906ac6576b
Fixups for error messages from ACL Errors Alter error messages to be more verbose and explanatory, something like: Permission denied: token with AccessorID '8a2d52a0-6b41-7077-8374-09d4fafa2d30 ' lacks permission 'service:read' on "foobar" on "foobar" in partition "foo" in namespace "bar" Signed-off-by: Mark Anderson <manderson@hashicorp.com>
53 lines
1.9 KiB
Go
53 lines
1.9 KiB
Go
package acl
|
|
|
|
import (
|
|
"fmt"
|
|
"github.com/stretchr/testify/require"
|
|
"regexp"
|
|
"testing"
|
|
)
|
|
|
|
func RequirePermissionDeniedError(t testing.TB, err error, authz Authorizer, _ *AuthorizerContext, resource Resource, accessLevel AccessLevel, resourceID string) {
|
|
t.Helper()
|
|
if err == nil {
|
|
t.Fatal("An error is expected but got nil.")
|
|
}
|
|
if v, ok := err.(PermissionDeniedError); ok {
|
|
require.Equal(t, v.Resource, resource)
|
|
require.Equal(t, v.AccessLevel, accessLevel)
|
|
require.Equal(t, v.ResourceID.Name, resourceID)
|
|
} else {
|
|
t.Fatalf("Expected a permission denied error got %T %vp", err, err)
|
|
}
|
|
}
|
|
|
|
func RequirePermissionDeniedMessage(t testing.TB, msg string, authz interface{}, _ *AuthorizerContext, resource Resource, accessLevel AccessLevel, resourceID string) {
|
|
require.NotEmpty(t, msg, "expected non-empty error message")
|
|
|
|
baseRegex := ` lacks permission '(\S*):(\S*)' on \"([^\"]*)\"(?: in partition \"([^\"]*)\" in namespace \"([^\"]*)\")?\s*$`
|
|
|
|
var resourceIDFound string
|
|
if authz == nil {
|
|
expr := "^Permission denied" + `: provided token` + baseRegex
|
|
re, _ := regexp.Compile(expr)
|
|
matched := re.FindStringSubmatch(msg)
|
|
|
|
require.NotNil(t, matched, fmt.Sprintf("RE %q didn't match %q", expr, msg))
|
|
require.Equal(t, string(resource), matched[1], "resource")
|
|
require.Equal(t, accessLevel.String(), matched[2], "access level")
|
|
resourceIDFound = matched[3]
|
|
} else {
|
|
expr := "^Permission denied" + `: token with AccessorID '(\S*)'` + baseRegex
|
|
re, _ := regexp.Compile(expr)
|
|
matched := re.FindStringSubmatch(msg)
|
|
|
|
require.NotNil(t, matched, fmt.Sprintf("RE %q didn't match %q", expr, msg))
|
|
require.Equal(t, extractAccessorID(authz), matched[1], "auth")
|
|
require.Equal(t, string(resource), matched[2], "resource")
|
|
require.Equal(t, accessLevel.String(), matched[3], "access level")
|
|
resourceIDFound = matched[4]
|
|
}
|
|
// AuthorizerContext information should be checked here
|
|
require.Contains(t, resourceIDFound, resourceID, "resource id")
|
|
}
|