216 lines
8.1 KiB
SQL
216 lines
8.1 KiB
SQL
-- =============================================================================
|
|
-- rls_check Tests
|
|
-- =============================================================================
|
|
-- Tests morbac.rls_check() with all session-org combinations, focusing on
|
|
-- the two cases fixed to support global rows (p_row_org_id IS NULL):
|
|
--
|
|
-- 1. No user_id set: always FALSE
|
|
-- 2. Single org context
|
|
-- a. org-scoped row, matching org
|
|
-- b. org-scoped row, different org (blocked)
|
|
-- c. global row (NULL org_id): uses session org
|
|
-- 3. org_ids filter
|
|
-- a. org-scoped row in list
|
|
-- b. org-scoped row not in list (blocked)
|
|
-- c. global row + global permission [was FALSE, now TRUE]
|
|
-- d. global row + global prohibition [was FALSE, now correctly FALSE]
|
|
-- e. global row + no rule [was FALSE, still FALSE]
|
|
-- 4. No org context
|
|
-- a. org-scoped row: uses row's org
|
|
-- b. global row + global permission [was FALSE, now TRUE]
|
|
-- c. global row + global prohibition [was FALSE, now correctly FALSE]
|
|
-- d. global row + no rule [was FALSE, still FALSE]
|
|
--
|
|
-- User state carried from previous tests:
|
|
-- Karl (30000000-0000-0000-0000-000000000011):
|
|
-- - user_rules: read documents, read reports in GlobalTech HQ (no expiry)
|
|
-- - no role assignments, no org memberships
|
|
--
|
|
-- Prerequisites: 00_setup.sql -> 14_system_principals.sql
|
|
-- =============================================================================
|
|
|
|
\echo ''
|
|
\echo '================================================================'
|
|
\echo '15 -- RLS_CHECK'
|
|
\echo '================================================================'
|
|
|
|
-- ---------------------------------------------------------------------------
|
|
-- Section 1: No user_id set — always FALSE
|
|
-- ---------------------------------------------------------------------------
|
|
\echo ''
|
|
\echo '--- 1. No user_id: always FALSE ---'
|
|
|
|
RESET morbac.user_id;
|
|
RESET morbac.org_id;
|
|
RESET morbac.org_ids;
|
|
|
|
SELECT morbac.t('rls_check without user_id, org row',
|
|
morbac.rls_check('read', 'documents',
|
|
'10000000-0000-0000-0000-000000000001'::uuid),
|
|
FALSE);
|
|
|
|
SELECT morbac.t('rls_check without user_id, global row',
|
|
morbac.rls_check('read', 'contracts', NULL),
|
|
FALSE);
|
|
|
|
-- ---------------------------------------------------------------------------
|
|
-- Section 2: Single org context
|
|
-- ---------------------------------------------------------------------------
|
|
\echo ''
|
|
\echo '--- 2. Single org context ---'
|
|
|
|
SET morbac.user_id = '30000000-0000-0000-0000-000000000011'; -- Karl
|
|
SET morbac.org_id = '10000000-0000-0000-0000-000000000001'; -- GlobalTech HQ
|
|
|
|
-- 2a: org-scoped row, matching org — Karl has user_rule for read documents
|
|
SELECT morbac.t('rls_check single org, org row matches session org (Karl/documents)',
|
|
morbac.rls_check('read', 'documents',
|
|
'10000000-0000-0000-0000-000000000001'::uuid),
|
|
TRUE);
|
|
|
|
-- 2b: org-scoped row, different org — blocked before is_allowed
|
|
SELECT morbac.t('rls_check single org, org row from different org (blocked)',
|
|
morbac.rls_check('read', 'documents',
|
|
'10000000-0000-0000-0000-000000000002'::uuid),
|
|
FALSE);
|
|
|
|
-- 2c: global row — uses session org, so Karl's user_rule on GlobalTech applies
|
|
SELECT morbac.t('rls_check single org, global row (NULL org_id): uses session org',
|
|
morbac.rls_check('read', 'documents', NULL),
|
|
TRUE);
|
|
|
|
-- 2c (no permission): Karl has no rule for contracts in GlobalTech
|
|
SELECT morbac.t('rls_check single org, global row (NULL org_id): no permission for contracts',
|
|
morbac.rls_check('read', 'contracts', NULL),
|
|
FALSE);
|
|
|
|
RESET morbac.user_id;
|
|
RESET morbac.org_id;
|
|
|
|
-- ---------------------------------------------------------------------------
|
|
-- Section 3: org_ids filter
|
|
-- ---------------------------------------------------------------------------
|
|
\echo ''
|
|
\echo '--- 3. org_ids filter ---'
|
|
|
|
SET morbac.user_id = '30000000-0000-0000-0000-000000000011'; -- Karl
|
|
SET morbac.org_ids = '["10000000-0000-0000-0000-000000000001"]'; -- [GlobalTech HQ]
|
|
|
|
-- 3a: org-scoped row in the list — Karl has user_rule for read documents in GlobalTech
|
|
SELECT morbac.t('rls_check org_ids, org row in list (Karl/documents/GlobalTech)',
|
|
morbac.rls_check('read', 'documents',
|
|
'10000000-0000-0000-0000-000000000001'::uuid),
|
|
TRUE);
|
|
|
|
-- 3b: org-scoped row not in the list — blocked
|
|
SELECT morbac.t('rls_check org_ids, org row not in list (blocked)',
|
|
morbac.rls_check('read', 'documents',
|
|
'10000000-0000-0000-0000-000000000002'::uuid),
|
|
FALSE);
|
|
|
|
-- 3c: global row + global permission — now goes to is_allowed(Karl, NULL, ...) → global_rules only
|
|
INSERT INTO morbac.global_rules (user_id, activity, view, context_id, modality)
|
|
VALUES (
|
|
'30000000-0000-0000-0000-000000000011', -- Karl
|
|
'read', 'contracts',
|
|
(SELECT id FROM morbac.contexts WHERE name = 'always'),
|
|
'permission'
|
|
);
|
|
|
|
SELECT morbac.t('rls_check org_ids, global row + global permission [new: was FALSE]',
|
|
morbac.rls_check('read', 'contracts', NULL),
|
|
TRUE);
|
|
|
|
DELETE FROM morbac.global_rules
|
|
WHERE user_id = '30000000-0000-0000-0000-000000000011'
|
|
AND activity = 'read' AND view = 'contracts';
|
|
|
|
-- 3d: global row + global prohibition
|
|
INSERT INTO morbac.global_rules (user_id, activity, view, context_id, modality)
|
|
VALUES (
|
|
'30000000-0000-0000-0000-000000000011', -- Karl
|
|
'read', 'contracts',
|
|
(SELECT id FROM morbac.contexts WHERE name = 'always'),
|
|
'prohibition'
|
|
);
|
|
|
|
SELECT morbac.t('rls_check org_ids, global row + global prohibition',
|
|
morbac.rls_check('read', 'contracts', NULL),
|
|
FALSE);
|
|
|
|
DELETE FROM morbac.global_rules
|
|
WHERE user_id = '30000000-0000-0000-0000-000000000011'
|
|
AND activity = 'read' AND view = 'contracts';
|
|
|
|
-- 3e: global row + no rule
|
|
SELECT morbac.t('rls_check org_ids, global row + no rule',
|
|
morbac.rls_check('read', 'contracts', NULL),
|
|
FALSE);
|
|
|
|
RESET morbac.user_id;
|
|
RESET morbac.org_ids;
|
|
|
|
-- ---------------------------------------------------------------------------
|
|
-- Section 4: No org context
|
|
-- ---------------------------------------------------------------------------
|
|
\echo ''
|
|
\echo '--- 4. No org context ---'
|
|
|
|
SET morbac.user_id = '30000000-0000-0000-0000-000000000011'; -- Karl
|
|
|
|
-- 4a: org-scoped row — uses row's org_id (Karl has user_rule in GlobalTech)
|
|
SELECT morbac.t('rls_check no org context, org row: uses row org (Karl/documents/GlobalTech)',
|
|
morbac.rls_check('read', 'documents',
|
|
'10000000-0000-0000-0000-000000000001'::uuid),
|
|
TRUE);
|
|
|
|
-- 4a (no permission): Karl has no rule in Engineering
|
|
SELECT morbac.t('rls_check no org context, org row: no permission in row org (Engineering)',
|
|
morbac.rls_check('read', 'documents',
|
|
'10000000-0000-0000-0000-000000000002'::uuid),
|
|
FALSE);
|
|
|
|
-- 4b: global row + global permission — now goes to is_allowed(Karl, NULL, ...) → global_rules only
|
|
INSERT INTO morbac.global_rules (user_id, activity, view, context_id, modality)
|
|
VALUES (
|
|
'30000000-0000-0000-0000-000000000011', -- Karl
|
|
'read', 'contracts',
|
|
(SELECT id FROM morbac.contexts WHERE name = 'always'),
|
|
'permission'
|
|
);
|
|
|
|
SELECT morbac.t('rls_check no org context, global row + global permission [new: was FALSE]',
|
|
morbac.rls_check('read', 'contracts', NULL),
|
|
TRUE);
|
|
|
|
DELETE FROM morbac.global_rules
|
|
WHERE user_id = '30000000-0000-0000-0000-000000000011'
|
|
AND activity = 'read' AND view = 'contracts';
|
|
|
|
-- 4c: global row + global prohibition
|
|
INSERT INTO morbac.global_rules (user_id, activity, view, context_id, modality)
|
|
VALUES (
|
|
'30000000-0000-0000-0000-000000000011', -- Karl
|
|
'read', 'contracts',
|
|
(SELECT id FROM morbac.contexts WHERE name = 'always'),
|
|
'prohibition'
|
|
);
|
|
|
|
SELECT morbac.t('rls_check no org context, global row + global prohibition',
|
|
morbac.rls_check('read', 'contracts', NULL),
|
|
FALSE);
|
|
|
|
DELETE FROM morbac.global_rules
|
|
WHERE user_id = '30000000-0000-0000-0000-000000000011'
|
|
AND activity = 'read' AND view = 'contracts';
|
|
|
|
-- 4d: global row + no rule
|
|
SELECT morbac.t('rls_check no org context, global row + no rule',
|
|
morbac.rls_check('read', 'contracts', NULL),
|
|
FALSE);
|
|
|
|
RESET morbac.user_id;
|
|
|
|
\echo ''
|
|
\echo '=== rls_check Tests Completed ==='
|