mirror of https://github.com/aptly-dev/aptly
82 lines
3.4 KiB
Go
82 lines
3.4 KiB
Go
package deb
|
|
|
|
import (
|
|
"github.com/aptly-dev/aptly/pgp"
|
|
. "gopkg.in/check.v1"
|
|
)
|
|
|
|
type UploadersSuite struct {
|
|
}
|
|
|
|
var _ = Suite(&UploadersSuite{})
|
|
|
|
func (s *UploadersSuite) TestExpandGroups(c *C) {
|
|
u := &Uploaders{
|
|
Groups: map[string][]string{
|
|
"group1": {"key1", "group2"},
|
|
"group2": {"key1", "key2", "key3", "group3"},
|
|
"group3": {},
|
|
"group4": {"key1", "group5"},
|
|
"group6": {"key1", "group8"},
|
|
"group7": {"key2", "group6"},
|
|
"group8": {"group7"},
|
|
},
|
|
}
|
|
|
|
c.Check(u.ExpandGroups([]string{"group1"}), DeepEquals, []string{"key1", "key2", "key3"})
|
|
c.Check(u.ExpandGroups([]string{"group2"}), DeepEquals, []string{"key1", "key2", "key3"})
|
|
c.Check(u.ExpandGroups([]string{"group3"}), DeepEquals, []string{})
|
|
c.Check(u.ExpandGroups([]string{"group4"}), DeepEquals, []string{"key1", "group5"})
|
|
c.Check(u.ExpandGroups([]string{"group6"}), DeepEquals, []string{"key1", "key2"})
|
|
c.Check(u.ExpandGroups([]string{"group7"}), DeepEquals, []string{"key2", "key1"})
|
|
c.Check(u.ExpandGroups([]string{"group8"}), DeepEquals, []string{"key2", "key1"})
|
|
}
|
|
|
|
func (s *UploadersSuite) TestIsAllowed(c *C) {
|
|
u := &Uploaders{
|
|
Groups: map[string][]string{
|
|
"group1": {"37E1C17570096AD1", "EC4B033C70096AD1"},
|
|
},
|
|
Rules: []UploadersRule{
|
|
{
|
|
CompiledCondition: &FieldQuery{Field: "Source", Relation: VersionEqual, Value: "calamares"},
|
|
Allow: []string{"*"},
|
|
},
|
|
{
|
|
CompiledCondition: &FieldQuery{Field: "Source", Relation: VersionEqual, Value: "never-calamares"},
|
|
Deny: []string{"*"},
|
|
},
|
|
{
|
|
CompiledCondition: &FieldQuery{Field: "Source", Relation: VersionEqual, Value: "some-calamares"},
|
|
Allow: []string{"group1", "12345678"},
|
|
},
|
|
{
|
|
CompiledCondition: &FieldQuery{Field: "Source", Relation: VersionEqual, Value: "some-calamares"},
|
|
Deny: []string{"45678901", "12345678"},
|
|
},
|
|
},
|
|
}
|
|
|
|
// no keys - not allowed
|
|
c.Check(u.IsAllowed(&Changes{SignatureKeys: []pgp.Key{}, Stanza: Stanza{"Source": "calamares"}}), ErrorMatches, "denied as no rule matches")
|
|
|
|
// no rule - not allowed
|
|
c.Check(u.IsAllowed(&Changes{SignatureKeys: []pgp.Key{"37E1C17570096AD1", "EC4B033C70096AD1"}, Stanza: Stanza{"Source": "unknown-calamares"}}), ErrorMatches, "denied as no rule matches")
|
|
|
|
// first rule: allow anyone do stuff with calamares
|
|
c.Check(u.IsAllowed(&Changes{SignatureKeys: []pgp.Key{"ABCD1234", "1234ABCD"}, Stanza: Stanza{"Source": "calamares"}}), IsNil)
|
|
|
|
// second rule: nobody is allowed to do stuff with never-calamares
|
|
c.Check(u.IsAllowed(&Changes{SignatureKeys: []pgp.Key{"ABCD1234", "1234ABCD"}, Stanza: Stanza{"Source": "never-calamares"}}),
|
|
ErrorMatches, "denied according to rule: {\"condition\":\"\",\"allow\":null,\"deny\":\\[\"\\*\"\\]}")
|
|
|
|
// third rule: anyone from the group or explicit key
|
|
c.Check(u.IsAllowed(&Changes{SignatureKeys: []pgp.Key{"45678901", "12345678"}, Stanza: Stanza{"Source": "some-calamares"}}), IsNil)
|
|
c.Check(u.IsAllowed(&Changes{SignatureKeys: []pgp.Key{"37E1C17570096AD1"}, Stanza: Stanza{"Source": "some-calamares"}}), IsNil)
|
|
c.Check(u.IsAllowed(&Changes{SignatureKeys: []pgp.Key{"70096AD1"}, Stanza: Stanza{"Source": "some-calamares"}}), IsNil)
|
|
|
|
// fourth rule: some are not allowed
|
|
c.Check(u.IsAllowed(&Changes{SignatureKeys: []pgp.Key{"ABCD1234", "45678901"}, Stanza: Stanza{"Source": "some-calamares"}}),
|
|
ErrorMatches, "denied according to rule: {\"condition\":\"\",\"allow\":null,\"deny\":\\[\"45678901\",\"12345678\"\\]}")
|
|
}
|