test: Add unit test for rbac `Authorize()` function #853

Emyrk · 2022-04-04T14:47:54Z

What this does

The main objective of this PR is to write the unit test for the Authorize() function before it is implemented. As consequence the function is also stubbed for use before authz is ready.

Unit test coverage

The only lines not covered will be covered or removed with the Authz implementation. The lines exist as stubs for "using" the library before it is ready. 100% will be reached as the implementation is introduced

Issues

Implement tests for permissions: #715
Implement stub function to authenticate: #718
Build the struct for permission format for RBAC: #720

Just testing out some ideas. The code is far from finished, and very sloppy. Committing to share it to start conversations

Playing around with helper functions to make life easy

- Cleanup some code too

…sley/rbac

- Add some docs

codecov · 2022-04-04T14:50:43Z

Codecov Report

Merging #853 (9918c16) into main (4dd3c57) will increase coverage by 0.35%.
The diff coverage is 86.34%.

@@            Coverage Diff             @@
##             main     #853      +/-   ##
==========================================
+ Coverage   65.74%   66.10%   +0.35%     
==========================================
  Files         202      226      +24     
  Lines       13209    14048     +839     
  Branches       87      103      +16     
==========================================
+ Hits         8684     9286     +602     
- Misses       3633     3840     +207     
- Partials      892      922      +30

Flag	Coverage Δ
unittest-go-	`65.90% <86.34%> (+0.73%)`	⬆️
unittest-go-macos-latest	`53.73% <86.34%> (+1.50%)`	⬆️
unittest-go-ubuntu-latest	`55.99% <86.34%> (+0.93%)`	⬆️
unittest-go-windows-2022	`52.94% <86.34%> (+1.23%)`	⬆️
unittest-js	`58.83% <ø> (-3.81%)`	⬇️

Impacted Files	Coverage Δ
coderd/authz/subject.go	`7.69% <7.69%> (ø)`
coderd/authz/resources.go	`52.63% <52.63%> (ø)`
coderd/authz/object.go	`52.94% <52.94%> (ø)`
coderd/authz/permission.go	`96.77% <96.77%> (ø)`
coderd/authz/authz.go	`100.00% <100.00%> (ø)`
coderd/authz/authztest/iterator.go	`100.00% <100.00%> (ø)`
coderd/authz/authztest/level.go	`100.00% <100.00%> (ø)`
coderd/authz/authztest/permissions.go	`100.00% <100.00%> (ø)`
coderd/authz/authztest/role.go	`100.00% <100.00%> (ø)`
coderd/authz/authztest/set.go	`100.00% <100.00%> (ø)`
... and 51 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 4dd3c57...9918c16. Read the comment docs.

Emyrk · 2022-04-04T16:19:37Z

coderd/authz/role.go

+type Role struct {
+	Level       permLevel
+	Permissions []Permission
+}


This is very TBD. Just a placeholder

Add some examples

Emyrk · 2022-04-05T13:03:45Z

Could an example be added? I'm a bit confused how this package would be consumed.

Example added:

coder/coderd/authz/example_test.go

Lines 35 to 65 in 75ed8ef

    
           	t.Run("ReadAllWorkspaces", func(t *testing.T) { 
        
           		// To read all workspaces on the site 
        
           		err := authz.Authorize(user, authz.ResourceWorkspace, authz.ActionRead) 
        
           		var _ = err 
        
           		// require.Error(t, err, "this user cannot read all workspaces") 
        
           	}) 
        
           	//nolint:paralleltest 
        
           	t.Run("ReadOrgWorkspaces", func(t *testing.T) { 
        
           		// To read all workspaces on the org 'default' 
        
           		err := authz.Authorize(user, authz.ResourceWorkspace.Org("default"), authz.ActionRead) 
        
           		require.NoError(t, err, "this user can read all org workspaces in 'default'") 
        
           	}) 
        
           	//nolint:paralleltest 
        
           	t.Run("ReadMyWorkspace", func(t *testing.T) { 
        
           		// Note 'database.Workspace' could fulfill the object interface and be passed in directly 
        
           		err := authz.Authorize(user, authz.ResourceWorkspace.Org("default").Owner(user.UserID), authz.ActionRead) 
        
           		require.NoError(t, err, "this user can their workspace") 
        
           		err = authz.Authorize(user, authz.ResourceWorkspace.Org("default").Owner(user.UserID).AsID("1234"), authz.ActionRead) 
        
           		require.NoError(t, err, "this user can read workspace '1234'") 
        
           	}) 
        
           	//nolint:paralleltest 
        
           	t.Run("CreateNewSiteUser", func(t *testing.T) { 
        
           		err := authz.Authorize(user, authz.ResourceUser, authz.ActionCreate) 
        
           		var _ = err 
        
           		// require.Error(t, err, "this user cannot create new users") 
        
           	}) 
        
           }

I'm nervous that the size and scope of functionality here are not aligned with the market status quo. Did we take precedent from another Enterprise product to determine feature scope?

I understand this is WIP, so if things are likely to change we can punt this discussion until it's more final.

This PR is not the RBAC implementation, but only the stubbed functions and unit tests to test the rbac opa/rego. @johnstcn and I decided to generate the tests instead of enumerating cases manually. This enumeration is way more comprehensive than any manual tabled test. All files in authztest are purely for testing. So only <300 LoC defines the surface area of this package so far.

Once thus is merged, other devs can use rbac and for now the stub always returns no error

johnstcn · 2022-04-05T13:30:12Z

coderd/authz/example_test.go

+
+// Test_Example gives some examples on how to use the authz library.
+// This serves to test syntax more than functionality.
+func Test_Example(t *testing.T) {


kylecarbs · 2022-04-05T13:49:37Z

Please don't merge until I review! I'll get to it before the afternoon.

kylecarbs

Mostly questions here. Steven and I hopped in Discord which helped me understand the objective quite a bit.

Minor nit: in other places we haven't used _ in test names. I'm impartial to either way, but we should be consistent.

kylecarbs · 2022-04-05T14:04:08Z

coderd/authz/action.go

@@ -0,0 +1,11 @@
+package authz


Could this be named rbac instead? I think it might more accurately scope what we're trying to do.

When authn comes in, I think it'll be like this. authz is not my term, https://www.cloudflare.com/learning/access-management/authn-vs-authz/. It's more clear than rbac, as it's the authorize function. TBD on where the roles go.

. ├── auth │ ├── authz/ │ └── authn/ ├── subject.go ├── object.go ├── action.go ├── roles.go └── authorize.go

Maybe auth/rbac can have roles? Still in the air, just needed to stub until Dean was ready.

Is there a reason to not call them authorization and authentication? I've rarely seen the terms authn and authz used in the wild, so it's confusing to me at a glance.

I think it's only common in this particular domain. Cloudflare for example uses the terms fairly prominently. (EDIT: Steven already linked it 😆)

kylecarbs · 2022-04-05T14:08:22Z

coderd/authz/object.go

+func (z zObject) ResourceType() ResourceType {
+	return z.ObjectType
+}
+
+func (z zObject) OwnerID() string {
+	return z.OwnedBy
+}
+
+func (z zObject) OrgOwnerID() string {
+	return z.OwnedByOrg
+}
+
+// Org adds an org OwnerID to the resource
+//nolint:revive
+func (z zObject) Org(orgID string) zObject {
+	z.OwnedByOrg = orgID
+	return z
+}
+
+// Owner adds an OwnerID to the resource
+//nolint:revive
+func (z zObject) Owner(id string) zObject {
+	z.OwnedBy = id
+	return z
+}
+
+//nolint:revive
+func (z zObject) AsID(id string) zObject {
+	z.ObjectID = id
+	return z
+}


Why have all these helper functions when you can just access the struct directly?

I don't want to expose this object. I believe the api is cleaner when you have to stem from a resource type. The accessors above are to fulfill an interface.

obj := authz.ResourceWorkspace.Org("default") // VS obj := authz.ZObject{ OrgOwner: "default", ResourceType: authz.ResourceWorkspace, }

I'm in favor of the more verbose option. Especially with something like RBAC, I think we should put extreme emphasis on simplicity in what we expose to the callers. Wrapping these feels unnecessary since they're just setting a struct parameter anyways.

authz.Authorize(user, authz.ResourceWorkspace.Org("default").Owner(user.UserID).AsID("1234"), authz.ActionRead) authz.Authorize(user, authz.ResourceWorkspace, authz.ActionRead)

To

authz.Authorize(user, authz.ActionRead, authz.ZObject{ Owner: user.UserID, OrgOwner: "default", ID: "1234" ResourceType: authz.ResourceWorkspace, }) authz.Authorize(user, authz.ActionRead, authz.ZObject{ ResourceType: authz.ResourceWorkspace, })

coderd/authz/permission.go

kylecarbs · 2022-04-05T14:12:56Z

coderd/authz/permission.go

+	LevelID string
+
+	ResourceType ResourceType
+	ResourceID   string


All of our resource identifiers are UUIDs, can this be one too?

I thought some ids from v1 are still strings. I would like uuid yes, I can change if this is true

This is true! All v1 IDs have been converted to UUIDs.

kylecarbs · 2022-04-05T14:13:19Z

coderd/authz/permission.go

+
+// String returns the <level>.<resource_type>.<id>.<action> string formatted permission.
+func (p Permission) String() string {
+	sign := "-"


In the absence of a -, would a + be implicit?

It is yes, I thought it'd be fine to just be explicit. I can roll either way on it

I think I'd prefer implicit, as - nodes should rarely be used from my perspective.

kylecarbs · 2022-04-05T14:15:45Z

coderd/authz/permission.go

+func ParsePermissions(perms string) ([]Permission, error) {
+	permList := strings.Split(perms, ",")
+	parsed := make([]Permission, 0, len(permList))
+	for _, permStr := range permList {
+		p, err := ParsePermission(strings.TrimSpace(permStr))
+		if err != nil {
+			return nil, xerrors.Errorf("perm '%s': %w", permStr, err)
+		}
+		parsed = append(parsed, p)
+	}
+	return parsed, nil
+}


Are we planning on storing permissions as a comma-separated array? Or is this a helper function?

Just a helper function. It's easier to make permissions this way. We will probably store as json

Could we store it as a string array? Exposing a helper function to the API that's just used for tests may confuse a caller.

coderd/authz/action.go

kylecarbs · 2022-04-05T15:06:38Z

coderd/authz/authztest/permissions.go

+)
+
+const (
+	OtherOption    = "other"


What is this?

For testing purposes, we want to ensure a non-relevant permission is in fact not relevant.
So I use this for fields. Like other action should never be relevant

Make negate bool default to positive permission

kylecarbs · 2022-04-06T13:59:37Z

coderd/authz/README.md

+The effect of a **permission** can be:
+- **positive** (allows)
+- **negative** (denies)
+- **abstain** (neither allows or denies, but interpreted as deny by default)


Why do we need abstain?

It's part of the permission model.
Some permissions are not applicable to a given request.
They will return an abstain result in this case.

Is this so we could display to customers which permission node is truly having an impact on the success/failure of an auth request?

It is not. Abstain is just naming the case where a permission node is irrelevant. So it's just naming this case so our language is complete in that we can describe all permissions.

Example: If the input action is read, then the perm *.*.*.update has no effect and passes no judgement. We named this abstain.

By default, if the only effect from a set of permissions is abstain, then we default to deny. Since they have no perm to access the object.

kylecarbs · 2022-04-06T13:59:49Z

coderd/authz/README.md

+**Permissions** at a higher **level** always override permissions at a **lower** level.
+
+The effect of a **permission** can be:
+- **positive** (allows)


Can we default to allows in the absence of denies?

I don't think that's a good idea.
Default deny is the de-facto behaviour of operation for the other authorization implementations I reviewed.

Just so I understand, workspaces.*.create would be interpreted as a deny by default in those implementations?

Yeah, for example here: https://sourcegraph.com/github.com/fleetdm/fleet/-/blob/server/authz/policy_test.go?L69

A nil user is not allowed to either read or write session. Obviously what you want to deny-by-default depends on what you're building.

kylecarbs · 2022-04-06T14:00:35Z

coderd/authz/README.md

+
+## Example Permissions
+
+- `+site.devurl.*.read`: allowed to perform the `read` action against all resources of type `devurl` in a given Coder deployment.


Could you add docs on why site is required here? This seems like it'd be attached to a workspace.

Eh, it's probably a bad example. +site:*.*.read might be better here.

kylecarbs · 2022-04-06T14:01:17Z

coderd/authz/object.go

+// An example is if you want to list all workspaces, you can create a zObject
+// that represents the set of workspaces you are trying to get access too.
+// Do not export this type, as it can be created from a resource type constant.
+type zObject struct {


Does this need to be prefixed with z? The package already ends with z, so I'd assume not.

kylecarbs · 2022-04-06T14:02:02Z

coderd/authz/object.go

+type UserResource interface {
+	Resource
+	OwnerID() string
+}
+
+type OrgResource interface {
+	Resource
+	OrgOwnerID() string
+}


I can't find anywhere that OwnerID or OrgOwnerID is used. Can we remove these interfaces?

kylecarbs · 2022-04-06T14:02:55Z

coderd/authz/object.go

+type Resource interface {
+	ID() string
+	ResourceType() ResourceType
+}
+
+type UserResource interface {
+	Resource
+	OwnerID() string
+}
+
+type OrgResource interface {
+	Resource
+	OrgOwnerID() string
+}


I don't see in the code how these interfaces are used. Can we remove them?

kylecarbs · 2022-04-06T14:03:53Z

coderd/authz/object.go

+func (z zObject) OrgOwnerID() string {
+	return z.OwnedByOrg


I think it's generally bad practice to expose a struct parameter under a different name.

OwnerByOrg and OrgOwnerID are the same thing, but in different words. What's the harm in exposing OwnedByOrg? I feel like these wrapper functions are misdirecting.

kylecarbs · 2022-04-06T14:04:37Z

coderd/authz/object.go

+
+// Org adds an org OwnerID to the resource
+//nolint:revive
+func (z zObject) Org(orgID string) zObject {


In idiomatic Go, these would be SetOrgOwnerID https://go.dev/doc/effective_go#Getters

kylecarbs · 2022-04-06T14:07:30Z

coderd/authz/authztest/README.md

-TODO
+Each row in the above table corresponds to a set of role permutations.
+There are 12 possible groups of role permutations:
+- Case 1 (W+):


Why did we need to create our own mini-DSL to test these cases? Since there's only 12, could we just write 12 test cases?

This isn't a DSL, it's just labeling categories for communication. It allows understanding a failure in O+ means there is a bug in positive org permissions.

Note that these 12 cases are applied to object permutations too. Using the labels makes this very easy to identify which sets change based on the object input.

So they are just names.

Could we reference these directly instead of abstracting them into abbreviated labels?

Closing this PR, so it doesn't matter, but giving them string names in a map or var names seems identical to me. It's a matter of documenting what the notation means, which I believe I have done in Notion. Would have had to be ported to Git if we continued this route.

unexport fields from zobject

Emyrk · 2022-04-08T15:11:00Z

We will not be generating the search space to test authz.

Emyrk and others added 27 commits March 31, 2022 15:46

WIP: This is a massive WIP

ab61328

Just testing out some ideas. The code is far from finished, and very sloppy. Committing to share it to start conversations

More info in the print

03e4d0f

Fix all()

9981291

reduce the amount of memoery allocated

3ab32da

Reuse a buffer

e1d5893

fix: use return size over size

84a90f3

WIP: don't look at this

1fac0d9

WIP: 🍐 auth-> testdata, refactoring and restructuring

1e3aac0

testdata -> authztest

e977e84

WIP: start work on SVO

00a7c3f

reduce allocations for union sets

1f04c01

fix: Fix nil permissions as Strings()

fbf4db1

chore: Make all permission variant levels

4946897

Playing around with helper functions to make life easy

First full draft of the authz authorize test

7e6cc66

Tally up failed tests

a0017e5

Change test pkg

4b110b3

Use an interface for the object

65ef4e3

fix: make authztest.Objects return correct type

d294786

refactor: rename consts {Read,Write,Modify,Delete}Action to Action$1

c1f8945

chore: Define object interface

01f3d40

- Cleanup some code too

test: Unit test extra properties

de7de6e

Merge remote-tracking branch 'origin/stevenmasley/rbac' into stevenma…

4c86e44

…sley/rbac

put back interface assertion

30c6568

Fix some compile errors from merge

a419a65

test: Roles, sets, permissions, iterators

bbd1c4c

Test string functions

def010f

test: Unit test permission string

c4ee590

- Add some docs

Emyrk marked this pull request as draft April 4, 2022 14:48

Emyrk changed the title ~~test: Add unit test for rbac `~~ test: Add unit test for rbac Authorize() function Apr 4, 2022

Emyrk commented Apr 4, 2022

View reviewed changes

Emyrk added 4 commits April 4, 2022 11:54

Merge remote-tracking branch 'origin/main' into stevenmasley/rbac

913d141

test: ParsePermissions from strings

2804b92

Add some examples

use fmt over str builder for easier to read

5698938

Linting

75ed8ef

Emyrk marked this pull request as ready for review April 5, 2022 12:58

Emyrk requested review from kylecarbs and johnstcn April 5, 2022 13:03

authz: README.md: update table formatting

b2db661

johnstcn reviewed Apr 5, 2022

View reviewed changes

johnstcn approved these changes Apr 5, 2022

View reviewed changes

kylecarbs reviewed Apr 5, 2022

View reviewed changes

Emyrk and others added 6 commits April 5, 2022 10:43

Make action CRUD

26ef1e6

Make negate bool default to positive permission

LevelID -> OrganizationID

19aba30

feat: authztest: categorize test failures by test name

ceee9cd

fixup! feat: authztest: categorize test failures by test name

ee8bf04

chore: add documentation for authz and authztest

44c02a1

fixup! chore: add documentation for authz and authztest

dfb9ad1

kylecarbs requested changes Apr 6, 2022

View reviewed changes

johnstcn and others added 3 commits April 6, 2022 15:07

chore: more authz/authztest docs

e482d2c

Remove underscore from test names

a4e038f

unexport fields from zobject

zObject does not need exported fields

9918c16

Emyrk closed this Apr 8, 2022

misskniss added the V2 BETA label May 15, 2022

misskniss added this to the V2 Beta milestone May 15, 2022

ammario deleted the stevenmasley/rbac branch August 3, 2022 00:50


		## Example Permissions

		- `+site.devurl.*.read`: allowed to perform the `read` action against all resources of type `devurl` in a given Coder deployment.

test: Add unit test for rbac Authorize() function #853

test: Add unit test for rbac Authorize() function #853

Conversation

Emyrk commented Apr 4, 2022 • edited Loading

What this does

Unit test coverage

Issues

codecov bot commented Apr 4, 2022 • edited Loading

Codecov Report

Choose a reason for hiding this comment

Emyrk commented Apr 5, 2022

Choose a reason for hiding this comment

kylecarbs commented Apr 5, 2022

kylecarbs left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

johnstcn Apr 5, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Emyrk Apr 5, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

johnstcn Apr 6, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Emyrk commented Apr 8, 2022

test: Add unit test for rbac `Authorize()` function #853

test: Add unit test for rbac `Authorize()` function #853

Emyrk commented Apr 4, 2022 •

edited

Loading

codecov bot commented Apr 4, 2022 •

edited

Loading

johnstcn Apr 5, 2022 •

edited

Loading

Emyrk Apr 5, 2022 •

edited

Loading

johnstcn Apr 6, 2022 •

edited

Loading