From 3e7898fbacd44141909ff951e63e17161a5d88ec Mon Sep 17 00:00:00 2001
From: Tit Petric <black@scene-si.org>
Date: Mon, 12 Nov 2018 15:38:35 +0100
Subject: [PATCH] add(rbac):

- multi delete resources
- check access over multiple resources
- tests
---
 internal/rbac/resources.go      | 75 ++++++++++++++++++++++++++-------
 internal/rbac/resources_test.go |  3 +-
 internal/rbac/sessions_test.go  |  1 +
 3 files changed, 61 insertions(+), 18 deletions(-)

diff --git a/internal/rbac/resources.go b/internal/rbac/resources.go
index 30a2b016d..a6219f068 100644
--- a/internal/rbac/resources.go
+++ b/internal/rbac/resources.go
@@ -20,23 +20,55 @@ type (
 	ResourcesInterface interface {
 		Create(resourceID string, operations []string) error
 		Get(resourceID string) (*types.Resource, error)
-		Delete(resourceID string) error
+		Delete(resourceID string, resourceIDs ...string) error
 
 		Grant(resourceID, rolepath string, operations []string) error
 		GrantMultiple(resourceID string, roles []ResourcesRole) error
 
 		CheckAccess(resourceID, operation, sessionID string) error
+		CheckAccessMulti(resourceID, operation, sessionID string) error
+		CheckAccessMultiDetail(resourceID, operation, sessionID string) error
 	}
 )
 
 const (
-	resourcesCreate      = "/resources/%s"
-	resourcesGet         = "/resources/%s"
-	resourcesDelete      = "/resources/%s"
-	resourcesGrant       = "/resources/%s/grantPermission"
-	resourcesCheckAccess = "/resources/%s/checkAccess?operation=%s&session=%s"
+	resourcesCreate                 = "/resources/%s"
+	resourcesGet                    = "/resources/%s"
+	resourcesDelete                 = "/resources/%s"
+	resourcesGrant                  = "/resources/%s/grantPermission"
+	resourcesCheckAccess            = "/resources/%s/checkAccess?operation=%s&session=%s"
+	resourcesCheckAccessMulti       = "/resources/%s/checkMultiAccess?operation=%s&session=%s"
+	resourcesCheckAccessMultiDetail = "/resources/%s/checkMultiAccess/detailed?operation=%s&session=%s"
 )
 
+func (u *Resources) CheckAccessMulti(resourceID, operation, sessionID string) error {
+	resp, err := u.Client.Get(fmt.Sprintf(resourcesCheckAccessMulti, resourceID, operation, sessionID))
+	if err != nil {
+		return errors.Wrap(err, "request failed")
+	}
+	defer resp.Body.Close()
+	switch resp.StatusCode {
+	case 200:
+		return nil
+	default:
+		return toError(resp)
+	}
+}
+
+func (u *Resources) CheckAccessMultiDetail(resourceID, operation, sessionID string) error {
+	resp, err := u.Client.Get(fmt.Sprintf(resourcesCheckAccessMultiDetail, resourceID, operation, sessionID))
+	if err != nil {
+		return errors.Wrap(err, "request failed")
+	}
+	defer resp.Body.Close()
+	switch resp.StatusCode {
+	case 200:
+		return nil
+	default:
+		return toError(resp)
+	}
+}
+
 func (u *Resources) CheckAccess(resourceID, operation, sessionID string) error {
 	resp, err := u.Client.Get(fmt.Sprintf(resourcesCheckAccess, resourceID, operation, sessionID))
 	if err != nil {
@@ -110,18 +142,29 @@ func (u *Resources) Get(resourceID string) (*types.Resource, error) {
 	}
 }
 
-func (u *Resources) Delete(resourceID string) error {
-	resp, err := u.Client.Delete(fmt.Sprintf(resourcesDelete, resourceID))
-	if err != nil {
-		return errors.Wrap(err, "request failed")
+func (u *Resources) Delete(resourceID string, resourceIDs ...string) error {
+	deleteResource := func(resourceID string) error {
+		resp, err := u.Client.Delete(fmt.Sprintf(resourcesDelete, resourceID))
+		if err != nil {
+			return errors.Wrap(err, "request failed")
+		}
+		defer resp.Body.Close()
+		switch resp.StatusCode {
+		case 200:
+			return nil
+		default:
+			return toError(resp)
+		}
 	}
-	defer resp.Body.Close()
-	switch resp.StatusCode {
-	case 200:
-		return nil
-	default:
-		return toError(resp)
+	if err := deleteResource(resourceID); err != nil {
+		return err
 	}
+	for _, resourceID := range resourceIDs {
+		if err := deleteResource(resourceID); err != nil {
+			return err
+		}
+	}
+	return nil
 }
 
 var _ ResourcesInterface = &Resources{}
diff --git a/internal/rbac/resources_test.go b/internal/rbac/resources_test.go
index 575dd8957..66cde4ec2 100644
--- a/internal/rbac/resources_test.go
+++ b/internal/rbac/resources_test.go
@@ -19,8 +19,7 @@ func TestResources(t *testing.T) {
 	must(t, resources.Create("test-resource", []string{"view", "edit", "delete"}), "Error when creating test-resource")
 	must(t, resources.Grant("test-resource", "test-role", []string{"view", "edit"}), "Error when granting permissions to role on resource")
 
-	// test get resources (not implemented) @todo
-	if false {
+	{
 		res, err := resources.Get("test-resource")
 		must(t, err, "Error when retrieving test-resource")
 		assert(t, res != nil, "Expected non-nil test-resource")
diff --git a/internal/rbac/sessions_test.go b/internal/rbac/sessions_test.go
index 97a5a4930..01a590d9d 100644
--- a/internal/rbac/sessions_test.go
+++ b/internal/rbac/sessions_test.go
@@ -19,6 +19,7 @@ func TestSessions(t *testing.T) {
 	sessions.Delete("test-session")
 	roles.Delete("test-role")
 	resources.Delete("test-resource")
+	resources.Delete("team-1", "team-2", "team-3")
 
 	must(t, roles.Create("test-role"), "Error when creating test-role")
 	must(t, users.Create("test-user", "test-password"), "Error when creating test-user")