Permissions, RateControl and Auditing

2026-07-30 17:30:40 +00:00 · 2026-07-16 14:01:08 +03:00
parent 3a1b95dbc5
commit ba64a0c95a
62 changed files with 6095 additions and 2366 deletions
@@ -0,0 +1,109 @@
+using Esiur.Data;
+using Esiur.Data.Types;
+using Esiur.Security.Authority;
+using Esiur.Security.Permissions;
+
+namespace Esiur.Tests.Unit;
+
+public class UserPermissionsManagerTests
+{
+    [Fact]
+    public void ExplicitMemberGrant_AllowsReadAndWriteActions()
+    {
+        var memberPermissions = new Map<string, object>
+        {
+            [ActionType.GetProperty.ToString()] = "yes",
+            [ActionType.SetProperty.ToString()] = "yes"
+        };
+        var manager = CreateManager(new Map<string, object>
+        {
+            ["Value"] = memberPermissions
+        });
+        var session = new Session { RemoteIdentity = "alice" };
+        var member = new MemberDef { Name = "Value" };
+
+        Assert.Equal(
+            Ruling.Allowed,
+            manager.Applicable(null!, session, ActionType.GetProperty, member, null!));
+        Assert.Equal(
+            Ruling.Allowed,
+            manager.Applicable(null!, session, ActionType.SetProperty, member, null!));
+    }
+
+    [Fact]
+    public void MissingMemberOrAction_DeniesInsteadOfFallingThrough()
+    {
+        var manager = CreateManager(new Map<string, object>
+        {
+            ["Value"] = new Map<string, object>
+            {
+                [ActionType.GetProperty.ToString()] = "yes"
+            }
+        });
+        var session = new Session { RemoteIdentity = "alice" };
+
+        Assert.Equal(
+            Ruling.Denied,
+            manager.Applicable(
+                null!,
+                session,
+                ActionType.Execute,
+                new MemberDef { Name = "Missing" },
+                null!));
+        Assert.Equal(
+            Ruling.Denied,
+            manager.Applicable(
+                null!,
+                session,
+                ActionType.SetProperty,
+                new MemberDef { Name = "Value" },
+                null!));
+    }
+
+    [Fact]
+    public void ExplicitResourceGrant_AllowsAttributeInquiry()
+    {
+        var manager = CreateManager(new Map<string, object>
+        {
+            ["_get_attributes"] = "yes"
+        });
+
+        Assert.Equal(
+            Ruling.Allowed,
+            manager.Applicable(
+                null!,
+                new Session { RemoteIdentity = "alice" },
+                ActionType.InquireAttributes,
+                null!,
+                null!));
+    }
+
+    [Fact]
+    public void MissingIdentityAndMalformedPermissionMaps_FailClosed()
+    {
+        var manager = new UserPermissionsManager(new Map<string, object>
+        {
+            ["alice"] = "not a permission map"
+        });
+
+        Assert.Equal(
+            Ruling.Denied,
+            manager.Applicable(
+                null!,
+                new Session { RemoteIdentity = "bob" },
+                ActionType.Attach,
+                null!,
+                null!));
+        Assert.Equal(
+            Ruling.Denied,
+            manager.Applicable(
+                null!,
+                new Session { RemoteIdentity = "alice" },
+                ActionType.Attach,
+                null!,
+                null!));
+    }
+
+    private static UserPermissionsManager CreateManager(Map<string, object> permissions)
+        => new(new Map<string, object> { ["alice"] = permissions });
+}