Add tests for cynara_admin_check function

[platform/core/test/security-tests.git] / tests / cynara-tests / test_cases.cpp

diff --git a/tests/cynara-tests/test_cases.cpp b/tests/cynara-tests/test_cases.cpp
index c61e632..63fcac3 100644 (file)
--- a/tests/cynara-tests/test_cases.cpp
+++ b/tests/cynara-tests/test_cases.cpp
@@ -22,6 +22,7 @@
  * @brief       Tests for libcynara-client and libcynara-admin
  */
 
+#include <dpl/exception.h>
 #include <tests_common.h>
 #include <cynara_test_client.h>
 #include <cynara_test_admin.h>
@@ -111,6 +112,7 @@ void tc04_admin_set_policies_invalid_params_func()
     const char *privilege = "privilege04";
     const int resultAllow = CYNARA_ADMIN_ALLOW;
     const int resultBucket = CYNARA_ADMIN_BUCKET;
+    const int resultNone = CYNARA_ADMIN_NONE;
     const char *resultExtra = nullptr;
 
     checkInvalidPolicy(admin, nullptr, client,  user,    privilege, resultAllow,  resultExtra);
@@ -119,6 +121,7 @@ void tc04_admin_set_policies_invalid_params_func()
     checkInvalidPolicy(admin, bucket,  client,  user,    nullptr,   resultAllow,  resultExtra);
     checkInvalidPolicy(admin, bucket,  client,  user,    privilege, INT_MAX,      resultExtra);
     checkInvalidPolicy(admin, bucket,  client,  user,    privilege, resultBucket, nullptr    );
+    checkInvalidPolicy(admin, bucket,  client,  user,    privilege, resultNone,   resultExtra);
 }
 
 void tc05_admin_set_bucket_invalid_params_func()
@@ -128,11 +131,13 @@ void tc05_admin_set_bucket_invalid_params_func()
     const char *bucket = CYNARA_ADMIN_DEFAULT_BUCKET;
     const int operationAllow = CYNARA_ADMIN_ALLOW;
     const int operationDelete = CYNARA_ADMIN_DELETE;
+    const int operationNone = CYNARA_ADMIN_NONE;
     const char *extra = nullptr;
 
     admin.setBucket(nullptr, operationAllow,   extra, CYNARA_ADMIN_API_INVALID_PARAM);
     admin.setBucket(bucket,  INT_MAX,          extra, CYNARA_ADMIN_API_INVALID_PARAM);
     admin.setBucket(bucket,  operationDelete,  extra, CYNARA_ADMIN_API_OPERATION_NOT_ALLOWED);
+    admin.setBucket(bucket,  operationNone,    extra, CYNARA_ADMIN_API_OPERATION_NOT_ALLOWED);
 }
 
 void tc06_cynara_check_empty_admin1_func()
@@ -332,7 +337,7 @@ void checkAllDeny(const std::vector< std::vector<const char *> > &data,
     CynaraTestClient cynara;
 
     for (auto it = data.begin(); it != data.end(); ++it) {
-        RUNNER_ASSERT_MSG_BT(it->size() == 3, "Wrong test data size");
+        RUNNER_ASSERT_MSG(it->size() == 3, "Wrong test data size");
     }
 
     for (auto itClient = data.begin(); itClient != data.end(); ++itClient) {
@@ -346,9 +351,9 @@ void checkAllDeny(const std::vector< std::vector<const char *> > &data,
 
 void checkSingleWildcardData(const std::vector< std::vector<const char *> > &data)
 {
-    RUNNER_ASSERT_MSG_BT(data.size() == 3, "Wrong test data size");
+    RUNNER_ASSERT_MSG(data.size() == 3, "Wrong test data size");
     for (auto it = data.begin(); it != data.end(); ++it) {
-        RUNNER_ASSERT_MSG_BT(it->size() == 3, "Wrong test data size");
+        RUNNER_ASSERT_MSG(it->size() == 3, "Wrong test data size");
     }
 }
 
@@ -570,6 +575,319 @@ void tc13_admin_set_policies_to_extra_bucket_func()
     cynara.check(client, session, user, privilege, CYNARA_API_ACCESS_DENIED);
 }
 
+void tc14_admin_set_policies_integrity_func()
+{
+    const char *bucketDefault = CYNARA_ADMIN_DEFAULT_BUCKET;
+    const char *bucket = "bucket14";
+    const char *client = "client14";
+    const char *session = "session14";
+    const char *user = "user14";
+    const char *privilege = "privilege14";
+    const char *extraResult = nullptr;
+
+    {
+        CynaraTestClient cynara;
+        cynara.check(client, session, user, privilege, CYNARA_API_ACCESS_DENIED);
+    }
+
+    {
+        CynaraTestAdmin admin;
+        CynaraPoliciesContainer cp;
+        cp.add(bucketDefault,
+               client, user, privilege,
+               CYNARA_ADMIN_ALLOW, extraResult);
+        cp.add(bucket,
+               client, user, privilege,
+               CYNARA_ADMIN_ALLOW, extraResult);
+        admin.setPolicies(cp, CYNARA_ADMIN_API_BUCKET_NOT_FOUND);
+    }
+
+    {
+        CynaraTestClient cynara;
+        cynara.check(client, session, user, privilege, CYNARA_API_ACCESS_DENIED);
+    }
+}
+
+void tc15_admin_set_bucket_admin_none1_func()
+{
+    CynaraTestAdmin admin;
+    CynaraTestClient cynara;
+
+    const char *bucketDefault = CYNARA_ADMIN_DEFAULT_BUCKET;
+    const char *bucket = "bucket15_1";
+    const char *client = "client15_1";
+    const char *session = "session15_1";
+    const char *user = "user15_1";
+    const char *privilege = "privilege15_1";
+    const char *extra = nullptr;
+    const char *extraResult = nullptr;
+
+    admin.setBucket(bucket, CYNARA_ADMIN_NONE, extra);
+
+    {
+        CynaraPoliciesContainer cp;
+        cp.add(bucketDefault,
+               client, user, privilege,
+               CYNARA_ADMIN_BUCKET, bucket);
+        cp.add(bucket,
+               client, user, privilege,
+               CYNARA_ADMIN_ALLOW, extraResult);
+        admin.setPolicies(cp);
+    }
+    cynara.check(client, session, user, privilege, CYNARA_API_SUCCESS);
+}
+
+void tc15_admin_set_bucket_admin_none2_func()
+{
+    CynaraTestAdmin admin;
+    CynaraTestClient cynara;
+
+    const char *bucketDefault = CYNARA_ADMIN_DEFAULT_BUCKET;
+    const char *bucket = "bucket15_2";
+    const char *client = "client15_2";
+    const char *session = "session15_2";
+    const char *user = "user15_2";
+    const char *privilege = "privilege15_2";
+    const char *extra = nullptr;
+
+    admin.setBucket(bucket, CYNARA_ADMIN_NONE, extra);
+
+    {
+        CynaraPoliciesContainer cp;
+        cp.add(bucketDefault,
+               client, user, privilege,
+               CYNARA_ADMIN_BUCKET, bucket);
+        admin.setPolicies(cp);
+    }
+    cynara.check(client, session, user, privilege, CYNARA_API_ACCESS_DENIED);
+}
+
+void tc15_admin_set_bucket_admin_none3_func()
+{
+    CynaraTestAdmin admin;
+    CynaraTestClient cynara;
+
+    const char *bucketDefault = CYNARA_ADMIN_DEFAULT_BUCKET;
+    const char *bucket = "bucket15_3";
+    const char *client = "client15_3";
+    const char *session = "session15_3";
+    const char *user = "user15_3";
+    const char *privilege = "privilege15_3";
+    const char *extra = nullptr;
+    const char *extraResult = nullptr;
+
+    admin.setBucket(bucket, CYNARA_ADMIN_NONE, extra);
+
+    {
+        CynaraPoliciesContainer cp;
+        cp.add(bucketDefault,
+               client, user, privilege,
+               CYNARA_ADMIN_BUCKET, bucket);
+        cp.add(bucketDefault,
+               client, user, CYNARA_ADMIN_WILDCARD,
+               CYNARA_ADMIN_ALLOW, extraResult);
+        admin.setPolicies(cp);
+    }
+    cynara.check(client, session, user, privilege, CYNARA_API_SUCCESS);
+}
+
+void tc16_admin_check_single_bucket_func()
+{
+    const char *bucketDefault = CYNARA_ADMIN_DEFAULT_BUCKET;
+    const char *client = "client16";
+    const char *user = "user16";
+    const char *privilege = "privilege16";
+    const char *extraResult = nullptr;
+    int recursive = 1;
+    int notrecursive = 0;
+
+    CynaraTestAdmin admin;
+
+    admin.adminCheck(bucketDefault, recursive, client, user, privilege,
+                     CYNARA_ADMIN_DENY, nullptr, CYNARA_ADMIN_API_SUCCESS);
+    admin.adminCheck(bucketDefault, notrecursive, client, user, privilege,
+                     CYNARA_ADMIN_DENY, nullptr, CYNARA_ADMIN_API_SUCCESS);
+
+    CynaraPoliciesContainer cp;
+    cp.add(bucketDefault,
+           client, user, privilege,
+           CYNARA_ADMIN_ALLOW, extraResult);
+    admin.setPolicies(cp);
+
+    admin.adminCheck(bucketDefault, recursive, client, user, privilege,
+                     CYNARA_ADMIN_ALLOW, nullptr, CYNARA_ADMIN_API_SUCCESS);
+    admin.adminCheck(bucketDefault, notrecursive, client, user, privilege,
+                     CYNARA_ADMIN_ALLOW, nullptr, CYNARA_ADMIN_API_SUCCESS);
+}
+
+void tc17_admin_check_nested_bucket_func()
+{
+    const char *bucketDefault = CYNARA_ADMIN_DEFAULT_BUCKET;
+    const char *bucket = "bucket17";
+    const char *client = "client17";
+    const char *user = "user17";
+    const char *privilege = "privilege17";
+    const char *extra = nullptr;
+    const char *extraResult = nullptr;
+    int recursive = 1;
+    int notrecursive = 0;
+
+    CynaraTestAdmin admin;
+    admin.setBucket(bucket, CYNARA_ADMIN_DENY, extra);
+
+    admin.adminCheck(bucketDefault, recursive, client, user, privilege,
+                     CYNARA_ADMIN_DENY, nullptr, CYNARA_ADMIN_API_SUCCESS);
+    admin.adminCheck(bucketDefault, notrecursive, client, user, privilege,
+                     CYNARA_ADMIN_DENY, nullptr, CYNARA_ADMIN_API_SUCCESS);
+    admin.adminCheck(bucket, recursive, client, user, privilege,
+                     CYNARA_ADMIN_DENY, nullptr, CYNARA_ADMIN_API_SUCCESS);
+    admin.adminCheck(bucket, notrecursive, client, user, privilege,
+                     CYNARA_ADMIN_DENY, nullptr, CYNARA_ADMIN_API_SUCCESS);
+
+    {
+        CynaraPoliciesContainer cp;
+        cp.add(bucketDefault,
+               client, user, privilege,
+               CYNARA_ADMIN_BUCKET, bucket);
+        cp.add(bucket,
+               client, user, privilege,
+               CYNARA_ADMIN_ALLOW, extraResult);
+        admin.setPolicies(cp);
+    }
+
+    admin.adminCheck(bucketDefault, recursive, client, user, privilege,
+                     CYNARA_ADMIN_ALLOW, nullptr, CYNARA_ADMIN_API_SUCCESS);
+    admin.adminCheck(bucketDefault, notrecursive, client, user, privilege,
+                     CYNARA_ADMIN_DENY, nullptr, CYNARA_ADMIN_API_SUCCESS);
+    admin.adminCheck(bucket, recursive, client, user, privilege,
+                     CYNARA_ADMIN_ALLOW, nullptr, CYNARA_ADMIN_API_SUCCESS);
+    admin.adminCheck(bucket, notrecursive, client, user, privilege,
+                     CYNARA_ADMIN_ALLOW, nullptr, CYNARA_ADMIN_API_SUCCESS);
+}
+
+void tc18_admin_check_multiple_matches_func()
+{
+    const char *bucketDefault = CYNARA_ADMIN_DEFAULT_BUCKET;
+    const char *client = "client18";
+    const char *user = "user18";
+    const char *privilege = "privilege18";
+    const char *wildcard = CYNARA_ADMIN_WILDCARD;
+    const char *extra = nullptr;
+    const char *extraResult = nullptr;
+    int recursive = 1;
+    int notrecursive = 0;
+
+    CynaraTestAdmin admin;
+
+    auto check = [&](int expected_result)
+    {
+        admin.adminCheck(bucketDefault, recursive, client, user, privilege,
+                         expected_result, nullptr, CYNARA_ADMIN_API_SUCCESS);
+        admin.adminCheck(bucketDefault, notrecursive, client, user, privilege,
+                         expected_result, nullptr, CYNARA_ADMIN_API_SUCCESS);
+    };
+
+    check(CYNARA_ADMIN_DENY);
+
+    {
+        CynaraPoliciesContainer cp;
+        cp.add(bucketDefault,
+               client, user, privilege,
+               CYNARA_ADMIN_ALLOW, extraResult);
+        admin.setPolicies(cp);
+    }
+
+    check(CYNARA_ADMIN_ALLOW);
+
+    {
+        CynaraPoliciesContainer cp;
+        cp.add(bucketDefault,
+               wildcard, user, privilege,
+               CYNARA_ADMIN_DENY, extraResult);
+        admin.setPolicies(cp);
+    }
+
+    check(CYNARA_ADMIN_DENY);
+
+    admin.setBucket(bucketDefault, CYNARA_ADMIN_ALLOW, extra);
+
+    check(CYNARA_ADMIN_DENY);
+
+    {
+        CynaraPoliciesContainer cp;
+        cp.add(bucketDefault,
+               client, user, privilege,
+               CYNARA_ADMIN_DELETE, extraResult);
+        admin.setPolicies(cp);
+    }
+
+    check(CYNARA_ADMIN_DENY);
+
+    {
+        CynaraPoliciesContainer cp;
+        cp.add(bucketDefault,
+               wildcard, user, privilege,
+               CYNARA_ADMIN_DELETE, extraResult);
+        admin.setPolicies(cp);
+    }
+
+    check(CYNARA_ADMIN_ALLOW);
+}
+
+void tc19_admin_check_none_bucket_func()
+{
+    const char *bucketDefault = CYNARA_ADMIN_DEFAULT_BUCKET;
+    const char *bucket1 = "bucket19_a";
+    const char *bucket2 = "bucket19_b";
+    const char *client = "client19";
+    const char *user = "user19";
+    const char *privilege = "privilege19";
+    const char *extra = nullptr;
+    int recursive = 1;
+    int notrecursive = 0;
+
+    CynaraTestAdmin admin;
+    admin.setBucket(bucket1, CYNARA_ADMIN_NONE, extra);
+    admin.setBucket(bucket2, CYNARA_ADMIN_ALLOW, extra);
+
+    admin.adminCheck(bucketDefault, recursive, client, user, privilege,
+                     CYNARA_ADMIN_DENY, nullptr, CYNARA_ADMIN_API_SUCCESS);
+    admin.adminCheck(bucketDefault, notrecursive, client, user, privilege,
+                     CYNARA_ADMIN_DENY, nullptr, CYNARA_ADMIN_API_SUCCESS);
+    admin.adminCheck(bucket1, recursive, client, user, privilege,
+                     CYNARA_ADMIN_NONE, nullptr, CYNARA_ADMIN_API_SUCCESS);
+    admin.adminCheck(bucket1, notrecursive, client, user, privilege,
+                     CYNARA_ADMIN_NONE, nullptr, CYNARA_ADMIN_API_SUCCESS);
+    admin.adminCheck(bucket2, recursive, client, user, privilege,
+                     CYNARA_ADMIN_ALLOW, nullptr, CYNARA_ADMIN_API_SUCCESS);
+    admin.adminCheck(bucket2, notrecursive, client, user, privilege,
+                     CYNARA_ADMIN_ALLOW, nullptr, CYNARA_ADMIN_API_SUCCESS);
+
+    {
+        CynaraPoliciesContainer cp;
+        cp.add(bucketDefault,
+               client, user, privilege,
+               CYNARA_ADMIN_BUCKET, bucket1);
+        cp.add(bucket1,
+               client, user, privilege,
+               CYNARA_ADMIN_BUCKET, bucket2);
+        admin.setPolicies(cp);
+    }
+
+    admin.adminCheck(bucketDefault, recursive, client, user, privilege,
+                     CYNARA_ADMIN_ALLOW, nullptr, CYNARA_ADMIN_API_SUCCESS);
+    admin.adminCheck(bucketDefault, notrecursive, client, user, privilege,
+                     CYNARA_ADMIN_DENY, nullptr, CYNARA_ADMIN_API_SUCCESS);
+    admin.adminCheck(bucket1, recursive, client, user, privilege,
+                     CYNARA_ADMIN_ALLOW, nullptr, CYNARA_ADMIN_API_SUCCESS);
+    admin.adminCheck(bucket1, notrecursive, client, user, privilege,
+                     CYNARA_ADMIN_NONE, nullptr, CYNARA_ADMIN_API_SUCCESS);
+    admin.adminCheck(bucket2, recursive, client, user, privilege,
+                     CYNARA_ADMIN_ALLOW, nullptr, CYNARA_ADMIN_API_SUCCESS);
+    admin.adminCheck(bucket2, notrecursive, client, user, privilege,
+                     CYNARA_ADMIN_ALLOW, nullptr, CYNARA_ADMIN_API_SUCCESS);
+}
+
 RUNNER_TEST_GROUP_INIT(cynara_tests)
 
 RUN_CYNARA_TEST(tc01_cynara_initialize)
@@ -588,3 +906,11 @@ RUN_CYNARA_TEST(tc10_admin_change_extra_bucket)
 RUN_CYNARA_TEST(tc11_admin_bucket_not_found)
 RUN_CYNARA_TEST(tc12_admin_delete_bucket_with_policies_pointing_to_it)
 RUN_CYNARA_TEST(tc13_admin_set_policies_to_extra_bucket)
+RUN_CYNARA_TEST(tc14_admin_set_policies_integrity)
+RUN_CYNARA_TEST(tc15_admin_set_bucket_admin_none1)
+RUN_CYNARA_TEST(tc15_admin_set_bucket_admin_none2)
+RUN_CYNARA_TEST(tc15_admin_set_bucket_admin_none3)
+RUN_CYNARA_TEST(tc16_admin_check_single_bucket)
+RUN_CYNARA_TEST(tc17_admin_check_nested_bucket)
+RUN_CYNARA_TEST(tc18_admin_check_multiple_matches)
+RUN_CYNARA_TEST(tc19_admin_check_none_bucket)