Skip to content

Commit d19af8e

Browse files
KevLehmanKevLehman
committed
test
1 parent 2de0ad5 commit d19af8e

File tree

1 file changed

+107
-56
lines changed
  • apps/meteor/tests/end-to-end/api

1 file changed

+107
-56
lines changed

‎apps/meteor/tests/end-to-end/api/abac.ts‎

Lines changed: 107 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -2666,33 +2666,26 @@ const addAbacAttributesToUserDirectly = async (userId: string, abacAttributes: I
26662666
await updateSetting('ABAC_Enabled', false);
26672667
});
26682668

2669-
describe('Full flow: create room → add users → set ABAC attributes → PDP evaluates', () => {
2669+
describe('PERMIT all: users remain when PDP permits everyone', () => {
26702670
let room: IRoom;
2671-
let userA: IUser;
2672-
let userACredentials: Credentials;
2673-
let userB: IUser;
2671+
let user: IUser;
2672+
let userCreds: Credentials;
26742673

26752674
before(async function () {
26762675
this.timeout(15000);
26772676

2678-
userA = await createUser();
2679-
userACredentials = await login(userA.username, password);
2680-
userB = await createUser();
2677+
user = await createUser();
2678+
userCreds = await login(user.username, password);
26812679

2682-
room = (await createRoom({ type: 'p', name: `extpdp-flow-${Date.now()}` })).body.group;
2680+
room = (await createRoom({ type: 'p', name: `extpdp-permit-${Date.now()}` })).body.group;
26832681

2684-
await request
2685-
.post('/api/v1/groups.invite')
2686-
.set(credentials)
2687-
.send({ roomId: room._id, usernames: [userA.username, userB.username] })
2688-
.expect(200);
2682+
await request.post('/api/v1/groups.invite').set(credentials).send({ roomId: room._id, usernames: [user.username] }).expect(200);
26892683

26902684
await mockServerReset();
26912685
await seedDefaultMocks();
26922686
await seedGetDecisionBulk([
26932687
{ resourceDecisions: [{ decision: 'DECISION_PERMIT', ephemeralResourceId: room._id }] },
26942688
{ resourceDecisions: [{ decision: 'DECISION_PERMIT', ephemeralResourceId: room._id }] },
2695-
{ resourceDecisions: [{ decision: 'DECISION_DENY', ephemeralResourceId: room._id }] },
26962689
]);
26972690

26982691
await request
@@ -2703,54 +2696,120 @@ const addAbacAttributesToUserDirectly = async (userId: string, abacAttributes: I
27032696
});
27042697

27052698
after(async () => {
2706-
await Promise.all([deleteRoom({ type: 'p', roomId: room._id }), deleteUser(userA), deleteUser(userB)]);
2699+
await Promise.all([deleteRoom({ type: 'p', roomId: room._id }), deleteUser(user)]);
27072700
});
27082701

2709-
it('room creator (admin) is never removed', async () => {
2710-
const res = await request.get('/api/v1/rooms.membersOrderedByRole').set(credentials).query({ roomId: room._id }).expect(200);
2702+
it('room creator remains in the room', async () => {
2703+
const res = await request.get('/api/v1/groups.members').set(credentials).query({ roomId: room._id }).expect(200);
27112704

27122705
const memberIds = res.body.members.map((m: IUser) => m._id);
27132706
expect(memberIds).to.include(credentials['X-User-Id']);
27142707
});
27152708

2716-
it('compliant user (PERMIT) remains in the room', async () => {
2717-
const res = await request.get('/api/v1/rooms.membersOrderedByRole').set(credentials).query({ roomId: room._id }).expect(200);
2718-
2719-
const usernames = res.body.members.map((m: IUser) => m.username);
2720-
expect(usernames).to.include(userA.username);
2721-
});
2722-
2723-
it('non-compliant user (DENY) was removed from the room', async () => {
2724-
const res = await request.get('/api/v1/rooms.membersOrderedByRole').set(credentials).query({ roomId: room._id }).expect(200);
2709+
it('user remains in the room', async () => {
2710+
const res = await request.get('/api/v1/groups.members').set(credentials).query({ roomId: room._id }).expect(200);
27252711

27262712
const usernames = res.body.members.map((m: IUser) => m.username);
2727-
expect(usernames).to.not.include(userB.username);
2713+
expect(usernames).to.include(user.username);
27282714
});
27292715

2730-
it('compliant user can access room history when PDP returns PERMIT', async () => {
2716+
it('user can access room history when PDP returns PERMIT', async () => {
27312717
await mockServerReset();
27322718
await seedDefaultMocks();
27332719
await seedGetDecisions('DECISION_PERMIT');
27342720

27352721
await request
27362722
.get('/api/v1/groups.history')
2737-
.set(userACredentials)
2723+
.set(userCreds)
27382724
.query({ roomId: room._id })
27392725
.expect(200)
27402726
.expect((res) => {
27412727
expect(res.body).to.have.property('success', true);
27422728
expect(res.body).to.have.property('messages').that.is.an('array');
27432729
});
27442730
});
2731+
});
2732+
2733+
describe('DENY all: all non-owner users are removed when PDP denies everyone', () => {
2734+
let room: IRoom;
2735+
let user: IUser;
2736+
2737+
before(async function () {
2738+
this.timeout(15000);
2739+
2740+
user = await createUser();
2741+
2742+
room = (await createRoom({ type: 'p', name: `extpdp-deny-${Date.now()}` })).body.group;
2743+
2744+
await request.post('/api/v1/groups.invite').set(credentials).send({ roomId: room._id, usernames: [user.username] }).expect(200);
27452745

2746-
it('compliant user loses access when PDP flips to DENY', async () => {
2746+
await mockServerReset();
2747+
await seedDefaultMocks();
2748+
await seedGetDecisionBulk([
2749+
{ resourceDecisions: [{ decision: 'DECISION_DENY', ephemeralResourceId: room._id }] },
2750+
{ resourceDecisions: [{ decision: 'DECISION_DENY', ephemeralResourceId: room._id }] },
2751+
]);
2752+
2753+
await request
2754+
.post(`/api/v1/abac/rooms/${room._id}/attributes/${attrKey}`)
2755+
.set(credentials)
2756+
.send({ values: ['alpha'] })
2757+
.expect(200);
2758+
});
2759+
2760+
after(async () => {
2761+
await Promise.all([deleteRoom({ type: 'p', roomId: room._id }), deleteUser(user)]);
2762+
});
2763+
2764+
it('user was removed from the room', async () => {
2765+
const res = await request.get('/api/v1/groups.members').set(credentials).query({ roomId: room._id }).expect(200);
2766+
2767+
const usernames = res.body.members.map((m: IUser) => m.username);
2768+
expect(usernames).to.not.include(user.username);
2769+
});
2770+
});
2771+
2772+
describe('Access check: PDP DENY removes user on room access', () => {
2773+
let room: IRoom;
2774+
let user: IUser;
2775+
let userCreds: Credentials;
2776+
2777+
before(async function () {
2778+
this.timeout(15000);
2779+
2780+
user = await createUser();
2781+
userCreds = await login(user.username, password);
2782+
2783+
room = (await createRoom({ type: 'p', name: `extpdp-access-${Date.now()}` })).body.group;
2784+
2785+
await request.post('/api/v1/groups.invite').set(credentials).send({ roomId: room._id, usernames: [user.username] }).expect(200);
2786+
2787+
await mockServerReset();
2788+
await seedDefaultMocks();
2789+
await seedGetDecisionBulk([
2790+
{ resourceDecisions: [{ decision: 'DECISION_PERMIT', ephemeralResourceId: room._id }] },
2791+
{ resourceDecisions: [{ decision: 'DECISION_PERMIT', ephemeralResourceId: room._id }] },
2792+
]);
2793+
2794+
await request
2795+
.post(`/api/v1/abac/rooms/${room._id}/attributes/${attrKey}`)
2796+
.set(credentials)
2797+
.send({ values: ['alpha'] })
2798+
.expect(200);
2799+
});
2800+
2801+
after(async () => {
2802+
await Promise.all([deleteRoom({ type: 'p', roomId: room._id }), deleteUser(user)]);
2803+
});
2804+
2805+
it('user loses access when PDP flips to DENY', async () => {
27472806
await mockServerReset();
27482807
await seedDefaultMocks();
27492808
await seedGetDecisions('DECISION_DENY');
27502809

27512810
await request
27522811
.get('/api/v1/groups.history')
2753-
.set(userACredentials)
2812+
.set(userCreds)
27542813
.query({ roomId: room._id })
27552814
.expect(403)
27562815
.expect((res) => {
@@ -2759,10 +2818,10 @@ const addAbacAttributesToUserDirectly = async (userId: string, abacAttributes: I
27592818
});
27602819

27612820
it('user is removed from room after access DENY', async () => {
2762-
const res = await request.get('/api/v1/rooms.membersOrderedByRole').set(credentials).query({ roomId: room._id }).expect(200);
2821+
const res = await request.get('/api/v1/groups.members').set(credentials).query({ roomId: room._id }).expect(200);
27632822

27642823
const usernames = res.body.members.map((m: IUser) => m.username);
2765-
expect(usernames).to.not.include(userA.username);
2824+
expect(usernames).to.not.include(user.username);
27662825
});
27672826
});
27682827

@@ -2808,7 +2867,7 @@ const addAbacAttributesToUserDirectly = async (userId: string, abacAttributes: I
28082867
});
28092868

28102869
it('invited user is a member of the room after PERMIT', async () => {
2811-
const res = await request.get('/api/v1/rooms.membersOrderedByRole').set(credentials).query({ roomId: room._id }).expect(200);
2870+
const res = await request.get('/api/v1/groups.members').set(credentials).query({ roomId: room._id }).expect(200);
28122871

28132872
const usernames = res.body.members.map((m: IUser) => m.username);
28142873
expect(usernames).to.include(permitUser.username);
@@ -2830,17 +2889,18 @@ const addAbacAttributesToUserDirectly = async (userId: string, abacAttributes: I
28302889
});
28312890
});
28322891

2833-
it('denied user is not a member of the room after DENY', async () => {
2834-
const res = await request.get('/api/v1/rooms.membersOrderedByRole').set(credentials).query({ roomId: room._id }).expect(200);
2892+
it('denied user is not a member of the room', async () => {
2893+
const res = await request.get('/api/v1/groups.members').set(credentials).query({ roomId: room._id }).expect(200);
28352894

28362895
const usernames = res.body.members.map((m: IUser) => m.username);
28372896
expect(usernames).to.not.include(denyUser.username);
28382897
});
28392898

28402899
it('room creator remains after invite operations', async () => {
2841-
const res = await request.get('/api/v1/rooms.membersOrderedByRole').set(credentials).query({ roomId: room._id }).expect(200);
2900+
const res = await request.get('/api/v1/groups.members').set(credentials).query({ roomId: room._id }).expect(200);
28422901

2843-
expect(res.body.members.length).to.be.at.least(1);
2902+
const memberIds = res.body.members.map((m: IUser) => m._id);
2903+
expect(memberIds).to.include(credentials['X-User-Id']);
28442904
});
28452905
});
28462906

@@ -2914,30 +2974,23 @@ const addAbacAttributesToUserDirectly = async (userId: string, abacAttributes: I
29142974
});
29152975
});
29162976

2917-
describe('Tightening room attributes: PDP re-evaluates members', () => {
2977+
describe('Tightening room attributes: PDP re-evaluates and removes denied users', () => {
29182978
let room: IRoom;
2919-
let staysUser: IUser;
2920-
let leavesUser: IUser;
2979+
let user: IUser;
29212980

29222981
before(async function () {
29232982
this.timeout(15000);
29242983

2925-
staysUser = await createUser();
2926-
leavesUser = await createUser();
2984+
user = await createUser();
29272985

29282986
room = (await createRoom({ type: 'p', name: `extpdp-tighten-${Date.now()}` })).body.group;
2929-
await request
2930-
.post('/api/v1/groups.invite')
2931-
.set(credentials)
2932-
.send({ roomId: room._id, usernames: [staysUser.username, leavesUser.username] })
2933-
.expect(200);
2987+
await request.post('/api/v1/groups.invite').set(credentials).send({ roomId: room._id, usernames: [user.username] }).expect(200);
29342988

29352989
await mockServerReset();
29362990
await seedDefaultMocks();
29372991
await seedGetDecisionBulk([
29382992
{ resourceDecisions: [{ decision: 'DECISION_PERMIT', ephemeralResourceId: room._id }] },
29392993
{ resourceDecisions: [{ decision: 'DECISION_PERMIT', ephemeralResourceId: room._id }] },
2940-
{ resourceDecisions: [{ decision: 'DECISION_PERMIT', ephemeralResourceId: room._id }] },
29412994
]);
29422995
await request
29432996
.post(`/api/v1/abac/rooms/${room._id}/attributes/${attrKey}`)
@@ -2947,16 +3000,15 @@ const addAbacAttributesToUserDirectly = async (userId: string, abacAttributes: I
29473000
});
29483001

29493002
after(async () => {
2950-
await Promise.all([deleteRoom({ type: 'p', roomId: room._id }), deleteUser(staysUser), deleteUser(leavesUser)]);
3003+
await Promise.all([deleteRoom({ type: 'p', roomId: room._id }), deleteUser(user)]);
29513004
});
29523005

2953-
it('should remove only the user the PDP denies when attributes are tightened', async function () {
3006+
it('user is removed when attributes are tightened and PDP denies all', async function () {
29543007
this.timeout(10000);
29553008
await mockServerReset();
29563009
await seedDefaultMocks();
29573010
await seedGetDecisionBulk([
2958-
{ resourceDecisions: [{ decision: 'DECISION_PERMIT', ephemeralResourceId: room._id }] },
2959-
{ resourceDecisions: [{ decision: 'DECISION_PERMIT', ephemeralResourceId: room._id }] },
3011+
{ resourceDecisions: [{ decision: 'DECISION_DENY', ephemeralResourceId: room._id }] },
29603012
{ resourceDecisions: [{ decision: 'DECISION_DENY', ephemeralResourceId: room._id }] },
29613013
]);
29623014

@@ -2966,11 +3018,10 @@ const addAbacAttributesToUserDirectly = async (userId: string, abacAttributes: I
29663018
.send({ values: ['alpha', 'beta'] })
29673019
.expect(200);
29683020

2969-
const res = await request.get('/api/v1/rooms.membersOrderedByRole').set(credentials).query({ roomId: room._id }).expect(200);
3021+
const res = await request.get('/api/v1/groups.members').set(credentials).query({ roomId: room._id }).expect(200);
29703022

29713023
const usernames = res.body.members.map((m: IUser) => m.username);
2972-
expect(usernames).to.include(staysUser.username);
2973-
expect(usernames).to.not.include(leavesUser.username);
3024+
expect(usernames).to.not.include(user.username);
29743025
});
29753026
});
29763027
});

0 commit comments

Comments
 (0)