66 lines
2.4 KiB
Go
66 lines
2.4 KiB
Go
package businessscope
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestCandidateQueryUsesCompletedLifecycleFactsInsteadOfAggregateReturnTime(t *testing.T) {
|
|
assertions := []string{
|
|
"FROM delivery_vehicle dv",
|
|
"dv.delivery_status IN (2, 3)",
|
|
"FROM return_vehicle_task rt",
|
|
"rt.status IN (2, 3, 5)",
|
|
"FROM delivery_vehicle newer",
|
|
"LEFT JOIN vehicle_lease_order_record r",
|
|
"ci.customer_name",
|
|
"co.business_department_name",
|
|
"co.other_business_department_name",
|
|
"co.business_manager_name",
|
|
"co.other_business_manager_name",
|
|
}
|
|
for _, expected := range assertions {
|
|
if !strings.Contains(candidateQuery, expected) {
|
|
t.Fatalf("candidate query missing %q", expected)
|
|
}
|
|
}
|
|
if strings.Contains(candidateQuery, "r.last_return_time") {
|
|
t.Fatal("candidate query must not trust aggregate last_return_time written by return drafts")
|
|
}
|
|
}
|
|
|
|
func TestValidateReadOnlyGrantsAllowsOnlyRequiredTableSelects(t *testing.T) {
|
|
grants := []string{
|
|
"GRANT USAGE ON *.* TO `reader`@`%`",
|
|
"GRANT SELECT ON `ln_asset_management`.`vehicle_lease_order_record` TO `reader`@`%`",
|
|
"GRANT SELECT ON `ln_asset_management`.`delivery_vehicle` TO `reader`@`%`",
|
|
"GRANT SELECT ON `ln_asset_management`.`return_vehicle_task` TO `reader`@`%`",
|
|
"GRANT SELECT ON `ln_asset_management`.`vehicle_info` TO `reader`@`%`",
|
|
"GRANT SELECT ON `ln_asset_management`.`customer_info` TO `reader`@`%`",
|
|
"GRANT SELECT ON `ln_asset_management`.`vehicle_lease_contract_info` TO `reader`@`%`",
|
|
"GRANT SELECT ON `ln_asset_management`.`vehicle_status` TO `reader`@`%`",
|
|
}
|
|
if err := ValidateReadOnlyGrants(grants); err != nil {
|
|
t.Fatalf("read-only grants rejected: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestValidateReadOnlyGrantsRejectsBroadOrWritePrivileges(t *testing.T) {
|
|
cases := [][]string{
|
|
{"GRANT ALL PRIVILEGES ON `ln_asset_management`.* TO `reader`@`%`"},
|
|
{"GRANT SELECT, UPDATE ON `ln_asset_management`.* TO `reader`@`%`"},
|
|
{"GRANT SELECT ON *.* TO `reader`@`%`"},
|
|
{"GRANT SELECT ON `ln_asset_management`.* TO `reader`@`%`"},
|
|
{"GRANT SELECT ON `ry-cloud`.`sys_user` TO `reader`@`%`"},
|
|
{"GRANT SHOW VIEW ON `ln_asset_management`.`vehicle_info` TO `reader`@`%`"},
|
|
{"GRANT PROCESS, REPLICATION CLIENT ON *.* TO `reader`@`%`"},
|
|
{"GRANT `scope_reader_role`@`%` TO `reader`@`%`"},
|
|
{"SET DEFAULT ROLE `scope_reader_role`@`%` TO `reader`@`%`"},
|
|
}
|
|
for _, grants := range cases {
|
|
if err := ValidateReadOnlyGrants(grants); err == nil {
|
|
t.Fatalf("unsafe grants accepted: %#v", grants)
|
|
}
|
|
}
|
|
}
|