57 lines
1.8 KiB
Go
57 lines
1.8 KiB
Go
package main
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
)
|
|
|
|
func writeFile(t *testing.T, path, content string) {
|
|
t.Helper()
|
|
if err := os.WriteFile(path, []byte(content), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
|
|
// 1262/AC4: the operators file missing, empty, or holding an unknown field lets nobody in, and says why.
|
|
func TestOperatorsLetsNobodyInWhenTheSettingIsMissingEmptyOrUnknown(t *testing.T) {
|
|
dir := t.TempDir()
|
|
|
|
missing := Operators{Path: filepath.Join(dir, "does-not-exist.json")}
|
|
if ok, why := missing.Allows("alice"); ok || why == "" {
|
|
t.Fatalf("missing: allowed=%v why=%q", ok, why)
|
|
}
|
|
|
|
empty := filepath.Join(dir, "empty.json")
|
|
writeFile(t, empty, ``)
|
|
if ok, why := (Operators{Path: empty}).Allows("alice"); ok || why == "" {
|
|
t.Fatalf("empty: allowed=%v why=%q", ok, why)
|
|
}
|
|
|
|
unknown := filepath.Join(dir, "unknown.json")
|
|
writeFile(t, unknown, `{"operators": ["alice"], "surprise": true}`)
|
|
if ok, why := (Operators{Path: unknown}).Allows("alice"); ok || why == "" {
|
|
t.Fatalf("unknown field: allowed=%v why=%q", ok, why)
|
|
}
|
|
|
|
// A well-formed setting still lets nobody in who is not named.
|
|
good := filepath.Join(dir, "good.json")
|
|
writeFile(t, good, `{"operators": ["alice"]}`)
|
|
if ok, _ := (Operators{Path: good}).Allows("bob"); ok {
|
|
t.Fatalf("bob was let in by a setting naming only alice")
|
|
}
|
|
if ok, why := (Operators{Path: good}).Allows("alice"); !ok || why != "" {
|
|
t.Fatalf("alice: allowed=%v why=%q", ok, why)
|
|
}
|
|
}
|
|
|
|
// Also 1262/AC4: an empty operators list (the default) lets nobody in.
|
|
func TestOperatorsDefaultEmptyListLetsNobodyIn(t *testing.T) {
|
|
dir := t.TempDir()
|
|
path := filepath.Join(dir, "operators.json")
|
|
writeFile(t, path, `{"operators": []}`)
|
|
if ok, why := (Operators{Path: path}).Allows("anyone"); ok || why == "" {
|
|
t.Fatalf("allowed=%v why=%q", ok, why)
|
|
}
|
|
}
|