mirror of https://gitee.com/bigwinds/arangodb
530 lines
19 KiB
JavaScript
530 lines
19 KiB
JavaScript
/* jshint globalstrict:true, strict:true, maxlen: 5000 */
|
|
/* global assertEqual, assertTrue, assertFalse, assertFail */
|
|
|
|
// //////////////////////////////////////////////////////////////////////////////
|
|
// / @brief tests for user access rights
|
|
// /
|
|
// / @file
|
|
// /
|
|
// / DISCLAIMER
|
|
// /
|
|
// / Copyright 2018 ArangoDB GmbH, Cologne, Germany
|
|
// /
|
|
// / Licensed under the Apache License, Version 2.0 (the "License");
|
|
// / you may not use this file except in compliance with the License.
|
|
// / You may obtain a copy of the License at
|
|
// /
|
|
// / http://www.apache.org/licenses/LICENSE-2.0
|
|
// /
|
|
// / Unless required by applicable law or agreed to in writing, software
|
|
// / distributed under the License is distributed on an "AS IS" BASIS,
|
|
// / WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// / See the License for the specific language governing permissions and
|
|
// / limitations under the License.
|
|
// /
|
|
// / Copyright holder is ArangoDB GmbH, Cologne, Germany
|
|
// /
|
|
// / @author Vadim Kondratyev
|
|
// / @author Copyright 2018, ArangoDB GmbH, Cologne, Germany
|
|
// //////////////////////////////////////////////////////////////////////////////
|
|
|
|
'use strict';
|
|
var jsunity = require('jsunity');
|
|
var analyzers = require("@arangodb/analyzers");
|
|
const testHelper = require('@arangodb/test-helper');
|
|
const isEqual = testHelper.isEqual;
|
|
const deriveTestSuite = testHelper.deriveTestSuite;
|
|
const deriveTestSuiteWithnamespace = testHelper.deriveTestSuiteWithnamespace;
|
|
const users = require('@arangodb/users');
|
|
const helper = require('@arangodb/user-helper');
|
|
const tasks = require('@arangodb/tasks');
|
|
const pu = require('@arangodb/process-utils');
|
|
const download = require('internal').download;
|
|
const errors = require('@arangodb').errors;
|
|
const db = require('@arangodb').db;
|
|
const namePrefix = helper.namePrefix;
|
|
const dbName = helper.dbName;
|
|
const rightLevels = helper.rightLevels;
|
|
const testViewName = `${namePrefix}ViewNew`;
|
|
const testViewRename = `${namePrefix}ViewRename`;
|
|
const testViewType = "arangosearch";
|
|
const testCol1Name = `${namePrefix}Col1New`;
|
|
const testCol2Name = `${namePrefix}Col2New`;
|
|
const keySpaceId = 'task_update_view_keyspace';
|
|
const userSet = helper.userSet;
|
|
const systemLevel = helper.systemLevel;
|
|
const dbLevel = helper.dbLevel;
|
|
const colLevel = helper.colLevel;
|
|
|
|
const arango = require('internal').arango;
|
|
for (let l of rightLevels) {
|
|
systemLevel[l] = new Set();
|
|
dbLevel[l] = new Set();
|
|
colLevel[l] = new Set();
|
|
}
|
|
|
|
const wait = (keySpaceId, key) => {
|
|
for (let i = 0; i < 200; i++) {
|
|
if (getKey(keySpaceId, key)) break;
|
|
require('internal').wait(0.1);
|
|
}
|
|
};
|
|
|
|
const createKeySpace = (keySpaceId) => {
|
|
return executeJS(`return global.KEYSPACE_CREATE('${keySpaceId}', 128, true);`).body === 'true';
|
|
};
|
|
|
|
const dropKeySpace = (keySpaceId) => {
|
|
executeJS(`global.KEYSPACE_DROP('${keySpaceId}');`);
|
|
};
|
|
|
|
const getKey = (keySpaceId, key) => {
|
|
return executeJS(`return global.KEY_GET('${keySpaceId}', '${key}');`).body === 'true';
|
|
};
|
|
|
|
const setKey = (keySpaceId, name) => {
|
|
return executeJS(`global.KEY_SET('${keySpaceId}', '${name}', false);`);
|
|
};
|
|
|
|
const executeJS = (code) => {
|
|
let httpOptions = pu.makeAuthorizationHeaders({
|
|
username: 'root',
|
|
password: ''
|
|
});
|
|
httpOptions.method = 'POST';
|
|
httpOptions.timeout = 1800;
|
|
httpOptions.returnBodyOnError = true;
|
|
return download(arango.getEndpoint().replace('tcp', 'http') + `/_db/${dbName}/_admin/execute?returnAsJSON=true`,
|
|
code,
|
|
httpOptions);
|
|
};
|
|
|
|
|
|
function hasIResearch (db) {
|
|
return !(db._views() === 0); // arangosearch views are not supported
|
|
}
|
|
let name = "";
|
|
function rootTestCollection (colName, switchBack = true) {
|
|
helper.switchUser('root', dbName);
|
|
let col = db._collection(colName);
|
|
if (switchBack) {
|
|
helper.switchUser(name, dbName);
|
|
}
|
|
return col !== null;
|
|
};
|
|
|
|
function rootCreateCollection (colName) {
|
|
if (!rootTestCollection(colName, false)) {
|
|
db._create(colName);
|
|
if (colLevel['none'].has(name)) {
|
|
if (helper.isLdapEnabledExternal()) {
|
|
users.grantCollection(':role:' + name, dbName, colName, 'none');
|
|
} else {
|
|
users.grantCollection(name, dbName, colName, 'none');
|
|
}
|
|
} else if (colLevel['ro'].has(name)) {
|
|
if (helper.isLdapEnabledExternal()) {
|
|
users.grantCollection(':role:' + name, dbName, colName, 'ro');
|
|
} else {
|
|
users.grantCollection(name, dbName, colName, 'ro');
|
|
}
|
|
} else if (colLevel['rw'].has(name)) {
|
|
if (helper.isLdapEnabledExternal()) {
|
|
users.grantCollection(':role:' + name, dbName, colName, 'rw');
|
|
} else {
|
|
users.grantCollection(name, dbName, colName, 'rw');
|
|
}
|
|
}
|
|
}
|
|
helper.switchUser(name, dbName);
|
|
};
|
|
|
|
function rootPrepareCollection (colName, numDocs = 1, defKey = true) {
|
|
if (rootTestCollection(colName, false)) {
|
|
db._collection(colName).truncate({ compact: false });
|
|
for(var i = 0; i < numDocs; ++i)
|
|
{
|
|
var doc = {prop1: colName + "_1", propI: i, plink: "lnk" + i};
|
|
if (!defKey) {
|
|
doc._key = colName + i;
|
|
}
|
|
db._collection(colName).save(doc, {waitForSync: true});
|
|
}
|
|
}
|
|
helper.switchUser(name, dbName);
|
|
};
|
|
|
|
function rootGrantCollection (colName, user, explicitRight = '') {
|
|
if (rootTestCollection(colName, false)) {
|
|
if (explicitRight !== '' && rightLevels.includes(explicitRight))
|
|
{
|
|
if (helper.isLdapEnabledExternal()) {
|
|
users.grantCollection(':role:' + user, dbName, colName, explicitRight);
|
|
} else {
|
|
users.grantCollection(user, dbName, colName, explicitRight);
|
|
}
|
|
}
|
|
}
|
|
helper.switchUser(user, dbName);
|
|
};
|
|
|
|
function rootDropCollection (colName) {
|
|
helper.switchUser('root', dbName);
|
|
try {
|
|
db._collection(colName).drop();
|
|
} catch (ignored) { }
|
|
helper.switchUser(name, dbName);
|
|
};
|
|
|
|
function rootTestView (viewName, switchBack = true) {
|
|
helper.switchUser('root', dbName);
|
|
let view = db._view(viewName);
|
|
if (switchBack) {
|
|
helper.switchUser(name, dbName);
|
|
}
|
|
return view !== null;
|
|
};
|
|
|
|
function rootGetViewProps (viewName, switchBack = true) {
|
|
helper.switchUser('root', dbName);
|
|
let properties = db._view(viewName).properties();
|
|
if (switchBack) {
|
|
helper.switchUser(name, dbName);
|
|
}
|
|
return properties;
|
|
};
|
|
|
|
function rootCreateView (viewName, properties = null) {
|
|
if (rootTestView(viewName, false)) {
|
|
try {
|
|
db._dropView(viewName);
|
|
} catch (ignored) {}
|
|
}
|
|
let view = db._createView(viewName, testViewType, {});
|
|
if (properties !== null) {
|
|
view.properties(properties, false);
|
|
}
|
|
helper.switchUser(name, dbName);
|
|
};
|
|
|
|
function rootGetDefaultViewProps () {
|
|
helper.switchUser('root', dbName);
|
|
try {
|
|
var tmpView = db._createView(this.title + "_tmpView", testViewType, {});
|
|
var properties = tmpView.properties();
|
|
db._dropView(this.title + "_tmpView");
|
|
} catch (ignored) { }
|
|
helper.switchUser(name, dbName);
|
|
return properties;
|
|
};
|
|
|
|
function rootDropView (viewName) {
|
|
helper.switchUser('root', dbName);
|
|
try {
|
|
db._dropView(viewName);
|
|
} catch (ignored) { }
|
|
helper.switchUser(name, dbName);
|
|
};
|
|
|
|
const checkError = (e) => {
|
|
assertEqual(e.code, 403, "Expected to get forbidden REST error code, but got another one");
|
|
assertEqual(e.errorNum, errors.ERROR_FORBIDDEN.code, "Expected to get forbidden error number, but got another one");
|
|
};
|
|
|
|
function UserRightsManagement(name) {
|
|
|
|
return {
|
|
setUpAll: function() {
|
|
helper.switchUser(name, dbName);
|
|
db._useDatabase(dbName);
|
|
assertEqual(createKeySpace(keySpaceId), true, 'keySpace creation failed for user: ' + name);
|
|
rootCreateCollection(testCol1Name);
|
|
rootCreateCollection(testCol2Name);
|
|
rootPrepareCollection(testCol1Name);
|
|
rootPrepareCollection(testCol2Name);
|
|
},
|
|
|
|
setUp: function() {
|
|
rootCreateView(testViewName, { links: { [testCol1Name] : {includeAllFields: true } } });
|
|
helper.switchUser('root', dbName);
|
|
},
|
|
|
|
tearDownAll: function() {
|
|
rootDropCollection(testCol1Name);
|
|
rootDropCollection(testCol2Name);
|
|
|
|
dropKeySpace(keySpaceId);
|
|
},
|
|
tearDown: function() {
|
|
rootDropView(testViewRename);
|
|
rootDropView(testViewName);
|
|
},
|
|
|
|
testCheckAllUsersAreCreated: function() {
|
|
helper.switchUser('root', '_system');
|
|
assertTrue(userSet.size > 0);
|
|
assertEqual(userSet.size, helper.userCount);
|
|
for (let name of userSet) {
|
|
assertTrue(users.document(name) !== undefined, `Could not find user: ${name}`);
|
|
}
|
|
}
|
|
};
|
|
};
|
|
|
|
|
|
if (hasIResearch(db)) {
|
|
helper.switchUser('root', '_system');
|
|
helper.removeAllUsers();
|
|
helper.generateAllUsers();
|
|
|
|
jsunity.run(function(){
|
|
let suite = {};
|
|
|
|
deriveTestSuite(
|
|
UserRightsManagement(name),
|
|
suite,
|
|
"_-_" + name);
|
|
return suite;
|
|
});
|
|
for (name of userSet) {
|
|
let canUse = true;
|
|
try {
|
|
helper.switchUser(name, dbName);
|
|
} catch (e) {
|
|
canUse = false;
|
|
}
|
|
|
|
if (canUse) {
|
|
let suite = {
|
|
testCheckAdministrateOnDBLevel: function() {
|
|
assertTrue(userSet.size > 0);
|
|
assertEqual(rootTestView(testViewName), true, 'Precondition failed, view was not found');
|
|
setKey(keySpaceId, name);
|
|
const taskId = 'task_update_view_name_' + name;
|
|
const task = {
|
|
id: taskId,
|
|
name: taskId,
|
|
command: `(function (params) {
|
|
try {
|
|
const db = require('@arangodb').db;
|
|
|
|
db._view('${testViewName}').rename('${testViewRename}');
|
|
global.KEY_SET('${keySpaceId}', '${name}_status', true);
|
|
} catch (e) {
|
|
//FIXME: remove IF block after renaming will work in cluster
|
|
if (e.errorNum === 1470) {
|
|
global.KEY_SET('${keySpaceId}', '${name}_no_cluster_rename', true);
|
|
global.KEY_SET('${keySpaceId}', '${name}_status', true);
|
|
} else {
|
|
global.KEY_SET('${keySpaceId}', '${name}_no_cluster_rename', false);
|
|
global.KEY_SET('${keySpaceId}', '${name}_status', false);
|
|
}
|
|
} finally {
|
|
global.KEY_SET('${keySpaceId}', '${name}', true);
|
|
}
|
|
})(params);`
|
|
};
|
|
if (dbLevel['rw'].has(name)) {
|
|
tasks.register(task);
|
|
wait(keySpaceId, name);
|
|
if(!getKey(keySpaceId, `${name}_no_cluster_rename`)) {
|
|
assertEqual(getKey(keySpaceId, `${name}_status`), colLevel['ro'].has(name) || colLevel['rw'].has(name), `${name} could update the view with sufficient rights`);
|
|
assertEqual(rootTestView(testViewRename), colLevel['ro'].has(name) || colLevel['rw'].has(name), 'View renaming reported success, but updated view was not found afterwards');
|
|
}
|
|
} else {
|
|
try {
|
|
tasks.register(task);
|
|
wait(keySpaceId, name);
|
|
assertFail(`${name} managed to register a task with insufficient rights`);
|
|
} catch (e) {
|
|
checkError(e);
|
|
} finally {
|
|
assertFalse(getKey(keySpaceId, `${name}_status`), `${name} could update the view with insufficient rights`);
|
|
}
|
|
}
|
|
},
|
|
testViewPropertyExceptLinksPartial: function() {
|
|
assertTrue(rootTestView(testViewName), 'Precondition failed, view was not found');
|
|
setKey(keySpaceId, name);
|
|
const taskId = 'task_update_view_property_not_links_partial_' + name;
|
|
const task = {
|
|
id: taskId,
|
|
name: taskId,
|
|
command: `(function (params) {
|
|
try {
|
|
const db = require('@arangodb').db;
|
|
db._view('${testViewName}').properties({ "cleanupIntervalStep": 1 }, true);
|
|
global.KEY_SET('${keySpaceId}', '${name}_status', true);
|
|
} catch (e) {
|
|
global.KEY_SET('${keySpaceId}', '${name}_status', false);
|
|
}finally {
|
|
global.KEY_SET('${keySpaceId}', '${name}', true);
|
|
}
|
|
})(params);`
|
|
};
|
|
if (dbLevel['rw'].has(name)) {
|
|
if(colLevel['rw'].has(name) || colLevel['ro'].has(name)){
|
|
tasks.register(task);
|
|
wait(keySpaceId, name);
|
|
assertTrue(getKey(keySpaceId, `${name}_status`), `${name} could not update the view with sufficient rights`);
|
|
assertEqual(rootGetViewProps(testViewName)["cleanupIntervalStep"], 1, 'View property update reported success, but property was not updated');
|
|
} else {
|
|
tasks.register(task);
|
|
wait(keySpaceId, name);
|
|
assertFalse(getKey(keySpaceId, `${name}_status`), `${name} could update the view with insufficient rights`);
|
|
}
|
|
} else {
|
|
try {
|
|
tasks.register(task);
|
|
wait(keySpaceId, name);
|
|
assertFail( `${name} managed to register a task with insufficient rights`);
|
|
} catch (e) {
|
|
checkError(e);
|
|
} finally {
|
|
assertFalse(getKey(keySpaceId, `${name}_status`), `${name} could update the view with insufficient rights`);
|
|
}
|
|
}
|
|
},
|
|
testViewByPropertyExceptLinksFull: function() {
|
|
assertTrue(rootTestView(testViewName), 'Precondition failed, view was not found');
|
|
setKey(keySpaceId, name);
|
|
const taskId = 'task_update_view_property_not_links_full_' + name;
|
|
const task = {
|
|
id: taskId,
|
|
name: taskId,
|
|
command: `(function (params) {
|
|
try {
|
|
const db = require('@arangodb').db;
|
|
db._view('${testViewName}').properties({ "cleanupIntervalStep": 1 }, false);
|
|
global.KEY_SET('${keySpaceId}', '${name}_status', true);
|
|
} catch (e) {
|
|
global.KEY_SET('${keySpaceId}', '${name}_status', false);
|
|
}finally {
|
|
global.KEY_SET('${keySpaceId}', '${name}', true);
|
|
}
|
|
})(params);`
|
|
};
|
|
if (dbLevel['rw'].has(name)) {
|
|
if(colLevel['rw'].has(name) || colLevel['ro'].has(name)){
|
|
tasks.register(task);
|
|
wait(keySpaceId, name);
|
|
assertTrue(getKey(keySpaceId, `${name}_status`), `${name} could not update the view with sufficient rights`);
|
|
assertEqual(rootGetViewProps(testViewName)["cleanupIntervalStep"], 1, 'View property update reported success, but property was not updated');
|
|
} else {
|
|
tasks.register(task);
|
|
wait(keySpaceId, name);
|
|
assertFalse(getKey(keySpaceId, `${name}_status`), `${name} could update the view with insufficient rights`);
|
|
}
|
|
} else {
|
|
try {
|
|
tasks.register(task);
|
|
wait(keySpaceId, name);
|
|
assertFail(`${name} managed to register a task with insufficient rights`);
|
|
} catch (e) {
|
|
checkError(e);
|
|
return;
|
|
} finally {
|
|
assertFalse(getKey(keySpaceId, `${name}_status`), `${name} could update the view with insufficient rights`);
|
|
}
|
|
}
|
|
},
|
|
testViewBypPropertiesRemoveFull: function() {
|
|
assertTrue(rootTestView(testViewName), 'Precondition failed, view was not found');
|
|
setKey(keySpaceId, name);
|
|
const taskId = 'task_update_view_properties_remove_full_' + name;
|
|
const task = {
|
|
id: taskId,
|
|
name: taskId,
|
|
command: `(function (params) {
|
|
try {
|
|
const db = require('@arangodb').db;
|
|
db._view('${testViewName}').properties({}, false);
|
|
global.KEY_SET('${keySpaceId}', '${name}_status', true);
|
|
} catch (e) {
|
|
global.KEY_SET('${keySpaceId}', '${name}_status', false);
|
|
}finally {
|
|
global.KEY_SET('${keySpaceId}', '${name}', true);
|
|
}
|
|
})(params);`
|
|
};
|
|
if (dbLevel['rw'].has(name)) {
|
|
if(colLevel['rw'].has(name) || colLevel['ro'].has(name)){
|
|
tasks.register(task);
|
|
wait(keySpaceId, name);
|
|
assertTrue(getKey(keySpaceId, `${name}_status`), `${name} could not update the view with sufficient rights`);
|
|
assertTrue(isEqual(rootGetViewProps(testViewName, true), rootGetDefaultViewProps()),
|
|
'View properties update reported success, but properties were not updated');
|
|
} else {
|
|
tasks.register(task);
|
|
wait(keySpaceId, name);
|
|
assertFalse(getKey(keySpaceId, `${name}_status`), `${name} could update the view with insufficient rights`);
|
|
}
|
|
} else {
|
|
try {
|
|
tasks.register(task);
|
|
wait(keySpaceId, name);
|
|
assertFail(`${name} managed to register a task with insufficient rights`);
|
|
} catch (e) {
|
|
checkError(e);
|
|
return;
|
|
} finally {
|
|
assertFalse(getKey(keySpaceId, `${name}_status`), `${name} could update the view with insufficient rights`);
|
|
}
|
|
}
|
|
},
|
|
testViewByExistingLinkUpdatePartial: function() {
|
|
assertTrue(rootTestView(testViewName), 'Precondition failed, view was not found');
|
|
setKey(keySpaceId, name);
|
|
const taskId = 'task_update_view_existing_link_partial_' + name;
|
|
const task = {
|
|
id: taskId,
|
|
name: taskId,
|
|
command: `(function (params) {
|
|
try {
|
|
const db = require('@arangodb').db;
|
|
db._view('${testViewName}').properties({ links: { ['${testCol1Name}']: { includeAllFields: true, analyzers: ['text_de','text_en'] } } }, true);
|
|
global.KEY_SET('${keySpaceId}', '${name}_status', true);
|
|
} catch (e) {
|
|
global.KEY_SET('${keySpaceId}', '${name}_status', false);
|
|
}finally {
|
|
global.KEY_SET('${keySpaceId}', '${name}', true);
|
|
}
|
|
})(params);`
|
|
};
|
|
if (dbLevel['rw'].has(name)) {
|
|
if(colLevel['rw'].has(name) || colLevel['ro'].has(name))
|
|
{
|
|
tasks.register(task);
|
|
wait(keySpaceId, name);
|
|
assertTrue(getKey(keySpaceId, `${name}_status`), `${name} could not update the view with sufficient rights`);
|
|
assertEqual(rootGetViewProps(testViewName)["links"][testCol1Name]["analyzers"], ["text_de", "text_en"], 'View link update reported success, but property was not updated');
|
|
} else {
|
|
tasks.register(task);
|
|
wait(keySpaceId, name);
|
|
assertFalse(getKey(keySpaceId, `${name}_status`), `${name} could update the view with insufficient rights`);
|
|
}
|
|
} else {
|
|
try {
|
|
tasks.register(task);
|
|
wait(keySpaceId, name);
|
|
assertFail(`${name} managed to register a task with insufficient rights`);
|
|
} catch (e) {
|
|
checkError(e);
|
|
} finally {
|
|
assertFalse(getKey(keySpaceId, `${name}_status`), `${name} could update the view with insufficient rights`);
|
|
}
|
|
|
|
}
|
|
}
|
|
};
|
|
jsunity.run(function() {
|
|
return deriveTestSuiteWithnamespace(
|
|
UserRightsManagement(name),
|
|
suite,
|
|
"_-_" + name);
|
|
});
|
|
}
|
|
}
|
|
}
|
|
return jsunity.done();
|