, "repo:push") if err != nil { t.Errorf("err = %v, want nil; a reachable knot gives a definitive answer", err) } if ok { t.Error("a stranger must not hold push") }}
func TestService_KnotMembersDegradesToOwner(t *testing.T) { ctx := context.Background() knot := &fakeKnot{version: "v1.15.0", capabilities: capsKnotACL, listStatus: http.StatusInternalServerError} svc, d, host := newServiceEnv(t, knot, nil) if err := db.AddKnot(d, host, testOwner); err != nil { t.Fatalf("db.AddKnot: %v", err) } if err := db.MarkRegistered(d, orm.FilterEq("domain", host), orm.FilterEq("did", testOwner)); err != nil { t.Fatalf("MarkRegistered: %v", err) }
members := svc.KnotMembers(ctx, host) if !slices.Contains(members, testOwner) { t.Errorf("KnotMembers with the list down = %v, want the registered owner so the dashboard still renders", members) }}
func TestService_VersionDownFailsClosedToCasbin(t *testing.T) { ctx := context.Background() knot := &fakeKnot{version: ""} svc, _, host := newServiceEnv(t, knot, func(e *rbac.Enforcer, h string) { seedRepoPolicies(t, e, h) })
if !svc.RolesInRepo(ctx, testRepo(host), testCollab).IsCollaborator() { t.Error("an unreachable version probe must fail closed to the casbin path, which knows the collaborator") } if knot.hits() != 0 { t.Errorf("listHits = %d; failing closed must route to casbin, never the live list", knot.hits()) }}
func TestService_RegisteredOwnersMemoizedPerRequest(t *testing.T) { svc, d, host := newServiceEnv(t, &fakeKnot{version: "v1.15.0", capabilities: capsKnotACL}, nil) if err := db.AddKnot(d, host, testOwner); err != nil { t.Fatalf("db.AddKnot: %v", err) } if err := db.MarkRegistered(d, orm.FilterEq("domain", host), orm.FilterEq("did", testOwner)); err != nil { t.Fatalf("MarkRegistered: %v", err) }
ctx := WithMemo(context.Background()) first := svc.nat.registeredOwners(ctx, host) if !slices.Contains(first, testOwner) { t.Fatalf("first read = %v, want testOwner", first) }
if err := db.AddKnot(d, host, testCollab); err != nil { t.Fatalf("db.AddKnot: %v", err) } if err := db.MarkRegistered(d, orm.FilterEq("domain", host), orm.FilterEq("did", testCollab)); err != nil { t.Fatalf("MarkRegistered: %v", err) }
if second := svc.nat.registeredOwners(ctx, host); slices.Contains(second, testCollab) { t.Errorf("second read in the same request saw a newly added owner %v; the memo did not short-circuit the DB", second) } if fresh := svc.nat.registeredOwners(context.Background(), host); !slices.Contains(fresh, testCollab) { t.Errorf("a fresh request %v must re-query and see the new owner", fresh) }
first[0] = "did:plc:squid" if again := svc.nat.registeredOwners(ctx, host); slices.Contains(again, "did:plc:squid") { t.Errorf("mutating the returned slice corrupted the memo: %v", again) }}