mirror of
https://github.com/navidrome/navidrome.git
synced 2026-10-08 02:17:25 +02:00
0628721006
- Fold Allowed into Expand and drop the ErrInsufficientScope sentinel; the gate's scopeError is now the only source of insufficient_scope. - Replace the two-value authKind with a public flag, inline loadUser, and pass the grant to touch. - Read a declared request body once before validation, so the JSON checks and the handler no longer depend on kin-openapi restoring the exact bytes. - Merge the Service tests into one file and drop specs that only covered the removed liveness cache. The revoked-during-password-change spec now revokes after the gate authenticates, so it reaches ChangePassword again. Signed-off-by: Deluan <deluan@navidrome.org>
50 lines
1.8 KiB
Go
50 lines
1.8 KiB
Go
package apiauth
|
|
|
|
import (
|
|
. "github.com/onsi/ginkgo/v2"
|
|
. "github.com/onsi/gomega"
|
|
)
|
|
|
|
var _ = Describe("scopes", func() {
|
|
BeforeEach(func() {
|
|
saved := KnownScopes
|
|
KnownScopes = []string{ScopeRead, ScopePassword, ScopeAdmin, "playlists", "playlists:write"}
|
|
DeferCleanup(func() { KnownScopes = saved })
|
|
})
|
|
|
|
Describe("Entitled", func() {
|
|
It("stores all when nothing is requested", func() {
|
|
Expect(Entitled(nil, false)).To(Equal([]string{ScopeAll}))
|
|
})
|
|
It("drops unknown scopes and admin for non-admins", func() {
|
|
Expect(Entitled([]string{"read", "future", "admin"}, false)).To(Equal([]string{"read"}))
|
|
})
|
|
It("keeps admin for admins and keeps all", func() {
|
|
Expect(Entitled([]string{"admin", "all"}, true)).To(Equal([]string{"admin", "all"}))
|
|
})
|
|
})
|
|
|
|
Describe("Expand", func() {
|
|
It("replaces all with every known scope except admin for non-admins", func() {
|
|
Expect(Expand([]string{ScopeAll}, false)).To(Equal([]string{"password", "playlists", "playlists:write", "read"}))
|
|
})
|
|
It("includes admin for admins", func() {
|
|
Expect(Expand([]string{ScopeAll}, true)).To(ContainElement("admin"))
|
|
})
|
|
It("drops admin from explicit scopes when the user is no longer an admin", func() {
|
|
Expect(Expand([]string{"admin", "read"}, false)).To(Equal([]string{"read"}))
|
|
})
|
|
It("drops scopes that are no longer known", func() {
|
|
Expect(Expand([]string{"read", "retired"}, false)).To(Equal([]string{"read"}))
|
|
})
|
|
})
|
|
|
|
Describe("Satisfies", func() {
|
|
It("accepts the exact scope or its :write form", func() {
|
|
Expect(Satisfies([]string{"read"}, "read")).To(BeTrue())
|
|
Expect(Satisfies([]string{"playlists:write"}, "playlists")).To(BeTrue())
|
|
Expect(Satisfies([]string{"playlists"}, "playlists:write")).To(BeFalse())
|
|
Expect(Satisfies(nil, "read")).To(BeFalse())
|
|
})
|
|
})
|
|
})
|