nexarch/connect/internal/datevapi/datevapi_policy_test.go

package datevapi

import (
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"

	"gitea.perlbach24.de/scripte/nexarch/common/policyclient"
)

func TestPolicy_PermissionAndRoleReachCore(t *testing.T) {
	type ask struct{ role, permission string }
	var got []ask
	policyAPI := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		var body struct {
			Role       string `json:"role"`
			Permission string `json:"permission"`
		}
		_ = json.NewDecoder(r.Body).Decode(&body)
		got = append(got, ask{body.Role, body.Permission})
		_ = json.NewEncoder(w).Encode(map[string]bool{"allowed": false})
	}))
	defer policyAPI.Close()
	mux := http.NewServeMux()
	(&Server{}).WithPolicy(policyclient.New(policyAPI.URL, "tok")).RegisterRoutes(mux)

	for _, c := range []struct{ method, role string }{{"GET", "tenant_admin"}, {"POST", ""}} {
		req := httptest.NewRequest(c.method, "/datev/exports", strings.NewReader("{}"))
		req.Header.Set("X-User-Id", "u1")
		req.Header.Set("X-Tenant-Slug", "acme")
		if c.role != "" {
			req.Header.Set("X-User-Role", c.role)
		}
		rec := httptest.NewRecorder()
		mux.ServeHTTP(rec, req)
		if rec.Code != http.StatusForbidden {
			t.Fatalf("%s: erwartet 403, bekam %d", c.method, rec.Code)
		}
	}
	want := []ask{{"tenant_admin", "connect.datev.read"}, {"user", "connect.datev.write"}}
	if len(got) != 2 || got[0] != want[0] || got[1] != want[1] {
		t.Fatalf("erwartet %v, bekam %v", want, got)
	}
}