|
24 | 24 | import java.time.OffsetDateTime; |
25 | 25 | import java.time.ZoneOffset; |
26 | 26 | import java.time.temporal.ChronoUnit; |
| 27 | +import java.util.List; |
27 | 28 | import java.util.concurrent.TimeUnit; |
28 | 29 | import java.util.function.BiConsumer; |
29 | 30 | import java.util.function.Predicate; |
|
34 | 35 | import static org.assertj.core.api.Assertions.assertThat; |
35 | 36 | import static org.assertj.core.api.Assertions.within; |
36 | 37 | import static org.awaitility.Awaitility.await; |
| 38 | +import static org.jooq.impl.DSL.role; |
37 | 39 |
|
38 | 40 | @QuarkusTest |
39 | 41 | @RequiredArgsConstructor |
@@ -553,6 +555,194 @@ void validUntil_updatesCorrectly() throws SQLException { |
553 | 555 | ).isNull(); |
554 | 556 | } |
555 | 557 |
|
| 558 | + @Test |
| 559 | + @DisplayName("When IN ROLE membership is changed, it should be updated in the database") |
| 560 | + void inRole_updatesCorrectly() throws SQLException { |
| 561 | + // given |
| 562 | + var clusterConnection = given.one() |
| 563 | + .clusterConnection() |
| 564 | + .withName("test-role-in-role") |
| 565 | + .returnFirst(); |
| 566 | + |
| 567 | + var dsl = postgreSQLContextFactory.getDSLContext(clusterConnection); |
| 568 | + |
| 569 | + var parentRole1 = "parent_role_1"; |
| 570 | + var parentRole2 = "parent_role_2"; |
| 571 | + |
| 572 | + dsl.execute("create role {0}", role(parentRole1)); |
| 573 | + dsl.execute("create role {0}", role(parentRole2)); |
| 574 | + |
| 575 | + var roleName = "test-role-in-role"; |
| 576 | + var role = buildRole( |
| 577 | + roleName, |
| 578 | + clusterConnection.getMetadata().getName(), |
| 579 | + /*login*/ false |
| 580 | + ); |
| 581 | + |
| 582 | + var spec = role.getSpec(); |
| 583 | + |
| 584 | + // 1. Add a parent role |
| 585 | + spec.getFlags().setInRole( |
| 586 | + List.of(parentRole1) |
| 587 | + ); |
| 588 | + |
| 589 | + // when |
| 590 | + var reconciled = applyRole(role); |
| 591 | + var initialGeneration = reconciled.getStatus().getObservedGeneration(); |
| 592 | + |
| 593 | + // then |
| 594 | + assertThat( |
| 595 | + RoleUtil.fetchCurrentFlags(dsl, spec).getInRole() |
| 596 | + ).containsExactly(parentRole1); |
| 597 | + |
| 598 | + // 2. Add another parent role and remove the first one |
| 599 | + spec.getFlags().setInRole( |
| 600 | + List.of(parentRole2) |
| 601 | + ); |
| 602 | + |
| 603 | + // when |
| 604 | + applyRole( |
| 605 | + role, |
| 606 | + r -> r.getStatus().getObservedGeneration() == initialGeneration + 1 |
| 607 | + ); |
| 608 | + |
| 609 | + // then |
| 610 | + assertThat( |
| 611 | + RoleUtil.fetchCurrentFlags(dsl, spec).getInRole() |
| 612 | + ).containsExactly(parentRole2); |
| 613 | + |
| 614 | + // 3. Remove all parent roles |
| 615 | + spec.getFlags().setInRole( |
| 616 | + List.of() |
| 617 | + ); |
| 618 | + |
| 619 | + // when |
| 620 | + applyRole( |
| 621 | + role, |
| 622 | + r -> r.getStatus().getObservedGeneration() == initialGeneration + 2 |
| 623 | + ); |
| 624 | + |
| 625 | + // then |
| 626 | + assertThat( |
| 627 | + RoleUtil.fetchCurrentFlags(dsl, spec).getInRole() |
| 628 | + ).isEmpty(); |
| 629 | + } |
| 630 | + |
| 631 | + @Test |
| 632 | + @DisplayName("When ROLE membership is changed, it should be updated in the database") |
| 633 | + void role_updatesCorrectly() throws SQLException { |
| 634 | + // given |
| 635 | + var clusterConnection = given.one() |
| 636 | + .clusterConnection() |
| 637 | + .withName("test-role-role") |
| 638 | + .returnFirst(); |
| 639 | + |
| 640 | + var dsl = postgreSQLContextFactory.getDSLContext(clusterConnection); |
| 641 | + |
| 642 | + var memberRole1 = "member_role_1"; |
| 643 | + var memberRole2 = "member_role_2"; |
| 644 | + |
| 645 | + dsl.execute("create role {0}", role(memberRole1)); |
| 646 | + dsl.execute("create role {0}", role(memberRole2)); |
| 647 | + |
| 648 | + var roleName = "test-role-role"; |
| 649 | + var role = buildRole( |
| 650 | + roleName, |
| 651 | + clusterConnection.getMetadata().getName(), |
| 652 | + /*login*/ false |
| 653 | + ); |
| 654 | + |
| 655 | + var spec = role.getSpec(); |
| 656 | + |
| 657 | + // 1. Add a member role |
| 658 | + spec.getFlags().setRole( |
| 659 | + List.of(memberRole1) |
| 660 | + ); |
| 661 | + |
| 662 | + // when |
| 663 | + var reconciled = applyRole(role); |
| 664 | + var initialGeneration = reconciled.getStatus().getObservedGeneration(); |
| 665 | + |
| 666 | + // then |
| 667 | + assertThat( |
| 668 | + RoleUtil.fetchCurrentFlags(dsl, spec).getRole() |
| 669 | + ).containsExactly(memberRole1); |
| 670 | + |
| 671 | + // 2. Add another member role and remove the first one |
| 672 | + spec.getFlags().setRole( |
| 673 | + List.of(memberRole2) |
| 674 | + ); |
| 675 | + |
| 676 | + // when |
| 677 | + applyRole( |
| 678 | + role, |
| 679 | + r -> r.getStatus().getObservedGeneration() == initialGeneration + 1 |
| 680 | + ); |
| 681 | + |
| 682 | + // then |
| 683 | + assertThat( |
| 684 | + RoleUtil.fetchCurrentFlags(dsl, spec).getRole() |
| 685 | + ).containsExactly(memberRole2); |
| 686 | + |
| 687 | + // 3. Remove all member roles |
| 688 | + spec.getFlags().setRole( |
| 689 | + List.of() |
| 690 | + ); |
| 691 | + |
| 692 | + // when |
| 693 | + applyRole( |
| 694 | + role, |
| 695 | + r -> r.getStatus().getObservedGeneration() == initialGeneration + 2 |
| 696 | + ); |
| 697 | + |
| 698 | + // then |
| 699 | + assertThat( |
| 700 | + RoleUtil.fetchCurrentFlags(dsl, spec).getRole() |
| 701 | + ).isEmpty(); |
| 702 | + } |
| 703 | + |
| 704 | + @Test |
| 705 | + @DisplayName("When multiple ROLE memberships are added, they should be sorted and updated correctly") |
| 706 | + void role_multipleMemberships_updatesCorrectly() throws SQLException { |
| 707 | + // given |
| 708 | + var clusterConnection = given.one() |
| 709 | + .clusterConnection() |
| 710 | + .withName("test-role-multiple") |
| 711 | + .returnFirst(); |
| 712 | + |
| 713 | + var dsl = postgreSQLContextFactory.getDSLContext(clusterConnection); |
| 714 | + |
| 715 | + var roleA = "role_a"; |
| 716 | + var roleB = "role_b"; |
| 717 | + var roleC = "role_c"; |
| 718 | + |
| 719 | + dsl.execute("create role {0}", role(roleA)); |
| 720 | + dsl.execute("create role {0}", role(roleB)); |
| 721 | + dsl.execute("create role {0}", role(roleC)); |
| 722 | + |
| 723 | + var roleName = "test-role-multiple"; |
| 724 | + var role = buildRole( |
| 725 | + roleName, |
| 726 | + clusterConnection.getMetadata().getName(), |
| 727 | + /*login*/ false |
| 728 | + ); |
| 729 | + |
| 730 | + var spec = role.getSpec(); |
| 731 | + |
| 732 | + // Add multiple roles out of order |
| 733 | + spec.getFlags().setInRole( |
| 734 | + List.of(roleC, roleA, roleB) |
| 735 | + ); |
| 736 | + |
| 737 | + // when |
| 738 | + applyRole(role); |
| 739 | + |
| 740 | + // then |
| 741 | + assertThat( |
| 742 | + RoleUtil.fetchCurrentFlags(dsl, spec).getInRole() |
| 743 | + ).containsExactly(roleA, roleB, roleC); |
| 744 | + } |
| 745 | + |
556 | 746 | private <T> T getRoleFlagValue( |
557 | 747 | DSLContext dsl, |
558 | 748 | String roleName, |
|
0 commit comments