Milo: ACL support

milo/appengine/settings/acl_test.go

+// Copyright 2016 The LUCI Authors. All rights reserved.
+// Use of this source code is governed under the Apache License, Version 2.0
+// that can be found in the LICENSE file.
+
+package settings
+
+import (
+        "net"
+        "strings"
+        "testing"
+
+        "github.com/luci/gae/impl/memory"
+        lucicfg "github.com/luci/luci-go/common/config"
+        memcfg "github.com/luci/luci-go/common/config/impl/memory"
+        "github.com/luci/luci-go/common/logging/gologger"
+        "github.com/luci/luci-go/server/auth"
+        "github.com/luci/luci-go/server/auth/authdb"
+        "github.com/luci/luci-go/server/auth/identity"
+        "github.com/luci/luci-go/server/secrets"
+        "golang.org/x/net/context"
+
+        . "github.com/smartystreets/goconvey/convey"
+)
+
+func TestACL(t *testing.T) {
+        t.Parallel()
+
+        Convey("Test Environment", t, func() {
+                c := memory.UseWithAppID(context.Background(), "dev~luci-milo")
+                c = gologger.StdConfig.Use(c)
+
+                Convey("Set up projects", func() {
+                        c = lucicfg.SetImplementation(c, memcfg.New(aclConfgs))
+                        err := update(c)
+                        So(err, ShouldBeNil)
+
+                        Convey("Anon wants to...", func() {
+                                c = auth.WithState(c, fakeState{})
+                                Convey("Read public project", func() {
+                                        ok, err := IsAllowed(c, "opensource")
+                                        So(ok, ShouldEqual, true)
+                                        So(err, ShouldBeNil)
+                                })
+                                Convey("Read private project", func() {
+                                        ok, err := IsAllowed(c, "secret")
+                                        So(ok, ShouldEqual, false)
+                                        So(err, ShouldBeNil)
+                                })
+
+                        })
+                        Convey("alicebob@google.com wants to...", func() {
+                                c = auth.WithState(c, fakeState{"alicebob@google.com"})
+                                Convey("Read private project", func() {
+                                        ok, err := IsAllowed(c, "secret")
+                                        So(ok, ShouldEqual, true)
+                                        So(err, ShouldBeNil)
+                                })
+                        })
+
+                        Convey("eve@notgoogle.com wants to...", func() {
+                                c = auth.WithState(c, fakeState{"eve@notgoogle.com"})
+                                Convey("Read public project", func() {
+                                        ok, err := IsAllowed(c, "opensource")
+                                        So(ok, ShouldEqual, true)
+                                        So(err, ShouldBeNil)
+                                })
+                                Convey("Read private project", func() {
+                                        ok, err := IsAllowed(c, "secret")
+                                        So(ok, ShouldEqual, false)
+                                        So(err, ShouldBeNil)
+                                })
+                        })
+                })
+        })
+}
+
+type testingAuthDB struct{}

[Vadim Sh., 2016/08/16 00:21:22]

you can probably avoid most of this mocks if you use stuff from
https://godoc.org/github.com/luci/luci-go/server/auth/authtest

in particular,
https://godoc.org/github.com/luci/luci-go/server/auth/authtest#FakeDB and
https://godoc.org/github.com/luci/luci-go/server/auth/authtest#FakeState

[Ryan Tseng, 2016/08/16 00:38:06]

Done.

+
+func (a testingAuthDB) IsAllowedOAuthClientID(
+        c context.Context, email, clientID string) (bool, error) {
+        panic("Not Implemented")
+}
+
+func (a testingAuthDB) IsMember(
+        c context.Context, id identity.Identity, group string) (bool, error) {
+        if group == "all" {
+                return true, nil
+        }
+        if id.Kind() == identity.User &&
+                strings.HasSuffix(id.Value(), "@google.com") {
+                return true, nil
+        }
+        return false, nil
+}
+func (a testingAuthDB) SharedSecrets(c context.Context) (secrets.Store, error) {
+        panic("Not Implemented")
+}
+
+func (a testingAuthDB) GetWhitelistForIdentity(
+        c context.Context, ident identity.Identity) (string, error) {
+
+        panic("Not Implemented")
+}
+func (a testingAuthDB) IsInWhitelist(
+        c context.Context, ip net.IP, whitelist string) (bool, error) {
+
+        panic("Not Implemented")
+}
+func (a testingAuthDB) GetAuthServiceURL(c context.Context) (string, error) {
+        panic("Not Implemented")
+}
+
+type fakeState struct{ Who string }
+
+func (s fakeState) DB() authdb.DB {
+        return testingAuthDB{}
+}
+func (s fakeState) Method() auth.Method {
+        return nil
+}
+func (s fakeState) User() *auth.User {
+        if s.Who == "" {
+                return &auth.User{Identity: identity.AnonymousIdentity}
+        }
+        id, _ := identity.MakeIdentity("user:" + s.Who)
+        return &auth.User{
+                Identity: id,
+                Email:    s.Who,
+        }
+}
+func (s fakeState) PeerIdentity() identity.Identity {
+        return identity.AnonymousIdentity
+}
+func (s fakeState) PeerIP() net.IP {
+        return nil
+}
+
+var secretProjectCfg = `
+ID: "secret"
+Readers: "google.com"
+`
+
+var publicProjectCfg = `
+ID: "opensource"
+Readers: "all"
+`
+
+var aclConfgs = map[string]memcfg.ConfigSet{
+        "projects/secret.git": {
+                "luci-milo.cfg": secretProjectCfg,
+        },
+        "projects/opensource.git": {
+                "luci-milo.cfg": publicProjectCfg,
+        },
+}