<commit_before>import lmdb
from synapse.tests.common import *

import synapse.lib.auth as s_auth

class AuthTest(SynTest):

    def test_auth_rules(self):

        rules = (
            (True, ('foo:bar', {'baz': 'faz'})),
            (False, ('foo:bar', {'baz': 'woot*'})),

            (True, ('hehe:*', {})),
        )

        rulz = s_auth.Rules(rules)

        self.true(rulz.allow(('hehe:ha', {})))
        self.true(rulz.allow(('foo:bar', {'baz': 'faz'})))

        self.false(rulz.allow(('foo:bar', {'baz': 'wootwoot'})))
        self.false(rulz.allow(('newp:newp', {})))

    def test_auth_runas(self):
        self.eq(s_auth.whoami(), 'root@localhost')
        with s_auth.runas('<EMAIL>'):
            self.eq(s_auth.whoami(), '<EMAIL>')
        self.eq(s_auth.whoami(), 'root@localhost')

    def test_auth_tagtree(self):

        tree = s_auth.TagTree()

        tree.add('foo.bar.baz')

        self.false(tree.get('foo'))
        self.false(tree.get('foo.bar'))

        self.true(tree.get('foo.bar.baz'))
        self.true(tree.get('foo.bar.baz.faz'))

        tree.add('foo')

        self.true(tree.get('foo'))
        self.true(tree.get('foo.bar'))

    def test_auth_rbac(self):

        with self.getTestDir() as dirn:

            with s_auth.Auth(dirn) as auth:

                # Ensure our default lmdb size is correct
                self.eq(auth.getConfOpt('lmdb:mapsize'),
                        s_const.gigabyte)

                self.none(auth.users.get('<EMAIL>'))
                self.none(auth.roles.get('ninjas'))

                auth.addUser('<EMAIL>')
                auth.addUser('<EMAIL>')
                auth.addRole('ninjas')

                auth.addUser('<EMAIL>')
                auth.addRole('delmes')

                udel = auth.users.get('<EMAIL>')
                rdel = auth.roles.get('delmes')

                udel.addRole('delmes')
                self.nn(udel.roles.get('delmes'))

                udel.delRole('delmes')
                self.none(udel.roles.get('delmes'))

                udel.addRole('delmes')
                self.nn(udel.roles.get('delmes'))

                auth.delRole('delmes')
                self.none(udel.roles.get('delmes'))

                auth.delUser('<EMAIL>')

                self.raises(s_exc.DupUserName, auth.addUser, '<EMAIL>')
                self.raises(s_exc.DupRoleName, auth.addRole, 'ninjas')

                root = auth.users.get('<EMAIL>')
                self.nn(root)

                visi = auth.users.get('<EMAIL>')
                self.nn(visi)

                ninj = auth.roles.get('ninjas')
                self.nn(ninj)

                self.false(visi.allowed(('node:add', {'form': 'inet:ipv4'})))
                self.false(visi.allowed(('node:del', {'form': 'inet:ipv4'})))
                self.false(visi.allowed(('node:prop:set', {'form': 'inet:ipv4', 'prop': 'cc'})))

                self.false(visi.allowed(('node:tag:add', {'tag': 'hehe.haha'})))
                self.false(visi.allowed(('node:tag:del', {'tag': 'hehe.haha'})))

                visi.addRule(('node:add', {'form': 'inet:ipv4'}))
                visi.addRule(('node:del', {'form': 'inet:ipv4'}))
                visi.addRule(('node:prop:set', {'form': 'inet:ipv4', 'prop': 'cc'}))
                visi.addRule(('node:tag:add', {'tag': 'foo.bar'}))
                visi.addRule(('node:tag:del', {'tag': 'baz.faz'}))

                root.setAdmin(True)
                self.true(root.allowed(('node:add', {'form': 'inet:ipv4'})))
                self.false(root.allowed(('node:add', {'form': 'inet:ipv4'}), elev=False))

                self.true(root.admin)
                self.false(visi.admin)

                ninj.addRule(('node:add', {'form': 'inet:fqdn'}))

                self.true(visi.allowed(('node:tag:add', {'tag': 'foo.bar'})))

                self.true(visi.allowed(('node:tag:add', {'tag': 'foo.bar'})))
                self.true(visi.allowed(('node:tag:del', {'tag': 'baz.faz'})))

                self.true(visi.allowed(('node:tag:add', {'tag': 'foo.bar.yep'})))
                self.true(visi.allowed(('node:tag:del', {'tag': 'baz.faz.yep'})))

                self.false(visi.allowed(('node:tag:add', {'tag': 'hehe.haha'})))
                self.false(visi.allowed(('node:tag:del', {'tag': 'hehe.haha'})))

                self.true(visi.allowed(('node:add', {'form': 'inet:ipv4'})))
                self.false(ninj.allowed(('node:add', {'form': 'inet:ipv4'})))

                self.true(ninj.allowed(('node:add', {'form': 'inet:fqdn'})))
                self.false(visi.allowed(('node:add', {'form': 'inet:fqdn'})))

                visi.addRole('ninjas')
                self.true(visi.allowed(('node:add', {'form': 'inet:fqdn'})))

                visi.delRole('ninjas')
                self.false(visi.allowed(('node:add', {'form': 'inet:fqdn'})))

                visi.addRole('ninjas')

            with s_auth.Auth(dirn) as auth:

                self.none(auth.users.get('<EMAIL>'))
                self.none(auth.roles.get('delmes'))

                visi = auth.users.get('<EMAIL>')
                self.true(visi.allowed(('node:add', {'form': 'inet:ipv4'})))

                self.nn(visi.roles.get('ninjas'))
                self.true(visi.allowed(('node:add', {'form': 'inet:fqdn'})))

                root = auth.users.get('<EMAIL>')
                self.true(root.admin)
<commit_msg>extend auth tests to twiddle admin status<commit_after>import lmdb
from synapse.tests.common import *

import synapse.lib.auth as s_auth

class AuthTest(SynTest):

    def test_auth_rules(self):

        rules = (
            (True, ('foo:bar', {'baz': 'faz'})),
            (False, ('foo:bar', {'baz': 'woot*'})),

            (True, ('hehe:*', {})),
        )

        rulz = s_auth.Rules(rules)

        self.true(rulz.allow(('hehe:ha', {})))
        self.true(rulz.allow(('foo:bar', {'baz': 'faz'})))

        self.false(rulz.allow(('foo:bar', {'baz': 'wootwoot'})))
        self.false(rulz.allow(('newp:newp', {})))

    def test_auth_runas(self):
        self.eq(s_auth.whoami(), 'root@localhost')
        with s_auth.runas('<EMAIL>'):
            self.eq(s_auth.whoami(), '<EMAIL>')
        self.eq(s_auth.whoami(), 'root@localhost')

    def test_auth_tagtree(self):

        tree = s_auth.TagTree()

        tree.add('foo.bar.baz')

        self.false(tree.get('foo'))
        self.false(tree.get('foo.bar'))

        self.true(tree.get('foo.bar.baz'))
        self.true(tree.get('foo.bar.baz.faz'))

        tree.add('foo')

        self.true(tree.get('foo'))
        self.true(tree.get('foo.bar'))

    def test_auth_rbac(self):

        with self.getTestDir() as dirn:

            with s_auth.Auth(dirn) as auth:

                # Ensure our default lmdb size is correct
                self.eq(auth.getConfOpt('lmdb:mapsize'),
                        s_const.gigabyte)

                self.none(auth.users.get('<EMAIL>'))
                self.none(auth.roles.get('ninjas'))

                auth.addUser('<EMAIL>')
                auth.addUser('<EMAIL>')
                auth.addRole('ninjas')

                auth.addUser('<EMAIL>')
                auth.addRole('delmes')

                udel = auth.users.get('<EMAIL>')
                rdel = auth.roles.get('delmes')

                udel.addRole('delmes')
                self.nn(udel.roles.get('delmes'))

                udel.delRole('delmes')
                self.none(udel.roles.get('delmes'))

                udel.addRole('delmes')
                self.nn(udel.roles.get('delmes'))

                auth.delRole('delmes')
                self.none(udel.roles.get('delmes'))

                auth.delUser('<EMAIL>')

                self.raises(s_exc.DupUserName, auth.addUser, '<EMAIL>')
                self.raises(s_exc.DupRoleName, auth.addRole, 'ninjas')

                root = auth.users.get('<EMAIL>')
                self.nn(root)

                visi = auth.users.get('<EMAIL>')
                self.nn(visi)

                ninj = auth.roles.get('ninjas')
                self.nn(ninj)

                self.false(visi.allowed(('node:add', {'form': 'inet:ipv4'})))
                self.false(visi.allowed(('node:del', {'form': 'inet:ipv4'})))
                self.false(visi.allowed(('node:prop:set', {'form': 'inet:ipv4', 'prop': 'cc'})))

                self.false(visi.allowed(('node:tag:add', {'tag': 'hehe.haha'})))
                self.false(visi.allowed(('node:tag:del', {'tag': 'hehe.haha'})))

                visi.addRule(('node:add', {'form': 'inet:ipv4'}))
                visi.addRule(('node:del', {'form': 'inet:ipv4'}))
                visi.addRule(('node:prop:set', {'form': 'inet:ipv4', 'prop': 'cc'}))
                visi.addRule(('node:tag:add', {'tag': 'foo.bar'}))
                visi.addRule(('node:tag:del', {'tag': 'baz.faz'}))

                root.setAdmin(True)
                self.true(root.allowed(('node:add', {'form': 'inet:ipv4'})))
                self.false(root.allowed(('node:add', {'form': 'inet:ipv4'}), elev=False))
                # Setting the admin flag to the same value is a no-op
                root.setAdmin(True)
                # We can twiddle the admin privs
                root.setAdmin(False)
                self.false(root.admin)
                self.false(root.allowed(('node:add', {'form': 'inet:ipv4'})))
                self.false(root.allowed(('node:add', {'form': 'inet:ipv4'}), elev=False))
                # And setting back to true restores the previous behavior.
                root.setAdmin(True)
                self.true(root.allowed(('node:add', {'form': 'inet:ipv4'})))
                self.false(root.allowed(('node:add', {'form': 'inet:ipv4'}), elev=False))

                self.true(root.admin)
                self.false(visi.admin)

                ninj.addRule(('node:add', {'form': 'inet:fqdn'}))

                self.true(visi.allowed(('node:tag:add', {'tag': 'foo.bar'})))

                self.true(visi.allowed(('node:tag:add', {'tag': 'foo.bar'})))
                self.true(visi.allowed(('node:tag:del', {'tag': 'baz.faz'})))

                self.true(visi.allowed(('node:tag:add', {'tag': 'foo.bar.yep'})))
                self.true(visi.allowed(('node:tag:del', {'tag': 'baz.faz.yep'})))

                self.false(visi.allowed(('node:tag:add', {'tag': 'hehe.haha'})))
                self.false(visi.allowed(('node:tag:del', {'tag': 'hehe.haha'})))

                self.true(visi.allowed(('node:add', {'form': 'inet:ipv4'})))
                self.false(ninj.allowed(('node:add', {'form': 'inet:ipv4'})))

                self.true(ninj.allowed(('node:add', {'form': 'inet:fqdn'})))
                self.false(visi.allowed(('node:add', {'form': 'inet:fqdn'})))

                visi.addRole('ninjas')
                self.true(visi.allowed(('node:add', {'form': 'inet:fqdn'})))

                visi.delRole('ninjas')
                self.false(visi.allowed(('node:add', {'form': 'inet:fqdn'})))

                visi.addRole('ninjas')

            with s_auth.Auth(dirn) as auth:

                self.none(auth.users.get('<EMAIL>'))
                self.none(auth.roles.get('delmes'))

                visi = auth.users.get('<EMAIL>')
                self.true(visi.allowed(('node:add', {'form': 'inet:ipv4'})))

                self.nn(visi.roles.get('ninjas'))
                self.true(visi.allowed(('node:add', {'form': 'inet:fqdn'})))

                root = auth.users.get('<EMAIL>')
                self.true(root.admin)

{'fraction_non_alphanumeric': 0.2014400971631821, 'fraction_numerical': 0.002255573870044244, 'mean_word_length': 1.952112676056338, 'pattern_counts': {'":': 0, '<': 31, '<?xml version=': 0, '>': 31, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3805891', 'n_tokens_mistral': 4087, 'n_tokens_neox': 3837, 'n_words': 484}