From 90e8764c449528aee8e7fe9e508aa1c4ea8ddd9a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Toma=C5=BE=20Jerman?= <tomaz.jerman121@gmail.com>
Date: Tue, 8 Jun 2021 14:07:50 +0200
Subject: [PATCH] Add tests for field-level access control

---
 tests/compose/record_test.go | 95 ++++++++++++++++++++++++++++++++++++
 1 file changed, 95 insertions(+)

diff --git a/tests/compose/record_test.go b/tests/compose/record_test.go
index 25f1ed0fd..b4373959b 100644
--- a/tests/compose/record_test.go
+++ b/tests/compose/record_test.go
@@ -274,6 +274,46 @@ func TestRecordCreate(t *testing.T) {
 		End()
 }
 
+func TestRecordCreateForbiden_forbidenFields(t *testing.T) {
+	h := newHelper(t)
+	h.clearRecords()
+
+	module := h.repoMakeRecordModuleWithFields("record testing module",
+		&types.ModuleField{Name: "f1", Kind: "String"},
+		&types.ModuleField{Name: "f2", Kind: "String"},
+	)
+	h.allow(types.ModuleRBACResource.AppendWildcard(), "record.create")
+	h.deny(types.ModuleFieldRBACResource.AppendID(module.Fields[1].ID), "record.value.update")
+
+	h.apiInit().
+		Post(fmt.Sprintf("/namespace/%d/module/%d/record/", module.NamespaceID, module.ID)).
+		JSON(fmt.Sprintf(`{"values": [{"name": "f1", "value": "f1.v1"}, {"name": "f2", "value": "f2.v1"}]}`)).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertError("1 issue(s) found")).
+		End()
+}
+
+func TestRecordCreate_forbidenFields(t *testing.T) {
+	h := newHelper(t)
+	h.clearRecords()
+
+	module := h.repoMakeRecordModuleWithFields("record testing module",
+		&types.ModuleField{Name: "f1", Kind: "String"},
+		&types.ModuleField{Name: "f2", Kind: "String"},
+	)
+	h.allow(types.ModuleRBACResource.AppendWildcard(), "record.create")
+	h.deny(types.ModuleFieldRBACResource.AppendID(module.Fields[1].ID), "record.value.update")
+
+	h.apiInit().
+		Post(fmt.Sprintf("/namespace/%d/module/%d/record/", module.NamespaceID, module.ID)).
+		JSON(fmt.Sprintf(`{"values": [{"name": "f1", "value": "f1.v1"}]}`)).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		End()
+}
+
 func TestRecordCreateWithErrors(t *testing.T) {
 	h := newHelper(t)
 	h.clearRecords()
@@ -386,6 +426,61 @@ func TestRecordUpdate_missingField(t *testing.T) {
 	h.a.Equal("f1.v1 (edited)", r.Values[0].Value)
 }
 
+func TestRecordUpdateForbiden_forbidenFields(t *testing.T) {
+	h := newHelper(t)
+	h.clearRecords()
+
+	module := h.repoMakeRecordModuleWithFields("record testing module",
+		&types.ModuleField{Name: "f1", Kind: "String"},
+		&types.ModuleField{Name: "f2", Kind: "String"},
+	)
+	record := h.makeRecord(module,
+		&types.RecordValue{Name: "f1", Value: "f1.v1"},
+		&types.RecordValue{Name: "f2", Value: "f2.v1"},
+	)
+	h.allow(types.ModuleRBACResource.AppendWildcard(), "record.update")
+	h.deny(types.ModuleFieldRBACResource.AppendID(module.Fields[1].ID), "record.value.update")
+
+	h.apiInit().
+		Post(fmt.Sprintf("/namespace/%d/module/%d/record/%d", module.NamespaceID, module.ID, record.ID)).
+		JSON(fmt.Sprintf(`{"values": [{"name": "f1", "value": "f1.v1"}, {"name": "f2", "value": "f2.v1 (edited)"}]}`)).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertError("1 issue(s) found")).
+		End()
+
+	r := h.lookupRecordByID(module, record.ID)
+	h.a.NotNil(r)
+	h.a.Equal("f2.v1", r.Values.FilterByName("f2")[0].Value)
+}
+
+func TestRecordUpdate_forbidenFields(t *testing.T) {
+	h := newHelper(t)
+	h.clearRecords()
+
+	module := h.repoMakeRecordModuleWithFields("record testing module",
+		&types.ModuleField{Name: "f1", Kind: "String"},
+		&types.ModuleField{Name: "f2", Kind: "String"},
+	)
+	record := h.makeRecord(module,
+		&types.RecordValue{Name: "f1", Value: "f1.v1"},
+		&types.RecordValue{Name: "f2", Value: "f2.v1"},
+	)
+	h.allow(types.ModuleRBACResource.AppendWildcard(), "record.update")
+	h.deny(types.ModuleFieldRBACResource.AppendID(module.Fields[1].ID), "record.value.update")
+
+	h.apiInit().
+		Post(fmt.Sprintf("/namespace/%d/module/%d/record/%d", module.NamespaceID, module.ID, record.ID)).
+		JSON(fmt.Sprintf(`{"values": [{"name": "f1", "value": "f1.v1"}, {"name": "f2", "value": "f2.v1"}]}`)).
+		Expect(t).
+		Status(http.StatusOK).
+		End()
+
+	r := h.lookupRecordByID(module, record.ID)
+	h.a.NotNil(r)
+	h.a.Equal("f2.v1", r.Values.FilterByName("f2")[0].Value)
+}
+
 func TestRecordUpdate_refUnchanged(t *testing.T) {
 	h := newHelper(t)
 	h.clearRecords()