cloudron-box/src/test/groups-test.js

import { describe, it, before, after } from 'mocha';
import BoxError from '../boxerror.js';
import common from './common.js';
import assert from 'node:assert/strict';
import groups from '../groups.js';
import safe from 'safetydance';


describe('Groups', function () {
    const { setup, cleanup, admin, user, auditSource, app } = common;

    before(setup);
    after(cleanup);

    const group0Name = 'administrators';
    let group0Object;
    const group1Name = 'externs';
    let group1Object;

    describe('add', function () {
        it('cannot add group - too small', async function () {
            const [error] = await safe(groups.add({ name: '' }, auditSource));
            assert.equal(error.reason, BoxError.BAD_FIELD);
        });

        it('cannot add group - too big', async function () {
            const [error] = await safe(groups.add({ name: new Array(256).join('a') }, auditSource));
            assert.equal(error.reason, BoxError.BAD_FIELD);
        });

        it('cannot add group - bad name', async function () {
            const [error] = await safe(groups.add({ name: 'bad:name' }, auditSource));
            assert.equal(error.reason, BoxError.BAD_FIELD);
        });

        it('cannot add group - reserved', async function () {
            const [error] = await safe(groups.add({ name: 'users' }, auditSource));
            assert.equal(error.reason, BoxError.BAD_FIELD);
        });

        it('cannot add group - invalid', async function () {
            const [error] = await safe(groups.add({ name: 'cloudron+admin' }, auditSource));
            assert.equal(error.reason, BoxError.BAD_FIELD);
        });

        it('cannot add group - invalid source', async function () {
            const [error] = await safe(groups.add({ name: 'somegroup', source: 'unknownsource' }, auditSource));
            assert.equal(error.reason, BoxError.BAD_FIELD);
        });

        it('can add valid groups', async function () {
            let [error, result] = await safe(groups.add({ name: group0Name }, auditSource));
            assert.equal(error, null);
            group0Object = result;

            [error, result] = await safe(groups.add({ name: group1Name}, auditSource));
            assert.equal(error, null);
            group1Object = result;
        });

        it('cannot add existing group with mixed case', async function () {
            const name = group0Name[0].toUpperCase() + group0Name.slice(1);
            const [error] = await safe(groups.add({ name }, auditSource));
            assert.equal(error.reason, BoxError.ALREADY_EXISTS);
        });

        it('cannot add existing group', async function () {
            const [error] = await safe(groups.add({name: group0Name }, auditSource));
            assert.equal(error.reason, BoxError.ALREADY_EXISTS);
        });
    });

    describe('get', function () {
        it('cannot get invalid group', async function () {
            const result = await groups.get('sometrandom');
            assert.equal(result, null);
        });

        it('can get valid group', async function () {
            const result = await groups.get(group0Object.id);
            assert.equal(result.name, group0Name);
        });
    });

    describe('members', function () {
        it('isMember returns false', async function () {
            const isMember = await groups.isMember(group0Object.id, admin.id);
            assert.equal(isMember, false);
        });

        it('can set members', async function () {
            await groups.setMembers(group0Object, [ admin.id, user.id ], {}, auditSource);
        });

        it('cannot set duplicate members', async function () {
            const [error] = await safe(groups.setMembers(group0Object, [ admin.id, user.id, admin.id ], {}, auditSource));
            assert.equal(error.reason, BoxError.CONFLICT);
        });

        it('can list users of group', async function () {
            const result = await groups.getMemberIds(group0Object.id);
            assert.deepEqual(result.sort(), [ admin.id, user.id ].sort());
        });

        it('cannot list members of non-existent group', async function () {
            const result = await groups.getMemberIds('randomgroup');
            assert.equal(result.length, 0); // currently, we cannot differentiate invalid groups and empty groups
        });

        it('can getWithMembers', async function () {
            const result = await groups.getWithMembers(group0Object.id);
            assert.equal(result.name, group0Name);
            assert.deepEqual(result.userIds.sort(), [ admin.id, user.id ].sort());
        });

        it('can set group membership', async function () {
            await groups.setLocalMembership(admin, [ group0Object.id ], auditSource);
            const groupIds = await groups._getMembership(admin.id);
            assert.equal(groupIds.length, 1);
        });

        it('cannot set user to same group twice', async function () {
            const [error] = await safe(groups.setLocalMembership(admin, [ group0Object.id, group0Object.id ], auditSource));
            assert.equal(error.reason, BoxError.CONFLICT);
        });

        it('can set user to multiple groups', async function () {
            await groups.setLocalMembership(admin, [ group0Object.id, group1Object.id ], auditSource);
        });

        it('can get groups membership', async function () {
            const groupIds = await groups._getMembership(admin.id);
            assert.equal(groupIds.length, 2);
            assert.deepEqual(groupIds.sort(), [ group0Object.id, group1Object.id ].sort());
        });
    });

    describe('list', function () {
        it('can list', async function () {
            const result = await groups.list();
            assert.equal(result.length, 2);
            assert.equal(result[0].name, group0Name);
            assert.equal(result[1].name, group1Name);
        });

        it('can listWithMembers', async function () {
            const result = await groups.listWithMembers();
            assert.equal(result.length, 2);
            assert.equal(result[0].name, group0Name);
            assert.deepEqual(result[1].userIds, [ admin.id ]);
            assert.equal(result[1].name, group1Name);
        });
    });

    describe('delete', function () {
        it('cannot delete invalid group', async function () {
            const [error] = await safe(groups.del({ id: 'random' }, auditSource));
            assert.equal(error.reason, BoxError.NOT_FOUND);
        });

        it('can delete valid group', async function () {
            await groups.setMembers(group0Object, [ admin.id, user.id ], {}, auditSource); // ensure group has some members
            await groups.del(group0Object, auditSource);
        });
    });

    describe('update', function () {
        let groupObject;

        before(async function () {
            const [error, result] = await safe(groups.add({ name: 'kootam' }, auditSource));
            assert.equal(error, null);
            groupObject = result;
        });

        it('cannot set empty group name', async function () {
            const [error] = await safe(groups.setName(groupObject, '', auditSource));
            assert.equal(error.reason, BoxError.BAD_FIELD);
        });

        it('cannot set bad group name', async function () {
            const [error] = await safe(groups.setName(groupObject, '!kootam', auditSource));
            assert.equal(error.reason, BoxError.BAD_FIELD);
        });

        it('can set group name', async function () {
            await groups.setName(groupObject, 'kootam2', auditSource);
            groupObject = await groups.get(groupObject.id);
            assert.equal(groupObject.name, 'kootam2');
        });
    });

    describe('app access', function () {
        let groupObject;

        before(async function () {
            const [error, result] = await safe(groups.add({ name: 'kootam' }, auditSource));
            assert.equal(error, null);
            groupObject = result;
        });

        it('has no app access', async function () {
            assert.deepEqual(groupObject.appIds, []);

            const g1 = await groups.get(groupObject.id);
            assert.deepEqual(g1.appIds, []);

            const g2 = await groups.getByName(groupObject.name);
            assert.deepEqual(g2.appIds, []);

            const g3 = await groups.getWithMembers(groupObject.id);
            assert.deepEqual(g3.appIds, []);
        });

        it('set app access', async function () {
            await groups.setAllowedApps(groupObject, [ app.id ], auditSource);

            const g1 = await groups.get(groupObject.id);
            assert.deepEqual(g1.appIds, [ app.id ]);

            const g2 = await groups.getByName(groupObject.name);
            assert.deepEqual(g2.appIds, [ app.id ]);

            const g3 = await groups.getWithMembers(groupObject.id);
            assert.deepEqual(g3.appIds, [ app.id ]);

            const allGroups = await groups.listWithMembers();
            const g4 = allGroups.filter(g => g.id === groupObject.id)[0];
            assert.deepEqual(g4.appIds, [ app.id ]);
        });

        it('cleared app access', async function () {
            await groups.setAllowedApps(groupObject, [ ], auditSource);

            const g1 = await groups.get(groupObject.id);
            assert.deepEqual(g1.appIds, [ ]);

            const g2 = await groups.getByName(groupObject.name);
            assert.deepEqual(g2.appIds, [ ]);

            const g3 = await groups.getWithMembers(groupObject.id);
            assert.deepEqual(g3.appIds, [ ]);

            const allGroups = await groups.listWithMembers();
            const g4 = allGroups.filter(g => g.id === groupObject.id)[0];
            assert.deepEqual(g4.appIds, [ ]);
        });
    });

    describe('ldap group', function () {
        let ldapGroup;

        before(async function () {
            ldapGroup = await groups.add({ name: 'ldap-kootam', source: 'ldap' }, auditSource);
        });

        it('cannot change name', async function () {
            const [error] = await safe(groups.setName(ldapGroup, 'ldap-kootam2', auditSource));
            assert.equal(error.reason, BoxError.BAD_STATE);
        });

        it('cannot set members', async function () {
            const [error] = await safe(groups.setMembers(ldapGroup, [ admin.id ], { skipSourceSkip: false }, auditSource));
            assert.equal(error.reason, BoxError.BAD_STATE);
        });

        it('cannot set membership', async function () {
            const [error] = await safe(groups.setLocalMembership(admin, [ ldapGroup.id ], auditSource));
            assert.equal(error.reason, BoxError.BAD_STATE);
        });

        it('does not clear remote membership', async function () {
            await groups.setMembers(ldapGroup, [ admin.id ], { skipSourceCheck: true }, auditSource); // would be called by ldap syncer
            await groups.setLocalMembership(admin, [ group1Object.id ], auditSource);

            const groupIds = await groups._getMembership(admin.id);
            assert.equal(groupIds.length, 2);
            assert.deepEqual(groupIds.sort(), [ group1Object.id, ldapGroup.id ].sort());
        });
    });
});