Merge branch 'feature/rbac-02-policy-enforcement-schicht-zentral' into feature/qa-04-sicherheits-penetrationspruefung-core
# Conflicts: # scripts/reset-test-env.sh
This commit is contained in:
sysops
@@ -0,0 +1,67 @@
|
||||
package policy
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
|
||||
"gitea.perlbach24.de/scripte/nexarch/internal/rbac"
|
||||
)
|
||||
|
||||
// ErrDenied wird geliefert, wenn keine Regel role+permission erlaubt —
|
||||
// Default-Deny (Akzeptanzkriterium 2).
|
||||
var ErrDenied = errors.New("policy: zugriff verweigert")
|
||||
|
||||
// Enforcer ist die EINE zentrale Entscheidungs- und Durchsetzungsschicht
|
||||
// (Akzeptanzkriterium 1). Repository-/Query-Code ruft ausschliesslich Guard
|
||||
// bzw. GuardTenantScoped auf, nie eine Rohabfrage direkt.
|
||||
type Enforcer struct {
|
||||
store *Store
|
||||
}
|
||||
|
||||
func NewEnforcer(store *Store) *Enforcer {
|
||||
return &Enforcer{store: store}
|
||||
}
|
||||
|
||||
// Authorize entscheidet erlaubt/verboten — unabhaengig von jeder konkreten
|
||||
// Query, rein anhand der deklarativen Regeln (Akzeptanzkriterium 2: fuer
|
||||
// sich genommen testbar, ohne Anwendungslogik).
|
||||
func (e *Enforcer) Authorize(ctx context.Context, role rbac.Role, perm rbac.Permission) error {
|
||||
allowed, err := e.store.IsAllowed(ctx, role, perm)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if !allowed {
|
||||
return fmt.Errorf("%w: rolle %q hat kein recht %q", ErrDenied, role, perm)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// Guard ist die zentrale Enforcement-Funktion (Akzeptanzkriterium 1): query
|
||||
// wird NUR aufgerufen, wenn Authorize zustimmt. Es gibt keinen Weg, query
|
||||
// ausserhalb von Guard aufzurufen und trotzdem den Aufrufer als autorisiert
|
||||
// zu behandeln — die Autorisierungsentscheidung steht immer VOR dem
|
||||
// Datenzugriff, nie danach.
|
||||
func Guard[T any](ctx context.Context, e *Enforcer, role rbac.Role, perm rbac.Permission, query func(ctx context.Context) (T, error)) (T, error) {
|
||||
var zero T
|
||||
if err := e.Authorize(ctx, role, perm); err != nil {
|
||||
return zero, err
|
||||
}
|
||||
return query(ctx)
|
||||
}
|
||||
|
||||
// GuardTenantScoped erzwingt zusaetzlich, dass tenantSlug TEIL der Query-
|
||||
// Funktion selbst ist (Akzeptanzkriterium 3): der Funktionstyp verlangt,
|
||||
// dass die Repository-Implementierung tenantSlug in ihre eigene WHERE-
|
||||
// Klausel einbaut — ein nachgelagerter Filter auf dem Ergebnis (der
|
||||
// archivmail-Fehler aus "Bekannte Fehler vermeiden") ist mit dieser
|
||||
// Signatur nicht moeglich, da die Query-Funktion tenantSlug selbst
|
||||
// entgegennimmt und dafuer verantwortlich ist, statt ihn hinterher
|
||||
// anzuwenden.
|
||||
func GuardTenantScoped[T any](ctx context.Context, e *Enforcer, role rbac.Role, perm rbac.Permission, tenantSlug string, query func(ctx context.Context, tenantSlug string) (T, error)) (T, error) {
|
||||
var zero T
|
||||
if err := e.Authorize(ctx, role, perm); err != nil {
|
||||
return zero, err
|
||||
}
|
||||
return query(ctx, tenantSlug)
|
||||
}
|
||||
@@ -0,0 +1,187 @@
|
||||
package policy
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"os"
|
||||
"testing"
|
||||
|
||||
"github.com/jackc/pgx/v5/pgxpool"
|
||||
|
||||
"gitea.perlbach24.de/scripte/nexarch/internal/rbac"
|
||||
)
|
||||
|
||||
func setupTest(t *testing.T) (*Store, *Enforcer, func()) {
|
||||
t.Helper()
|
||||
adminDSN := os.Getenv("TEST_ADMIN_DSN")
|
||||
if adminDSN == "" {
|
||||
t.Skip("TEST_ADMIN_DSN nicht gesetzt, Integrationstest uebersprungen")
|
||||
}
|
||||
ctx := context.Background()
|
||||
|
||||
pool, err := pgxpool.New(ctx, adminDSN)
|
||||
if err != nil {
|
||||
t.Fatalf("pool: %v", err)
|
||||
}
|
||||
if _, err := pool.Exec(ctx, `
|
||||
CREATE TABLE IF NOT EXISTS policy_rules (
|
||||
role TEXT NOT NULL, permission TEXT NOT NULL,
|
||||
granted_by TEXT NOT NULL, granted_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
||||
PRIMARY KEY (role, permission)
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS policy_rule_changes (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(), role TEXT NOT NULL, permission TEXT NOT NULL,
|
||||
action TEXT NOT NULL CHECK (action IN ('grant','revoke')), actor TEXT NOT NULL,
|
||||
version INT NOT NULL, changed_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
`); err != nil {
|
||||
t.Fatalf("schema: %v", err)
|
||||
}
|
||||
|
||||
store := NewStore(pool)
|
||||
cleanup := func() {
|
||||
_, _ = pool.Exec(ctx, `DELETE FROM policy_rule_changes WHERE role LIKE 'test\_%' ESCAPE '\'`)
|
||||
_, _ = pool.Exec(ctx, `DELETE FROM policy_rules WHERE role LIKE 'test\_%' ESCAPE '\'`)
|
||||
pool.Close()
|
||||
}
|
||||
return store, NewEnforcer(store), cleanup
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 2 + Pruefung 2: Anfrage ohne passende Policy wird
|
||||
// zuverlaessig abgewiesen (Default-Deny), nicht standardmaessig erlaubt.
|
||||
func TestAuthorize_DefaultDeny(t *testing.T) {
|
||||
_, enforcer, cleanup := setupTest(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
err := enforcer.Authorize(ctx, rbac.Role("test_niemand"), rbac.Permission("test_irgendwas"))
|
||||
if !errors.Is(err, ErrDenied) {
|
||||
t.Fatalf("erwartet ErrDenied ohne konfigurierte regel, habe %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 1 + Pruefung 1: Guard ruft query NUR bei Autorisierung
|
||||
// auf — kein Datenzugriffs-Pfad umgeht die Enforcement-Schicht.
|
||||
func TestGuard_NeverCallsQueryWithoutAuthorization(t *testing.T) {
|
||||
store, enforcer, cleanup := setupTest(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
role := rbac.Role("test_rolle_guard")
|
||||
perm := rbac.Permission("test_lesen")
|
||||
|
||||
queryCalled := false
|
||||
_, err := Guard(ctx, enforcer, role, perm, func(ctx context.Context) (string, error) {
|
||||
queryCalled = true
|
||||
return "geheime-daten", nil
|
||||
})
|
||||
if !errors.Is(err, ErrDenied) {
|
||||
t.Fatalf("erwartet ErrDenied, habe %v", err)
|
||||
}
|
||||
if queryCalled {
|
||||
t.Fatal("query haette bei fehlender autorisierung NICHT aufgerufen werden duerfen")
|
||||
}
|
||||
|
||||
if err := store.Grant(ctx, role, perm, "admin@example.com"); err != nil {
|
||||
t.Fatalf("grant: %v", err)
|
||||
}
|
||||
|
||||
result, err := Guard(ctx, enforcer, role, perm, func(ctx context.Context) (string, error) {
|
||||
queryCalled = true
|
||||
return "geheime-daten", nil
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatalf("guard nach grant: %v", err)
|
||||
}
|
||||
if !queryCalled || result != "geheime-daten" {
|
||||
t.Fatalf("erwartet query-aufruf mit ergebnis nach autorisierung, habe queryCalled=%v result=%q", queryCalled, result)
|
||||
}
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 2 + 3: Policy-Entscheidungen deklarativ und unabhaengig
|
||||
// von Anwendungslogik testbar — Regelwechsel wirkt ohne Codeaenderung,
|
||||
// Historie ist versioniert nachvollziehbar.
|
||||
func TestGrantRevoke_ChangesBehaviorWithoutCodeChange(t *testing.T) {
|
||||
store, enforcer, cleanup := setupTest(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
role := rbac.Role("test_rolle_history")
|
||||
perm := rbac.Permission("test_schreiben")
|
||||
|
||||
allowed, err := store.IsAllowed(ctx, role, perm)
|
||||
if err != nil {
|
||||
t.Fatalf("is allowed (vorher): %v", err)
|
||||
}
|
||||
if allowed {
|
||||
t.Fatal("erwartet nicht erlaubt vor grant")
|
||||
}
|
||||
|
||||
if err := store.Grant(ctx, role, perm, "admin@example.com"); err != nil {
|
||||
t.Fatalf("grant: %v", err)
|
||||
}
|
||||
if err := enforcer.Authorize(ctx, role, perm); err != nil {
|
||||
t.Fatalf("authorize nach grant sollte erlauben: %v", err)
|
||||
}
|
||||
|
||||
if err := store.Revoke(ctx, role, perm, "admin@example.com"); err != nil {
|
||||
t.Fatalf("revoke: %v", err)
|
||||
}
|
||||
if err := enforcer.Authorize(ctx, role, perm); !errors.Is(err, ErrDenied) {
|
||||
t.Fatalf("authorize nach revoke sollte verweigern, habe %v", err)
|
||||
}
|
||||
|
||||
history, err := store.History(ctx, role, perm)
|
||||
if err != nil {
|
||||
t.Fatalf("history: %v", err)
|
||||
}
|
||||
if len(history) != 2 {
|
||||
t.Fatalf("erwartet 2 historieneintraege (grant, revoke), habe %d", len(history))
|
||||
}
|
||||
if history[0].Action != "grant" || history[0].Version != 1 {
|
||||
t.Fatalf("history[0] unerwartet: %+v", history[0])
|
||||
}
|
||||
if history[1].Action != "revoke" || history[1].Version != 2 {
|
||||
t.Fatalf("history[1] unerwartet: %+v", history[1])
|
||||
}
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 3 + Pruefung 3 (Tenant-Scoping): GuardTenantScoped
|
||||
// zwingt tenantSlug in die Query-Funktion selbst, kein Post-Filter moeglich.
|
||||
func TestGuardTenantScoped_IsolatesDataBetweenTenants(t *testing.T) {
|
||||
_, enforcer, cleanup := setupTest(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
// Simuliertes Repository: die WHERE-Klausel (hier: Map-Lookup) liegt
|
||||
// INNERHALB der Query-Funktion, nicht als nachgelagerter Filter.
|
||||
data := map[string][]string{
|
||||
"acme": {"dokument-a1", "dokument-a2"},
|
||||
"globex": {"dokument-b1"},
|
||||
}
|
||||
repoQuery := func(ctx context.Context, tenantSlug string) ([]string, error) {
|
||||
return data[tenantSlug], nil
|
||||
}
|
||||
|
||||
role := rbac.Role("test_tenant_rolle")
|
||||
perm := rbac.Permission("test_dokumente_lesen")
|
||||
if err := enforcer.store.Grant(ctx, role, perm, "admin@example.com"); err != nil {
|
||||
t.Fatalf("grant: %v", err)
|
||||
}
|
||||
|
||||
gotAcme, err := GuardTenantScoped(ctx, enforcer, role, perm, "acme", repoQuery)
|
||||
if err != nil {
|
||||
t.Fatalf("guard tenant scoped (acme): %v", err)
|
||||
}
|
||||
if len(gotAcme) != 2 {
|
||||
t.Fatalf("erwartet 2 dokumente fuer acme, habe %d", len(gotAcme))
|
||||
}
|
||||
|
||||
gotGlobex, err := GuardTenantScoped(ctx, enforcer, role, perm, "globex", repoQuery)
|
||||
if err != nil {
|
||||
t.Fatalf("guard tenant scoped (globex): %v", err)
|
||||
}
|
||||
if len(gotGlobex) != 1 {
|
||||
t.Fatalf("erwartet 1 dokument fuer globex, habe %d", len(gotGlobex))
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,124 @@
|
||||
// Package policy implementiert Core RBAC-02: die zentrale Policy-
|
||||
// Entscheidungs- und Durchsetzungsschicht. Regeln liegen deklarativ in der
|
||||
// Datenbank (Casbin-Prinzip: Policy als Modell+Regeln getrennt vom Code),
|
||||
// versioniert und auditierbar — anders als Casbin-Dateien im Dateisystem
|
||||
// (siehe "bewusst vermeiden" im Ticket).
|
||||
package policy
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
|
||||
"github.com/jackc/pgx/v5/pgxpool"
|
||||
|
||||
"gitea.perlbach24.de/scripte/nexarch/internal/rbac"
|
||||
)
|
||||
|
||||
// Rule ist eine gewaehrte Regel: role darf permission.
|
||||
type Rule struct {
|
||||
Role rbac.Role
|
||||
Permission rbac.Permission
|
||||
}
|
||||
|
||||
// RuleChange ist ein Eintrag der Aenderungshistorie (Akzeptanzkriterium 3).
|
||||
type RuleChange struct {
|
||||
Role rbac.Role
|
||||
Permission rbac.Permission
|
||||
Action string // "grant" oder "revoke"
|
||||
Actor string
|
||||
Version int
|
||||
}
|
||||
|
||||
// Store verwaltet den deklarativen Regelsatz. IsAllowed schaut NUR in die
|
||||
// Datenbank — es gibt keinen hartcodierten Go-Fallback, ein Regelwechsel
|
||||
// wirkt sich ohne Codeaenderung sofort aus (Akzeptanzkriterium 2 / 3).
|
||||
type Store struct {
|
||||
pool *pgxpool.Pool
|
||||
}
|
||||
|
||||
func NewStore(pool *pgxpool.Pool) *Store {
|
||||
return &Store{pool: pool}
|
||||
}
|
||||
|
||||
// IsAllowed prueft, ob role das Recht permission besitzt. Default-Deny:
|
||||
// existiert keine passende Regel, ist der Zugriff verboten
|
||||
// (Akzeptanzkriterium 2 / Pruefung 2) — es gibt keinen impliziten
|
||||
// "erlaubt, wenn nichts anderes gesagt"-Pfad.
|
||||
func (s *Store) IsAllowed(ctx context.Context, role rbac.Role, perm rbac.Permission) (bool, error) {
|
||||
var exists bool
|
||||
err := s.pool.QueryRow(ctx, `
|
||||
SELECT EXISTS(SELECT 1 FROM policy_rules WHERE role = $1 AND permission = $2)
|
||||
`, string(role), string(perm)).Scan(&exists)
|
||||
if err != nil {
|
||||
return false, fmt.Errorf("policy pruefen: %w", err)
|
||||
}
|
||||
return exists, nil
|
||||
}
|
||||
|
||||
// Grant gewaehrt role das Recht permission — deklarativ, ohne Codeaenderung
|
||||
// wirksam. actor wird fuer die Aenderungshistorie festgehalten.
|
||||
func (s *Store) Grant(ctx context.Context, role rbac.Role, perm rbac.Permission, actor string) error {
|
||||
return s.change(ctx, role, perm, "grant", actor, `
|
||||
INSERT INTO policy_rules (role, permission, granted_by, granted_at)
|
||||
VALUES ($1, $2, $3, now())
|
||||
ON CONFLICT (role, permission) DO UPDATE SET granted_by = $3, granted_at = now()
|
||||
`, string(role), string(perm), actor)
|
||||
}
|
||||
|
||||
// Revoke entzieht role das Recht permission.
|
||||
func (s *Store) Revoke(ctx context.Context, role rbac.Role, perm rbac.Permission, actor string) error {
|
||||
return s.change(ctx, role, perm, "revoke", actor, `
|
||||
DELETE FROM policy_rules WHERE role = $1 AND permission = $2
|
||||
`, string(role), string(perm))
|
||||
}
|
||||
|
||||
func (s *Store) change(ctx context.Context, role rbac.Role, perm rbac.Permission, action, actor, sql string, args ...any) error {
|
||||
tx, err := s.pool.Begin(ctx)
|
||||
if err != nil {
|
||||
return fmt.Errorf("transaktion starten: %w", err)
|
||||
}
|
||||
defer func() { _ = tx.Rollback(ctx) }()
|
||||
|
||||
if _, err := tx.Exec(ctx, sql, args...); err != nil {
|
||||
return fmt.Errorf("regel aendern: %w", err)
|
||||
}
|
||||
|
||||
var version int
|
||||
if err := tx.QueryRow(ctx, `
|
||||
SELECT COALESCE(MAX(version), 0) + 1 FROM policy_rule_changes WHERE role = $1 AND permission = $2
|
||||
`, string(role), string(perm)).Scan(&version); err != nil {
|
||||
return fmt.Errorf("naechste version ermitteln: %w", err)
|
||||
}
|
||||
|
||||
if _, err := tx.Exec(ctx, `
|
||||
INSERT INTO policy_rule_changes (role, permission, action, actor, version, changed_at)
|
||||
VALUES ($1, $2, $3, $4, $5, now())
|
||||
`, string(role), string(perm), action, actor, version); err != nil {
|
||||
return fmt.Errorf("historie schreiben: %w", err)
|
||||
}
|
||||
|
||||
return tx.Commit(ctx)
|
||||
}
|
||||
|
||||
// History liefert die vollstaendige, versionierte Aenderungshistorie einer
|
||||
// Regel (Akzeptanzkriterium 3).
|
||||
func (s *Store) History(ctx context.Context, role rbac.Role, perm rbac.Permission) ([]RuleChange, error) {
|
||||
rows, err := s.pool.Query(ctx, `
|
||||
SELECT action, actor, version FROM policy_rule_changes
|
||||
WHERE role = $1 AND permission = $2 ORDER BY version
|
||||
`, string(role), string(perm))
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("historie abfragen: %w", err)
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
var out []RuleChange
|
||||
for rows.Next() {
|
||||
c := RuleChange{Role: role, Permission: perm}
|
||||
if err := rows.Scan(&c.Action, &c.Actor, &c.Version); err != nil {
|
||||
return nil, fmt.Errorf("historieneintrag lesen: %w", err)
|
||||
}
|
||||
out = append(out, c)
|
||||
}
|
||||
return out, rows.Err()
|
||||
}
|
||||
@@ -0,0 +1,48 @@
|
||||
package rbac
|
||||
|
||||
import "testing"
|
||||
|
||||
func contains(perms []Permission, p Permission) bool {
|
||||
for _, x := range perms {
|
||||
if x == p {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 2 + Pruefung 2: Rollenhierarchie liefert die erwartete
|
||||
// effektive Rechtemenge.
|
||||
func TestEffectivePermissions_Inheritance(t *testing.T) {
|
||||
userPerms := EffectivePermissions(RoleUser)
|
||||
if !contains(userPerms, PermSelfRead) || !contains(userPerms, PermSelfUpdate) {
|
||||
t.Fatalf("user sollte self.read/self.update haben, habe %v", userPerms)
|
||||
}
|
||||
if contains(userPerms, PermManageUsers) {
|
||||
t.Fatal("user sollte KEIN tenant.manage_users haben")
|
||||
}
|
||||
|
||||
adminPerms := EffectivePermissions(RoleTenantAdmin)
|
||||
if !contains(adminPerms, PermSelfRead) || !contains(adminPerms, PermManageUsers) || !contains(adminPerms, PermManageSettings) {
|
||||
t.Fatalf("tenant_admin sollte geerbte user-rechte + eigene rechte haben, habe %v", adminPerms)
|
||||
}
|
||||
if contains(adminPerms, PermManageTenants) {
|
||||
t.Fatal("tenant_admin sollte KEIN platform.manage_tenants haben")
|
||||
}
|
||||
|
||||
superPerms := EffectivePermissions(RoleSuperadmin)
|
||||
for _, want := range []Permission{PermSelfRead, PermSelfUpdate, PermManageUsers, PermManageSettings, PermManageTenants} {
|
||||
if !contains(superPerms, want) {
|
||||
t.Fatalf("superadmin sollte %q haben (volle vererbte kette), habe %v", want, superPerms)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestHasPermission(t *testing.T) {
|
||||
if !HasPermission(RoleTenantAdmin, PermSelfRead) {
|
||||
t.Fatal("tenant_admin sollte geerbtes self.read haben")
|
||||
}
|
||||
if HasPermission(RoleUser, PermManageTenants) {
|
||||
t.Fatal("user sollte platform.manage_tenants nicht haben")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,144 @@
|
||||
package rbac
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"os"
|
||||
"testing"
|
||||
|
||||
"github.com/jackc/pgx/v5/pgxpool"
|
||||
|
||||
"gitea.perlbach24.de/scripte/nexarch/internal/user"
|
||||
)
|
||||
|
||||
func setupStoreTest(t *testing.T) (*Store, string, func()) {
|
||||
t.Helper()
|
||||
adminDSN := os.Getenv("TEST_ADMIN_DSN")
|
||||
if adminDSN == "" {
|
||||
t.Skip("TEST_ADMIN_DSN nicht gesetzt, Integrationstest uebersprungen")
|
||||
}
|
||||
ctx := context.Background()
|
||||
|
||||
pool, err := pgxpool.New(ctx, adminDSN)
|
||||
if err != nil {
|
||||
t.Fatalf("pool: %v", err)
|
||||
}
|
||||
if _, err := pool.Exec(ctx, `
|
||||
CREATE TABLE IF NOT EXISTS users (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
email TEXT NOT NULL UNIQUE,
|
||||
name TEXT NOT NULL,
|
||||
status TEXT NOT NULL DEFAULT 'active',
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
||||
updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS role_assignments (
|
||||
user_id UUID PRIMARY KEY REFERENCES users(id),
|
||||
role TEXT NOT NULL CHECK (role IN ('user', 'tenant_admin')),
|
||||
granted_by TEXT NOT NULL,
|
||||
granted_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS role_assignment_history (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
user_id UUID NOT NULL,
|
||||
role TEXT NOT NULL,
|
||||
granted_by TEXT NOT NULL,
|
||||
granted_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
`); err != nil {
|
||||
t.Fatalf("schema: %v", err)
|
||||
}
|
||||
|
||||
userStore := user.NewTenantUserStore(pool)
|
||||
u, err := userStore.Create(ctx, "rbac_test@example.com", "RBAC Test")
|
||||
if err != nil {
|
||||
t.Fatalf("testuser anlegen: %v", err)
|
||||
}
|
||||
|
||||
cleanup := func() {
|
||||
_, _ = pool.Exec(ctx, `DELETE FROM role_assignment_history WHERE user_id = $1`, u.ID)
|
||||
_, _ = pool.Exec(ctx, `DELETE FROM role_assignments WHERE user_id = $1`, u.ID)
|
||||
_, _ = pool.Exec(ctx, `DELETE FROM users WHERE id = $1`, u.ID)
|
||||
pool.Close()
|
||||
}
|
||||
return NewStore(pool), u.ID, cleanup
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 1: Grundrollen sind einem Benutzer je Tenant zuweisbar.
|
||||
func TestStore_AssignAndGet(t *testing.T) {
|
||||
store, userID, cleanup := setupStoreTest(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
assigned, err := store.Assign(ctx, userID, RoleTenantAdmin, "admin@acme.example")
|
||||
if err != nil {
|
||||
t.Fatalf("assign: %v", err)
|
||||
}
|
||||
if assigned.Role != RoleTenantAdmin {
|
||||
t.Fatalf("erwartet tenant_admin, habe %q", assigned.Role)
|
||||
}
|
||||
|
||||
got, err := store.Get(ctx, userID)
|
||||
if err != nil {
|
||||
t.Fatalf("get: %v", err)
|
||||
}
|
||||
if got.Role != RoleTenantAdmin || got.GrantedBy != "admin@acme.example" {
|
||||
t.Fatalf("zuweisung unerwartet: %+v", got)
|
||||
}
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 1 + Pruefung 1: Zuweisung ausserhalb der erlaubten
|
||||
// Matrix (superadmin im tenant-gescopten Store) wird abgewiesen.
|
||||
func TestStore_RejectsSuperadminOutsideAllowedMatrix(t *testing.T) {
|
||||
store, userID, cleanup := setupStoreTest(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
_, err := store.Assign(ctx, userID, RoleSuperadmin, "admin@acme.example")
|
||||
if !errors.Is(err, ErrRoleNotAssignableInTenantScope) {
|
||||
t.Fatalf("erwartet ErrRoleNotAssignableInTenantScope, habe %v", err)
|
||||
}
|
||||
|
||||
// Sicherstellen, dass der abgewiesene Versuch keine Zeile hinterlassen hat.
|
||||
if _, err := store.Get(ctx, userID); !errors.Is(err, ErrNotFound) {
|
||||
t.Fatalf("erwartet ErrNotFound nach abgewiesener zuweisung, habe %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestStore_RejectsUnknownRole(t *testing.T) {
|
||||
store, userID, cleanup := setupStoreTest(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
if _, err := store.Assign(ctx, userID, Role("erfunden"), "admin@acme.example"); !errors.Is(err, ErrRoleNotAssignableInTenantScope) {
|
||||
t.Fatalf("erwartet ErrRoleNotAssignableInTenantScope fuer unbekannte rolle, habe %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 3: Rollenzuweisung vollstaendig auditierbar.
|
||||
func TestStore_HistoryTracksWhoAndWhen(t *testing.T) {
|
||||
store, userID, cleanup := setupStoreTest(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
if _, err := store.Assign(ctx, userID, RoleUser, "system"); err != nil {
|
||||
t.Fatalf("assign 1: %v", err)
|
||||
}
|
||||
if _, err := store.Assign(ctx, userID, RoleTenantAdmin, "admin@acme.example"); err != nil {
|
||||
t.Fatalf("assign 2: %v", err)
|
||||
}
|
||||
|
||||
history, err := store.History(ctx, userID)
|
||||
if err != nil {
|
||||
t.Fatalf("history: %v", err)
|
||||
}
|
||||
if len(history) != 2 {
|
||||
t.Fatalf("erwartet 2 historieneintraege, habe %d", len(history))
|
||||
}
|
||||
if history[0].Role != RoleUser || history[0].GrantedBy != "system" {
|
||||
t.Fatalf("history[0] unerwartet: %+v", history[0])
|
||||
}
|
||||
if history[1].Role != RoleTenantAdmin || history[1].GrantedBy != "admin@acme.example" {
|
||||
t.Fatalf("history[1] unerwartet: %+v", history[1])
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,2 @@
|
||||
DROP TABLE IF EXISTS policy_rule_changes;
|
||||
DROP TABLE IF EXISTS policy_rules;
|
||||
@@ -0,0 +1,24 @@
|
||||
-- Zentrale, deklarative Policy-Regeln (RBAC-02, siehe core-kanban/tickets/RBAC-02.md).
|
||||
-- policy_rules haelt den AKTUELLEN, gewaehrten Regelsatz (Existenz = erlaubt,
|
||||
-- Default-Deny fuer alles ohne Zeile). policy_rule_changes ist die
|
||||
-- versionierte Aenderungshistorie (Akzeptanzkriterium 3: Regelwechsel ohne
|
||||
-- Codeaenderung nachvollziehbar).
|
||||
CREATE TABLE policy_rules (
|
||||
role TEXT NOT NULL,
|
||||
permission TEXT NOT NULL,
|
||||
granted_by TEXT NOT NULL,
|
||||
granted_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
||||
PRIMARY KEY (role, permission)
|
||||
);
|
||||
|
||||
CREATE TABLE policy_rule_changes (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
role TEXT NOT NULL,
|
||||
permission TEXT NOT NULL,
|
||||
action TEXT NOT NULL CHECK (action IN ('grant', 'revoke')),
|
||||
actor TEXT NOT NULL,
|
||||
version INT NOT NULL,
|
||||
changed_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
|
||||
CREATE INDEX policy_rule_changes_idx ON policy_rule_changes (role, permission, version);
|
||||
Reference in New Issue
Block a user