Fix system integration tests

system/service/access_control.go

@@ -77,7 +77,7 @@ func (svc accessControl) CanCreateApplication(ctx context.Context) bool {
 }
 
 func (svc accessControl) CanAssignReminder(ctx context.Context) bool {
-	return svc.can(ctx, types.SystemPermissionResource, "store.assign")
+	return svc.can(ctx, types.SystemPermissionResource, "reminder.assign")
 }
 
 func (svc accessControl) CanReadRole(ctx context.Context, rl *types.Role) bool {
@@ -225,7 +225,7 @@ func (svc accessControl) Whitelist() permissions.Whitelist {
 		"role.create",
 		"user.create",
 		"application.create",
-		"store.assign",
+		"reminder.assign",
 	)
 
 	wl.Set(

system/service/application.go

@@ -107,6 +107,11 @@ func (svc *application) Create(ctx context.Context, new *types.Application) (app
 		// Set new values after beforeCreate events are emitted
 		new.ID = nextID()
 		new.CreatedAt = now()
+
+		if new.Unify == nil {
+			new.Unify = &types.ApplicationUnify{}
+		}
+
 		if err = svc.store.CreateApplication(ctx, new); err != nil {
 			return
 		}
@@ -147,9 +152,12 @@ func (svc *application) Update(ctx context.Context, upd *types.Application) (app
 		// Assign changed values after afterUpdate events are emitted
 		app.Name = upd.Name
 		app.Enabled = upd.Enabled
-		app.Unify = upd.Unify
 		app.UpdatedAt = nowPtr()
 
+		if upd.Unify != nil {
+			app.Unify = upd.Unify
+		}
+
 		if err = svc.store.UpdateApplication(ctx, app); err != nil {
 			return err
 		}
@@ -187,7 +195,7 @@ func (svc *application) Delete(ctx context.Context, ID uint64) (err error) {
 		}
 
 		app.DeletedAt = nowPtr()
-		if err = svc.store.PartialApplicationUpdate(ctx, []string{"UpdatedAt"}, app); err != nil {
+		if err = svc.store.UpdateApplication(ctx, app); err != nil {
 			return
 		}
 
@@ -225,7 +233,7 @@ func (svc *application) Undelete(ctx context.Context, ID uint64) (err error) {
 		//       }
 
 		app.DeletedAt = nil
-		if err = svc.store.PartialApplicationUpdate(ctx, []string{"UpdatedAt"}, app); err != nil {
+		if err = svc.store.UpdateApplication(ctx, app); err != nil {
 			return
 		}
 

system/service/auth.go

@@ -669,7 +669,7 @@ func (svc auth) SetPasswordCredentials(ctx context.Context, userID uint64, passw
 	})
 
 	// Do a partial update and soft-delete all
-	if err = svc.store.PartialCredentialsUpdate(ctx, []string{"deleted_at"}, cc...); err != nil {
+	if err = svc.store.UpdateCredentials(ctx, cc...); err != nil {
 		return
 	}
 

system/service/auth_test.go

@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"github.com/cortezaproject/corteza-server/pkg/id"
 	"github.com/cortezaproject/corteza-server/store/sqlite"
-	"github.com/davecgh/go-spew/spew"
 	"github.com/markbates/goth"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/zap"
@@ -105,8 +104,6 @@ func TestAuth_External(t *testing.T) {
 		}
 	)
 
-	_ = spew.Dump
-
 	svc := makeMockAuthService()
 	svc.settings.Auth.External.Enabled = true
 	req.NoError(svc.store.TruncateUsers(ctx))

tests/system/application_test.go

@@ -1,162 +1,185 @@
 package system
 
-//
-//import (
-//	"context"
-//	"fmt"
-//	"net/http"
-//	"testing"
-//
-//	jsonpath "github.com/steinfletcher/apitest-jsonpath"
-//
-//	"github.com/cortezaproject/corteza-server/system/repository"
-//	"github.com/cortezaproject/corteza-server/system/types"
-//	"github.com/cortezaproject/corteza-server/tests/helpers"
-//)
-//
-//func (h helper) repoApplication() repository.ApplicationRepository {
-//	return repository.Application(context.Background(), db())
-//}
-//
-//func (h helper) repoMakeApplication(name string) *types.Application {
-//	a, err := h.
-//		repoApplication().
-//		Create(&types.Application{Name: name})
-//	h.a.NoError(err)
-//
-//	return a
-//}
-//
-//func TestApplicationRead(t *testing.T) {
-//	h := newHelper(t)
-//
-//	a := h.repoMakeApplication("one-app")
-//
-//	h.apiInit().
-//		Get(fmt.Sprintf("/application/%d", a.ID)).
-//		Expect(t).
-//		Status(http.StatusOK).
-//		Assert(helpers.AssertNoErrors).
-//		Assert(jsonpath.Equal(`$.response.name`, a.Name)).
-//		Assert(jsonpath.Equal(`$.response.applicationID`, fmt.Sprintf("%d", a.ID))).
-//		End()
-//}
-//
-//func TestApplicationList(t *testing.T) {
-//	h := newHelper(t)
-//
-//	h.repoMakeApplication("app")
-//	h.repoMakeApplication("app")
-//
-//	h.apiInit().
-//		Get("/application/").
-//		Expect(t).
-//		Status(http.StatusOK).
-//		Assert(helpers.AssertNoErrors).
-//		End()
-//}
-//
-//func TestApplicationList_filterForbiden(t *testing.T) {
-//	h := newHelper(t)
-//
-//	h.repoMakeApplication("app")
-//	f := h.repoMakeApplication("app_forbiden")
-//
-//	h.deny(types.ApplicationPermissionResource.AppendID(f.ID), "read")
-//
-//	h.apiInit().
-//		Get("/application/").
-//		Expect(t).
-//		Status(http.StatusOK).
-//		Assert(helpers.AssertNoErrors).
-//		Assert(jsonpath.NotPresent(`$.response.set[? @.name=="app_forbiden"]`)).
-//		End()
-//}
-//
-//func TestApplicationCreateForbidden(t *testing.T) {
-//	h := newHelper(t)
-//
-//	h.apiInit().
-//		Post("/application/").
-//		FormData("name", "my-app").
-//		Expect(t).
-//		Status(http.StatusOK).
-//		Assert(helpers.AssertError("not allowed to create applications")).
-//		End()
-//}
-//
-//func TestApplicationCreate(t *testing.T) {
-//	h := newHelper(t)
-//	h.allow(types.SystemPermissionResource, "application.create")
-//
-//	h.apiInit().
-//		Post("/application/").
-//		FormData("name", "my-app").
-//		Expect(t).
-//		Status(http.StatusOK).
-//		Assert(helpers.AssertNoErrors).
-//		End()
-//}
-//
-//func TestApplicationUpdateForbidden(t *testing.T) {
-//	h := newHelper(t)
-//	a := h.repoMakeApplication("one-app")
-//
-//	h.apiInit().
-//		Put(fmt.Sprintf("/application/%d", a.ID)).
-//		FormData("name", "changed-name").
-//		Expect(t).
-//		Status(http.StatusOK).
-//		Assert(helpers.AssertError("not allowed to update this application")).
-//		End()
-//}
-//
-//func TestApplicationUpdate(t *testing.T) {
-//	h := newHelper(t)
-//	a := h.repoMakeApplication("one-app")
-//	h.allow(types.ApplicationPermissionResource.AppendWildcard(), "update")
-//
-//	h.apiInit().
-//		Put(fmt.Sprintf("/application/%d", a.ID)).
-//		FormData("name", "changed-name").
-//		Expect(t).
-//		Status(http.StatusOK).
-//		Assert(helpers.AssertNoErrors).
-//		End()
-//
-//	a, err := h.repoApplication().FindByID(a.ID)
-//	h.a.NoError(err)
-//	h.a.NotNil(a)
-//	h.a.Equal("changed-name", a.Name)
-//}
-//
-//func TestApplicationDeleteForbidden(t *testing.T) {
-//	h := newHelper(t)
-//	a := h.repoMakeApplication("one-app")
-//
-//	h.apiInit().
-//		Delete(fmt.Sprintf("/application/%d", a.ID)).
-//		Expect(t).
-//		Status(http.StatusOK).
-//		Assert(helpers.AssertError("not allowed to delete this application")).
-//		End()
-//}
-//
-//func TestApplicationDelete(t *testing.T) {
-//	h := newHelper(t)
-//	h.allow(types.ApplicationPermissionResource.AppendWildcard(), "delete")
-//
-//	a := h.repoMakeApplication("one-app")
-//
-//	h.apiInit().
-//		Delete(fmt.Sprintf("/application/%d", a.ID)).
-//		Expect(t).
-//		Status(http.StatusOK).
-//		Assert(helpers.AssertNoErrors).
-//		End()
-//
-//	a, err := h.repoApplication().FindByID(a.ID)
-//	h.a.NoError(err)
-//	h.a.NotNil(a)
-//	h.a.NotNil(a.DeletedAt)
-//}
+import (
+	"context"
+	"fmt"
+	"github.com/cortezaproject/corteza-server/pkg/id"
+	"github.com/cortezaproject/corteza-server/store"
+	"github.com/cortezaproject/corteza-server/system/service"
+	"github.com/cortezaproject/corteza-server/system/types"
+	"github.com/cortezaproject/corteza-server/tests/helpers"
+	"github.com/steinfletcher/apitest-jsonpath"
+	"net/http"
+	"testing"
+	"time"
+)
+
+func (h helper) clearApplications() {
+	h.noError(store.TruncateApplications(context.Background(), service.DefaultNgStore))
+}
+
+func (h helper) repoMakeApplication(ss ...string) *types.Application {
+	var res = &types.Application{
+		ID:        id.Next(),
+		CreatedAt: time.Now(),
+		Unify:     &types.ApplicationUnify{},
+	}
+
+	if len(ss) > 0 {
+		res.Name = ss[0]
+	} else {
+		res.Name = "n_" + rs()
+	}
+
+	h.a.NoError(store.CreateApplication(context.Background(), service.DefaultNgStore, res))
+
+	return res
+}
+
+func (h helper) lookupApplicationByID(ID uint64) *types.Application {
+	res, err := store.LookupApplicationByID(context.Background(), service.DefaultNgStore, ID)
+	h.noError(err)
+	return res
+}
+
+func TestApplicationRead(t *testing.T) {
+	h := newHelper(t)
+
+	u := h.repoMakeApplication()
+
+	h.apiInit().
+		Get(fmt.Sprintf("/application/%d", u.ID)).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		Assert(jsonpath.Equal(`$.response.name`, u.Name)).
+		Assert(jsonpath.Equal(`$.response.applicationID`, fmt.Sprintf("%d", u.ID))).
+		End()
+}
+
+func TestApplicationList(t *testing.T) {
+	h := newHelper(t)
+
+	h.repoMakeApplication(h.randEmail())
+	h.repoMakeApplication(h.randEmail())
+
+	h.apiInit().
+		Get("/application/").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		End()
+}
+
+func TestApplicationList_filterForbidden(t *testing.T) {
+	h := newHelper(t)
+
+	// @todo this can be a problematic test because it leaves
+	//       behind applications that are not denied this context
+	//       db purge might be needed
+
+	h.repoMakeApplication("application")
+	f := h.repoMakeApplication()
+
+	h.deny(types.ApplicationPermissionResource.AppendID(f.ID), "read")
+
+	h.apiInit().
+		Get("/application/").
+		Query("name", f.Name).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		Assert(jsonpath.NotPresent(fmt.Sprintf(`$.response.set[? @.name=="%s"]`, f.Name))).
+		End()
+}
+
+func TestApplicationCreateForbidden(t *testing.T) {
+	h := newHelper(t)
+
+	h.apiInit().
+		Post("/application/").
+		FormData("name", rs()).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertError("not allowed to create applications")).
+		End()
+}
+
+func TestApplicationCreate(t *testing.T) {
+	h := newHelper(t)
+	h.allow(types.SystemPermissionResource, "application.create")
+
+	h.apiInit().
+		Post("/application/").
+		FormData("name", rs()).
+		FormData("handle", "handle_"+rs()).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		End()
+}
+
+func TestApplicationUpdateForbidden(t *testing.T) {
+	h := newHelper(t)
+	u := h.repoMakeApplication()
+
+	h.apiInit().
+		Put(fmt.Sprintf("/application/%d", u.ID)).
+		FormData("email", h.randEmail()).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertError("not allowed to update this application")).
+		End()
+}
+
+func TestApplicationUpdate(t *testing.T) {
+	h := newHelper(t)
+	res := h.repoMakeApplication()
+	h.allow(types.ApplicationPermissionResource.AppendWildcard(), "update")
+
+	newName := "updated-" + rs()
+	newHandle := "updated-" + rs()
+
+	h.apiInit().
+		Put(fmt.Sprintf("/application/%d", res.ID)).
+		FormData("name", newName).
+		FormData("handle", newHandle).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		End()
+
+	res = h.lookupApplicationByID(res.ID)
+	h.a.NotNil(res)
+	h.a.Equal(newName, res.Name)
+}
+
+func TestApplicationDeleteForbidden(t *testing.T) {
+	h := newHelper(t)
+	u := h.repoMakeApplication()
+
+	h.apiInit().
+		Delete(fmt.Sprintf("/application/%d", u.ID)).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertError("not allowed to delete this application")).
+		End()
+}
+
+func TestApplicationDelete(t *testing.T) {
+	h := newHelper(t)
+	h.allow(types.ApplicationPermissionResource.AppendWildcard(), "delete")
+
+	res := h.repoMakeApplication()
+
+	h.apiInit().
+		Delete(fmt.Sprintf("/application/%d", res.ID)).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		End()
+
+	res = h.lookupApplicationByID(res.ID)
+	h.a.NotNil(res)
+	h.a.NotNil(res.DeletedAt)
+}

tests/system/main_test.go

@@ -2,6 +2,7 @@ package system
 
 import (
 	"context"
+	"errors"
 	"github.com/cortezaproject/corteza-server/app"
 	"github.com/cortezaproject/corteza-server/pkg/api"
 	"github.com/cortezaproject/corteza-server/pkg/auth"
@@ -156,3 +157,12 @@ func (h helper) allow(r permissions.Resource, o permissions.Operation) {
 func (h helper) deny(r permissions.Resource, o permissions.Operation) {
 	h.mockPermissions(permissions.DenyRule(h.roleID, r, o))
 }
+
+// Unwraps error before it passes it to the tester
+func (h helper) noError(err error) {
+	for errors.Unwrap(err) != nil {
+		err = errors.Unwrap(err)
+	}
+
+	h.a.NoError(err)
+}

tests/system/role_test.go

@@ -1,211 +1,216 @@
 package system
 
-//
-//import (
-//	"context"
-//	"fmt"
-//	"net/http"
-//	"testing"
-//
-//	jsonpath "github.com/steinfletcher/apitest-jsonpath"
-//
-//	"github.com/cortezaproject/corteza-server/system/repository"
-//	"github.com/cortezaproject/corteza-server/system/types"
-//	"github.com/cortezaproject/corteza-server/tests/helpers"
-//)
-//
-//func (h helper) repoRole() repository.RoleRepository {
-//	return repository.Role(context.Background(), db())
-//}
-//
-//func (h helper) repoMakeRole(ss ...string) *types.Role {
-//	var r = &types.Role{}
-//	if len(ss) > 1 {
-//		r.Handle = ss[1]
-//	} else {
-//		r.Handle = "h_" + rs()
-//
-//	}
-//	if len(ss) > 0 {
-//		r.Name = ss[0]
-//	} else {
-//		r.Name = "n_" + rs()
-//	}
-//
-//	r, err := h.
-//		repoRole().
-//		Create(r)
-//	h.a.NoError(err)
-//
-//	return r
-//}
-//
-//func TestRoleRead(t *testing.T) {
-//	h := newHelper(t)
-//
-//	u := h.repoMakeRole()
-//
-//	h.apiInit().
-//		Get(fmt.Sprintf("/roles/%d", u.ID)).
-//		Expect(t).
-//		Status(http.StatusOK).
-//		Assert(helpers.AssertNoErrors).
-//		Assert(jsonpath.Equal(`$.response.name`, u.Name)).
-//		Assert(jsonpath.Equal(`$.response.roleID`, fmt.Sprintf("%d", u.ID))).
-//		End()
-//}
-//
-//func TestRoleList(t *testing.T) {
-//	h := newHelper(t)
-//
-//	h.repoMakeRole(h.randEmail())
-//	h.repoMakeRole(h.randEmail())
-//
-//	h.apiInit().
-//		Get("/roles/").
-//		Expect(t).
-//		Status(http.StatusOK).
-//		Assert(helpers.AssertNoErrors).
-//		End()
-//}
-//
-//func TestRoleList_filterForbidden(t *testing.T) {
-//	h := newHelper(t)
-//
-//	// @todo this can be a problematic test because it leaves
-//	//       behind roles that are not denied this context
-//	//       db purge might be needed
-//
-//	h.repoMakeRole("role")
-//	f := h.repoMakeRole()
-//
-//	h.deny(types.RolePermissionResource.AppendID(f.ID), "read")
-//
-//	h.apiInit().
-//		Get("/roles/").
-//		Query("handle", f.Handle).
-//		Expect(t).
-//		Status(http.StatusOK).
-//		Assert(helpers.AssertNoErrors).
-//		Assert(jsonpath.NotPresent(fmt.Sprintf(`$.response.set[? @.handle=="%s"]`, f.Handle))).
-//		End()
-//}
-//
-//func TestRoleCreateForbidden(t *testing.T) {
-//	h := newHelper(t)
-//
-//	h.apiInit().
-//		Post("/roles/").
-//		FormData("name", rs()).
-//		Expect(t).
-//		Status(http.StatusOK).
-//		Assert(helpers.AssertError("not allowed to create roles")).
-//		End()
-//}
-//
-//func TestRoleCreateNotUnique(t *testing.T) {
-//	h := newHelper(t)
-//	h.allow(types.SystemPermissionResource, "role.create")
-//
-//	role := h.repoMakeRole()
-//	h.apiInit().
-//		Post("/roles/").
-//		FormData("name", rs()).
-//		FormData("handle", role.Handle).
-//		Expect(t).
-//		Status(http.StatusOK).
-//		Assert(helpers.AssertError("role handle not unique")).
-//		End()
-//
-//	h.apiInit().
-//		Post("/roles/").
-//		FormData("name", role.Name).
-//		FormData("handle", "handle_"+rs()).
-//		Expect(t).
-//		Status(http.StatusOK).
-//		Assert(helpers.AssertError("role name not unique")).
-//		End()
-//
-//}
-//
-//func TestRoleCreate(t *testing.T) {
-//	h := newHelper(t)
-//	h.allow(types.SystemPermissionResource, "role.create")
-//
-//	h.apiInit().
-//		Post("/roles/").
-//		FormData("name", rs()).
-//		FormData("handle", "handle_"+rs()).
-//		Expect(t).
-//		Status(http.StatusOK).
-//		Assert(helpers.AssertNoErrors).
-//		End()
-//}
-//
-//func TestRoleUpdateForbidden(t *testing.T) {
-//	h := newHelper(t)
-//	u := h.repoMakeRole()
-//
-//	h.apiInit().
-//		Put(fmt.Sprintf("/roles/%d", u.ID)).
-//		FormData("email", h.randEmail()).
-//		Expect(t).
-//		Status(http.StatusOK).
-//		Assert(helpers.AssertError("not allowed to update this role")).
-//		End()
-//}
-//
-//func TestRoleUpdate(t *testing.T) {
-//	h := newHelper(t)
-//	u := h.repoMakeRole()
-//	h.allow(types.RolePermissionResource.AppendWildcard(), "update")
-//
-//	newName := "updated-" + rs()
-//	newHandle := "updated-" + rs()
-//
-//	h.apiInit().
-//		Put(fmt.Sprintf("/roles/%d", u.ID)).
-//		FormData("name", newName).
-//		FormData("handle", newHandle).
-//		Expect(t).
-//		Status(http.StatusOK).
-//		Assert(helpers.AssertNoErrors).
-//		End()
-//
-//	u, err := h.repoRole().FindByID(u.ID)
-//	h.a.NoError(err)
-//	h.a.NotNil(u)
-//	h.a.Equal(newName, u.Name)
-//	h.a.Equal(newHandle, u.Handle)
-//}
-//
-//func TestRoleDeleteForbidden(t *testing.T) {
-//	h := newHelper(t)
-//	u := h.repoMakeRole()
-//
-//	h.apiInit().
-//		Delete(fmt.Sprintf("/roles/%d", u.ID)).
-//		Expect(t).
-//		Status(http.StatusOK).
-//		Assert(helpers.AssertError("not allowed to delete this role")).
-//		End()
-//}
-//
-//func TestRoleDelete(t *testing.T) {
-//	h := newHelper(t)
-//	h.allow(types.RolePermissionResource.AppendWildcard(), "delete")
-//
-//	r := h.repoMakeRole()
-//
-//	h.apiInit().
-//		Delete(fmt.Sprintf("/roles/%d", r.ID)).
-//		Expect(t).
-//		Status(http.StatusOK).
-//		Assert(helpers.AssertNoErrors).
-//		End()
-//
-//	r, err := h.repoRole().FindByID(r.ID)
-//	h.a.NoError(err)
-//	h.a.NotNil(r)
-//	h.a.NotNil(r.DeletedAt)
-//}
+import (
+	"context"
+	"fmt"
+	"github.com/cortezaproject/corteza-server/pkg/id"
+	"github.com/cortezaproject/corteza-server/store"
+	"github.com/cortezaproject/corteza-server/system/service"
+	"github.com/cortezaproject/corteza-server/system/types"
+	"github.com/cortezaproject/corteza-server/tests/helpers"
+	"github.com/steinfletcher/apitest-jsonpath"
+	"net/http"
+	"testing"
+	"time"
+)
+
+func (h helper) clearRoles() {
+	h.noError(store.TruncateRoles(context.Background(), service.DefaultNgStore))
+}
+
+func (h helper) repoMakeRole(ss ...string) *types.Role {
+	var r = &types.Role{
+		ID:        id.Next(),
+		CreatedAt: time.Now(),
+	}
+
+	if len(ss) > 1 {
+		r.Handle = ss[1]
+	} else {
+		r.Handle = "h_" + rs()
+
+	}
+	if len(ss) > 0 {
+		r.Name = ss[0]
+	} else {
+		r.Name = "n_" + rs()
+	}
+
+	h.a.NoError(store.CreateRole(context.Background(), service.DefaultNgStore, r))
+
+	return r
+}
+
+func (h helper) lookupRoleByID(ID uint64) *types.Role {
+	res, err := store.LookupRoleByID(context.Background(), service.DefaultNgStore, ID)
+	h.noError(err)
+	return res
+}
+
+func TestRoleRead(t *testing.T) {
+	h := newHelper(t)
+
+	u := h.repoMakeRole()
+
+	h.apiInit().
+		Get(fmt.Sprintf("/roles/%d", u.ID)).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		Assert(jsonpath.Equal(`$.response.name`, u.Name)).
+		Assert(jsonpath.Equal(`$.response.roleID`, fmt.Sprintf("%d", u.ID))).
+		End()
+}
+
+func TestRoleList(t *testing.T) {
+	h := newHelper(t)
+
+	h.repoMakeRole(h.randEmail())
+	h.repoMakeRole(h.randEmail())
+
+	h.apiInit().
+		Get("/roles/").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		End()
+}
+
+func TestRoleList_filterForbidden(t *testing.T) {
+	h := newHelper(t)
+
+	// @todo this can be a problematic test because it leaves
+	//       behind roles that are not denied this context
+	//       db purge might be needed
+
+	h.repoMakeRole("role")
+	f := h.repoMakeRole()
+
+	h.deny(types.RolePermissionResource.AppendID(f.ID), "read")
+
+	h.apiInit().
+		Get("/roles/").
+		Query("handle", f.Handle).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		Assert(jsonpath.NotPresent(fmt.Sprintf(`$.response.set[? @.handle=="%s"]`, f.Handle))).
+		End()
+}
+
+func TestRoleCreateForbidden(t *testing.T) {
+	h := newHelper(t)
+
+	h.apiInit().
+		Post("/roles/").
+		FormData("name", rs()).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertError("not allowed to create roles")).
+		End()
+}
+
+func TestRoleCreateNotUnique(t *testing.T) {
+	h := newHelper(t)
+	h.allow(types.SystemPermissionResource, "role.create")
+
+	role := h.repoMakeRole()
+	h.apiInit().
+		Post("/roles/").
+		FormData("name", rs()).
+		FormData("handle", role.Handle).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertError("role handle not unique")).
+		End()
+
+	h.apiInit().
+		Post("/roles/").
+		FormData("name", role.Name).
+		FormData("handle", "handle_"+rs()).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertError("role name not unique")).
+		End()
+
+}
+
+func TestRoleCreate(t *testing.T) {
+	h := newHelper(t)
+	h.allow(types.SystemPermissionResource, "role.create")
+
+	h.apiInit().
+		Post("/roles/").
+		FormData("name", rs()).
+		FormData("handle", "handle_"+rs()).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		End()
+}
+
+func TestRoleUpdateForbidden(t *testing.T) {
+	h := newHelper(t)
+	u := h.repoMakeRole()
+
+	h.apiInit().
+		Put(fmt.Sprintf("/roles/%d", u.ID)).
+		FormData("email", h.randEmail()).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertError("not allowed to update this role")).
+		End()
+}
+
+func TestRoleUpdate(t *testing.T) {
+	h := newHelper(t)
+	res := h.repoMakeRole()
+	h.allow(types.RolePermissionResource.AppendWildcard(), "update")
+
+	newName := "updated-" + rs()
+	newHandle := "updated-" + rs()
+
+	h.apiInit().
+		Put(fmt.Sprintf("/roles/%d", res.ID)).
+		FormData("name", newName).
+		FormData("handle", newHandle).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		End()
+
+	res = h.lookupRoleByID(res.ID)
+	h.a.NotNil(res)
+	h.a.Equal(newName, res.Name)
+	h.a.Equal(newHandle, res.Handle)
+}
+
+func TestRoleDeleteForbidden(t *testing.T) {
+	h := newHelper(t)
+	u := h.repoMakeRole()
+
+	h.apiInit().
+		Delete(fmt.Sprintf("/roles/%d", u.ID)).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertError("not allowed to delete this role")).
+		End()
+}
+
+func TestRoleDelete(t *testing.T) {
+	h := newHelper(t)
+	h.allow(types.RolePermissionResource.AppendWildcard(), "delete")
+
+	res := h.repoMakeRole()
+
+	h.apiInit().
+		Delete(fmt.Sprintf("/roles/%d", res.ID)).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		End()
+
+	res = h.lookupRoleByID(res.ID)
+	h.a.NotNil(res)
+	h.a.NotNil(res.DeletedAt)
+}

tests/system/user_test.go

@@ -4,10 +4,11 @@ import (
 	"context"
 	"fmt"
 	"github.com/cortezaproject/corteza-server/pkg/id"
+	"github.com/cortezaproject/corteza-server/store"
 	"github.com/cortezaproject/corteza-server/system/service"
 	"github.com/cortezaproject/corteza-server/system/types"
 	"github.com/cortezaproject/corteza-server/tests/helpers"
-	jsonpath "github.com/steinfletcher/apitest-jsonpath"
+	"github.com/steinfletcher/apitest-jsonpath"
 	"net/http"
 	"testing"
 	"time"
@@ -34,8 +35,13 @@ func (h helper) createUser(user *types.User) *types.User {
 	return user
 }
 
+func (h helper) clearUsers() {
+	h.noError(store.TruncateUsers(context.Background(), service.DefaultNgStore))
+}
+
 func TestUserRead(t *testing.T) {
 	h := newHelper(t)
+	h.clearUsers()
 
 	u := h.createUserWithEmail(h.randEmail())
 
@@ -62,6 +68,7 @@ func TestUserRead(t *testing.T) {
 
 func TestUserListAll(t *testing.T) {
 	h := newHelper(t)
+	h.clearUsers()
 
 	h.secCtx()
 
@@ -72,27 +79,21 @@ func TestUserListAll(t *testing.T) {
 
 	h.allow(types.UserPermissionResource.AppendWildcard(), "read")
 
-	aux := struct {
-		Response *struct{ Filter *types.UserFilter }
-	}{}
-
 	h.apiInit().
 		Get("/users/").
 		Expect(t).
 		Status(http.StatusOK).
 		Assert(helpers.AssertNoErrors).
-		End().
-		JSON(&aux)
-
-	h.a.NotNil(aux.Response)
-	h.a.NotNil(aux.Response.Filter)
-
-	// we need to test with >= because we're not running this inside a transaction.
-	h.a.GreaterOrEqual(int(aux.Response.Filter.Count), seedCount)
+		Assert(jsonpath.Present(`$.response.filter`)).
+		Assert(jsonpath.Present(`$.response.set`)).
+		Assert(jsonpath.Len(`$.response.set`, seedCount)).
+		End()
 }
 
 func TestUserList_filterForbidden(t *testing.T) {
 	h := newHelper(t)
+	h.clearUsers()
+
 	h.allow(types.UserPermissionResource.AppendWildcard(), "read")
 
 	h.createUserWithEmail("usr")
@@ -111,17 +112,13 @@ func TestUserList_filterForbidden(t *testing.T) {
 
 func TestUserListQuery(t *testing.T) {
 	h := newHelper(t)
+	h.clearUsers()
 
 	h.secCtx()
 
 	h.allow(types.UserPermissionResource.AppendWildcard(), "read")
 
-	aux := struct {
-		Response *struct{ Filter *types.UserFilter }
-	}{}
-
 	h.apiInit().
-		Debug().
 		Get("/users/").
 		Query("query", h.randEmail()).
 		Query("email", h.randEmail()).
@@ -131,16 +128,14 @@ func TestUserListQuery(t *testing.T) {
 		Expect(t).
 		Status(http.StatusOK).
 		Assert(helpers.AssertNoErrors).
-		End().
-		JSON(&aux)
-
-	h.a.NotNil(aux.Response)
-	h.a.NotNil(aux.Response.Filter)
-	h.a.GreaterOrEqual(int(aux.Response.Filter.Count), 0)
+		Assert(jsonpath.Present(`$.response.filter`)).
+		Assert(jsonpath.Len(`$.response.set`, 0)).
+		End()
 }
 
 func TestUserListQueryEmail(t *testing.T) {
 	h := newHelper(t)
+	h.clearUsers()
 
 	h.secCtx()
 	h.allow(types.UserPermissionResource.AppendWildcard(), "read")
@@ -150,7 +145,6 @@ func TestUserListQueryEmail(t *testing.T) {
 	h.createUserWithEmail(ee)
 
 	h.apiInit().
-		Debug().
 		Get("/users/").
 		Query("email", ee).
 		Expect(t).
@@ -162,6 +156,7 @@ func TestUserListQueryEmail(t *testing.T) {
 
 func TestUserListQueryUsername(t *testing.T) {
 	h := newHelper(t)
+	h.clearUsers()
 
 	h.secCtx()
 	h.allow(types.UserPermissionResource.AppendWildcard(), "read")
@@ -173,7 +168,6 @@ func TestUserListQueryUsername(t *testing.T) {
 	})
 
 	h.apiInit().
-		Debug().
 		Get("/users/").
 		Query("username", ee).
 		Expect(t).
@@ -185,6 +179,7 @@ func TestUserListQueryUsername(t *testing.T) {
 
 func TestUserListQueryHandle(t *testing.T) {
 	h := newHelper(t)
+	h.clearUsers()
 
 	h.secCtx()
 	h.allow(types.UserPermissionResource.AppendWildcard(), "read")
@@ -195,7 +190,6 @@ func TestUserListQueryHandle(t *testing.T) {
 	})
 
 	h.apiInit().
-		Debug().
 		Get("/users/").
 		Query("handle", "johnDoe").
 		Expect(t).
@@ -207,6 +201,7 @@ func TestUserListQueryHandle(t *testing.T) {
 
 func TestUserListWithOneAllowed(t *testing.T) {
 	h := newHelper(t)
+	h.clearUsers()
 
 	h.secCtx()
 
@@ -227,18 +222,16 @@ func TestUserListWithOneAllowed(t *testing.T) {
 		Expect(t).
 		Status(http.StatusOK).
 		Assert(helpers.AssertNoErrors).
+		Assert(jsonpath.Present(`$.response.filter`)).
+		Assert(jsonpath.Present(`$.response.set`)).
+		Assert(jsonpath.Len(`$.response.set`, 1)).
 		End().
 		JSON(&aux)
-
-	h.a.NotNil(aux.Response)
-	h.a.NotNil(aux.Response.Filter)
-
-	// we need to test with >= because we're not running this inside a transaction.
-	h.a.Equal(1, int(aux.Response.Filter.Count))
 }
 
 func TestUserCreateForbidden(t *testing.T) {
 	h := newHelper(t)
+	h.clearUsers()
 
 	h.apiInit().
 		Post("/users/").
@@ -251,6 +244,8 @@ func TestUserCreateForbidden(t *testing.T) {
 
 func TestUserCreate(t *testing.T) {
 	h := newHelper(t)
+	h.clearUsers()
+
 	h.allow(types.SystemPermissionResource, "user.create")
 
 	email := h.randEmail()
@@ -266,6 +261,8 @@ func TestUserCreate(t *testing.T) {
 
 func TestUserUpdateForbidden(t *testing.T) {
 	h := newHelper(t)
+	h.clearUsers()
+
 	u := h.createUserWithEmail(h.randEmail())
 
 	h.apiInit().
@@ -279,6 +276,8 @@ func TestUserUpdateForbidden(t *testing.T) {
 
 func TestUserUpdate(t *testing.T) {
 	h := newHelper(t)
+	h.clearUsers()
+
 	u := h.createUserWithEmail(h.randEmail())
 	h.allow(types.UserPermissionResource.AppendWildcard(), "update")
 
@@ -295,6 +294,8 @@ func TestUserUpdate(t *testing.T) {
 
 func TestUserDeleteForbidden(t *testing.T) {
 	h := newHelper(t)
+	h.clearUsers()
+
 	u := h.createUserWithEmail(h.randEmail())
 
 	h.apiInit().
@@ -307,6 +308,8 @@ func TestUserDeleteForbidden(t *testing.T) {
 
 func TestUserDelete(t *testing.T) {
 	h := newHelper(t)
+	h.clearUsers()
+
 	h.allow(types.UserPermissionResource.AppendWildcard(), "delete")
 
 	u := h.createUserWithEmail(h.randEmail())