@cubejs-backend/testing 1.5.15 → 1.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -91,6 +91,47 @@ module.exports = {
|
|
|
91
91
|
},
|
|
92
92
|
};
|
|
93
93
|
}
|
|
94
|
+
// Developer user for testing overlapping policies scenario
|
|
95
|
+
// where group "*" has empty member includes and "developer" has row filter
|
|
96
|
+
if (user === 'developer') {
|
|
97
|
+
if (password && password !== 'developer_password') {
|
|
98
|
+
throw new Error(`Password doesn't match for ${user}`);
|
|
99
|
+
}
|
|
100
|
+
return {
|
|
101
|
+
password,
|
|
102
|
+
superuser: false,
|
|
103
|
+
securityContext: {
|
|
104
|
+
auth: {
|
|
105
|
+
username: 'developer',
|
|
106
|
+
userAttributes: {
|
|
107
|
+
region: 'CA',
|
|
108
|
+
allowedCities: ['Los Angeles', 'New York'],
|
|
109
|
+
},
|
|
110
|
+
roles: [],
|
|
111
|
+
groups: ['developer'],
|
|
112
|
+
},
|
|
113
|
+
},
|
|
114
|
+
};
|
|
115
|
+
}
|
|
116
|
+
// User for testing two-dimensional policy overlap (matches diagram in CompilerApi.ts)
|
|
117
|
+
// Has policy2_role, so both Policy 1 (*) and Policy 2 (policy2_role) apply
|
|
118
|
+
if (user === 'policy_test') {
|
|
119
|
+
if (password && password !== 'policy_test_password') {
|
|
120
|
+
throw new Error(`Password doesn't match for ${user}`);
|
|
121
|
+
}
|
|
122
|
+
return {
|
|
123
|
+
password,
|
|
124
|
+
superuser: false,
|
|
125
|
+
securityContext: {
|
|
126
|
+
auth: {
|
|
127
|
+
username: 'policy_test',
|
|
128
|
+
userAttributes: {},
|
|
129
|
+
roles: ['policy2_role'],
|
|
130
|
+
groups: [],
|
|
131
|
+
},
|
|
132
|
+
},
|
|
133
|
+
};
|
|
134
|
+
}
|
|
94
135
|
throw new Error(`User "${user}" doesn't exist`);
|
|
95
136
|
}
|
|
96
137
|
};
|
|
@@ -0,0 +1,69 @@
|
|
|
1
|
+
# Test case for overlapping access policies with member-level and row-level filters.
|
|
2
|
+
#
|
|
3
|
+
# This tests the scenario where:
|
|
4
|
+
# - Policy 1: group "*" with memberLevel.includes: [] (no members)
|
|
5
|
+
# - Policy 2: group "developer" with memberLevel.includes: "*" and row_level filters
|
|
6
|
+
# - Policy 3: group "admin" with memberLevel.includes: "*" and allowAll
|
|
7
|
+
#
|
|
8
|
+
# The row-level filter from the developer policy SHOULD be applied when a developer
|
|
9
|
+
# queries for members, because:
|
|
10
|
+
#
|
|
11
|
+
# Members
|
|
12
|
+
# ^
|
|
13
|
+
# | ┌─────────────────┐
|
|
14
|
+
# | │ Policy 1 │ (no members, no row filter)
|
|
15
|
+
# | │ ┌─────────────┼───────────────┐
|
|
16
|
+
# | │ │ │ │
|
|
17
|
+
# | └───┼─────────────┘ Policy 2 │ (all members, with row filter)
|
|
18
|
+
# | │ │
|
|
19
|
+
# | └─────────────────────────────┘
|
|
20
|
+
# └──────────────────────────────────────────> Rows
|
|
21
|
+
#
|
|
22
|
+
# Policy 1 covers no members (empty includes), so it should not affect row filtering.
|
|
23
|
+
# Policy 2 covers all members with a row filter, so the filter MUST be applied.
|
|
24
|
+
|
|
25
|
+
cubes:
|
|
26
|
+
- name: customers
|
|
27
|
+
sql_table: users
|
|
28
|
+
|
|
29
|
+
measures:
|
|
30
|
+
- name: count
|
|
31
|
+
type: count
|
|
32
|
+
|
|
33
|
+
- name: total_count
|
|
34
|
+
sql: "1"
|
|
35
|
+
type: sum
|
|
36
|
+
|
|
37
|
+
dimensions:
|
|
38
|
+
- name: id
|
|
39
|
+
sql: id
|
|
40
|
+
type: number
|
|
41
|
+
primary_key: true
|
|
42
|
+
|
|
43
|
+
- name: city
|
|
44
|
+
sql: city
|
|
45
|
+
type: string
|
|
46
|
+
|
|
47
|
+
access_policy:
|
|
48
|
+
# Policy 1: All groups, but grants access to NO members
|
|
49
|
+
- group: "*"
|
|
50
|
+
member_level:
|
|
51
|
+
includes: []
|
|
52
|
+
|
|
53
|
+
# Policy 2: Developers get all members, but with row-level filter on city
|
|
54
|
+
- group: developer
|
|
55
|
+
member_level:
|
|
56
|
+
includes: "*"
|
|
57
|
+
row_level:
|
|
58
|
+
filters:
|
|
59
|
+
- member: city
|
|
60
|
+
operator: equals
|
|
61
|
+
values: security_context.auth.userAttributes.allowedCities
|
|
62
|
+
|
|
63
|
+
# Policy 3: Admins get all members with no row restrictions
|
|
64
|
+
- group: leadership
|
|
65
|
+
member_level:
|
|
66
|
+
includes: "*"
|
|
67
|
+
row_level:
|
|
68
|
+
allow_all: true
|
|
69
|
+
|
|
@@ -0,0 +1,81 @@
|
|
|
1
|
+
# Test view for validating two-dimensional policy behavior
|
|
2
|
+
# Matches the diagram in CompilerApi.ts:559-647
|
|
3
|
+
#
|
|
4
|
+
# Base cube has no policies - the view applies the access policies
|
|
5
|
+
#
|
|
6
|
+
# Policy 1: covers members a, b with row filter R1 (id < 500)
|
|
7
|
+
# Policy 2: covers members b, c with row filter R2 (id >= 500)
|
|
8
|
+
#
|
|
9
|
+
# Expected behavior:
|
|
10
|
+
# Query (a, b) → Only Policy 1 applies → R1 rows (id < 500)
|
|
11
|
+
# Query (b, c) → Only Policy 2 applies → R2 rows (id >= 500)
|
|
12
|
+
# Query (b) → Both policies apply → R1 ∪ R2 rows (all rows)
|
|
13
|
+
# Query (a, b, c) → Neither covers all → Empty result (denied)
|
|
14
|
+
|
|
15
|
+
cubes:
|
|
16
|
+
# Base cube with no access policy
|
|
17
|
+
- name: policy_overlap_base
|
|
18
|
+
sql_table: public.line_items
|
|
19
|
+
|
|
20
|
+
dimensions:
|
|
21
|
+
- name: id
|
|
22
|
+
sql: id
|
|
23
|
+
type: number
|
|
24
|
+
primary_key: true
|
|
25
|
+
|
|
26
|
+
# Member "a" - only covered by Policy 1
|
|
27
|
+
- name: member_a
|
|
28
|
+
sql: order_id
|
|
29
|
+
type: number
|
|
30
|
+
|
|
31
|
+
# Member "b" - covered by both Policy 1 and Policy 2
|
|
32
|
+
- name: member_b
|
|
33
|
+
sql: product_id
|
|
34
|
+
type: number
|
|
35
|
+
|
|
36
|
+
# Member "c" - only covered by Policy 2
|
|
37
|
+
- name: member_c
|
|
38
|
+
sql: quantity
|
|
39
|
+
type: number
|
|
40
|
+
|
|
41
|
+
measures:
|
|
42
|
+
- name: count
|
|
43
|
+
type: count
|
|
44
|
+
|
|
45
|
+
views:
|
|
46
|
+
# View with two-dimensional access policies
|
|
47
|
+
- name: policy_overlap_test
|
|
48
|
+
cubes:
|
|
49
|
+
- join_path: policy_overlap_base
|
|
50
|
+
includes: "*"
|
|
51
|
+
|
|
52
|
+
access_policy:
|
|
53
|
+
# Policy 1: covers members a, b (and count, id for filtering) with row filter R1 (id < 500)
|
|
54
|
+
- role: "*"
|
|
55
|
+
member_level:
|
|
56
|
+
includes:
|
|
57
|
+
- id
|
|
58
|
+
- count
|
|
59
|
+
- member_a
|
|
60
|
+
- member_b
|
|
61
|
+
row_level:
|
|
62
|
+
filters:
|
|
63
|
+
- member: id
|
|
64
|
+
operator: lt
|
|
65
|
+
values:
|
|
66
|
+
- "500"
|
|
67
|
+
|
|
68
|
+
# Policy 2: covers members b, c (and count, id for filtering) with row filter R2 (id >= 500)
|
|
69
|
+
- role: "policy2_role"
|
|
70
|
+
member_level:
|
|
71
|
+
includes:
|
|
72
|
+
- id
|
|
73
|
+
- count
|
|
74
|
+
- member_b
|
|
75
|
+
- member_c
|
|
76
|
+
row_level:
|
|
77
|
+
filters:
|
|
78
|
+
- member: id
|
|
79
|
+
operator: gte
|
|
80
|
+
values:
|
|
81
|
+
- "500"
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@cubejs-backend/testing",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.6.0",
|
|
4
4
|
"description": "Cube.js e2e tests",
|
|
5
5
|
"author": "Cube Dev, Inc.",
|
|
6
6
|
"repository": {
|
|
@@ -99,15 +99,15 @@
|
|
|
99
99
|
"birdbox-fixtures"
|
|
100
100
|
],
|
|
101
101
|
"dependencies": {
|
|
102
|
-
"@cubejs-backend/cubestore-driver": "1.
|
|
102
|
+
"@cubejs-backend/cubestore-driver": "1.6.0",
|
|
103
103
|
"@cubejs-backend/dotenv": "^9.0.2",
|
|
104
|
-
"@cubejs-backend/ksql-driver": "1.
|
|
105
|
-
"@cubejs-backend/postgres-driver": "1.
|
|
106
|
-
"@cubejs-backend/query-orchestrator": "1.
|
|
107
|
-
"@cubejs-backend/schema-compiler": "1.
|
|
108
|
-
"@cubejs-backend/shared": "1.
|
|
109
|
-
"@cubejs-backend/testing-shared": "1.
|
|
110
|
-
"@cubejs-client/ws-transport": "1.
|
|
104
|
+
"@cubejs-backend/ksql-driver": "1.6.0",
|
|
105
|
+
"@cubejs-backend/postgres-driver": "1.6.0",
|
|
106
|
+
"@cubejs-backend/query-orchestrator": "1.6.0",
|
|
107
|
+
"@cubejs-backend/schema-compiler": "1.6.0",
|
|
108
|
+
"@cubejs-backend/shared": "1.6.0",
|
|
109
|
+
"@cubejs-backend/testing-shared": "1.6.0",
|
|
110
|
+
"@cubejs-client/ws-transport": "1.6.0",
|
|
111
111
|
"dedent": "^0.7.0",
|
|
112
112
|
"fs-extra": "^8.1.0",
|
|
113
113
|
"http-proxy": "^1.18.1",
|
|
@@ -118,8 +118,8 @@
|
|
|
118
118
|
},
|
|
119
119
|
"devDependencies": {
|
|
120
120
|
"@4tw/cypress-drag-drop": "^1.6.0",
|
|
121
|
-
"@cubejs-backend/linter": "1.
|
|
122
|
-
"@cubejs-client/core": "1.
|
|
121
|
+
"@cubejs-backend/linter": "1.6.0",
|
|
122
|
+
"@cubejs-client/core": "1.6.0",
|
|
123
123
|
"@jest/globals": "^29",
|
|
124
124
|
"@types/dedent": "^0.7.0",
|
|
125
125
|
"@types/http-proxy": "^1.17.5",
|
|
@@ -145,5 +145,5 @@
|
|
|
145
145
|
"eslintConfig": {
|
|
146
146
|
"extends": "../cubejs-linter"
|
|
147
147
|
},
|
|
148
|
-
"gitHead": "
|
|
148
|
+
"gitHead": "d2b683872b42db6c18dbd62b4a236eaf5faf090d"
|
|
149
149
|
}
|