2023-07-06 08:25:51 +12:00
|
|
|
defmodule Ash.Test.Policy.FieldPolicyTest do
|
2023-06-23 04:28:39 +12:00
|
|
|
@doc false
|
|
|
|
use ExUnit.Case
|
|
|
|
|
|
|
|
require Ash.Query
|
|
|
|
|
2023-06-23 06:19:40 +12:00
|
|
|
alias Ash.Test.Support.PolicyField.{Api, Ticket, User}
|
2023-06-23 04:28:39 +12:00
|
|
|
|
|
|
|
setup do
|
|
|
|
rep = Api.create!(Ash.Changeset.new(User, %{role: :representative}))
|
|
|
|
user = Api.create!(Ash.Changeset.new(User, %{role: :user}))
|
2023-07-12 02:28:07 +12:00
|
|
|
admin = Api.create!(Ash.Changeset.new(User, %{role: :admin}))
|
2023-06-23 04:28:39 +12:00
|
|
|
other_user = Api.create!(Ash.Changeset.new(User, %{role: :user}))
|
|
|
|
|
|
|
|
[
|
|
|
|
user: user,
|
2023-07-12 02:28:07 +12:00
|
|
|
admin: admin,
|
2023-06-23 04:28:39 +12:00
|
|
|
representative: rep,
|
|
|
|
ticket:
|
|
|
|
Api.create!(Ash.Changeset.new(Ticket, %{representative_id: rep.id, reporter_id: user.id})),
|
|
|
|
other_ticket:
|
|
|
|
Api.create!(
|
|
|
|
Ash.Changeset.new(Ticket, %{representative_id: rep.id, reporter_id: other_user.id})
|
|
|
|
)
|
|
|
|
]
|
|
|
|
end
|
|
|
|
|
|
|
|
describe "introspection" do
|
|
|
|
test "introspection returns field policies" do
|
2023-07-12 02:28:07 +12:00
|
|
|
assert [
|
|
|
|
%Ash.Policy.FieldPolicy{bypass?: true},
|
|
|
|
%Ash.Policy.FieldPolicy{bypass?: false},
|
|
|
|
%Ash.Policy.FieldPolicy{bypass?: false}
|
|
|
|
] =
|
2023-07-11 01:00:55 +12:00
|
|
|
Ash.Policy.Info.field_policies(User)
|
2023-06-23 04:28:39 +12:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
describe "rendering fields" do
|
2023-07-07 02:39:24 +12:00
|
|
|
test "when creating as a user that cannot see the field, its value is not displayed", %{
|
|
|
|
representative: rep,
|
|
|
|
user: user
|
|
|
|
} do
|
|
|
|
assert %Ash.ForbiddenField{field: :internal_status, type: :attribute} ==
|
|
|
|
Ticket
|
2023-07-07 02:58:09 +12:00
|
|
|
|> Ash.Changeset.for_create(
|
|
|
|
:create,
|
|
|
|
%{representative_id: rep.id, reporter_id: user.id, internal_status: :new},
|
|
|
|
authorize?: true,
|
|
|
|
actor: user
|
|
|
|
)
|
2023-07-07 02:39:24 +12:00
|
|
|
|> Api.create!(authorize?: true, actor: user)
|
|
|
|
|> Map.get(:internal_status)
|
|
|
|
end
|
|
|
|
|
2023-06-23 04:28:39 +12:00
|
|
|
test "when reading as a user that can see the field, its value is displayed", %{
|
|
|
|
representative: representative
|
|
|
|
} do
|
|
|
|
assert :representative ==
|
|
|
|
User
|
|
|
|
|> Ash.Query.for_read(:read, authorize?: true, actor: representative)
|
|
|
|
|> Ash.Query.filter(id == ^representative.id)
|
|
|
|
|> Api.read_one!(authorize?: true, actor: representative)
|
|
|
|
|> Map.get(:role)
|
|
|
|
end
|
|
|
|
|
2023-07-12 02:28:07 +12:00
|
|
|
test "bypasses take priority over subsequent policies", %{
|
|
|
|
representative: representative,
|
|
|
|
admin: admin
|
|
|
|
} do
|
|
|
|
assert :representative ==
|
|
|
|
User
|
|
|
|
|> Ash.Query.for_read(:read, authorize?: true, actor: admin)
|
|
|
|
|> Ash.Query.filter(id == ^representative.id)
|
|
|
|
|> Api.read_one!(authorize?: true, actor: admin)
|
|
|
|
|> Map.get(:role)
|
|
|
|
end
|
|
|
|
|
2023-07-11 01:00:55 +12:00
|
|
|
test "can load a resource with a forbidden aggregate", %{
|
|
|
|
representative: representative
|
|
|
|
} do
|
|
|
|
assert %Ash.ForbiddenField{field: :ticket_count, type: :aggregate} ==
|
|
|
|
User
|
|
|
|
|> Ash.Query.for_read(:read, authorize?: true, actor: representative)
|
|
|
|
|> Ash.Query.filter(id == ^representative.id)
|
|
|
|
|> Ash.Query.load([:ticket_count])
|
|
|
|
|> Api.read_one!(authorize?: true, actor: representative)
|
|
|
|
|> Map.get(:ticket_count)
|
|
|
|
end
|
|
|
|
|
2023-06-23 04:28:39 +12:00
|
|
|
test "when reading as a user that cant see the field, its value is not displayed", %{
|
|
|
|
representative: representative,
|
|
|
|
user: user
|
|
|
|
} do
|
|
|
|
assert %Ash.ForbiddenField{field: :role, type: :attribute} ==
|
|
|
|
User
|
|
|
|
|> Ash.Query.for_read(:read, authorize?: true, actor: representative)
|
|
|
|
|> Ash.Query.filter(id == ^representative.id)
|
|
|
|
|> Api.read_one!(authorize?: true, actor: user)
|
|
|
|
|> Map.get(:role)
|
|
|
|
end
|
|
|
|
|
|
|
|
test "when loading as a user that cant see the field, its value is not displayed", %{
|
|
|
|
representative: representative,
|
|
|
|
user: user
|
|
|
|
} do
|
|
|
|
assert %Ash.ForbiddenField{field: :role, type: :attribute} ==
|
|
|
|
User
|
|
|
|
|> Ash.Query.select([])
|
|
|
|
|> Ash.Query.for_read(:read, authorize?: true, actor: representative)
|
|
|
|
|> Ash.Query.filter(id == ^representative.id)
|
|
|
|
|> Api.read_one!(authorize?: true, actor: user)
|
|
|
|
|> Api.load!(:role, authorize?: true)
|
|
|
|
|> Map.get(:role)
|
|
|
|
end
|
|
|
|
|
2023-06-23 08:26:03 +12:00
|
|
|
test "when reading as a user that cant see the field with a `relates_to_actor_via` check, the value is not displayed",
|
|
|
|
%{
|
|
|
|
user: user,
|
|
|
|
ticket: ticket,
|
|
|
|
other_ticket: other_ticket
|
|
|
|
} do
|
|
|
|
Application.put_env(:foo, :bar, true)
|
|
|
|
|
|
|
|
assert nil ==
|
|
|
|
Ticket
|
|
|
|
|> Ash.Query.select(:status)
|
|
|
|
|> Ash.Query.for_read(:read, %{}, authorize?: true, actor: user)
|
|
|
|
|> Ash.Query.filter(id == ^ticket.id)
|
|
|
|
|> Api.read_one!()
|
|
|
|
|> Map.get(:status)
|
|
|
|
|
|
|
|
assert %Ash.ForbiddenField{} =
|
|
|
|
Ticket
|
|
|
|
|> Ash.Query.select(:status)
|
|
|
|
|> Ash.Query.for_read(:read, %{}, authorize?: true, actor: user)
|
|
|
|
|> Ash.Query.filter(id == ^other_ticket.id)
|
|
|
|
|> Api.read_one!()
|
|
|
|
|> Map.get(:status)
|
2023-06-23 04:28:39 +12:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
describe "filters" do
|
|
|
|
test "filters are replaced with the appropriate field policies", %{
|
|
|
|
representative: representative,
|
|
|
|
user: user
|
|
|
|
} do
|
|
|
|
assert [] =
|
|
|
|
User
|
|
|
|
|> Ash.Query.select([])
|
|
|
|
|> Ash.Query.for_read(:read, %{}, authorize?: true, actor: user)
|
|
|
|
|> Ash.Query.filter_input(role: :representative)
|
|
|
|
|> Api.read!(authorize?: true)
|
|
|
|
|
|
|
|
assert [_] =
|
|
|
|
User
|
|
|
|
|> Ash.Query.select([])
|
|
|
|
|> Ash.Query.for_read(:read, %{}, authorize?: true, actor: representative)
|
|
|
|
|> Ash.Query.filter_input(role: :representative)
|
|
|
|
|> Api.read!(authorize?: true)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|