36 lines
1.1 KiB
Go
36 lines
1.1 KiB
Go
|
package identity
|
||
|
|
|
||
|
|
import "testing"
|
||
|
|
|
||
|
|
func TestRoleCapabilityMatrix(t *testing.T) {
|
||
|
|
tests := []struct {
|
||
|
|
role Role
|
||
|
|
capability Capability
|
||
|
|
allowed bool
|
||
|
|
}{
|
||
|
|
{RoleOwner, CapabilityMemberManage, true},
|
||
|
|
{RoleAdmin, CapabilityMemberManage, true},
|
||
|
|
{RoleEditor, CapabilityMemberManage, false},
|
||
|
|
{RoleViewer, CapabilitySubjectWrite, false},
|
||
|
|
{RoleViewer, CapabilityConversationRead, true},
|
||
|
|
{RoleAdmin, CapabilityOwnershipTransfer, false},
|
||
|
|
{RoleOwner, CapabilityPrivacyManage, true},
|
||
|
|
{RoleAdmin, CapabilityPrivacyRead, true},
|
||
|
|
{RoleAdmin, CapabilityPrivacyManage, false},
|
||
|
|
{RoleEditor, CapabilityPrivacyRead, false},
|
||
|
|
}
|
||
|
|
for _, test := range tests {
|
||
|
|
if actual := Can(test.role, test.capability); actual != test.allowed {
|
||
|
|
t.Errorf("Can(%s, %s) = %t, want %t", test.role, test.capability, actual, test.allowed)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestHouseholdRoleNeverGrantsRecordingAccess(t *testing.T) {
|
||
|
|
for _, role := range []Role{RoleOwner, RoleAdmin, RoleEditor, RoleViewer} {
|
||
|
|
if Can(role, CapabilityRecordingPlay) || Can(role, CapabilityRecordingDownload) {
|
||
|
|
t.Fatalf("role %s must not implicitly grant recording access", role)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|