fix(rbac): fix service to service requests for RBAC CRUD (#886)

* fix(rbac): fix service to service requests for RBAC CRUD Signed-off-by: Oleksandr Andriienko <[email protected]> * fix(rbac): limit service to service requests to only read operations Signed-off-by: Oleksandr Andriienko <[email protected]> * fix(rbac): fix compilation after rebase Signed-off-by: Oleksandr Andriienko <[email protected]> --------- Signed-off-by: Oleksandr Andriienko <[email protected]>
janus-idp · Oct 30, 2023 · 0b72d73 · 0b72d73
1 parent 307c913
commit 0b72d73
Show file tree

Hide file tree

Showing 2 changed files with 71 additions and 136 deletions.
diff --git a/plugins/rbac-backend/src/service/policies-rest-api.test.ts b/plugins/rbac-backend/src/service/policies-rest-api.test.ts
@@ -179,6 +179,7 @@ describe('REST policies api', () => {
 
       expect(result.status).toBe(200);
       expect(result.body).toEqual({ status: 'Authorized' });
+      expect(mockIdentityClient.getIdentity).toHaveBeenCalledTimes(0);
     });
 
     it('should return a status of Unauthorized', async () => {
@@ -287,6 +288,7 @@ describe('REST policies api', () => {
       });
 
       expect(result.statusCode).toBe(201);
+      expect(mockIdentityClient.getIdentity).toHaveBeenCalledTimes(1);
     });
 
     it('should not be created permission policy, because it is has been already present', async () => {
@@ -357,6 +359,7 @@ describe('REST policies api', () => {
           effect: 'allow',
         },
       ]);
+      expect(mockIdentityClient.getIdentity).toHaveBeenCalledTimes(0);
     });
     it('should be returned policies by user reference not found', async () => {
       mockEnforcer.getFilteredPolicy = jest
@@ -423,6 +426,7 @@ describe('REST policies api', () => {
           effect: 'allow',
         },
       ]);
+      expect(mockIdentityClient.getIdentity).toHaveBeenCalledTimes(0);
     });
     it('should be returned list filtered policies', async () => {
       mockEnforcer.getFilteredPolicy = jest
@@ -573,6 +577,7 @@ describe('REST policies api', () => {
         .send();
 
       expect(result.statusCode).toEqual(204);
+      expect(mockIdentityClient.getIdentity).toHaveBeenCalledTimes(1);
     });
   });
 
@@ -925,6 +930,7 @@ describe('REST policies api', () => {
         });
 
       expect(result.statusCode).toEqual(200);
+      expect(mockIdentityClient.getIdentity).toHaveBeenCalledTimes(1);
     });
   });
 
@@ -1012,6 +1018,7 @@ describe('REST policies api', () => {
           name: 'role:default/rbac_admin',
         },
       ]);
+      expect(mockIdentityClient.getIdentity).toHaveBeenCalledTimes(0);
     });
 
     it('should be returned roles by role reference not found', async () => {
@@ -1129,6 +1136,7 @@ describe('REST policies api', () => {
         });
 
       expect(result.statusCode).toBe(201);
+      expect(mockIdentityClient.getIdentity).toHaveBeenCalledTimes(1);
     });
 
     it('should not be created role, because it is has been already present', async () => {
@@ -1409,6 +1417,7 @@ describe('REST policies api', () => {
         });
 
       expect(result.statusCode).toEqual(200);
+      expect(mockIdentityClient.getIdentity).toHaveBeenCalledTimes(1);
     });
 
     it('should update role where newRole has multiple roles', async () => {
@@ -1607,6 +1616,7 @@ describe('REST policies api', () => {
         .send();
 
       expect(result.statusCode).toEqual(204);
+      expect(mockIdentityClient.getIdentity).toHaveBeenCalledTimes(1);
     });
 
     it('should delete a role', async () => {
@@ -1713,6 +1723,7 @@ describe('REST policies api', () => {
         const result = await request(app).get('/conditions').send();
         expect(result.statusCode).toBe(200);
         expect(result.body).toEqual(conditions);
+        expect(mockIdentityClient.getIdentity).toHaveBeenCalledTimes(0);
       });
 
       it('should be returned condition decision by pluginId', async () => {
@@ -1827,6 +1838,7 @@ describe('REST policies api', () => {
         const result = await request(app).delete('/conditions/1').send();
 
         expect(result.statusCode).toEqual(204);
+        expect(mockIdentityClient.getIdentity).toHaveBeenCalledTimes(1);
       });
 
       it('should fail to delete condition decision by id', async () => {
@@ -1899,6 +1911,7 @@ describe('REST policies api', () => {
         const result = await request(app).get('/conditions/1').send();
         expect(result.statusCode).toBe(200);
         expect(result.body).toEqual(condition);
+        expect(mockIdentityClient.getIdentity).toHaveBeenCalledTimes(0);
       });
 
       it('should return return 404', async () => {
@@ -1962,6 +1975,7 @@ describe('REST policies api', () => {
 
         expect(result.statusCode).toBe(201);
         expect(result.body).toEqual({ id: 1 });
+        expect(mockIdentityClient.getIdentity).toHaveBeenCalledTimes(1);
       });
     });
 
@@ -2020,6 +2034,7 @@ describe('REST policies api', () => {
           1,
           conditionDecision,
         );
+        expect(mockIdentityClient.getIdentity).toHaveBeenCalledTimes(1);
       });
     });
   });