303 lines
13 KiB
SQL
303 lines
13 KiB
SQL
-- =============================================================================
|
|
-- Cross-Organization Rules Tests
|
|
-- =============================================================================
|
|
-- Tests inter-organizational access via the cross_org_rules table.
|
|
--
|
|
-- Scenarios:
|
|
-- 1. No cross-org rule: users in org A cannot access org B resources
|
|
-- 2. Cross-org permission: specific role in source org can access target org
|
|
-- 3. User must hold role in source org (not just any role)
|
|
-- 4. Cross-org prohibition: blocks access even if there's a regular permission
|
|
-- 5. Cross-org rules combine with activity hierarchy
|
|
-- 6. Cross-org rules combine with view hierarchy
|
|
-- 7. Temporal cross-org rules (valid_from / valid_until)
|
|
--
|
|
-- Company context:
|
|
-- Judy (sales_rep at Sales) is allowed to read GlobalTech reports via cross-org rule
|
|
-- Nina (eng_auditor at Engineering) has a temporal cross-org rule to read GlobalTech audit_logs
|
|
-- Diana (sales_manager at Sales) has a cross-org prohibition on writing Engineering docs
|
|
--
|
|
-- Prerequisites: 00_setup.sql -> 05_temporal.sql
|
|
-- =============================================================================
|
|
|
|
\echo ''
|
|
\echo '================================================================'
|
|
\echo '06 — CROSS-ORGANIZATIONAL RULES'
|
|
\echo '================================================================'
|
|
|
|
-- ---------------------------------------------------------------------------
|
|
-- Setup: additional roles and users for cross-org scenarios
|
|
-- ---------------------------------------------------------------------------
|
|
|
|
-- Nina: eng_auditor role in Engineering Dept
|
|
INSERT INTO morbac.roles (id, org_id, name, description) VALUES
|
|
('20000000-0002-0000-0000-000000000003', '10000000-0000-0000-0000-000000000002', 'eng_auditor', 'Engineering Auditor');
|
|
|
|
INSERT INTO morbac.user_roles (user_id, role_id, org_id) VALUES
|
|
('30000000-0000-0000-0000-000000000014', '20000000-0002-0000-0000-000000000003', '10000000-0000-0000-0000-000000000002');
|
|
|
|
-- Rules for eng_auditor in Engineering
|
|
INSERT INTO morbac.rules (org_id, role_id, activity, view, context_id, modality)
|
|
SELECT o.id, r.id, 'read', 'audit_logs', c.id, 'permission'
|
|
FROM morbac.orgs o
|
|
JOIN morbac.roles r ON r.org_id = o.id AND r.name = 'eng_auditor'
|
|
JOIN morbac.contexts c ON c.name = 'always'
|
|
WHERE o.name = 'Engineering Dept';
|
|
|
|
-- Verify nina's role was set up correctly
|
|
SELECT morbac.t('Nina has eng_auditor role at Engineering',
|
|
morbac.user_has_role(
|
|
'30000000-0000-0000-0000-000000000014'::uuid,
|
|
'10000000-0000-0000-0000-000000000002'::uuid,
|
|
'eng_auditor'
|
|
), TRUE);
|
|
|
|
-- ---------------------------------------------------------------------------
|
|
-- Section 1: No cross-org rule — access between orgs is denied by default
|
|
-- ---------------------------------------------------------------------------
|
|
\echo ''
|
|
\echo '--- 1. No cross-org rule: access denied by default ---'
|
|
|
|
-- Dave (employee at GlobalTech) has no role in Engineering and no cross-org rule
|
|
SELECT morbac.t('Dave (GlobalTech employee) reads Engineering documents [no cross-org rule]',
|
|
morbac.is_allowed_nocache(
|
|
'30000000-0000-0000-0000-000000000004'::uuid,
|
|
'10000000-0000-0000-0000-000000000002'::uuid,
|
|
'read', 'documents'
|
|
), FALSE);
|
|
|
|
-- Judy (Engineering engineer) accesses GlobalTech financial_data (no cross-org rule yet)
|
|
SELECT morbac.t('Judy (Engineering engineer) reads GlobalTech financial_data [no cross-org rule]',
|
|
morbac.is_allowed_nocache(
|
|
'30000000-0000-0000-0000-000000000010'::uuid,
|
|
'10000000-0000-0000-0000-000000000001'::uuid,
|
|
'read', 'financial_data'
|
|
), FALSE);
|
|
|
|
-- ---------------------------------------------------------------------------
|
|
-- Section 2: Cross-org permission — Sales sales_rep reads GlobalTech reports
|
|
-- ---------------------------------------------------------------------------
|
|
\echo ''
|
|
\echo '--- 2. Cross-org permission ---'
|
|
|
|
-- Judy is sales_rep at Sales. Add a cross-org rule:
|
|
-- Sales sales_rep can read GlobalTech reports
|
|
INSERT INTO morbac.cross_org_rules
|
|
(source_org_id, target_org_id, role_id, activity, view, context_id, modality)
|
|
VALUES (
|
|
'10000000-0000-0000-0000-000000000003', -- source: Sales Dept
|
|
'10000000-0000-0000-0000-000000000001', -- target: GlobalTech HQ
|
|
'20000000-0003-0000-0000-000000000002', -- sales_rep role
|
|
'read', 'reports',
|
|
(SELECT id FROM morbac.contexts WHERE name = 'always'),
|
|
'permission'
|
|
);
|
|
|
|
-- Cross-org rule grants access
|
|
SELECT morbac.t('Judy (Sales sales_rep) reads GlobalTech reports via cross-org rule',
|
|
morbac.is_allowed_nocache(
|
|
'30000000-0000-0000-0000-000000000010'::uuid,
|
|
'10000000-0000-0000-0000-000000000001'::uuid,
|
|
'read', 'reports'
|
|
), TRUE);
|
|
|
|
-- Judy at Sales can still read Sales docs normally (local rule, no cross-org needed)
|
|
SELECT morbac.t('Judy (Sales sales_rep) reads Sales documents [local rule]',
|
|
morbac.is_allowed_nocache(
|
|
'30000000-0000-0000-0000-000000000010'::uuid,
|
|
'10000000-0000-0000-0000-000000000003'::uuid,
|
|
'read', 'documents'
|
|
), TRUE);
|
|
|
|
-- Judy does NOT have permission to read GlobalTech documents (cross-org rule only covers reports)
|
|
SELECT morbac.t('Judy (Sales sales_rep) reads GlobalTech documents [no rule for documents]',
|
|
morbac.is_allowed_nocache(
|
|
'30000000-0000-0000-0000-000000000010'::uuid,
|
|
'10000000-0000-0000-0000-000000000001'::uuid,
|
|
'read', 'documents'
|
|
), FALSE);
|
|
|
|
-- ---------------------------------------------------------------------------
|
|
-- Section 3: User must hold role in source org
|
|
-- ---------------------------------------------------------------------------
|
|
\echo ''
|
|
\echo '--- 3. Role must be held in source org ---'
|
|
|
|
-- Karl has no role anywhere — cannot use the Sales->GlobalTech cross-org rule
|
|
SELECT morbac.t('Karl (no role) reads GlobalTech reports via cross-org rule [no role in source]',
|
|
morbac.is_allowed_nocache(
|
|
'30000000-0000-0000-0000-000000000011'::uuid,
|
|
'10000000-0000-0000-0000-000000000001'::uuid,
|
|
'read', 'reports'
|
|
), FALSE);
|
|
|
|
-- Karl also has no access to GlobalTech documents
|
|
SELECT morbac.t('Karl (no role) reads GlobalTech documents [no access anywhere]',
|
|
morbac.is_allowed_nocache(
|
|
'30000000-0000-0000-0000-000000000011'::uuid,
|
|
'10000000-0000-0000-0000-000000000001'::uuid,
|
|
'read', 'documents'
|
|
), FALSE);
|
|
|
|
-- ---------------------------------------------------------------------------
|
|
-- Section 4: Cross-org prohibition — blocks access even with regular permission
|
|
-- ---------------------------------------------------------------------------
|
|
\echo ''
|
|
\echo '--- 4. Cross-org prohibition ---'
|
|
|
|
-- Engineering engineer can normally read Engineering documents (local perm)
|
|
SELECT morbac.t('Judy (Engineering engineer) reads Engineering documents [local perm]',
|
|
morbac.is_allowed_nocache(
|
|
'30000000-0000-0000-0000-000000000010'::uuid,
|
|
'10000000-0000-0000-0000-000000000002'::uuid,
|
|
'read', 'documents'
|
|
), TRUE);
|
|
|
|
-- Add Diana (sales_manager at Sales) for cross-org prohibition test
|
|
INSERT INTO morbac.user_roles (user_id, role_id, org_id) VALUES
|
|
('30000000-0000-0000-0000-000000000015', '20000000-0003-0000-0000-000000000001', '10000000-0000-0000-0000-000000000003');
|
|
|
|
-- Add cross-org prohibition: Sales sales_manager prohibited from writing Engineering documents
|
|
INSERT INTO morbac.cross_org_rules
|
|
(source_org_id, target_org_id, role_id, activity, view, context_id, modality)
|
|
VALUES (
|
|
'10000000-0000-0000-0000-000000000003', -- source: Sales Dept
|
|
'10000000-0000-0000-0000-000000000002', -- target: Engineering Dept
|
|
'20000000-0003-0000-0000-000000000001', -- sales_manager role
|
|
'write', 'documents',
|
|
(SELECT id FROM morbac.contexts WHERE name = 'always'),
|
|
'prohibition'
|
|
);
|
|
|
|
-- Also give a cross-org permission that would otherwise allow the write
|
|
INSERT INTO morbac.cross_org_rules
|
|
(source_org_id, target_org_id, role_id, activity, view, context_id, modality)
|
|
VALUES (
|
|
'10000000-0000-0000-0000-000000000003', -- source: Sales Dept
|
|
'10000000-0000-0000-0000-000000000002', -- target: Engineering Dept
|
|
'20000000-0003-0000-0000-000000000001', -- sales_manager role
|
|
'write', 'documents',
|
|
(SELECT id FROM morbac.contexts WHERE name = 'always'),
|
|
'permission'
|
|
);
|
|
|
|
-- Cross-org prohibition takes precedence over permission
|
|
SELECT morbac.t('Diana (Sales sales_manager) writes Engineering documents [cross-org prohibition wins]',
|
|
morbac.is_allowed_nocache(
|
|
'30000000-0000-0000-0000-000000000015'::uuid,
|
|
'10000000-0000-0000-0000-000000000002'::uuid,
|
|
'write', 'documents'
|
|
), FALSE);
|
|
|
|
-- Diana can read Engineering documents (no prohibition for read)
|
|
INSERT INTO morbac.cross_org_rules
|
|
(source_org_id, target_org_id, role_id, activity, view, context_id, modality)
|
|
VALUES (
|
|
'10000000-0000-0000-0000-000000000003', -- source: Sales Dept
|
|
'10000000-0000-0000-0000-000000000002', -- target: Engineering Dept
|
|
'20000000-0003-0000-0000-000000000001', -- sales_manager role
|
|
'read', 'documents',
|
|
(SELECT id FROM morbac.contexts WHERE name = 'always'),
|
|
'permission'
|
|
);
|
|
|
|
-- No prohibition for read, permission applies
|
|
SELECT morbac.t('Diana (Sales sales_manager) reads Engineering documents [cross-org permission]',
|
|
morbac.is_allowed_nocache(
|
|
'30000000-0000-0000-0000-000000000015'::uuid,
|
|
'10000000-0000-0000-0000-000000000002'::uuid,
|
|
'read', 'documents'
|
|
), TRUE);
|
|
|
|
-- ---------------------------------------------------------------------------
|
|
-- Section 5: Cross-org + activity hierarchy
|
|
-- ---------------------------------------------------------------------------
|
|
\echo ''
|
|
\echo '--- 5. Cross-org with activity hierarchy ---'
|
|
|
|
-- The sales_rep cross-org rule grants 'read reports' in GlobalTech.
|
|
-- With activity hierarchy (write->read), requesting 'write reports' also matches
|
|
-- the 'read' rule (get_effective_activities('write') = {write, read}).
|
|
SELECT morbac.t('Judy (Sales sales_rep) writes GlobalTech reports via cross-org + activity hierarchy',
|
|
morbac.is_allowed_nocache(
|
|
'30000000-0000-0000-0000-000000000010'::uuid,
|
|
'10000000-0000-0000-0000-000000000001'::uuid,
|
|
'write', 'reports'
|
|
), TRUE);
|
|
|
|
-- ---------------------------------------------------------------------------
|
|
-- Section 6: Cross-org + view hierarchy
|
|
-- ---------------------------------------------------------------------------
|
|
\echo ''
|
|
\echo '--- 6. Cross-org with view hierarchy ---'
|
|
|
|
-- Add a cross-org rule for 'read documents' (not financial_data directly)
|
|
-- With view hierarchy (financial_data->documents), 'read documents' cross-org rule
|
|
-- also covers 'read financial_data' requests
|
|
INSERT INTO morbac.cross_org_rules
|
|
(source_org_id, target_org_id, role_id, activity, view, context_id, modality)
|
|
VALUES (
|
|
'10000000-0000-0000-0000-000000000003', -- source: Sales Dept
|
|
'10000000-0000-0000-0000-000000000001', -- target: GlobalTech HQ
|
|
'20000000-0003-0000-0000-000000000002', -- sales_rep role
|
|
'read', 'documents',
|
|
(SELECT id FROM morbac.contexts WHERE name = 'always'),
|
|
'permission'
|
|
);
|
|
|
|
-- get_effective_views('financial_data') = {financial_data, documents}
|
|
-- so 'read documents' cross-org rule covers 'read financial_data' request
|
|
SELECT morbac.t('Judy (Sales sales_rep) reads GlobalTech financial_data via cross-org + view hierarchy',
|
|
morbac.is_allowed_nocache(
|
|
'30000000-0000-0000-0000-000000000010'::uuid,
|
|
'10000000-0000-0000-0000-000000000001'::uuid,
|
|
'read', 'financial_data'
|
|
), TRUE);
|
|
|
|
-- ---------------------------------------------------------------------------
|
|
-- Section 7: Temporal cross-org rule
|
|
-- ---------------------------------------------------------------------------
|
|
\echo ''
|
|
\echo '--- 7. Temporal cross-org rule ---'
|
|
|
|
-- Add a time-limited cross-org rule for eng_auditor to read GlobalTech audit_logs
|
|
INSERT INTO morbac.cross_org_rules
|
|
(source_org_id, target_org_id, role_id, activity, view, context_id, modality, valid_from, valid_until)
|
|
VALUES (
|
|
'10000000-0000-0000-0000-000000000002', -- source: Engineering
|
|
'10000000-0000-0000-0000-000000000001', -- target: GlobalTech HQ
|
|
'20000000-0002-0000-0000-000000000003', -- eng_auditor role
|
|
'read', 'audit_logs',
|
|
(SELECT id FROM morbac.contexts WHERE name = 'always'),
|
|
'permission',
|
|
now() - interval '1 hour',
|
|
now() + interval '1 day'
|
|
);
|
|
|
|
-- Nina (Engineering eng_auditor) reads GlobalTech audit_logs within window
|
|
SELECT morbac.t('Nina (Engineering eng_auditor) reads GlobalTech audit_logs [temporal cross-org, active]',
|
|
morbac.is_allowed_nocache(
|
|
'30000000-0000-0000-0000-000000000014'::uuid,
|
|
'10000000-0000-0000-0000-000000000001'::uuid,
|
|
'read', 'audit_logs'
|
|
), TRUE);
|
|
|
|
-- Expire the cross-org rule
|
|
UPDATE morbac.cross_org_rules
|
|
SET valid_until = now() - interval '1 second'
|
|
WHERE source_org_id = '10000000-0000-0000-0000-000000000002'
|
|
AND target_org_id = '10000000-0000-0000-0000-000000000001'
|
|
AND role_id = '20000000-0002-0000-0000-000000000003'
|
|
AND activity = 'read' AND view = 'audit_logs';
|
|
|
|
-- Temporal rule expired
|
|
SELECT morbac.t('Nina (Engineering eng_auditor) reads GlobalTech audit_logs [temporal cross-org, expired]',
|
|
morbac.is_allowed_nocache(
|
|
'30000000-0000-0000-0000-000000000014'::uuid,
|
|
'10000000-0000-0000-0000-000000000001'::uuid,
|
|
'read', 'audit_logs'
|
|
), FALSE);
|
|
|
|
\echo ''
|
|
\echo '=== Cross-Organization Rules Tests Completed ==='
|