|
| 1 | +/* |
| 2 | + * Copyright (c) 2020-2024. Devtron Inc. |
| 3 | + */ |
| 4 | + |
| 5 | +package rbac |
| 6 | + |
| 7 | +import ( |
| 8 | + "testing" |
| 9 | + |
| 10 | + "github.com/devtron-labs/devtron/internal/sql/repository/app" |
| 11 | + environmentRepository "github.com/devtron-labs/devtron/pkg/cluster/environment/repository" |
| 12 | + clusterRepository "github.com/devtron-labs/devtron/pkg/cluster/repository" |
| 13 | + teamRepo "github.com/devtron-labs/devtron/pkg/team/repository" |
| 14 | + "github.com/go-pg/pg" |
| 15 | + "go.uber.org/zap" |
| 16 | +) |
| 17 | + |
| 18 | +// stubAppRepo overrides only the lookups used while building helm rbac objects; every other method of the |
| 19 | +// interface is left nil and will panic if a code path unexpectedly reaches it. |
| 20 | +type stubAppRepo struct { |
| 21 | + app.AppRepository |
| 22 | + byName map[string]*app.App |
| 23 | + byId map[int]*app.App |
| 24 | +} |
| 25 | + |
| 26 | +func (s *stubAppRepo) FindAppAndProjectByAppName(appName string) (*app.App, error) { |
| 27 | + if a, ok := s.byName[appName]; ok { |
| 28 | + return a, nil |
| 29 | + } |
| 30 | + // mirrors the real repository, which returns an empty (non nil) app alongside ErrNoRows |
| 31 | + return &app.App{}, pg.ErrNoRows |
| 32 | +} |
| 33 | + |
| 34 | +func (s *stubAppRepo) FindAppAndProjectByAppId(appId int) (*app.App, error) { |
| 35 | + if a, ok := s.byId[appId]; ok { |
| 36 | + return a, nil |
| 37 | + } |
| 38 | + return &app.App{}, pg.ErrNoRows |
| 39 | +} |
| 40 | + |
| 41 | +type stubEnvRepo struct { |
| 42 | + environmentRepository.EnvironmentRepository |
| 43 | + env *environmentRepository.Environment |
| 44 | +} |
| 45 | + |
| 46 | +func (s *stubEnvRepo) FindById(id int) (*environmentRepository.Environment, error) { |
| 47 | + if s.env == nil || s.env.Id != id { |
| 48 | + return nil, pg.ErrNoRows |
| 49 | + } |
| 50 | + return s.env, nil |
| 51 | +} |
| 52 | + |
| 53 | +const ( |
| 54 | + testClusterName = "default_cluster" |
| 55 | + testNamespace = "devtron-demo" |
| 56 | + testEnvId = 1 |
| 57 | + testClusterId = 1 |
| 58 | +) |
| 59 | + |
| 60 | +// linkedExternalApp is how an external helm app looks in the app table once it is linked to chart store: |
| 61 | +// app_name carries the unique identifier while display_name carries the release name. |
| 62 | +func linkedExternalApp(id int, releaseName string, teamId int, teamName string) *app.App { |
| 63 | + return &app.App{ |
| 64 | + Id: id, |
| 65 | + AppName: releaseName + "-" + testNamespace + "-1", |
| 66 | + DisplayName: releaseName, |
| 67 | + TeamId: teamId, |
| 68 | + Team: teamRepo.Team{Name: teamName}, |
| 69 | + } |
| 70 | +} |
| 71 | + |
| 72 | +func newTestEnforcerUtil(envIdentifier string) *EnforcerUtilImpl { |
| 73 | + nginx := linkedExternalApp(1, "nginx", 2, "myproject") |
| 74 | + // linked with no project assigned -> team_id stays 0 and the joined team row is empty |
| 75 | + redis := linkedExternalApp(2, "redis", 0, "") |
| 76 | + // a regular chart store app, which has no display name at all |
| 77 | + grafana := &app.App{Id: 3, AppName: "grafana", TeamId: 2, Team: teamRepo.Team{Name: "myproject"}} |
| 78 | + |
| 79 | + appRepo := &stubAppRepo{ |
| 80 | + byName: map[string]*app.App{ |
| 81 | + nginx.AppName: nginx, |
| 82 | + redis.AppName: redis, |
| 83 | + grafana.AppName: grafana, |
| 84 | + }, |
| 85 | + byId: map[int]*app.App{1: nginx, 2: redis, 3: grafana}, |
| 86 | + } |
| 87 | + envRepo := &stubEnvRepo{env: &environmentRepository.Environment{ |
| 88 | + Id: testEnvId, |
| 89 | + Name: testNamespace, |
| 90 | + ClusterId: testClusterId, |
| 91 | + Namespace: testNamespace, |
| 92 | + EnvironmentIdentifier: envIdentifier, |
| 93 | + Cluster: &clusterRepository.Cluster{Id: testClusterId, ClusterName: testClusterName}, |
| 94 | + }} |
| 95 | + return &EnforcerUtilImpl{logger: zap.NewNop().Sugar(), appRepo: appRepo, environmentRepository: envRepo} |
| 96 | +} |
| 97 | + |
| 98 | +func TestGetHelmObjectByAppNameAndEnvId(t *testing.T) { |
| 99 | + envIdentifier := testClusterName + "__" + testNamespace |
| 100 | + tests := []struct { |
| 101 | + name string |
| 102 | + appName string |
| 103 | + wantObject string |
| 104 | + wantObject2 string |
| 105 | + }{ |
| 106 | + { |
| 107 | + name: "external app linked to chart store is resolved by its display name", |
| 108 | + // this is the regression: the listing APIs hand over the release name, but app_name in db holds |
| 109 | + // the unique identifier, so the lookup used to miss and the object came back as "//" |
| 110 | + appName: "nginx", |
| 111 | + wantObject: "myproject/" + envIdentifier + "/nginx", |
| 112 | + }, |
| 113 | + { |
| 114 | + name: "external app linked without a project falls under the unassigned project", |
| 115 | + appName: "redis", |
| 116 | + wantObject: teamRepo.UNASSIGNED_PROJECT + "/" + envIdentifier + "/redis", |
| 117 | + }, |
| 118 | + { |
| 119 | + name: "regular chart store app keeps working via the plain app name", |
| 120 | + appName: "grafana", |
| 121 | + wantObject: "myproject/" + envIdentifier + "/grafana", |
| 122 | + }, |
| 123 | + { |
| 124 | + name: "caller passing the unique identifier still gets the display name based object", |
| 125 | + // some handlers hand over installedApp.App.AppName directly |
| 126 | + appName: "nginx-" + testNamespace + "-1", |
| 127 | + wantObject: "myproject/" + envIdentifier + "/nginx", |
| 128 | + }, |
| 129 | + { |
| 130 | + name: "unknown app yields an empty object", |
| 131 | + appName: "does-not-exist", |
| 132 | + wantObject: "//", |
| 133 | + }, |
| 134 | + } |
| 135 | + impl := newTestEnforcerUtil(envIdentifier) |
| 136 | + for _, tt := range tests { |
| 137 | + t.Run(tt.name, func(t *testing.T) { |
| 138 | + object, object2 := impl.GetHelmObjectByAppNameAndEnvId(tt.appName, testEnvId) |
| 139 | + if object != tt.wantObject { |
| 140 | + t.Errorf("object = %q, want %q", object, tt.wantObject) |
| 141 | + } |
| 142 | + if object2 != tt.wantObject2 { |
| 143 | + t.Errorf("object2 = %q, want %q", object2, tt.wantObject2) |
| 144 | + } |
| 145 | + }) |
| 146 | + } |
| 147 | +} |
| 148 | + |
| 149 | +// When the environment identifier is not clusterName__namespace, both the migrated and the futuristic |
| 150 | +// permission objects are returned, and each has to carry the display name. |
| 151 | +func TestGetHelmObjectByAppNameAndEnvId_FuturisticPermissionObject(t *testing.T) { |
| 152 | + impl := newTestEnforcerUtil("devtron-demo") |
| 153 | + object, object2 := impl.GetHelmObjectByAppNameAndEnvId("nginx", testEnvId) |
| 154 | + if want := "myproject/devtron-demo/nginx"; object != want { |
| 155 | + t.Errorf("object = %q, want %q", object, want) |
| 156 | + } |
| 157 | + if want := "myproject/" + testClusterName + "__" + testNamespace + "/nginx"; object2 != want { |
| 158 | + t.Errorf("object2 = %q, want %q", object2, want) |
| 159 | + } |
| 160 | +} |
| 161 | + |
| 162 | +// GetHelmObjectByAppNameAndEnvId lowercases its objects, so a mixed case release name still has to line up |
| 163 | +// with the policy that was stored for it. |
| 164 | +func TestGetHelmObjectByAppNameAndEnvId_LowerCased(t *testing.T) { |
| 165 | + envIdentifier := testClusterName + "__" + testNamespace |
| 166 | + mixed := &app.App{ |
| 167 | + Id: 4, |
| 168 | + AppName: "MyRelease-" + testNamespace + "-1", |
| 169 | + DisplayName: "MyRelease", |
| 170 | + TeamId: 2, |
| 171 | + Team: teamRepo.Team{Name: "MyProject"}, |
| 172 | + } |
| 173 | + impl := newTestEnforcerUtil(envIdentifier) |
| 174 | + impl.appRepo.(*stubAppRepo).byName[mixed.AppName] = mixed |
| 175 | + |
| 176 | + object, _ := impl.GetHelmObjectByAppNameAndEnvId("MyRelease", testEnvId) |
| 177 | + if want := "myproject/" + envIdentifier + "/myrelease"; object != want { |
| 178 | + t.Errorf("object = %q, want %q", object, want) |
| 179 | + } |
| 180 | +} |
| 181 | + |
| 182 | +func TestGetHelmObject(t *testing.T) { |
| 183 | + envIdentifier := testClusterName + "__" + testNamespace |
| 184 | + impl := newTestEnforcerUtil(envIdentifier) |
| 185 | + |
| 186 | + // app id lookup always succeeded, but the object used to be built from app_name (the unique identifier) |
| 187 | + object, _ := impl.GetHelmObject(1, testEnvId) |
| 188 | + if want := "myproject/" + envIdentifier + "/nginx"; object != want { |
| 189 | + t.Errorf("object = %q, want %q", object, want) |
| 190 | + } |
| 191 | + |
| 192 | + object, _ = impl.GetHelmObject(2, testEnvId) |
| 193 | + if want := teamRepo.UNASSIGNED_PROJECT + "/" + envIdentifier + "/redis"; object != want { |
| 194 | + t.Errorf("object = %q, want %q", object, want) |
| 195 | + } |
| 196 | + |
| 197 | + object, _ = impl.GetHelmObject(3, testEnvId) |
| 198 | + if want := "myproject/" + envIdentifier + "/grafana"; object != want { |
| 199 | + t.Errorf("object = %q, want %q", object, want) |
| 200 | + } |
| 201 | +} |
| 202 | + |
| 203 | +func TestGetAppNameForRbac(t *testing.T) { |
| 204 | + external := &app.App{AppName: "nginx-devtron-demo-1", DisplayName: "nginx"} |
| 205 | + if got := external.GetAppNameForRbac(); got != "nginx" { |
| 206 | + t.Errorf("GetAppNameForRbac() = %q, want %q", got, "nginx") |
| 207 | + } |
| 208 | + regular := &app.App{AppName: "grafana"} |
| 209 | + if got := regular.GetAppNameForRbac(); got != "grafana" { |
| 210 | + t.Errorf("GetAppNameForRbac() = %q, want %q", got, "grafana") |
| 211 | + } |
| 212 | +} |
0 commit comments