mirror of
https://github.com/mattermost/mattermost-mobile.git
synced 2026-11-07 19:30:14 +00:00
287db3bd17
* Remove BoR quick action on ABAC permission denial
* Update Render Permission to support handling for ABAC servers that do not yet support a particular permision action - they will be treated as "unenforced"
* detox - allow skipping of tests on permission policy actions that are not supported by the test server yet
(cherry picked from commit 16c5849eb6)
Co-authored-by: Nate Schlossberg <nate.schlossberg@mattermost.com>
47 lines
2.5 KiB
TypeScript
47 lines
2.5 KiB
TypeScript
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
|
|
// See LICENSE.txt for license information.
|
|
|
|
import {RenderPermissionAction} from '@constants/access_control';
|
|
|
|
import {resolveRenderPermission, shouldFetchRenderPermissions} from './render_permissions';
|
|
|
|
const upload = RenderPermissionAction.UploadFileAttachment;
|
|
const denied = {epoch: 5, decisions: {[upload]: {allowed: false, evaluated: true}}};
|
|
|
|
describe('resolveRenderPermission', () => {
|
|
it('should return the default while ABAC is not enforced, even with a stored deny', () => {
|
|
expect(resolveRenderPermission(false, denied, upload, true)).toBe(true);
|
|
});
|
|
|
|
it('should keep rendering the last decision while it is revalidated', () => {
|
|
expect(resolveRenderPermission(true, denied, upload, true)).toBe(false);
|
|
expect(resolveRenderPermission(true, {...denied, expired: true}, upload, true)).toBe(false);
|
|
});
|
|
|
|
it('should return the not evaluated value for a decision the server did not evaluate', () => {
|
|
const notEvaluated = {epoch: 5, decisions: {[upload]: {allowed: false, evaluated: false}}};
|
|
expect(resolveRenderPermission(true, notEvaluated, upload, true)).toBe(true);
|
|
expect(resolveRenderPermission(true, notEvaluated, upload, true, false)).toBe(false);
|
|
});
|
|
|
|
it('should return the unenforced value for an action the server answered without, as it does not govern it', () => {
|
|
expect(resolveRenderPermission(true, {epoch: 5, decisions: {}}, upload, true, false)).toBe(true);
|
|
expect(resolveRenderPermission(true, {epoch: 5, decisions: {}}, upload, false, true)).toBe(false);
|
|
});
|
|
|
|
it('should tell not enforced apart from not evaluated yet when the caller sets both', () => {
|
|
expect(resolveRenderPermission(false, undefined, upload, true, false)).toBe(true);
|
|
expect(resolveRenderPermission(true, undefined, upload, true, false)).toBe(false);
|
|
});
|
|
});
|
|
|
|
describe('shouldFetchRenderPermissions', () => {
|
|
it('should only ask while ABAC is enforced and the stored decisions are missing, expired or predate an invalidation', () => {
|
|
expect(shouldFetchRenderPermissions(false, 5)).toBe(false);
|
|
expect(shouldFetchRenderPermissions(true, 5)).toBe(true);
|
|
expect(shouldFetchRenderPermissions(true, 5, denied)).toBe(false);
|
|
expect(shouldFetchRenderPermissions(true, 5, {...denied, expired: true})).toBe(true);
|
|
expect(shouldFetchRenderPermissions(true, 6, denied)).toBe(true);
|
|
});
|
|
});
|