Skip to content

Commit a668fec

Browse files
iamayushmiamayushm
committed
addding test cases file
1 parent 0dbcdcd commit a668fec

File tree

6 files changed

+1439
-34
lines changed

6 files changed

+1439
-34
lines changed

‎api/user/UserRestHandler.go‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -165,7 +165,7 @@ func (handler UserRestHandlerImpl) CreateUser(w http.ResponseWriter, r *http.Req
165165
return
166166
}
167167

168-
res, err := handler.userService.CreateUser(&userInfo, token, handler.checkManagerAuth)
168+
res, err := handler.userService.CreateUser(&userInfo, token, handler.CheckManagerAuth)
169169
if err != nil {
170170
handler.logger.Errorw("service err, CreateUser", "err", err, "payload", userInfo)
171171
if _, ok := err.(*util.ApiError); ok {
@@ -214,7 +214,7 @@ func (handler UserRestHandlerImpl) UpdateUser(w http.ResponseWriter, r *http.Req
214214
userInfo.EmailId = "admin"
215215
}
216216

217-
res, rolesChanged, restrictedGroups, err := handler.userService.UpdateUser(&userInfo, token, handler.checkManagerAuth)
217+
res, rolesChanged, groupsModified, restrictedGroups, err := handler.userService.UpdateUser(&userInfo, token, handler.CheckManagerAuth)
218218

219219
if err != nil {
220220
handler.logger.Errorw("service err, UpdateUser", "err", err, "payload", userInfo)
@@ -227,9 +227,9 @@ func (handler UserRestHandlerImpl) UpdateUser(w http.ResponseWriter, r *http.Req
227227
} else {
228228
groups := strings.Join(restrictedGroups, ", ")
229229

230-
if len(restrictedGroups) == len(userInfo.Groups) {
230+
if len(restrictedGroups) >= len(userInfo.Groups) {
231231

232-
if rolesChanged {
232+
if rolesChanged || groupsModified {
233233
// warning
234234
message := fmt.Errorf("User permissions updated partially. " + groups + " could not be modified. You do not have manager permission for some or all projects in these groups.")
235235
common.WriteJsonResp(w, message, nil, http.StatusExpectationFailed)
@@ -568,7 +568,7 @@ func (handler UserRestHandlerImpl) UpdateRoleGroup(w http.ResponseWriter, r *htt
568568
common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
569569
return
570570
}
571-
res, err := handler.roleGroupService.UpdateRoleGroup(&request, token, handler.checkManagerAuth)
571+
res, err := handler.roleGroupService.UpdateRoleGroup(&request, token, handler.CheckManagerAuth)
572572
if err != nil {
573573
handler.logger.Errorw("service err, UpdateRoleGroup", "err", err, "payload", request)
574574
common.WriteJsonResp(w, err, "", http.StatusInternalServerError)
@@ -806,9 +806,10 @@ func (handler UserRestHandlerImpl) InvalidateRoleCache(w http.ResponseWriter, r
806806

807807
}
808808

809-
func (handler UserRestHandlerImpl) checkManagerAuth(token string, object string) bool {
809+
func (handler UserRestHandlerImpl) CheckManagerAuth(token string, object string) bool {
810810
if ok := handler.enforcer.Enforce(token, casbin.ResourceUser, casbin.ActionUpdate, strings.ToLower(object)); !ok {
811811
return false
812812
}
813813
return true
814+
814815
}

‎pkg/user/UserService.go‎

Lines changed: 36 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ import (
3838
type UserService interface {
3939
CreateUser(userInfo *bean.UserInfo, token string, managerAuth func(token string, object string) bool) ([]*bean.UserInfo, error)
4040
SelfRegisterUserIfNotExists(userInfo *bean.UserInfo) ([]*bean.UserInfo, error)
41-
UpdateUser(userInfo *bean.UserInfo, token string, managerAuth func(token string, object string) bool) (*bean.UserInfo, bool, []string, error)
41+
UpdateUser(userInfo *bean.UserInfo, token string, managerAuth func(token string, object string) bool) (*bean.UserInfo, bool, bool, []string, error)
4242
GetById(id int32) (*bean.UserInfo, error)
4343
GetAll() ([]bean.UserInfo, error)
4444
GetAllDetailedUsers() ([]bean.UserInfo, error)
@@ -268,7 +268,7 @@ func (impl UserServiceImpl) updateUserIfExists(userInfo *bean.UserInfo, dbUser *
268268
updateUserInfo.Groups = impl.mergeGroups(updateUserInfo.Groups, userInfo.Groups)
269269
updateUserInfo.UserId = userInfo.UserId
270270
updateUserInfo.EmailId = emailId // override case sensitivity
271-
updateUserInfo, _, _, err = impl.UpdateUser(updateUserInfo, token, managerAuth)
271+
updateUserInfo, _, _, _, err = impl.UpdateUser(updateUserInfo, token, managerAuth)
272272
if err != nil {
273273
impl.logger.Errorw("error while update user", "error", err)
274274
return nil, err
@@ -499,49 +499,50 @@ func (impl UserServiceImpl) mergeGroups(oldGroups []string, newGroups []string)
499499
return groups
500500
}
501501

502-
func (impl UserServiceImpl) UpdateUser(userInfo *bean.UserInfo, token string, managerAuth func(token string, object string) bool) (*bean.UserInfo, bool, []string, error) {
502+
func (impl UserServiceImpl) UpdateUser(userInfo *bean.UserInfo, token string, managerAuth func(token string, object string) bool) (*bean.UserInfo, bool, bool, []string, error) {
503503
//validating if action user is not admin and trying to update user who has super admin polices, return 403
504504
isUserSuperAdmin, err := impl.IsSuperAdmin(int(userInfo.Id))
505505
if err != nil {
506-
return nil, false, nil, err
506+
return nil, false, false, nil, err
507507
}
508508
isActionPerformingUserSuperAdmin, err := impl.IsSuperAdmin(int(userInfo.UserId))
509509
if err != nil {
510-
return nil, false, nil, err
510+
return nil, false, false, nil, err
511511
}
512512
//if request comes to make user as a super admin or user already a super admin (who'is going to be updated), action performing user should have super admin access
513513
if userInfo.SuperAdmin || isUserSuperAdmin {
514514
if !isActionPerformingUserSuperAdmin {
515515
err = &util.ApiError{HttpStatusCode: http.StatusForbidden, UserMessage: "Invalid request, not allow to update super admin type user"}
516-
return nil, false, nil, err
516+
return nil, false, false, nil, err
517517
}
518518
}
519519

520520
dbConnection := impl.userRepository.GetConnection()
521521
tx, err := dbConnection.Begin()
522522
if err != nil {
523-
return nil, false, nil, err
523+
return nil, false, false, nil, err
524524
}
525525
// Rollback tx on error.
526526
defer tx.Rollback()
527527

528528
model, err := impl.userRepository.GetByIdIncludeDeleted(userInfo.Id)
529529
if err != nil {
530530
impl.logger.Errorw("error while fetching user from db", "error", err)
531-
return nil, false, nil, err
531+
return nil, false, false, nil, err
532532
}
533533

534534
var addedPolicies []casbin2.Policy
535535
var eliminatedPolicies []casbin2.Policy
536536

537537
restrictedGroups := []string{}
538538
rolesChanged := false
539+
groupsModified := false
539540

540541
if userInfo.SuperAdmin == false {
541542
//Starts Role and Mapping
542543
userRoleModels, err := impl.userAuthRepository.GetUserRoleMappingByUserId(model.Id)
543544
if err != nil {
544-
return nil, false, nil, err
545+
return nil, false, false, nil, err
545546
}
546547
existingRoleIds := make(map[int]repository2.UserRoleModel)
547548
eliminatedRoleIds := make(map[int]*repository2.UserRoleModel)
@@ -554,13 +555,13 @@ func (impl UserServiceImpl) UpdateUser(userInfo *bean.UserInfo, token string, ma
554555
_, err = impl.validateUserRequest(userInfo)
555556
if err != nil {
556557
err = &util.ApiError{HttpStatusCode: http.StatusBadRequest, UserMessage: "Invalid request, please provide role filters"}
557-
return nil, false, nil, err
558+
return nil, false, false, nil, err
558559
}
559560

560561
// DELETE Removed Items
561562
items, err := impl.userCommonService.RemoveRolesAndReturnEliminatedPolicies(userInfo, existingRoleIds, eliminatedRoleIds, tx, token, managerAuth)
562563
if err != nil {
563-
return nil, false, nil, err
564+
return nil, false, false, nil, err
564565
}
565566
eliminatedPolicies = append(eliminatedPolicies, items...)
566567
if len(eliminatedPolicies) > 0 {
@@ -597,7 +598,7 @@ func (impl UserServiceImpl) UpdateUser(userInfo *bean.UserInfo, token string, ma
597598
roleModel, err := impl.userAuthRepository.GetRoleByFilter(roleFilter.Entity, roleFilter.Team, entityName, environment, roleFilter.Action, roleFilter.AccessType)
598599
if err != nil {
599600
impl.logger.Errorw("Error in fetching role by filter", "user", userInfo)
600-
return nil, false, nil, err
601+
return nil, false, false, nil, err
601602
}
602603
if roleModel.Id == 0 {
603604
impl.logger.Debugw("no role found for given filter", "filter", roleFilter)
@@ -607,18 +608,18 @@ func (impl UserServiceImpl) UpdateUser(userInfo *bean.UserInfo, token string, ma
607608
if roleFilter.AccessType == bean.APP_ACCESS_TYPE_HELM {
608609
flag, err := impl.userAuthRepository.CreateDefaultHelmPolicies(roleFilter.Team, entityName, environment, tx)
609610
if err != nil || flag == false {
610-
return nil, false, nil, err
611+
return nil, false, false, nil, err
611612
}
612613
} else {
613614
flag, err := impl.userAuthRepository.CreateDefaultPolicies(roleFilter.Team, entityName, environment, tx)
614615
if err != nil || flag == false {
615-
return nil, false, nil, err
616+
return nil, false, false, nil, err
616617
}
617618
}
618619
roleModel, err = impl.userAuthRepository.GetRoleByFilter(roleFilter.Entity, roleFilter.Team, entityName, environment, roleFilter.Action, roleFilter.AccessType)
619620
if err != nil {
620621
impl.logger.Errorw("Error in fetching role by filter", "user", userInfo)
621-
return nil, false, nil, err
622+
return nil, false, false, nil, err
622623
}
623624
if roleModel.Id == 0 {
624625
impl.logger.Debugw("no role found for given filter", "filter", roleFilter)
@@ -628,12 +629,12 @@ func (impl UserServiceImpl) UpdateUser(userInfo *bean.UserInfo, token string, ma
628629
} else if len(roleFilter.Entity) > 0 {
629630
flag, err := impl.userAuthRepository.CreateDefaultPoliciesForGlobalEntity(roleFilter.Entity, entityName, roleFilter.Action, tx)
630631
if err != nil || flag == false {
631-
return nil, false, nil, err
632+
return nil, false, false, nil, err
632633
}
633634
roleModel, err = impl.userAuthRepository.GetRoleByFilter(roleFilter.Entity, roleFilter.Team, entityName, environment, roleFilter.Action, roleFilter.AccessType)
634635
if err != nil {
635636
impl.logger.Errorw("Error in fetching role by filter", "user", userInfo)
636-
return nil, false, nil, err
637+
return nil, false, false, nil, err
637638
}
638639
if roleModel.Id == 0 {
639640
impl.logger.Debugw("no role found for given filter", "filter", roleFilter)
@@ -657,7 +658,7 @@ func (impl UserServiceImpl) UpdateUser(userInfo *bean.UserInfo, token string, ma
657658
userRoleModel.UpdatedOn = time.Now()
658659
userRoleModel, err = impl.userAuthRepository.CreateUserRoleMapping(userRoleModel, tx)
659660
if err != nil {
660-
return nil, false, nil, err
661+
return nil, false, false, nil, err
661662
}
662663
addedPolicies = append(addedPolicies, casbin2.Policy{Type: "g", Sub: casbin2.Subject(model.EmailId), Obj: casbin2.Object(roleModel.Role)})
663664
}
@@ -672,7 +673,7 @@ func (impl UserServiceImpl) UpdateUser(userInfo *bean.UserInfo, token string, ma
672673
userCasbinRoles, err := impl.CheckUserRoles(userInfo.Id)
673674

674675
if err != nil {
675-
return nil, false, nil, err
676+
return nil, false, false, nil, err
676677
}
677678
for _, oldItem := range userCasbinRoles {
678679
oldGroupMap[oldItem] = oldItem
@@ -681,28 +682,35 @@ func (impl UserServiceImpl) UpdateUser(userInfo *bean.UserInfo, token string, ma
681682
for _, item := range userInfo.Groups {
682683
userGroup, err := impl.roleGroupRepository.GetRoleGroupByName(item)
683684
if err != nil {
684-
return nil, false, nil, err
685+
return nil, false, false, nil, err
685686
}
686687
newGroupMap[userGroup.CasbinName] = userGroup.CasbinName
687688
if _, ok := oldGroupMap[userGroup.CasbinName]; !ok {
688689
//check permission for new group which is going to add
689690
hasAccessToGroup := impl.checkGroupAuth(userGroup.CasbinName, token, managerAuth, isActionPerformingUserSuperAdmin)
690691
if hasAccessToGroup {
692+
groupsModified = true
691693
addedPolicies = append(addedPolicies, casbin2.Policy{Type: "g", Sub: casbin2.Subject(userInfo.EmailId), Obj: casbin2.Object(userGroup.CasbinName)})
692694
} else {
693-
restrictedGroups = append(restrictedGroups, item)
695+
trimmedGroup := strings.TrimPrefix(item, "group:")
696+
restrictedGroups = append(restrictedGroups, trimmedGroup)
694697
}
695698
}
696699
}
700+
697701
for _, item := range userCasbinRoles {
698702
if _, ok := newGroupMap[item]; !ok {
699703
if item != bean.SUPERADMIN {
700704
//check permission for group which is going to eliminate
701705
hasAccessToGroup := impl.checkGroupAuth(item, token, managerAuth, isActionPerformingUserSuperAdmin)
702706
if hasAccessToGroup {
707+
if strings.HasPrefix(item, "group:") {
708+
groupsModified = true
709+
}
703710
eliminatedPolicies = append(eliminatedPolicies, casbin2.Policy{Type: "g", Sub: casbin2.Subject(userInfo.EmailId), Obj: casbin2.Object(item)})
704711
} else {
705-
restrictedGroups = append(restrictedGroups, item)
712+
trimmedGroup := strings.TrimPrefix(item, "group:")
713+
restrictedGroups = append(restrictedGroups, trimmedGroup)
706714
}
707715
}
708716
}
@@ -712,18 +720,18 @@ func (impl UserServiceImpl) UpdateUser(userInfo *bean.UserInfo, token string, ma
712720
} else if userInfo.SuperAdmin == true {
713721
flag, err := impl.userAuthRepository.CreateRoleForSuperAdminIfNotExists(tx)
714722
if err != nil || flag == false {
715-
return nil, false, nil, err
723+
return nil, false, false, nil, err
716724
}
717725
roleModel, err := impl.userAuthRepository.GetRoleByFilter("", "", "", "", "super-admin", "")
718726
if err != nil {
719727
impl.logger.Errorw("Error in fetching role by filter", "user", userInfo)
720-
return nil, false, nil, err
728+
return nil, false, false, nil, err
721729
}
722730
if roleModel.Id > 0 {
723731
userRoleModel := &repository2.UserRoleModel{UserId: model.Id, RoleId: roleModel.Id}
724732
userRoleModel, err = impl.userAuthRepository.CreateUserRoleMapping(userRoleModel, tx)
725733
if err != nil {
726-
return nil, false, nil, err
734+
return nil, false, false, nil, err
727735
}
728736
addedPolicies = append(addedPolicies, casbin2.Policy{Type: "g", Sub: casbin2.Subject(model.EmailId), Obj: casbin2.Object(roleModel.Role)})
729737
}
@@ -747,14 +755,14 @@ func (impl UserServiceImpl) UpdateUser(userInfo *bean.UserInfo, token string, ma
747755
model, err = impl.userRepository.UpdateUser(model, tx)
748756
if err != nil {
749757
impl.logger.Errorw("error while fetching user from db", "error", err)
750-
return nil, false, nil, err
758+
return nil, false, false, nil, err
751759
}
752760
err = tx.Commit()
753761
if err != nil {
754-
return nil, false, nil, err
762+
return nil, false, false, nil, err
755763
}
756764

757-
return userInfo, rolesChanged, restrictedGroups, nil
765+
return userInfo, rolesChanged, groupsModified, restrictedGroups, nil
758766
}
759767

760768
func (impl UserServiceImpl) GetById(id int32) (*bean.UserInfo, error) {

0 commit comments

Comments
 (0)