| 20 |
20 |
from django.contrib.auth import get_user_model
|
| 21 |
21 |
from django.contrib.contenttypes.models import ContentType
|
| 22 |
22 |
from django.db import connection
|
|
23 |
from django.db.models import Q
|
| 23 |
24 |
from django.test.utils import CaptureQueriesContext
|
| 24 |
25 |
|
| 25 |
26 |
from django_rbac import backends, models, utils
|
| ... | ... | |
| 36 |
37 |
ou = OrganizationalUnit.objects.create(name='ou')
|
| 37 |
38 |
roles = []
|
| 38 |
39 |
for i in range(10):
|
| 39 |
|
roles.append(Role.objects.create(name='r%d' % i, ou=ou))
|
|
40 |
roles.append(Role.objects.create(name='test-role-%d' % i, ou=ou))
|
| 40 |
41 |
|
| 41 |
|
assert Role.objects.count() == 10
|
| 42 |
|
assert RoleParenting.objects.count() == 0
|
|
42 |
assert Role.objects.filter(name__startswith='test-role-').count() == 10
|
|
43 |
role_parenting_qs = RoleParenting.objects.filter(Q(parent__in=roles) | Q(child__in=roles))
|
|
44 |
assert role_parenting_qs.count() == 0
|
| 43 |
45 |
for i in range(1, 3):
|
| 44 |
46 |
RoleParenting.objects.soft_create(parent=roles[i - 1], child=roles[i])
|
| 45 |
|
assert RoleParenting.objects.filter(direct=True).count() == 2
|
| 46 |
|
assert RoleParenting.objects.filter(direct=False).count() == 1
|
|
47 |
assert role_parenting_qs.filter(direct=True).count() == 2
|
|
48 |
assert role_parenting_qs.filter(direct=False).count() == 1
|
| 47 |
49 |
for i, role in enumerate(roles[:3]):
|
| 48 |
50 |
assert role.children().count() == 3 - i
|
| 49 |
51 |
assert role.parents().count() == i + 1
|
| ... | ... | |
| 51 |
53 |
assert role.parents(False).count() == i
|
| 52 |
54 |
|
| 53 |
55 |
for i in range(4, 6):
|
| 54 |
|
RoleParenting.objects.create(parent=roles[i - 1], child=roles[i])
|
| 55 |
|
assert RoleParenting.objects.filter(direct=True).count() == 4
|
| 56 |
|
assert RoleParenting.objects.filter(direct=False).count() == 2
|
|
56 |
role_parenting_qs.create(parent=roles[i - 1], child=roles[i])
|
|
57 |
assert role_parenting_qs.filter(direct=True).count() == 4
|
|
58 |
assert role_parenting_qs.filter(direct=False).count() == 2
|
| 57 |
59 |
for i, role in enumerate(roles[3:6]):
|
| 58 |
60 |
assert role.children().count() == 3 - i
|
| 59 |
61 |
assert role.parents().count() == i + 1
|
| 60 |
62 |
assert role.children(False).count() == 3 - i - 1
|
| 61 |
63 |
assert role.parents(False).count() == i
|
| 62 |
64 |
RoleParenting.objects.soft_create(parent=roles[2], child=roles[3])
|
| 63 |
|
assert RoleParenting.objects.filter(direct=True).count() == 5
|
| 64 |
|
assert RoleParenting.objects.filter(direct=False).count() == 10
|
|
65 |
assert role_parenting_qs.filter(direct=True).count() == 5
|
|
66 |
assert role_parenting_qs.filter(direct=False).count() == 10
|
| 65 |
67 |
for i in range(6):
|
| 66 |
68 |
assert roles[i].parents().distinct().count() == i + 1
|
| 67 |
69 |
for i, role in enumerate(roles[:6]):
|
| ... | ... | |
| 71 |
73 |
assert role.parents(False).count() == i
|
| 72 |
74 |
RoleParenting.objects.soft_delete(roles[2], roles[3])
|
| 73 |
75 |
assert (
|
| 74 |
|
RoleParenting.objects.filter(
|
|
76 |
role_parenting_qs.filter(
|
| 75 |
77 |
direct=True,
|
| 76 |
78 |
deleted__isnull=True,
|
| 77 |
79 |
).count()
|
| 78 |
80 |
== 4
|
| 79 |
81 |
)
|
| 80 |
82 |
assert (
|
| 81 |
|
RoleParenting.objects.filter(
|
|
83 |
role_parenting_qs.filter(
|
| 82 |
84 |
direct=False,
|
| 83 |
85 |
deleted__isnull=True,
|
| 84 |
86 |
).count()
|
| ... | ... | |
| 101 |
103 |
roles = []
|
| 102 |
104 |
for i in range(10):
|
| 103 |
105 |
roles.append(Role.objects.create(name='r%d' % i, ou=ou))
|
| 104 |
|
assert not len(RoleParenting.objects.all())
|
|
106 |
role_parenting_qs = RoleParenting.objects.filter(Q(parent__in=roles) | Q(child__in=roles))
|
|
107 |
assert not len(role_parenting_qs.all())
|
| 105 |
108 |
|
| 106 |
109 |
rps = []
|
| 107 |
110 |
for i in range(5):
|
| 108 |
111 |
rps.append(RoleParenting.objects.soft_create(parent=roles[9 - i], child=roles[i]))
|
| 109 |
|
assert len(RoleParenting.objects.all()) == 5
|
|
112 |
assert len(role_parenting_qs.all()) == 5
|
| 110 |
113 |
for i in range(5):
|
| 111 |
114 |
roles[9 - i].remove_child(roles[i])
|
| 112 |
|
assert len(RoleParenting.objects.all()) == 5
|
| 113 |
|
assert len(RoleParenting.objects.filter(deleted__isnull=True).all()) == 4 - i
|
|
115 |
assert len(role_parenting_qs.all()) == 5
|
|
116 |
assert len(role_parenting_qs.filter(deleted__isnull=True).all()) == 4 - i
|
| 114 |
117 |
for i in range(5):
|
| 115 |
118 |
roles[9 - i].add_child(roles[i])
|
| 116 |
|
assert len(RoleParenting.objects.all()) == 5
|
| 117 |
|
assert len(RoleParenting.objects.filter(deleted__isnull=True).all()) == i + 1
|
|
119 |
assert len(role_parenting_qs.all()) == 5
|
|
120 |
assert len(role_parenting_qs.filter(deleted__isnull=True).all()) == i + 1
|
| 118 |
121 |
|
| 119 |
122 |
|
| 120 |
123 |
def test_role_parenting_soft_delete_parents(db):
|
| ... | ... | |
| 126 |
129 |
roles = []
|
| 127 |
130 |
for i in range(10):
|
| 128 |
131 |
roles.append(Role.objects.create(name='r%d' % i, ou=ou))
|
| 129 |
|
assert not len(RoleParenting.objects.all())
|
|
132 |
role_parenting_qs = RoleParenting.objects.filter(Q(parent__in=roles) | Q(child__in=roles))
|
|
133 |
assert not len(role_parenting_qs.all())
|
| 130 |
134 |
|
| 131 |
135 |
rps = []
|
| 132 |
136 |
for i in range(5):
|
| 133 |
137 |
rps.append(RoleParenting.objects.soft_create(child=roles[9 - i], parent=roles[i]))
|
| 134 |
|
assert len(RoleParenting.objects.all()) == 5
|
|
138 |
assert len(role_parenting_qs.all()) == 5
|
| 135 |
139 |
for i in range(5):
|
| 136 |
140 |
roles[9 - i].remove_parent(roles[i])
|
| 137 |
|
assert len(RoleParenting.objects.all()) == 5
|
| 138 |
|
assert len(RoleParenting.objects.filter(deleted__isnull=True).all()) == 4 - i
|
|
141 |
assert len(role_parenting_qs.all()) == 5
|
|
142 |
assert len(role_parenting_qs.filter(deleted__isnull=True).all()) == 4 - i
|
| 139 |
143 |
for i in range(5):
|
| 140 |
144 |
roles[9 - i].add_parent(roles[i])
|
| 141 |
|
assert len(RoleParenting.objects.all()) == 5
|
| 142 |
|
assert len(RoleParenting.objects.filter(deleted__isnull=True).all()) == i + 1
|
|
145 |
assert len(role_parenting_qs.all()) == 5
|
|
146 |
assert len(role_parenting_qs.filter(deleted__isnull=True).all()) == i + 1
|
| 143 |
147 |
|
| 144 |
148 |
|
| 145 |
149 |
SIZE = 50
|
| ... | ... | |
| 147 |
151 |
|
| 148 |
152 |
|
| 149 |
153 |
def test_massive_role_parenting(db):
|
|
154 |
Role.objects.all().delete()
|
|
155 |
|
| 150 |
156 |
user = User.objects.create(username='user')
|
| 151 |
157 |
roles = []
|
| 152 |
158 |
# Try a depth=10 tree of roles
|
| ... | ... | |
| 188 |
194 |
admin_op = models.Operation.objects.get(slug='admin')
|
| 189 |
195 |
perm1 = Permission.objects.create(operation=change_op, target_ct=ct_ct, target_id=role_ct.pk)
|
| 190 |
196 |
perm2 = Permission.objects.create(operation=view_op, target_ct=ct_ct, target_id=role_ct.pk)
|
|
197 |
Role.objects.all().delete()
|
| 191 |
198 |
role1 = Role.objects.create(name='role1')
|
| 192 |
199 |
role2 = Role.objects.create(name='role2', ou=ou1)
|
| 193 |
200 |
role1.permissions.add(perm1)
|
| ... | ... | |
| 203 |
210 |
ctx = CaptureQueriesContext(connection)
|
| 204 |
211 |
with ctx:
|
| 205 |
212 |
assert rbac_backend.get_all_permissions(user1) == {
|
| 206 |
|
'django_rbac.change_role',
|
| 207 |
|
'django_rbac.search_role',
|
| 208 |
|
'django_rbac.view_role',
|
|
213 |
'a2_rbac.change_role',
|
|
214 |
'a2_rbac.manage_members_role',
|
|
215 |
'a2_rbac.search_role',
|
|
216 |
'a2_rbac.view_role',
|
| 209 |
217 |
}
|
| 210 |
218 |
assert rbac_backend.get_all_permissions(user1, obj=role1) == {
|
| 211 |
|
'django_rbac.delete_role',
|
| 212 |
|
'django_rbac.change_role',
|
| 213 |
|
'django_rbac.search_role',
|
| 214 |
|
'django_rbac.view_role',
|
|
219 |
'a2_rbac.delete_role',
|
|
220 |
'a2_rbac.change_role',
|
|
221 |
'a2_rbac.manage_members_role',
|
|
222 |
'a2_rbac.search_role',
|
|
223 |
'a2_rbac.view_role',
|
| 215 |
224 |
}
|
| 216 |
225 |
assert rbac_backend.get_all_permissions(user1, obj=role2) == {
|
| 217 |
|
'django_rbac.change_role',
|
| 218 |
|
'django_rbac.view_role',
|
| 219 |
|
'django_rbac.search_role',
|
| 220 |
|
'django_rbac.add_role',
|
|
226 |
'a2_rbac.change_role',
|
|
227 |
'a2_rbac.view_role',
|
|
228 |
'a2_rbac.manage_members_role',
|
|
229 |
'a2_rbac.search_role',
|
|
230 |
'a2_rbac.add_role',
|
| 221 |
231 |
}
|
| 222 |
|
assert not rbac_backend.has_perm(user1, 'django_rbac.delete_role', obj=role2)
|
| 223 |
|
assert rbac_backend.has_perm(user1, 'django_rbac.delete_role', obj=role1)
|
|
232 |
assert not rbac_backend.has_perm(user1, 'a2_rbac.delete_role', obj=role2)
|
|
233 |
assert rbac_backend.has_perm(user1, 'a2_rbac.delete_role', obj=role1)
|
| 224 |
234 |
assert rbac_backend.has_perms(
|
| 225 |
|
user1, ['django_rbac.delete_role', 'django_rbac.change_role', 'django_rbac.view_role'], obj=role1
|
|
235 |
user1, ['a2_rbac.delete_role', 'a2_rbac.change_role', 'a2_rbac.view_role'], obj=role1
|
| 226 |
236 |
)
|
| 227 |
|
assert rbac_backend.has_module_perms(user1, 'django_rbac')
|
|
237 |
assert rbac_backend.has_module_perms(user1, 'a2_rbac')
|
| 228 |
238 |
assert not rbac_backend.has_module_perms(user1, 'contenttypes')
|
| 229 |
239 |
assert len(ctx.captured_queries) == 1
|
| 230 |
|
assert set(rbac_backend.filter_by_perm(user1, 'django_rbac.add_role', Role.objects.all())) == {role2}
|
| 231 |
|
assert set(rbac_backend.filter_by_perm(user1, 'django_rbac.delete_role', Role.objects.all())) == {role1}
|
|
240 |
assert set(rbac_backend.filter_by_perm(user1, 'a2_rbac.add_role', Role.objects.all())) == {role2}
|
|
241 |
assert set(rbac_backend.filter_by_perm(user1, 'a2_rbac.delete_role', Role.objects.all())) == {role1}
|
| 232 |
242 |
assert set(
|
| 233 |
|
rbac_backend.filter_by_perm(
|
| 234 |
|
user1, ['django_rbac.delete_role', 'django_rbac.add_role'], Role.objects.all()
|
| 235 |
|
)
|
|
243 |
rbac_backend.filter_by_perm(user1, ['a2_rbac.delete_role', 'a2_rbac.add_role'], Role.objects.all())
|
| 236 |
244 |
) == {role1, role2}
|
| 237 |
|
assert set(rbac_backend.filter_by_perm(user1, 'django_rbac.view_role', Role.objects.all())) == {
|
|
245 |
assert set(rbac_backend.filter_by_perm(user1, 'a2_rbac.view_role', Role.objects.all())) == {
|
| 238 |
246 |
role1,
|
| 239 |
247 |
role2,
|
| 240 |
248 |
}
|
| 241 |
|
assert set(rbac_backend.filter_by_perm(user1, 'django_rbac.change_role', Role.objects.all())) == {
|
|
249 |
assert set(rbac_backend.filter_by_perm(user1, 'a2_rbac.change_role', Role.objects.all())) == {
|
| 242 |
250 |
role1,
|
| 243 |
251 |
role2,
|
| 244 |
252 |
}
|
| ... | ... | |
| 247 |
255 |
user2 = User.objects.create(username='donald.knuth')
|
| 248 |
256 |
role3 = Role.objects.create(name='role3')
|
| 249 |
257 |
role3.members.add(user2)
|
| 250 |
|
perm5 = Permission.objects.create(operation=admin_op, target_ct=ct_ct, target_id=role_ct.pk)
|
|
258 |
perm5 = Permission.objects.filter(operation=admin_op, target_ct=ct_ct, target_id=role_ct.pk).first()
|
| 251 |
259 |
role3.permissions.add(perm5)
|
| 252 |
260 |
assert rbac_backend.get_all_permissions(user2) == {
|
| 253 |
|
'django_rbac.add_role',
|
| 254 |
|
'django_rbac.change_role',
|
| 255 |
|
'django_rbac.search_role',
|
| 256 |
|
'django_rbac.admin_role',
|
| 257 |
|
'django_rbac.view_role',
|
| 258 |
|
'django_rbac.delete_role',
|
|
261 |
'a2_rbac.activate_role',
|
|
262 |
'a2_rbac.add_role',
|
|
263 |
'a2_rbac.change_role',
|
|
264 |
'a2_rbac.change_email_role',
|
|
265 |
'a2_rbac.change_password_role',
|
|
266 |
'a2_rbac.search_role',
|
|
267 |
'a2_rbac.admin_role',
|
|
268 |
'a2_rbac.view_role',
|
|
269 |
'a2_rbac.delete_role',
|
|
270 |
'a2_rbac.manage_authorizations_role',
|
|
271 |
'a2_rbac.manage_members_role',
|
|
272 |
'a2_rbac.reset_password_role',
|
| 259 |
273 |
}
|
| 260 |
274 |
|
| 261 |
275 |
# test ous_with_perm
|
| 262 |
|
assert set(rbac_backend.ous_with_perm(user1, 'django_rbac.add_role')) == {ou1}
|
| 263 |
|
assert set(rbac_backend.ous_with_perm(user1, 'django_rbac.view_role')) == {ou1, ou2}
|
| 264 |
|
assert set(rbac_backend.ous_with_perm(user1, 'django_rbac.delete_role')) == set()
|
|
276 |
assert set(rbac_backend.ous_with_perm(user1, 'a2_rbac.add_role')) == {ou1}
|
|
277 |
assert set(rbac_backend.ous_with_perm(user1, 'a2_rbac.view_role')).issuperset({ou1, ou2})
|
|
278 |
assert set(rbac_backend.ous_with_perm(user1, 'a2_rbac.delete_role')) == set()
|
| 265 |
279 |
|
| 266 |
280 |
|
| 267 |
281 |
def test_all_members(db):
|
| ... | ... | |
| 295 |
309 |
|
| 296 |
310 |
import numpy as np
|
| 297 |
311 |
|
|
312 |
Role.objects.all().delete()
|
| 298 |
313 |
c = 15
|
| 299 |
314 |
roles = [Role.objects.create(id=i, name=f'role{i}') for i in range(c)]
|
| 300 |
315 |
m = [[False] * c for i in range(c)]
|
| 301 |
|
-
|