@@ -1110,6 +1110,57 @@ func TestAuthorizeScope(t *testing.T) {
11101110{resource :ResourceOrganization .WithID (defOrg )},
11111111}),
11121112)
1113+
1114+ // Test setting a scope on the org and the user level
1115+ // This is a bit of a contrived example that would not exist in practice.
1116+ // It combines a specific organization scope with a user scope to verify
1117+ // that both are applied.
1118+ // The test uses the `Owner` role, so by default the user can do everything.
1119+ user = Subject {
1120+ ID :"me" ,
1121+ Roles :Roles {
1122+ must (RoleByName (RoleOwner ())),
1123+ // TODO: There is a __bug__ in the policy.rego. If the user is not a
1124+ // member of the organization, the org_scope fails. This happens because
1125+ // the org_allow_set uses "org_members".
1126+ // This is odd behavior, as without this membership role, the test for
1127+ // the workspace fails. Maybe scopes should just assume the user
1128+ // is a member.
1129+ must (RoleByName (ScopedRoleOrgMember (defOrg ))),
1130+ },
1131+ Scope :Scope {
1132+ Role :Role {
1133+ Identifier :RoleIdentifier {
1134+ Name :"org-and-user-scope" ,
1135+ OrganizationID :defOrg ,
1136+ },
1137+ DisplayName :"OrgAndUserScope" ,
1138+ Site :nil ,
1139+ Org :map [string ][]Permission {
1140+ defOrg .String ():Permissions (map [string ][]policy.Action {
1141+ ResourceWorkspace .Type : {policy .ActionRead },
1142+ }),
1143+ },
1144+ User :Permissions (map [string ][]policy.Action {
1145+ ResourceUser .Type : {policy .ActionRead },
1146+ }),
1147+ },
1148+ AllowIDList : []string {policy .WildcardSymbol },
1149+ },
1150+ }
1151+
1152+ testAuthorize (t ,"OrgAndUserScope" ,user ,
1153+ // Allowed by scope:
1154+ []authTestCase {
1155+ {resource :ResourceWorkspace .InOrg (defOrg ).WithOwner (user .ID ),allow :true ,actions : []policy.Action {policy .ActionRead }},
1156+ {resource :ResourceUser .WithOwner (user .ID ),allow :true ,actions : []policy.Action {policy .ActionRead }},
1157+ },
1158+ // Not allowed by scope:
1159+ []authTestCase {
1160+ {resource :ResourceWorkspace .InOrg (defOrg ).WithOwner (user .ID ),allow :false ,actions : []policy.Action {policy .ActionCreate }},
1161+ {resource :ResourceUser .WithOwner (user .ID ),allow :false ,actions : []policy.Action {policy .ActionUpdate }},
1162+ },
1163+ )
11131164}
11141165
11151166// cases applies a given function to all test cases. This makes generalities easier to create.