mirror of
https://github.com/hanzoai/team.git
synced 2026-09-30 01:57:35 +00:00
Pablo VélezandGitHub
228112507a
* MM-68846 - add canonical CEL AST masking walker and model resolver interface * add canonical masking methods to PAP einterface and update mock * Migrate app-layer masking to canonical CEL AST walker * Remove Visual AST masking dead code and obsolete i18n key * Update simulation masking tests to mock MaskExpressionForCaller * reject persisted tokens and enforce merge shape match and add corresponding tests * MM-68900 - abac masking add e2e back * add missing config values and split the tests * implement coderabbit feedback * adjust timeout and disable button logic * enhance masking logic and tests for access control policies * refactor masking tests and database setup for improved field deletion handling * Enhance error handling in TestMergeStoredPolicyExpressions to verify error ID and status code * Refactor error handling in access control policy methods for clarity * Refactor masking logic and improve clarity in access control methods * Allow deny-all 'false' policies by dropping the redundant sentinel check in rejectMaskedTokens; add tests * Add masking-related error messages and update test descriptions with tags * Add error handling for uninitialized Policy Administration Point in access control
61 lines
2.0 KiB
Go
61 lines
2.0 KiB
Go
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
|
|
// See LICENSE.txt for license information.
|
|
|
|
package app
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/mattermost/mattermost/server/public/model"
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestIsMembershipRule(t *testing.T) {
|
|
t.Run("nil rule is not a membership rule", func(t *testing.T) {
|
|
assert.False(t, isMembershipRule(nil))
|
|
})
|
|
|
|
t.Run("named rule with membership action is not a membership rule", func(t *testing.T) {
|
|
// v0.4 permission rules always carry a Name; treat a non-empty Name as a
|
|
// permission rule even if its Actions happen to mention membership, so a
|
|
// rename can't accidentally collide with the membership slot.
|
|
rule := &model.AccessControlPolicyRule{
|
|
Name: "Custom",
|
|
Actions: []string{model.AccessControlPolicyActionMembership},
|
|
}
|
|
assert.False(t, isMembershipRule(rule))
|
|
})
|
|
|
|
t.Run("unnamed rule without membership action is not a membership rule", func(t *testing.T) {
|
|
// Anonymous non-membership rules can't be safely identified across the
|
|
// submit boundary; mergeStoredPolicyExpressions deliberately skips them
|
|
// rather than mispair, so this helper must report false too.
|
|
rule := &model.AccessControlPolicyRule{
|
|
Actions: []string{model.AccessControlPolicyActionUploadFileAttachment},
|
|
}
|
|
assert.False(t, isMembershipRule(rule))
|
|
})
|
|
|
|
t.Run("unnamed rule with membership action is a membership rule", func(t *testing.T) {
|
|
rule := &model.AccessControlPolicyRule{
|
|
Actions: []string{model.AccessControlPolicyActionMembership},
|
|
}
|
|
assert.True(t, isMembershipRule(rule))
|
|
})
|
|
|
|
t.Run("unnamed rule with membership action among others is a membership rule", func(t *testing.T) {
|
|
rule := &model.AccessControlPolicyRule{
|
|
Actions: []string{
|
|
model.AccessControlPolicyActionUploadFileAttachment,
|
|
model.AccessControlPolicyActionMembership,
|
|
},
|
|
}
|
|
assert.True(t, isMembershipRule(rule))
|
|
})
|
|
|
|
t.Run("empty actions list is not a membership rule", func(t *testing.T) {
|
|
rule := &model.AccessControlPolicyRule{}
|
|
assert.False(t, isMembershipRule(rule))
|
|
})
|
|
}
|