mixandClaude Opus 5.5
3b86f6c3b6
Stage 1, step 2 (plan § Who sees what).
Store
- Reach{AllDomains, DomainIDs, AllInbound, InboundDomainIDs} is what a
domain user is assigned. CreateUser takes it; SetUserReach / ClearUserReach
replace SetUserDomains / ClearUserDomains and write both directions in one
transaction. A domain user with nothing on either list is refused
(ErrEmptyReach). With All set the rows of that direction are not stored,
so clearing All later brings nothing stale back.
- ListDomainsForUser honours all_domains; ListInboundDomainsForUser is its
inbound twin. Both filter in the query.
Authorization
- auth.Principal carries the whole reach: CanAccessDomain (now also true
with All), CanAccessInboundDomain, HasOutbound, HasInbound. An id or a
name on one list opens nothing on the other.
- Inbound handlers in three strengths: requireInbound (the list, filtered),
requireInboundDomain (one domain: page, DNS re-check, upstream,
recipients), requireInboundGlobal (add, delete confirm, delete). All
answer the same 404.
- domainIDSet and the DMARC report pages go through the principal instead
of looking at p.Domains themselves.
Panel (old templates, until stage 2)
- User form: two lists with All; inbound is offered only where the feature
is on, and saving the form with it off keeps the user's inbound reach.
Promotion to global drops the reach.
- Menu: a group with nothing assigned is absent; / sends an inbound-only
administrator to Inbound. The inbound pages hide add / delete from a
domain administrator.
Tests: every route of one inbound domain against five kinds of refused
request (another tenant's id, a missing id, outbound-only reach, an outbound
domain with the same id, one with the same name, no principal) with the 404
bodies compared; add/delete as every non-global user; the filtered list
including a domain added later; thirteen outbound routes against another
tenant's domain and application id; the user form; the reach in the store;
the principal matrix; the menu; the home redirect. Removing the access check
or the query filter makes the tests fail (checked by hand).
go test ./... green except the two Windows-only failures in internal/domain
and internal/logtail that predate this work.
Roadmap 12/27.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
53 lines
2.1 KiB
Go
53 lines
2.1 KiB
Go
package auth
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/mixeme/selfpost/internal/store"
|
|
)
|
|
|
|
// Outbound and inbound are granted separately: an id on one list opens nothing
|
|
// on the other, All opens a whole direction, and the global role opens both.
|
|
func TestPrincipalReach(t *testing.T) {
|
|
for _, tc := range []struct {
|
|
name string
|
|
p Principal
|
|
out7, out8, in7, in8 bool
|
|
hasOutbound, hasInbound bool
|
|
}{
|
|
{"global", Principal{Role: RoleGlobal}, true, true, true, true, true, true},
|
|
{"outbound 7", Principal{Role: RoleDomain, Domains: []int64{7}}, true, false, false, false, true, false},
|
|
{"inbound 7", Principal{Role: RoleDomain, InboundDomains: []int64{7}}, false, false, true, false, false, true},
|
|
{"all outbound", Principal{Role: RoleDomain, AllDomains: true}, true, true, false, false, true, false},
|
|
{"all inbound, outbound 8", Principal{Role: RoleDomain, AllInbound: true, Domains: []int64{8}}, false, true, true, true, true, true},
|
|
{"nothing", Principal{Role: RoleDomain}, false, false, false, false, false, false},
|
|
} {
|
|
got := []bool{
|
|
tc.p.CanAccessDomain(7), tc.p.CanAccessDomain(8), tc.p.CanAccessInboundDomain(7), tc.p.CanAccessInboundDomain(8),
|
|
tc.p.HasOutbound(), tc.p.HasInbound(),
|
|
}
|
|
want := []bool{tc.out7, tc.out8, tc.in7, tc.in8, tc.hasOutbound, tc.hasInbound}
|
|
for i := range got {
|
|
if got[i] != want[i] {
|
|
t.Errorf("%s: [out 7, out 8, in 7, in 8, has out, has in] = %v, want %v", tc.name, got, want)
|
|
break
|
|
}
|
|
}
|
|
}
|
|
if !(Principal{Role: RoleDomain, Domains: []int64{7}}).CanAccessApp(store.Application{DomainID: 7}) {
|
|
t.Error("an application follows its sending domain")
|
|
}
|
|
}
|
|
|
|
// The principal a request carries is the user's whole reach, flags included.
|
|
func TestPrincipalFromUser(t *testing.T) {
|
|
p := principalFromUser(store.User{
|
|
ID: 3, Username: "ops", Role: store.RoleDomain,
|
|
DomainIDs: []int64{1}, AllDomains: true, InboundDomainIDs: []int64{2, 4}, AllInboundDomains: true,
|
|
})
|
|
if p.ID != 3 || p.Username != "ops" || p.Role != RoleDomain || !p.AllDomains || !p.AllInbound ||
|
|
len(p.Domains) != 1 || len(p.InboundDomains) != 2 {
|
|
t.Errorf("principal = %+v", p)
|
|
}
|
|
}
|