Edouard Vanbelle
416 lines
16 KiB
Plaintext
416 lines
16 KiB
Plaintext
# =============================================================
|
|
# OxiCloud — ReBAC subject groups (POST/GET/PATCH/DELETE /api/groups)
|
|
# =============================================================
|
|
# Exercises:
|
|
# • Admin-only gate on mutations (403 for non-admin)
|
|
# • CRUD happy path (create / list / get / rename / delete)
|
|
# • RFC 5321 name validation (400 on invalid names)
|
|
# • Membership add/remove (users + nested groups)
|
|
# • Cycle prevention (400 on circular reference)
|
|
# • Authorization cascade: a user reaches a resource through group
|
|
# membership (the headline feature)
|
|
# • Authenticated /api/groups/search (non-admin can search)
|
|
#
|
|
# Runs after permissions.hurl + grants.hurl (alice = admin, bob = user).
|
|
# Self-contained group names ("grp-...-hurl") so it doesn't depend on
|
|
# external state and won't collide with other test files.
|
|
# =============================================================
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# Step 1 — Login as admin (alice) + create a second user (grace).
|
|
# ─────────────────────────────────────────────────────────────
|
|
POST {{base_url}}/api/auth/login
|
|
Content-Type: application/json
|
|
{ "username": "{{username}}", "password": "{{password}}" }
|
|
|
|
HTTP 200
|
|
[Captures]
|
|
alice_token: jsonpath "$.access_token"
|
|
|
|
POST {{base_url}}/api/admin/users
|
|
Authorization: Bearer {{alice_token}}
|
|
Content-Type: application/json
|
|
{ "username": "grace", "password": "GracePassword1!", "email": "grace@example.com", "role": "user" }
|
|
|
|
HTTP 201
|
|
[Captures]
|
|
grace_user_id: jsonpath "$.user.id"
|
|
|
|
POST {{base_url}}/api/auth/login
|
|
Content-Type: application/json
|
|
{ "username": "grace", "password": "GracePassword1!" }
|
|
|
|
HTTP 200
|
|
[Captures]
|
|
grace_token: jsonpath "$.access_token"
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# Step 2 — Non-admin cannot create groups (403).
|
|
# ─────────────────────────────────────────────────────────────
|
|
POST {{base_url}}/api/groups
|
|
Authorization: Bearer {{grace_token}}
|
|
Content-Type: application/json
|
|
{ "name": "grp-forbidden-hurl" }
|
|
|
|
HTTP 403
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# Step 3 — RFC 5321 name validation: space, leading dot, non-ASCII rejected.
|
|
# ─────────────────────────────────────────────────────────────
|
|
POST {{base_url}}/api/groups
|
|
Authorization: Bearer {{alice_token}}
|
|
Content-Type: application/json
|
|
{ "name": "grp with space" }
|
|
|
|
HTTP 400
|
|
|
|
POST {{base_url}}/api/groups
|
|
Authorization: Bearer {{alice_token}}
|
|
Content-Type: application/json
|
|
{ "name": ".leadingdot" }
|
|
|
|
HTTP 400
|
|
|
|
POST {{base_url}}/api/groups
|
|
Authorization: Bearer {{alice_token}}
|
|
Content-Type: application/json
|
|
{ "name": "équipe" }
|
|
|
|
HTTP 400
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# Step 4 — CRUD happy path: create + list + get + rename.
|
|
# ─────────────────────────────────────────────────────────────
|
|
POST {{base_url}}/api/groups
|
|
Authorization: Bearer {{alice_token}}
|
|
Content-Type: application/json
|
|
{ "name": "grp-engineers-hurl", "description": "engineering team" }
|
|
|
|
HTTP 201
|
|
[Captures]
|
|
engineers_id: jsonpath "$.id"
|
|
[Asserts]
|
|
jsonpath "$.name" == "grp-engineers-hurl"
|
|
jsonpath "$.is_virtual" == false
|
|
jsonpath "$.member_count" == 0
|
|
jsonpath "$.can_manage" == true
|
|
|
|
# Duplicate name rejected (case-insensitive via CITEXT).
|
|
POST {{base_url}}/api/groups
|
|
Authorization: Bearer {{alice_token}}
|
|
Content-Type: application/json
|
|
{ "name": "Grp-Engineers-Hurl" }
|
|
|
|
HTTP 409
|
|
|
|
# GET by id.
|
|
GET {{base_url}}/api/groups/{{engineers_id}}
|
|
Authorization: Bearer {{alice_token}}
|
|
|
|
HTTP 200
|
|
[Asserts]
|
|
jsonpath "$.id" == "{{engineers_id}}"
|
|
jsonpath "$.name" == "grp-engineers-hurl"
|
|
|
|
# Rename.
|
|
PATCH {{base_url}}/api/groups/{{engineers_id}}
|
|
Authorization: Bearer {{alice_token}}
|
|
Content-Type: application/json
|
|
{ "name": "grp-engineering-hurl" }
|
|
|
|
HTTP 200
|
|
[Asserts]
|
|
jsonpath "$.name" == "grp-engineering-hurl"
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# Step 5 — Add grace as a member of the group.
|
|
# ─────────────────────────────────────────────────────────────
|
|
POST {{base_url}}/api/groups/{{engineers_id}}/members
|
|
Authorization: Bearer {{alice_token}}
|
|
Content-Type: application/json
|
|
{ "user_id": "{{grace_user_id}}" }
|
|
|
|
HTTP 201
|
|
|
|
# GET the group again — member_count now reflects the add.
|
|
GET {{base_url}}/api/groups/{{engineers_id}}
|
|
Authorization: Bearer {{alice_token}}
|
|
|
|
HTTP 200
|
|
[Asserts]
|
|
jsonpath "$.member_count" == 1
|
|
|
|
# List members shows grace.
|
|
GET {{base_url}}/api/groups/{{engineers_id}}/members
|
|
Authorization: Bearer {{alice_token}}
|
|
|
|
HTTP 200
|
|
[Asserts]
|
|
jsonpath "$[*].kind" contains "user"
|
|
jsonpath "$[*].id" contains "{{grace_user_id}}"
|
|
|
|
# Idempotency: adding the same member twice is rejected with 409.
|
|
POST {{base_url}}/api/groups/{{engineers_id}}/members
|
|
Authorization: Bearer {{alice_token}}
|
|
Content-Type: application/json
|
|
{ "user_id": "{{grace_user_id}}" }
|
|
|
|
HTTP 409
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# Step 6 — Cycle prevention: nest engineering inside qa, then try the loop.
|
|
# ─────────────────────────────────────────────────────────────
|
|
POST {{base_url}}/api/groups
|
|
Authorization: Bearer {{alice_token}}
|
|
Content-Type: application/json
|
|
{ "name": "grp-qa-hurl" }
|
|
|
|
HTTP 201
|
|
[Captures]
|
|
qa_id: jsonpath "$.id"
|
|
|
|
# Add engineering as a member of qa (qa ∋ engineering).
|
|
POST {{base_url}}/api/groups/{{qa_id}}/members
|
|
Authorization: Bearer {{alice_token}}
|
|
Content-Type: application/json
|
|
{ "group_id": "{{engineers_id}}" }
|
|
|
|
HTTP 201
|
|
|
|
# Now try the reverse — engineering ∋ qa — should be rejected as a cycle.
|
|
POST {{base_url}}/api/groups/{{engineers_id}}/members
|
|
Authorization: Bearer {{alice_token}}
|
|
Content-Type: application/json
|
|
{ "group_id": "{{qa_id}}" }
|
|
|
|
HTTP 400
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# Step 7 — Authorization cascade through the group.
|
|
#
|
|
# Alice creates a folder, grants read to the engineering group;
|
|
# grace (a transitive member via engineering ⊆ qa) reaches the folder.
|
|
# ─────────────────────────────────────────────────────────────
|
|
GET {{base_url}}/api/folders
|
|
Authorization: Bearer {{alice_token}}
|
|
|
|
HTTP 200
|
|
[Captures]
|
|
alice_home_id: jsonpath "$[0].id"
|
|
|
|
POST {{base_url}}/api/folders
|
|
Authorization: Bearer {{alice_token}}
|
|
Content-Type: application/json
|
|
{ "name": "grp-shared-hurl", "parent_id": "{{alice_home_id}}" }
|
|
|
|
HTTP 201
|
|
[Captures]
|
|
shared_folder_id: jsonpath "$.id"
|
|
|
|
# Grant read to the engineering group on this folder.
|
|
POST {{base_url}}/api/grants
|
|
Authorization: Bearer {{alice_token}}
|
|
Content-Type: application/json
|
|
{
|
|
"subject": { "type": "group", "id": "{{engineers_id}}" },
|
|
"resource": { "type": "folder", "id": "{{shared_folder_id}}" },
|
|
"role": "viewer"
|
|
}
|
|
|
|
HTTP 201
|
|
|
|
# Grace (a member of engineering) can now list the folder's contents.
|
|
GET {{base_url}}/api/folders/{{shared_folder_id}}
|
|
Authorization: Bearer {{grace_token}}
|
|
|
|
HTTP 200
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# Step 8 — Self-defense on group remove_member.
|
|
# A group must not drop to 0 transitive users once seeded —
|
|
# without this guard, an admin could empty a group that owns
|
|
# a shared drive (D3a), leaving the drive with no effective
|
|
# Owner. Conservative-by-default: the rule applies to every
|
|
# group, not just drive-owning ones.
|
|
#
|
|
# So the first attempt to remove grace (the sole member) is
|
|
# refused with 400. We then seed the group with a second user,
|
|
# re-attempt the removal, and assert it now succeeds — the
|
|
# authz cascade tests below depend on grace being out of the
|
|
# group.
|
|
#
|
|
# Note: the authz cache has a 30s TTL — Hurl tests run within
|
|
# seconds so grace may still see the folder during the cache
|
|
# window. We assert the membership removal succeeded; the
|
|
# post-TTL denial is exercised by the Rust integration tests,
|
|
# not here (test runtime cost).
|
|
# ─────────────────────────────────────────────────────────────
|
|
# 8a — First removal refused: grace is the sole transitive user.
|
|
DELETE {{base_url}}/api/groups/{{engineers_id}}/members/user/{{grace_user_id}}
|
|
Authorization: Bearer {{alice_token}}
|
|
|
|
HTTP 400
|
|
|
|
|
|
# 8b — Seed engineering with a second user so the removal can succeed.
|
|
POST {{base_url}}/api/admin/users
|
|
Authorization: Bearer {{alice_token}}
|
|
Content-Type: application/json
|
|
{ "username": "grp_helper", "password": "GrpHelperPwd1!", "email": "grp_helper@example.com", "role": "user" }
|
|
|
|
HTTP 201
|
|
[Captures]
|
|
helper_user_id: jsonpath "$.user.id"
|
|
|
|
|
|
POST {{base_url}}/api/groups/{{engineers_id}}/members
|
|
Authorization: Bearer {{alice_token}}
|
|
Content-Type: application/json
|
|
{ "user_id": "{{helper_user_id}}" }
|
|
|
|
HTTP 201
|
|
|
|
|
|
# 8c — Grace removal now succeeds: engineering still has grp_helper.
|
|
DELETE {{base_url}}/api/groups/{{engineers_id}}/members/user/{{grace_user_id}}
|
|
Authorization: Bearer {{alice_token}}
|
|
|
|
HTTP 204
|
|
|
|
|
|
# 8d — Confirming the invariant still holds: removing the last user
|
|
# (grp_helper) is again refused.
|
|
DELETE {{base_url}}/api/groups/{{engineers_id}}/members/user/{{helper_user_id}}
|
|
Authorization: Bearer {{alice_token}}
|
|
|
|
HTTP 400
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# Step 9 — Authenticated /api/groups/search (no admin role required).
|
|
# ─────────────────────────────────────────────────────────────
|
|
GET {{base_url}}/api/groups/search?q=engineering
|
|
Authorization: Bearer {{grace_token}}
|
|
|
|
HTTP 200
|
|
[Asserts]
|
|
jsonpath "$[*].name" contains "grp-engineering-hurl"
|
|
|
|
# Virtual groups (Internal, future Everyone, …) are surfaced by the
|
|
# share-target search so they can be selected as grant subjects.
|
|
# Ordering puts virtuals first; see `subject_group_pg_repository::list`.
|
|
GET {{base_url}}/api/groups/search?q=Internal
|
|
Authorization: Bearer {{grace_token}}
|
|
|
|
HTTP 200
|
|
[Asserts]
|
|
jsonpath "$[*].name" contains "Internal"
|
|
jsonpath "$[?(@.name=='Internal')].is_virtual" == true
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# Step 10 — Internal virtual group is immutable.
|
|
# ─────────────────────────────────────────────────────────────
|
|
# Internal group's well-known UUID is 00000000-0000-0000-0000-000000000001.
|
|
POST {{base_url}}/api/groups/00000000-0000-0000-0000-000000000001/members
|
|
Authorization: Bearer {{alice_token}}
|
|
Content-Type: application/json
|
|
{ "user_id": "{{grace_user_id}}" }
|
|
|
|
HTTP 403
|
|
|
|
DELETE {{base_url}}/api/groups/00000000-0000-0000-0000-000000000001
|
|
Authorization: Bearer {{alice_token}}
|
|
|
|
HTTP 403
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# Step 11 — Sole-Owner group-delete guard (D3b).
|
|
#
|
|
# A group that is the only `Role::Owner` of a shared drive must NOT be
|
|
# deletable — wiping it would orphan the drive (no live Owner grant
|
|
# left). Symmetric to the last-owner-protection rule on `set_role` /
|
|
# `remove_member` from the membership API side; this guard catches
|
|
# the same invariant from the group-lifecycle side.
|
|
#
|
|
# Setup: admin creates a shared drive owned by `grp-engineering-hurl`,
|
|
# then tries to delete the group. Refused with 409. Promote a second
|
|
# Owner (a user), then the group delete succeeds.
|
|
# ─────────────────────────────────────────────────────────────
|
|
POST {{base_url}}/api/drives
|
|
Authorization: Bearer {{alice_token}}
|
|
Content-Type: application/json
|
|
{
|
|
"kind": "shared",
|
|
"name": "grp-guarded-drive-hurl",
|
|
"owner": { "type": "group", "id": "{{engineers_id}}" }
|
|
}
|
|
|
|
HTTP 201
|
|
[Captures]
|
|
guarded_drive_id: jsonpath "$.id"
|
|
|
|
|
|
# 11a — Group delete refused while it's the sole Owner of the drive.
|
|
DELETE {{base_url}}/api/groups/{{engineers_id}}
|
|
Authorization: Bearer {{alice_token}}
|
|
|
|
HTTP 409
|
|
|
|
|
|
# 11b — Add Grace as a co-Owner of the drive via the admin endpoint.
|
|
# Alice (the OxiCloud admin) created the drive but doesn't
|
|
# auto-grant herself a role on it, so she lacks `Manage` on the
|
|
# user-facing `/api/drives/{id}/members` — the admin route
|
|
# bypasses that check for exactly this case.
|
|
POST {{base_url}}/api/admin/drives/{{guarded_drive_id}}/members
|
|
Authorization: Bearer {{alice_token}}
|
|
Content-Type: application/json
|
|
{
|
|
"subject": { "type": "user", "id": "{{grace_user_id}}" },
|
|
"role": "owner"
|
|
}
|
|
|
|
HTTP 201
|
|
|
|
|
|
# 11c — Group delete now succeeds — the drive still has Grace as Owner.
|
|
DELETE {{base_url}}/api/groups/{{engineers_id}}
|
|
Authorization: Bearer {{alice_token}}
|
|
|
|
HTTP 204
|
|
|
|
|
|
# 11d — Cleanup: trash the drive (no content) so subsequent test files
|
|
# don't see a dangling shared drive. After 11c, Grace is the
|
|
# only remaining Owner via her direct grant, so she's the one
|
|
# who can delete via the user-facing route.
|
|
DELETE {{base_url}}/api/drives/{{guarded_drive_id}}
|
|
Authorization: Bearer {{grace_token}}
|
|
|
|
HTTP 204
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# Step 12 — Cleanup: delete qa group.
|
|
# ─────────────────────────────────────────────────────────────
|
|
DELETE {{base_url}}/api/groups/{{qa_id}}
|
|
Authorization: Bearer {{alice_token}}
|
|
|
|
HTTP 204
|
|
|
|
# Confirm gone.
|
|
GET {{base_url}}/api/groups/{{engineers_id}}
|
|
Authorization: Bearer {{alice_token}}
|
|
|
|
HTTP 404
|