server/config: Service-side project access checks.

server/config/access/access_test.go

+// Copyright 2016 The LUCI Authors. All rights reserved.
+// Use of this source code is governed under the Apache License, Version 2.0
+// that can be found in the LICENSE file.
+
+package access
+
+import (
+        "fmt"
+        "testing"
+
+        configPB "github.com/luci/luci-go/common/proto/config"
+        "github.com/luci/luci-go/server/auth"
+        "github.com/luci/luci-go/server/auth/authtest"
+        "github.com/luci/luci-go/server/auth/identity"
+        "github.com/luci/luci-go/server/config"
+
+        "github.com/golang/protobuf/proto"
+        "golang.org/x/net/context"
+
+        . "github.com/luci/luci-go/common/testing/assertions"
+        . "github.com/smartystreets/goconvey/convey"
+)
+
+type testingBackend struct {
+        config.Backend
+
+        item *config.Item
+}
+
+func (tb *testingBackend) Get(c context.Context, configSet, path string, p config.Params) (*config.Item, error) {
+        if tb.item == nil {
+                return nil, config.ErrNoConfig
+        }
+        clone := *tb.item
+        return &clone, nil
+}
+
+func tpb(msg proto.Message) string { return proto.MarshalTextString(msg) }
+
+func accessCfg(access ...string) string {
+        return tpb(&configPB.ProjectCfg{
+                Access: access,
+        })
+}
+
+func TestCheckAccess(t *testing.T) {
+        t.Parallel()
+
+        Convey(`A testing environment`, t, func() {
+                c := context.Background()
+
+                authState := authtest.FakeState{
+                        Identity: identity.AnonymousIdentity,
+                }
+                c = auth.WithState(c, &authState)
+
+                tb := testingBackend{}
+                setAccess := func(access ...string) {
+                        if len(access) == 0 {
+                                tb.item = nil
+                                return
+                        }
+                        tb.item = &config.Item{
+                                Content: tpb(&configPB.ProjectCfg{Access: access}),
+                        }
+                }
+
+                c = config.WithBackend(c, &tb)
+
+                Convey(`Will grant AsService access to any config`, func() {
+                        So(Check(c, config.AsService, "foo/bar"), ShouldBeNil)
+                        So(Check(c, config.AsService, "services/foo"), ShouldBeNil)
+                        So(Check(c, config.AsService, "projects/nonexistent"), ShouldBeNil)
+                        So(Check(c, config.AsService, "projects/public"), ShouldBeNil)
+                })
+
+                for _, tc := range []struct {
+                        A    config.Authority
+                        Name string
+                }{
+                        {config.AsUser, "AsUser"},
+                        {config.AsAnonymous, "AsAnonymous"},
+                } {
+                        Convey(fmt.Sprintf(`Will deny %q access to any config`, tc.Name), func() {
+                                So(Check(c, tc.A, "foo/bar"), ShouldEqual, ErrNoAccess)
+                                So(Check(c, tc.A, "services/foo"), ShouldEqual, ErrNoAccess)
+                                So(Check(c, tc.A, "projects/nonexistent"), ShouldErrLike, "failed to load \"project.cfg\"")
+                        })
+
+                        Convey(fmt.Sprintf(`Will grant %q access to an all-inclusive project`, tc.Name), func() {
+                                setAccess("group:all")
+                                So(Check(c, tc.A, "projects/public"), ShouldBeNil)
+                        })
+                }
+
+                mustMakeIdentity := func(v string) identity.Identity {
+                        id, err := identity.MakeIdentity(v)
+                        if err != nil {
+                                panic(err)
+                        }
+                        return id
+                }
+                for _, tc := range []struct {
+                        name  string
+                        apply func()
+                }{
+                        {"a special user", func() { authState.Identity = mustMakeIdentity("user:cat@example.com") }},
+                        {"a special user (e-mail)", func() { authState.Identity = mustMakeIdentity("user:email@example.com") }},
+                        {"a member of a special group", func() { authState.IdentityGroups = []string{"special"} }},
+                } {
+                        Convey(fmt.Sprintf(`When user is %s`, tc.name), func() {
+                                tc.apply()
+
+                                setAccess()
+                                So(Check(c, config.AsService, "foo/bar"), ShouldBeNil)
+                                So(Check(c, config.AsUser, "foo/bar"), ShouldEqual, ErrNoAccess)
+                                So(Check(c, config.AsAnonymous, "foo/bar"), ShouldEqual, ErrNoAccess)
+
+                                So(Check(c, config.AsService, "services/foo"), ShouldBeNil)
+                                So(Check(c, config.AsUser, "services/foo"), ShouldEqual, ErrNoAccess)
+                                So(Check(c, config.AsAnonymous, "services/foo"), ShouldEqual, ErrNoAccess)
+
+                                So(Check(c, config.AsService, "projects/nonexistent"), ShouldBeNil)
+                                So(Check(c, config.AsUser, "projects/nonexistent"), ShouldErrLike, "failed to load \"project.cfg\"")
+                                So(Check(c, config.AsAnonymous, "projects/nonexistent"), ShouldErrLike, "failed to load \"project.cfg\"")
+
+                                setAccess("group:all")
+                                So(Check(c, config.AsService, "projects/public"), ShouldBeNil)
+                                So(Check(c, config.AsUser, "projects/public"), ShouldBeNil)
+                                So(Check(c, config.AsAnonymous, "projects/public"), ShouldBeNil)
+
+                                setAccess("group:special", "user:cat@example.com", "email@example.com")
+                                So(Check(c, config.AsUser, "projects/exclusive"), ShouldBeNil)
+                                So(Check(c, config.AsAnonymous, "projects/exclusive"), ShouldEqual, ErrNoAccess)
+                        })
+                }
+        })
+}