feat(scope): unattributed and all org targets
Adds a first-class org target vocabulary shared by every rule kind: a specific organization, unattributed (objects whose org is NULL), or all. A role can now be granted the unassigned pile without a global rule. - rules.scope gains 'unattributed' and 'all' - user_rules.org_id accepts NULL to target unattributed objects - org_in_scope partitions the classes: 'unattributed' matches only a NULL target, tree scopes never match one - has_permission(user, activity, view) capability probe for UI gating - current_org_filter() parses morbac.org_ids once into org UUIDs plus the unattributed-bucket flag (a JSON null element requests it) - rls_check split by arity so NULL never carries two meanings: rls_check(activity, view) for tables with no org column, rls_check(activity, view, row_org_id[, row_user_id]) where a NULL row_org_id means the record is unattributed - detect_rule_conflicts is scope-aware, so rules targeting different object sets no longer collide Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
@@ -0,0 +1,225 @@
|
||||
-- =============================================================================
|
||||
-- Unattributed (no-org) rule Tests
|
||||
-- =============================================================================
|
||||
-- Tests scope = 'unattributed': rules authored by an org that govern objects
|
||||
-- with no org (org_id IS NULL), evaluated via is_allowed(user, NULL, ...).
|
||||
--
|
||||
-- Key properties:
|
||||
-- - role-bound: the user must hold the rule's role in the declaring org
|
||||
-- - partitioned: unattributed rules never reach real-org objects, and
|
||||
-- org-scoped rules never reach no-org objects
|
||||
-- - composes with prohibition precedence, revocation, delegation, multi-org
|
||||
-- - has_permission() capability probe surfaces the grant
|
||||
--
|
||||
-- Fixtures created here (isolated from the GlobalTech scenario):
|
||||
-- AttribCorp (org) role triage user Nomad
|
||||
-- IntakeCorp (org) role intake user Nomad (multi-org over the same pool)
|
||||
--
|
||||
-- Prerequisites: 00_setup.sql -> 15_rls_check.sql
|
||||
-- =============================================================================
|
||||
|
||||
\echo ''
|
||||
\echo '================================================================'
|
||||
\echo '16 -- UNATTRIBUTED'
|
||||
\echo '================================================================'
|
||||
|
||||
RESET morbac.user_id;
|
||||
RESET morbac.org_id;
|
||||
RESET morbac.org_ids;
|
||||
|
||||
INSERT INTO morbac.orgs (id, name) VALUES
|
||||
('40000000-0000-0000-0000-000000000001','AttribCorp'),
|
||||
('40000000-0000-0000-0000-000000000002','IntakeCorp');
|
||||
|
||||
INSERT INTO morbac.roles (id, org_id, name) VALUES
|
||||
('40000000-0000-0000-0000-0000000000a1','40000000-0000-0000-0000-000000000001','triage'),
|
||||
('40000000-0000-0000-0000-0000000000a2','40000000-0000-0000-0000-000000000002','intake');
|
||||
|
||||
-- Nomad: triage in AttribCorp; Scout: delegatee
|
||||
\set NOMAD '''40000000-0000-0000-0000-0000000000f1'''
|
||||
\set SCOUT '''40000000-0000-0000-0000-0000000000f2'''
|
||||
\set STRANGER '''40000000-0000-0000-0000-0000000000f9'''
|
||||
|
||||
INSERT INTO morbac.user_roles (user_id, role_id, org_id) VALUES
|
||||
(:NOMAD,'40000000-0000-0000-0000-0000000000a1','40000000-0000-0000-0000-000000000001');
|
||||
|
||||
\set CTX '(SELECT id FROM morbac.contexts WHERE name = ''always'')'
|
||||
|
||||
-- unattributed permission for triage
|
||||
INSERT INTO morbac.rules (org_id, role_id, activity, view, context_id, modality, scope)
|
||||
VALUES ('40000000-0000-0000-0000-000000000001','40000000-0000-0000-0000-0000000000a1',
|
||||
'read','documents', :CTX,'permission','unattributed');
|
||||
|
||||
\echo ''
|
||||
\echo '--- 1. Authorization + role binding ---'
|
||||
|
||||
SELECT morbac.t('unattributed grant -> orphan object allowed',
|
||||
morbac.is_allowed_nocache(:NOMAD, NULL, 'read','documents'), TRUE);
|
||||
|
||||
SELECT morbac.t('stranger without role -> orphan denied',
|
||||
morbac.is_allowed_nocache(:STRANGER, NULL, 'read','documents'), FALSE);
|
||||
|
||||
\echo ''
|
||||
\echo '--- 2. Partition: unattributed does not reach real-org objects ---'
|
||||
|
||||
SELECT morbac.t('unattributed rule does NOT grant AttribCorp object',
|
||||
morbac.is_allowed_nocache(:NOMAD, '40000000-0000-0000-0000-000000000001','read','documents'), FALSE);
|
||||
|
||||
-- add a self permission; now the org object is allowed, orphan still allowed
|
||||
INSERT INTO morbac.rules (org_id, role_id, activity, view, context_id, modality, scope)
|
||||
VALUES ('40000000-0000-0000-0000-000000000001','40000000-0000-0000-0000-0000000000a1',
|
||||
'read','documents', :CTX,'permission','self');
|
||||
|
||||
SELECT morbac.t('self rule grants AttribCorp object',
|
||||
morbac.is_allowed_nocache(:NOMAD, '40000000-0000-0000-0000-000000000001','read','documents'), TRUE);
|
||||
|
||||
SELECT morbac.t('orphan still allowed alongside self rule',
|
||||
morbac.is_allowed_nocache(:NOMAD, NULL, 'read','documents'), TRUE);
|
||||
|
||||
\echo ''
|
||||
\echo '--- 3. Partition: org-scoped does not reach no-org objects ---'
|
||||
|
||||
-- remove the unattributed rule; self remains
|
||||
DELETE FROM morbac.rules
|
||||
WHERE org_id = '40000000-0000-0000-0000-000000000001'
|
||||
AND role_id = '40000000-0000-0000-0000-0000000000a1'
|
||||
AND scope = 'unattributed';
|
||||
|
||||
SELECT morbac.t('self rule does NOT reach orphan object',
|
||||
morbac.is_allowed_nocache(:NOMAD, NULL, 'read','documents'), FALSE);
|
||||
|
||||
SELECT morbac.t('AttribCorp object still allowed by self rule',
|
||||
morbac.is_allowed_nocache(:NOMAD, '40000000-0000-0000-0000-000000000001','read','documents'), TRUE);
|
||||
|
||||
-- restore unattributed permission for the remaining tests
|
||||
INSERT INTO morbac.rules (org_id, role_id, activity, view, context_id, modality, scope)
|
||||
VALUES ('40000000-0000-0000-0000-000000000001','40000000-0000-0000-0000-0000000000a1',
|
||||
'read','documents', :CTX,'permission','unattributed');
|
||||
|
||||
\echo ''
|
||||
\echo '--- 4. Prohibition precedence on orphan objects ---'
|
||||
|
||||
INSERT INTO morbac.rules (org_id, role_id, activity, view, context_id, modality, scope, priority)
|
||||
VALUES ('40000000-0000-0000-0000-000000000001','40000000-0000-0000-0000-0000000000a1',
|
||||
'read','documents', :CTX,'prohibition','unattributed', 10);
|
||||
|
||||
SELECT morbac.t('unattributed prohibition (prio 10) beats permission (prio 0)',
|
||||
morbac.is_allowed_nocache(:NOMAD, NULL, 'read','documents'), FALSE);
|
||||
|
||||
DELETE FROM morbac.rules
|
||||
WHERE org_id = '40000000-0000-0000-0000-000000000001'
|
||||
AND role_id = '40000000-0000-0000-0000-0000000000a1'
|
||||
AND scope = 'unattributed' AND modality = 'prohibition';
|
||||
|
||||
\echo ''
|
||||
\echo '--- 5. Revocation ---'
|
||||
|
||||
DELETE FROM morbac.user_roles WHERE user_id = :NOMAD;
|
||||
|
||||
SELECT morbac.t('revoke role -> orphan access removed',
|
||||
morbac.is_allowed_nocache(:NOMAD, NULL, 'read','documents'), FALSE);
|
||||
|
||||
INSERT INTO morbac.user_roles (user_id, role_id, org_id) VALUES
|
||||
(:NOMAD,'40000000-0000-0000-0000-0000000000a1','40000000-0000-0000-0000-000000000001');
|
||||
|
||||
\echo ''
|
||||
\echo '--- 6. Delegation propagates orphan access ---'
|
||||
|
||||
INSERT INTO morbac.delegations (delegator_id, delegatee_id, role_id, org_id, valid_until)
|
||||
VALUES (:NOMAD, :SCOUT, '40000000-0000-0000-0000-0000000000a1',
|
||||
'40000000-0000-0000-0000-000000000001', now() + interval '1 day');
|
||||
|
||||
SELECT morbac.t('delegatee gains orphan access via delegated role',
|
||||
morbac.is_allowed_nocache(:SCOUT, NULL, 'read','documents'), TRUE);
|
||||
|
||||
\echo ''
|
||||
\echo '--- 7. Multi-org: independent authority over the same pool ---'
|
||||
|
||||
INSERT INTO morbac.user_roles (user_id, role_id, org_id) VALUES
|
||||
(:NOMAD,'40000000-0000-0000-0000-0000000000a2','40000000-0000-0000-0000-000000000002');
|
||||
INSERT INTO morbac.rules (org_id, role_id, activity, view, context_id, modality, scope)
|
||||
VALUES ('40000000-0000-0000-0000-000000000002','40000000-0000-0000-0000-0000000000a2',
|
||||
'write','documents', :CTX,'permission','unattributed');
|
||||
|
||||
SELECT morbac.t('IntakeCorp role independently grants orphan write',
|
||||
morbac.is_allowed_nocache(:NOMAD, NULL, 'write','documents'), TRUE);
|
||||
|
||||
\echo ''
|
||||
\echo '--- 8. has_permission capability probe ---'
|
||||
|
||||
SELECT morbac.t('has_permission TRUE via orphan grant',
|
||||
morbac.has_permission(:NOMAD, 'read','documents'), TRUE);
|
||||
|
||||
SELECT morbac.t('has_permission FALSE for ungranted activity/view',
|
||||
morbac.has_permission(:STRANGER, 'read','documents'), FALSE);
|
||||
|
||||
\echo ''
|
||||
\echo '--- 9. Org target triad: specific / unattributed / all ---'
|
||||
|
||||
-- role-based 'all': every org, unattributed included
|
||||
INSERT INTO morbac.roles (id, org_id, name) VALUES
|
||||
('40000000-0000-0000-0000-0000000000a3','40000000-0000-0000-0000-000000000001','overseer');
|
||||
INSERT INTO morbac.user_roles (user_id, role_id, org_id) VALUES
|
||||
(:SCOUT,'40000000-0000-0000-0000-0000000000a3','40000000-0000-0000-0000-000000000001');
|
||||
INSERT INTO morbac.rules (org_id, role_id, activity, view, context_id, modality, scope)
|
||||
VALUES ('40000000-0000-0000-0000-000000000001','40000000-0000-0000-0000-0000000000a3',
|
||||
'approve','documents', :CTX,'permission','all');
|
||||
|
||||
SELECT morbac.t('scope all reaches a specific org',
|
||||
morbac.is_allowed_nocache(:SCOUT, '40000000-0000-0000-0000-000000000002','approve','documents'), TRUE);
|
||||
|
||||
SELECT morbac.t('scope all reaches unattributed objects',
|
||||
morbac.is_allowed_nocache(:SCOUT, NULL,'approve','documents'), TRUE);
|
||||
|
||||
-- roleless user_rule targeting unattributed (org_id NULL)
|
||||
INSERT INTO morbac.user_rules (user_id, org_id, activity, view, context_id, modality)
|
||||
VALUES (:STRANGER, NULL, 'read','reports', :CTX,'permission');
|
||||
|
||||
SELECT morbac.t('user_rule with no org grants unattributed objects',
|
||||
morbac.is_allowed_nocache(:STRANGER, NULL,'read','reports'), TRUE);
|
||||
|
||||
SELECT morbac.t('user_rule with no org does NOT reach a real org',
|
||||
morbac.is_allowed_nocache(:STRANGER, '40000000-0000-0000-0000-000000000001','read','reports'), FALSE);
|
||||
|
||||
-- roleless user_rule targeting a specific org stays partitioned
|
||||
INSERT INTO morbac.user_rules (user_id, org_id, activity, view, context_id, modality)
|
||||
VALUES (:STRANGER, '40000000-0000-0000-0000-000000000002', 'read','documents', :CTX,'permission');
|
||||
|
||||
SELECT morbac.t('user_rule with an org grants that org',
|
||||
morbac.is_allowed_nocache(:STRANGER, '40000000-0000-0000-0000-000000000002','read','documents'), TRUE);
|
||||
|
||||
SELECT morbac.t('user_rule with an org does NOT reach unattributed',
|
||||
morbac.is_allowed_nocache(:STRANGER, NULL,'read','documents'), FALSE);
|
||||
|
||||
\echo ''
|
||||
\echo '--- 10. rls_check filter matrix ---'
|
||||
|
||||
SELECT set_config('morbac.user_id', :NOMAD, false);
|
||||
|
||||
RESET morbac.org_id;
|
||||
RESET morbac.org_ids;
|
||||
SELECT morbac.t('no filter: orphan row visible',
|
||||
morbac.rls_check('read','documents', NULL), TRUE);
|
||||
|
||||
SET morbac.org_id = '40000000-0000-0000-0000-000000000001';
|
||||
SELECT morbac.t('single org pin: orphan row filtered out',
|
||||
morbac.rls_check('read','documents', NULL), FALSE);
|
||||
RESET morbac.org_id;
|
||||
|
||||
SET morbac.org_ids = '[null]';
|
||||
SELECT morbac.t('org_ids [null]: orphan row visible',
|
||||
morbac.rls_check('read','documents', NULL), TRUE);
|
||||
SELECT morbac.t('org_ids [null]: real-org row filtered out',
|
||||
morbac.rls_check('read','documents', '40000000-0000-0000-0000-000000000001'::uuid), FALSE);
|
||||
|
||||
SET morbac.org_ids = '["40000000-0000-0000-0000-000000000001", null]';
|
||||
SELECT morbac.t('org_ids [AttribCorp, null]: orphan row visible',
|
||||
morbac.rls_check('read','documents', NULL), TRUE);
|
||||
SELECT morbac.t('org_ids [AttribCorp, null]: AttribCorp row visible',
|
||||
morbac.rls_check('read','documents', '40000000-0000-0000-0000-000000000001'::uuid), TRUE);
|
||||
|
||||
RESET morbac.user_id;
|
||||
RESET morbac.org_ids;
|
||||
|
||||
\echo ''
|
||||
\echo '=== Unattributed Tests Completed ==='
|
||||
Reference in New Issue
Block a user