jimmy/postgrest
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix #746 (#769)

Browse Source 
also fix broken text env

After the last couple of commits the tests ran correctly only on a
fresh db, in addition, the roles within the db were not created/dropped
on each request and we need that since their privileges differ and we
need to to have an absolute clean db on each execution
This commit is contained in:
Ruslan Talpa
2016-12-18 15:46:53 -08:00
committed by Joe Nelson
parent e364cbc3ff
commit 16fd3a57ff
12 changed files with 106 additions and 84 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/Feature/InsertSpec.hs
+22
View File
@@ -201,6 +201,28 @@ spec = do
, matchStatus = 201
, matchHeaders = []
}
context "table with limited privileges" $ do
it "succeeds if correct select is applied" $
request methodPost "/limited_article_stars?select=article_id,user_id" [("Prefer", "return=representation")]
[json| {"article_id": 2, "user_id": 1} |] `shouldRespondWith` ResponseMatcher {
matchBody = Just [str|{"article_id":2,"user_id":1}|]
, matchStatus = 201
, matchHeaders = []
}
it "fails if more columns are selected" $
request methodPost "/limited_article_stars?select=article_id,user_id,created_at" [("Prefer", "return=representation")]
[json| {"article_id": 2, "user_id": 2} |] `shouldRespondWith` ResponseMatcher {
matchBody = Just [str|{"hint":null,"details":null,"code":"42501","message":"permission denied for relation limited_article_stars"}|]
, matchStatus = 401
, matchHeaders = []
}
it "fails if select is not specified" $
request methodPost "/limited_article_stars" [("Prefer", "return=representation")]
[json| {"article_id": 3, "user_id": 1} |] `shouldRespondWith` ResponseMatcher {
matchBody = Just [str|{"hint":null,"details":null,"code":"42501","message":"permission denied for relation limited_article_stars"}|]
, matchStatus = 401
, matchHeaders = []
}
describe "CSV insert" $ do
test/Main.hs
+1
View File
@@ -31,6 +31,7 @@ import Protolude
main :: IO ()
main = do
testDbConn <- getEnvVarWithDefault "POSTGREST_TEST_CONNECTION" "postgres://postgrest_test@localhost/postgrest_test"
setupDb testDbConn
pool <- P.acquire (3, 10, toS testDbConn)
-- ask for the OS time at most once per second
test/SpecHelper.hs
+9
View File
@@ -84,6 +84,15 @@ testCfgBinaryJWT testDbConn = (testCfg testDbConn) { configJwtSecret = Just secr
where secretBs = B64.decodeLenient "h2CGB1FoBd51aQooCS2g+UmRgYQfTPQ6v3+9ALbaqM4="
setupDb :: Text -> IO ()
setupDb dbConn = do
loadFixture dbConn "database"
loadFixture dbConn "roles"
loadFixture dbConn "schema"
loadFixture dbConn "jwt"
loadFixture dbConn "privileges"
resetDb dbConn
resetDb :: Text -> IO ()
resetDb dbConn = loadFixture dbConn "data"
test/create_test_db
+10 -47
View File
@@ -23,10 +23,10 @@ URI=$(echo $1 | cut -d'/' -f1-3)
HOST_PORT=$(echo $URI | cut -d'/' -f3 | cut -d'@' -f2 )
DB=$2
# Specify the username of choice, or let the script create a random unique user by appending the database name
TEST_USER_NAME=${3:-postgrest_test_$DB}
TEST_USER_NAME=postgrest_test_authenticator
# New password will get assigned only if the user does not already exist
# Otherwise make sure to provide the correct password for the existing user
TEST_USER_PASS=${4:-$(cat /dev/urandom | env LC_CTYPE=C tr -dc 'a-zA-Z0-9' | fold -w 16 | head -n 1)a}
TEST_USER_PASS=$(cat /dev/urandom | env LC_CTYPE=C tr -dc 'a-zA-Z0-9' | fold -w 16 | head -n 1)
PGOPTIONS='-c client_min_messages=WARNING' psql "$URI" -Xq >/dev/null -c 'select rolcreatedb from pg_authid where rolname = current_user;' 2>/dev/null
if [ $? -ne 0 ]; then
@@ -41,53 +41,16 @@ FROM pg_stat_activity
WHERE pg_stat_activity.datname = '$DB'
AND pid <> pg_backend_pid();
drop database if exists "$DB";
create database "$DB" encoding = 'UTF8';
DO \$\$
BEGIN
IF NOT EXISTS (SELECT * FROM pg_catalog.pg_roles WHERE rolname = '$TEST_USER_NAME')
THEN CREATE ROLE $TEST_USER_NAME WITH LOGIN NOINHERIT PASSWORD '$TEST_USER_PASS';
END IF;
END \$\$;
DO \$\$
BEGIN
IF NOT EXISTS (SELECT * FROM pg_catalog.pg_roles WHERE rolname = 'postgrest_test_anonymous')
THEN CREATE ROLE postgrest_test_anonymous;
END IF;
END \$\$;
DO \$\$
BEGIN
IF NOT EXISTS (SELECT * FROM pg_catalog.pg_roles WHERE rolname = 'postgrest_test_default_role')
THEN CREATE ROLE postgrest_test_default_role;
END IF;
END \$\$;
DO \$\$
BEGIN
IF NOT EXISTS (SELECT * FROM pg_catalog.pg_roles WHERE rolname = 'postgrest_test_author')
THEN CREATE ROLE postgrest_test_author;
END IF;
END \$\$;
DO \$\$
BEGIN
IF NOT EXISTS (select * from pg_roles where rolname = 'postgrest_test_anonymous' AND pg_has_role('$TEST_USER_NAME', oid, 'member'))
THEN GRANT postgrest_test_anonymous TO $TEST_USER_NAME;
END IF;
IF NOT EXISTS (select * from pg_roles where rolname = 'postgrest_test_author' AND pg_has_role('$TEST_USER_NAME', oid, 'member'))
THEN GRANT postgrest_test_author TO $TEST_USER_NAME;
END IF;
IF NOT EXISTS (select * from pg_roles where rolname = 'postgrest_test_default_role' AND pg_has_role('$TEST_USER_NAME', oid, 'member'))
THEN GRANT postgrest_test_default_role TO $TEST_USER_NAME;
END IF;
END \$\$;
DROP DATABASE IF EXISTS $DB;
DROP ROLE IF EXISTS $TEST_USER_NAME;
CREATE USER $TEST_USER_NAME WITH LOGIN NOINHERIT PASSWORD '$TEST_USER_PASS' CREATEROLE;
CREATE DATABASE $DB OWNER $TEST_USER_NAME;
EOF
PGDATABASE=$DB PGOPTIONS='-c client_min_messages=WARNING' psql "$URI" --set=db=$DB -Xqf $BASEPATH/fixtures/database.sql
PGDATABASE=$DB PGOPTIONS='-c client_min_messages=WARNING' psql "$URI" -Xqf $BASEPATH/fixtures/schema.sql
PGDATABASE=$DB PGOPTIONS='-c client_min_messages=WARNING' psql "$URI" -Xqf $BASEPATH/fixtures/jwt.sql
PGDATABASE=$DB PGOPTIONS='-c client_min_messages=WARNING' psql "$URI" --set=test_user_name="$TEST_USER_NAME" -Xqf $BASEPATH/fixtures/privileges.sql
PGDATABASE=$DB PGOPTIONS='-c client_min_messages=WARNING' psql "$URI" --set=db=$DB -Xq <<EOF
CREATE EXTENSION IF NOT EXISTS pgcrypto;
ALTER DATABASE ${DB} SET request.jwt.claim.id = '-1';
EOF
# Create a new connection string to use with the test runner
echo 'postgres://'${TEST_USER_NAME}':'$TEST_USER_PASS'@'$HOST_PORT'/'$DB
test/fixtures/database.sql
Vendored
+3 -3
View File
@@ -1,3 +1,3 @@
CREATE EXTENSION IF NOT EXISTS pgcrypto;
ALTER DATABASE :db SET request.jwt.claim.id = '-1';
set client_min_messages to warning;
DROP SCHEMA IF EXISTS test, private, postgrest, jwt, تست CASCADE;
DROP TYPE IF EXISTS jwt_token CASCADE;
test/fixtures/jwt.sql
Vendored
+1
View File
@@ -1,5 +1,6 @@
-- From michelp/pgjwt commit c02bbd3
BEGIN;
set client_min_messages to warning;
DROP SCHEMA IF EXISTS jwt CASCADE;
CREATE SCHEMA jwt;
test/fixtures/privileges.sql
Vendored
+3 -4
View File
@@ -58,7 +58,6 @@ TO postgrest_test_anonymous;
GRANT USAGE ON SCHEMA test TO postgrest_test_author;
GRANT ALL ON TABLE authors_only TO postgrest_test_author;
GRANT USAGE ON SCHEMA postgrest,private,test to :test_user_name;
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA postgrest,private,test TO :test_user_name;
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA postgrest,private,test TO :test_user_name;
GRANT SELECT (article_id, user_id) ON TABLE limited_article_stars TO postgrest_test_anonymous;
GRANT INSERT (article_id, user_id) ON TABLE limited_article_stars TO postgrest_test_anonymous;
GRANT UPDATE (article_id, user_id) ON TABLE limited_article_stars TO postgrest_test_anonymous;
test/fixtures/roles.sql
Vendored
+7
View File
@@ -0,0 +1,7 @@
\set AUTHENTICATOR current_user
DROP ROLE IF EXISTS postgrest_test_anonymous, postgrest_test_default_role, postgrest_test_author;
CREATE ROLE postgrest_test_anonymous;
CREATE ROLE postgrest_test_default_role;
CREATE ROLE postgrest_test_author;
GRANT postgrest_test_anonymous, postgrest_test_default_role, postgrest_test_author TO :USER;
test/fixtures/schema.sql
Vendored
+4
View File
@@ -382,6 +382,10 @@ CREATE TABLE articles (
SET search_path = test, pg_catalog;
CREATE VIEW limited_article_stars AS
SELECT article_id, user_id, created_at FROM private.article_stars;
--
-- Name: articleStars; Type: VIEW; Schema: test; Owner: -
--