synapse 2.164.0__py311-none-any.whl → 2.166.0__py311-none-any.whl

synapse/tests/test_lib_aha.py

@@ -186,8 +186,8 @@ class AhaTest(s_test.SynTest):
                     self.nn(await proxy.getCellIden())
 
                 with self.raises(s_exc.BadArg):
-                    await cryo.ahaclient.waitready(timeout=2)
-                    await cryo.ahaclient.modAhaSvcInfo('cryo.mynet', {'newp': 'newp'})
+                    _proxy = await cryo.ahaclient.proxy(timeout=2)
+                    await _proxy.modAhaSvcInfo('cryo.mynet', {'newp': 'newp'})
 
                 async with await s_telepath.openurl('aha://root:secret@0.cryo.mynet') as proxy:
                     self.nn(await proxy.getCellIden())
@@ -885,6 +885,27 @@ class AhaTest(s_test.SynTest):
                 self.isin('Provisioning aha:network must be equal to the Aha servers network',
                           cm.exception.get('mesg'))
 
+                # We can generate urls and then drop them en-mass. They will not usable.
+                provurls = []
+                enrlursl = []
+                async with aha.getLocalProxy() as proxy:
+                    provurls.append(await proxy.addAhaSvcProv('00.cell'))
+                    provurls.append(await proxy.addAhaSvcProv('01.cell', {'mirror': 'cell'}))
+                    enrlursl.append(await proxy.addAhaUserEnroll('bob'))
+                    enrlursl.append(await proxy.addAhaUserEnroll('alice'))
+
+                    await proxy.clearAhaSvcProvs()
+                    await proxy.clearAhaUserEnrolls()
+
+                for url in provurls:
+                    with self.raises(s_exc.NoSuchName) as cm:
+                        async with await s_telepath.openurl(url) as client:
+                            self.fail(f'Connected to an expired provisioning URL {url}')  # pragma: no cover
+                for url in enrlursl:
+                    with self.raises(s_exc.NoSuchName) as cm:
+                        async with await s_telepath.openurl(url) as prox:
+                            self.fail(f'Connected to an expired enrollment URL {url}')  # pragma: no cover
+
     async def test_aha_httpapi(self):
 
         conf = {
@@ -1148,13 +1169,24 @@ class AhaTest(s_test.SynTest):
                     self.stormHasNoWarnErr(msgs)
                     self.stormIsInPrint('Created AHA service pool: pool00.loop.vertex.link', msgs)
 
-                    with self.raises(s_exc.BadArg):
-                        await s_telepath.open('aha://pool00...')
+                    # Pool has no members....
+                    pool = await s_telepath.open('aha://pool00...')
+                    self.eq(0, pool.size())
+                    waiter = pool.waiter(0, 'svc:add')
 
                     msgs = await core00.stormlist('aha.pool.svc.add pool00... 00...')
                     self.stormHasNoWarnErr(msgs)
                     self.stormIsInPrint('AHA service (00...) added to service pool (pool00.loop.vertex.link)', msgs)
 
+                    self.len(1, await waiter.wait(timeout=12))
+                    prox = await pool.proxy(timeout=12)
+                    info = await prox.getCellInfo()
+                    self.eq('00', info.get('cell').get('aha').get('name'))
+                    self.eq(1, pool.size())
+                    await pool.fini()
+                    self.eq(0, pool.size())
+                    self.true(prox.isfini)
+
                     poolinfo = await aha.getAhaPool('pool00...')
                     self.len(1, poolinfo['services'])
 
@@ -1163,6 +1195,9 @@ class AhaTest(s_test.SynTest):
                     self.stormIsInPrint('    00.loop.vertex.link', msgs)
                     self.stormIsInPrint('1 pools', msgs)
 
+                    msgs = await core00.stormlist('$lib.print($lib.aha.pool.get(pool00.loop.vertex.link))')
+                    self.stormIsInPrint('aha:pool: pool00.loop.vertex.link', msgs)
+
                     async with await s_telepath.open('aha://pool00...') as pool:
 
                         replay = s_common.envbool('SYNDEV_NEXUS_REPLAY')
@@ -1320,3 +1355,90 @@ class AhaTest(s_test.SynTest):
                     svcinfo = snfo.get('svcinfo')
                     ready = svcinfo.get('ready')
                     self.true(ready)
+
+    async def test_aha_provision_longname(self):
+        # Run a long network name and try provisioning with values that would exceed CSR
+        # and certificate functionality.
+        with self.withNexusReplay() as stack:
+
+            with self.getTestDir() as dirn:
+                aha00dirn = s_common.gendir(dirn, 'aha00')
+                svc0dirn = s_common.gendir(dirn, 'svc00')
+                async with await s_base.Base.anit() as cm:
+                    # Add enough space to allow aha CA bootstraping.
+                    basenet = 'loop.vertex.link'
+                    networkname = f'{"x" * (64 - 7 - len(basenet))}.{basenet}'
+                    aconf = {
+                        'aha:name': 'aha',
+                        'aha:network': networkname,
+                        'provision:listen': f'ssl://aha.{networkname}:0'
+                    }
+                    name = aconf.get('aha:name')
+                    netw = aconf.get('aha:network')
+                    dnsname = f'{name}.{netw}'
+
+                    aha = await s_aha.AhaCell.anit(aha00dirn, conf=aconf)
+                    await cm.enter_context(aha)
+
+                    addr, port = aha.provdmon.addr
+                    # update the config to reflect the dynamically bound port
+                    aha.conf['provision:listen'] = f'ssl://{dnsname}:{port}'
+
+                    # do this config ex-post-facto due to port binding...
+                    host, ahaport = await aha.dmon.listen(f'ssl://0.0.0.0:0?hostname={dnsname}&ca={netw}')
+                    aha.conf['aha:urls'] = (f'ssl://{dnsname}:{ahaport}',)
+
+                    with self.raises(s_exc.BadArg) as errcm:
+                        await aha.addAhaSvcProv('00.svc', provinfo=None)
+                    self.isin('Hostname value must not exceed 64 characters in length.',
+                              errcm.exception.get('mesg'))
+                    self.isin('len=65', errcm.exception.get('mesg'))
+
+                    # We can generate a 64 character names though.
+                    onetime = await aha.addAhaSvcProv('00.sv', provinfo=None)
+                    sconf = {'aha:provision': onetime}
+                    s_common.yamlsave(sconf, svc0dirn, 'cell.yaml')
+                    svc0 = await s_cell.Cell.anit(svc0dirn, conf=sconf)
+                    await cm.enter_context(svc0)
+
+                    # Cannot generate a user cert that would be a problem for signing
+                    with self.raises(s_exc.BadArg) as errcm:
+                        await aha.addAhaUserEnroll('ruhroh')
+                    self.isin('Username value must not exceed 64 characters in length.',
+                              errcm.exception.get('mesg'))
+                    self.isin('len=65', errcm.exception.get('mesg'))
+
+                    # We can generate a name that is 64 characters in length and have its csr signed
+                    onetime = await aha.addAhaUserEnroll('vvvvv')
+                    async with await s_telepath.openurl(onetime) as prox:
+                        userinfo = await prox.getUserInfo()
+                        ahauser = userinfo.get('aha:user')
+                        ahanetw = userinfo.get('aha:network')
+                        username = f'{ahauser}@{ahanetw}'
+                        byts = aha.certdir.genUserCsr(username)
+                        byts = await prox.signUserCsr(byts)
+                        self.nn(byts)
+
+                    # 0 length inputs
+                    with self.raises(s_exc.BadArg) as errcm:
+                        await aha.addAhaSvcProv('')
+                    self.isin('Empty name values are not allowed for provisioning.', errcm.exception.get('mesg'))
+                    with self.raises(s_exc.BadArg) as errcm:
+                        await aha.addAhaUserEnroll('')
+                    self.isin('Empty name values are not allowed for provisioning.', errcm.exception.get('mesg'))
+
+            # add an aha bootstrapping test failure
+            with self.getTestDir() as dirn:
+                aha00dirn = s_common.gendir(dirn, 'aha00')
+                async with await s_base.Base.anit() as cm:
+                    # Make the network too long that we cannot bootstrap the CA
+                    basenet = 'loop.vertex.link'
+                    networkname = f'{"x" * (64 - len(basenet))}.{basenet}'
+                    aconf = {
+                        'aha:name': 'aha',
+                        'aha:network': networkname,
+                        'provision:listen': f'ssl://aha.{networkname}:0'
+                    }
+                    with self.raises(s_exc.CryptoErr) as errcm:
+                        await s_aha.AhaCell.anit(aha00dirn, conf=aconf)
+                    self.isin('Certificate name values must be between 1-64 characters', errcm.exception.get('mesg'))

synapse/tests/test_lib_ast.py

@@ -6,6 +6,7 @@ from unittest import mock
 
 import synapse.exc as s_exc
 import synapse.common as s_common
+import synapse.datamodel as s_datamodel
 
 import synapse.lib.ast as s_ast
 import synapse.lib.snap as s_snap
@@ -16,7 +17,6 @@ foo_stormpkg = {
     'name': 'foo',
     'desc': 'The Foo Module',
     'version': (0, 0, 1),
-    'synapse_minversion': [2, 144, 0],
     'synapse_version': '>=2.8.0,<3.0.0',
     'modules': [
         {
@@ -713,6 +713,8 @@ class AstTest(s_test.SynTest):
             self.len(3, await core.nodes('$form=(inet:dns:a, inet:dns:mx) inet:fqdn=vertex.link -+> $form'))
 
             self.len(2, await core.nodes('inet:fqdn=vertex.link :zone -> (inet:dns:a:fqdn, inet:dns:mx:fqdn)'))
+            self.len(2, await core.nodes('$prop=fqdn $targ=inet:fqdn inet:dns:a* :$prop -> $targ'))
+
             self.len(1, await core.nodes('$form=inet:dns:a:fqdn inet:fqdn=vertex.link :zone -> $form'))
 
             self.len(3, await core.nodes('inet:fqdn=vertex.link :zone -+> (inet:dns:a:fqdn, inet:dns:mx:fqdn)'))
@@ -1216,14 +1218,12 @@ class AstTest(s_test.SynTest):
         otherpkg = {
             'name': 'foosball',
             'version': '0.0.1',
-            'synapse_minversion': [2, 144, 0],
             'synapse_version': '>=2.8.0,<3.0.0',
         }
 
         stormpkg = {
             'name': 'stormpkg',
             'version': '1.2.3',
-            'synapse_minversion': [2, 144, 0],
             'synapse_version': '>=2.8.0,<3.0.0',
             'commands': (
                 {
@@ -1236,7 +1236,6 @@ class AstTest(s_test.SynTest):
         stormpkgnew = {
             'name': 'stormpkg',
             'version': '1.2.4',
-            'synapse_minversion': [2, 144, 0],
             'synapse_version': '>=2.8.0,<3.0.0',
             'commands': (
                 {
@@ -1249,7 +1248,6 @@ class AstTest(s_test.SynTest):
         jsonpkg = {
             'name': 'jsonpkg',
             'version': '1.2.3',
-            'synapse_minversion': [2, 144, 0],
             'synapse_version': '>=2.8.0,<3.0.0',
             'docs': (
                 {
@@ -2365,6 +2363,12 @@ class AstTest(s_test.SynTest):
             nodes = await core.nodes('if (false) { [inet:ipv4=1.2.3.4] }')
             self.len(0, nodes)
 
+            nodes = await core.nodes('if (null) { [inet:ipv4=1.2.3.4] }')
+            self.len(0, nodes)
+
+            self.none(await core.callStorm('return((null))'))
+            self.eq({'foo': None}, await core.callStorm('return(({"foo": null}))'))
+
             nodes = await core.nodes('[ test:int=(18 + 2) ]')
             self.len(1, nodes)
             self.eq(nodes[0].ndef, ('test:int', 20))
@@ -3549,7 +3553,17 @@ class AstTest(s_test.SynTest):
 
     async def test_ast_prop_perms(self):
 
-        async with self.getTestCore() as core:
+        async with self.getTestCore() as core:  # type: s_cortex.Cortex
+
+            # TODO: This goes away in 3.0.0 when we remove old style permissions.
+            for key, prop in core.model.props.items():
+                if not isinstance(prop, s_datamodel.Prop):
+                    continue
+                if prop.isuniv:
+                    continue
+                self.len(2, prop.delperms)
+                self.len(2, prop.setperms)
+
             visi = (await core.addUser('visi'))['iden']
 
             self.len(1, await core.nodes('[ inet:ipv4=1.2.3.4 :asn=10 ]'))
@@ -3571,3 +3585,395 @@ class AstTest(s_test.SynTest):
             self.stormHasNoWarnErr(msgs)
 
             self.len(1, await core.nodes('inet:ipv4=1.2.3.4 [ -:asn ]', opts={'user': visi}))
+
+        # When evaluating the property set permissions:
+        #
+        # node.prop.del.<form>.<prop>
+        # node.prop.del.<fullprop>
+        # node.prop.set.<form>.<prop>
+        # node.prop.set.<fullprop>
+        #
+        # We have to consider cases of no-match ( None ) results when interpreting
+        # the rules matches, in order to grant the permission. Since we decide
+        # the precedence order is the newer-style, we do not allow a mixed match
+        # where is an deny on the new style and an allow on the old style.
+        #
+        # Implementing this can be done by short-circuiting the a0 ( representing
+        # the new style permission matching ) where possible, and allowing the
+        # one undefined a0 + a1 case. All other results can then be left to raise
+        # a s_exc.AuthDeny error.
+        #
+        # a0    a1      action
+        # None  None    Deny
+        # None  True    Allow
+        # None  False   Deny
+        # True  None    Allow
+        # True  True    Allow
+        # True  False   Allow with precedence
+        # False None    Deny
+        # False True    Deny with precedence
+        # False False   Deny
+
+        # These tests assume that only positive permissions are present to grant node.add / node.prop.set
+        # and then denies on node.prop.set.
+
+        async with self.getTestCore() as core:  # type: s_cortex.Cortex
+            q = '[media:news=* :published=2020]'
+
+            # test 0
+            # None  None    Deny
+            name = s_common.guid()
+            unfo = await core.addUser(name)
+            opts = {'vars': {'name': name}}
+            await core.callStorm('auth.user.addrule $name node.add', opts=opts)
+            aslow = {'user': unfo.get('iden')}
+
+            msgs = await core.stormlist(q, opts=aslow)
+            self.stormIsInErr('must have permission node.prop.set.media:news.published', msgs)
+
+            # test 1
+            # None  True    Allow
+            name = s_common.guid()
+            unfo = await core.addUser(name)
+            opts = {'vars': {'name': name}}
+            await core.callStorm('auth.user.addrule $name node.prop.set.media:news:published', opts=opts)
+            await core.callStorm('auth.user.addrule $name node.add', opts=opts)
+            aslow = {'user': unfo.get('iden')}
+            msgs = await core.stormlist(q, opts=aslow)
+            self.stormHasNoErr(msgs)
+
+            # test 2
+            # None  False   Deny
+            name = s_common.guid()
+            unfo = await core.addUser(name)
+            opts = {'vars': {'name': name}}
+            await core.callStorm('auth.user.addrule $name "!node.prop.set.media:news:published"', opts=opts)
+            await core.callStorm('auth.user.addrule $name node.add', opts=opts)
+            aslow = {'user': unfo.get('iden')}
+            msgs = await core.stormlist(q, opts=aslow)
+            self.stormIsInErr('must have permission node.prop.set.media:news.published', msgs)
+
+            # test 3
+            # True  None    Allow
+            name = s_common.guid()
+            unfo = await core.addUser(name)
+            opts = {'vars': {'name': name}}
+            await core.callStorm('auth.user.addrule $name "node.prop.set.media:news.published"', opts=opts)
+            await core.callStorm('auth.user.addrule $name node.add', opts=opts)
+            aslow = {'user': unfo.get('iden')}
+            msgs = await core.stormlist(q, opts=aslow)
+            self.stormHasNoWarnErr(msgs)
+
+            # test 4
+            # True  True    Allow
+            name = s_common.guid()
+            unfo = await core.addUser(name)
+            opts = {'vars': {'name': name}}
+            await core.callStorm('auth.user.addrule $name "node.prop.set.media:news.published"', opts=opts)
+            await core.callStorm('auth.user.addrule $name "node.prop.set.media:news:published"', opts=opts)
+            await core.callStorm('auth.user.addrule $name node.add', opts=opts)
+            aslow = {'user': unfo.get('iden')}
+            msgs = await core.stormlist(q, opts=aslow)
+            self.stormHasNoWarnErr(msgs)
+
+            # test 5
+            # True  False   Allow with precedence
+            name = s_common.guid()
+            unfo = await core.addUser(name)
+            opts = {'vars': {'name': name}}
+            await core.callStorm('auth.user.addrule $name "node.prop.set.media:news.published"', opts=opts)
+            await core.callStorm('auth.user.addrule $name "!node.prop.set.media:news:published"', opts=opts)
+            await core.callStorm('auth.user.addrule $name node.add', opts=opts)
+            aslow = {'user': unfo.get('iden')}
+            msgs = await core.stormlist(q, opts=aslow)
+            self.stormHasNoWarnErr(msgs)
+
+            # test 6
+            # False None    Deny
+            name = s_common.guid()
+            unfo = await core.addUser(name)
+            opts = {'vars': {'name': name}}
+            await core.callStorm('auth.user.addrule $name "!node.prop.set.media:news.published"', opts=opts)
+            await core.callStorm('auth.user.addrule $name node.add', opts=opts)
+            aslow = {'user': unfo.get('iden')}
+            msgs = await core.stormlist(q, opts=aslow)
+            self.stormIsInErr('must have permission node.prop.set.media:news.published', msgs)
+
+            # test 7
+            # False True    Deny with precedence
+            name = s_common.guid()
+            unfo = await core.addUser(name)
+            opts = {'vars': {'name': name}}
+            await core.callStorm('auth.user.addrule $name "!node.prop.set.media:news.published"', opts=opts)
+            await core.callStorm('auth.user.addrule $name "node.prop.set.media:news:published"', opts=opts)
+            await core.callStorm('auth.user.addrule $name node.add', opts=opts)
+            aslow = {'user': unfo.get('iden')}
+            msgs = await core.stormlist(q, opts=aslow)
+            self.stormIsInErr('must have permission node.prop.set.media:news.published', msgs)
+
+            # test 8
+            # False False   Deny
+            name = s_common.guid()
+            unfo = await core.addUser(name)
+            opts = {'vars': {'name': name}}
+            await core.callStorm('auth.user.addrule $name "!node.prop.set.media:news.published"', opts=opts)
+            await core.callStorm('auth.user.addrule $name "!node.prop.set.media:news:published"', opts=opts)
+            await core.callStorm('auth.user.addrule $name node.add', opts=opts)
+            aslow = {'user': unfo.get('iden')}
+            msgs = await core.stormlist(q, opts=aslow)
+            self.stormIsInErr('must have permission node.prop.set.media:news.published', msgs)
+
+        # Exhaustive test for node.prop.del behaviors
+        async with self.getTestCore() as core:  # type: s_cortex.Cortex
+            q = 'inet:asn=$valu [ -:name ]'
+
+            # test 0
+            # None  None    Deny
+            name = s_common.guid()
+            unfo = await core.addUser(name)
+            varz = {'valu': 0}
+            aslow = {'user': unfo.get('iden'), 'vars': varz}
+            self.len(1, await core.nodes('[inet:asn=$valu :name=name]', opts={'vars': varz}))
+            msgs = await core.stormlist(q, opts=aslow)
+            self.stormIsInErr('must have permission node.prop.del.inet:asn.name', msgs)
+
+            # test 1
+            # None  True    Allow
+            name = s_common.guid()
+            unfo = await core.addUser(name)
+            opts = {'vars': {'name': name}}
+            await core.callStorm('auth.user.addrule $name node.prop.del.inet:asn:name', opts=opts)
+
+            varz = {'valu': 1}
+            aslow = {'user': unfo.get('iden'), 'vars': varz}
+            self.len(1, await core.nodes('[inet:asn=$valu :name=name]', opts={'vars': varz}))
+            msgs = await core.stormlist(q, opts=aslow)
+            self.stormHasNoErr(msgs)
+
+            # test 2
+            # None  False   Deny
+            name = s_common.guid()
+            unfo = await core.addUser(name)
+            opts = {'vars': {'name': name}}
+            await core.callStorm('auth.user.addrule $name "!node.prop.del:inet:asn:name"', opts=opts)
+            varz = {'valu': 2}
+            aslow = {'user': unfo.get('iden'), 'vars': varz}
+            self.len(1, await core.nodes('[inet:asn=$valu :name=name]', opts={'vars': varz}))
+            msgs = await core.stormlist(q, opts=aslow)
+            self.stormIsInErr('must have permission node.prop.del.inet:asn.name', msgs)
+
+            # test 3
+            # True  None    Allow
+            name = s_common.guid()
+            unfo = await core.addUser(name)
+            opts = {'vars': {'name': name}}
+            await core.callStorm('auth.user.addrule $name "node.prop.del.inet:asn.name"', opts=opts)
+
+            varz = {'valu': 3}
+            aslow = {'user': unfo.get('iden'), 'vars': varz}
+            self.len(1, await core.nodes('[inet:asn=$valu :name=name]', opts={'vars': varz}))
+            msgs = await core.stormlist(q, opts=aslow)
+            self.stormHasNoWarnErr(msgs)
+
+            # test 4
+            # True  True    Allow
+            name = s_common.guid()
+            unfo = await core.addUser(name)
+            opts = {'vars': {'name': name}}
+            await core.callStorm('auth.user.addrule $name "node.prop.del.inet:asn.name"', opts=opts)
+            await core.callStorm('auth.user.addrule $name "node.prop.del.inet:asn:name"', opts=opts)
+            varz = {'valu': 4}
+            aslow = {'user': unfo.get('iden'), 'vars': varz}
+            self.len(1, await core.nodes('[inet:asn=$valu :name=name]', opts={'vars': varz}))
+            msgs = await core.stormlist(q, opts=aslow)
+            self.stormHasNoWarnErr(msgs)
+
+            # test 5
+            # True  False   Allow with precedence
+            name = s_common.guid()
+            unfo = await core.addUser(name)
+            opts = {'vars': {'name': name}}
+            await core.callStorm('auth.user.addrule $name "node.prop.del.inet:asn.name"', opts=opts)
+            await core.callStorm('auth.user.addrule $name "!node.prop.del.inet:asn:name"', opts=opts)
+            varz = {'valu': 5}
+            aslow = {'user': unfo.get('iden'), 'vars': varz}
+            self.len(1, await core.nodes('[inet:asn=$valu :name=name]', opts={'vars': varz}))
+            msgs = await core.stormlist(q, opts=aslow)
+            self.stormHasNoWarnErr(msgs)
+
+            # test 6
+            # False None    Deny
+            name = s_common.guid()
+            unfo = await core.addUser(name)
+            opts = {'vars': {'name': name}}
+            await core.callStorm('auth.user.addrule $name "!node.prop.del.inet:asn.name"', opts=opts)
+            varz = {'valu': 6}
+            aslow = {'user': unfo.get('iden'), 'vars': varz}
+            self.len(1, await core.nodes('[inet:asn=$valu :name=name]', opts={'vars': varz}))
+            msgs = await core.stormlist(q, opts=aslow)
+            self.stormIsInErr('must have permission node.prop.del.inet:asn.name', msgs)
+
+            # test 7
+            # False True    Deny with precedence
+            name = s_common.guid()
+            unfo = await core.addUser(name)
+            opts = {'vars': {'name': name}}
+            await core.callStorm('auth.user.addrule $name "!node.prop.del.inet:asn.name"', opts=opts)
+            await core.callStorm('auth.user.addrule $name "node.prop.del.inet:asn:name"', opts=opts)
+            varz = {'valu': 7}
+            aslow = {'user': unfo.get('iden'), 'vars': varz}
+            self.len(1, await core.nodes('[inet:asn=$valu :name=name]', opts={'vars': varz}))
+            msgs = await core.stormlist(q, opts=aslow)
+            self.stormIsInErr('must have permission node.prop.del.inet:asn.name', msgs)
+
+            # test 8
+            # False False   Deny
+            name = s_common.guid()
+            unfo = await core.addUser(name)
+            opts = {'vars': {'name': name}}
+            await core.callStorm('auth.user.addrule $name "!node.prop.del.inet:asn.name"', opts=opts)
+            await core.callStorm('auth.user.addrule $name "!node.prop.del.inet:asn:name"', opts=opts)
+            varz = {'valu': 8}
+            aslow = {'user': unfo.get('iden'), 'vars': varz}
+            self.len(1, await core.nodes('[inet:asn=$valu :name=name]', opts={'vars': varz}))
+            msgs = await core.stormlist(q, opts=aslow)
+            self.stormIsInErr('must have permission node.prop.del.inet:asn.name', msgs)
+
+        # Negative permission tests
+        # These tests confirm the behavior when a deny rule is used to deny the permission
+        # but may still have an underlying allow rule present.
+
+        async with self.getTestCore() as core:  # type: s_cortex.Cortex
+            unfo = await core.addUser('lowuser')
+
+            await core.callStorm('auth.user.addrule lowuser "!node.prop.set.media:news.published"')
+            await core.callStorm('auth.user.addrule lowuser "!node.prop.set.media:news:published"')
+            await core.callStorm('auth.user.addrule lowuser node')
+            aslow = {'user': unfo.get('iden')}
+            q = '[media:news=(m0,) .seen=2020 :published=2020]'
+            msgs = await core.stormlist(q, opts=aslow)
+            self.stormIsInErr('must have permission node.prop.set.media:news.published', msgs)
+
+        # New style permission being deny, blanket node allowed
+        async with self.getTestCore() as core:  # type: s_cortex.Cortex
+            unfo = await core.addUser('lowuser')
+
+            await core.callStorm('auth.user.addrule lowuser "!node.prop.set.media:news.published"')
+            await core.callStorm('auth.user.addrule lowuser node')
+            aslow = {'user': unfo.get('iden')}
+            q = '[media:news=(m0,) .seen=2021 :published=2021]'
+            msgs = await core.stormlist(q, opts=aslow)
+            self.stormIsInErr('must have permission node.prop.set.media:news.published', msgs)
+
+        # Old style permission being deny, blanket node allowed
+        async with self.getTestCore() as core:  # type: s_cortex.Cortex
+            unfo = await core.addUser('lowuser')
+
+            await core.callStorm('auth.user.addrule lowuser "!node.prop.set.media:news:published"')
+            await core.callStorm('auth.user.addrule lowuser node')
+            aslow = {'user': unfo.get('iden')}
+            q = '[media:news=(m0,) .seen=2022 :published=2022]'
+            msgs = await core.stormlist(q, opts=aslow)
+            self.stormIsInErr('must have permission node.prop.set.media:news.published', msgs)
+
+        # Now with del - new style perm
+        async with self.getTestCore() as core:  # type: s_cortex.Cortex
+            unfo = await core.addUser('lowuser')
+            await core.callStorm('auth.user.addrule lowuser "!node.prop.del.media:news.published"')
+            await core.callStorm('auth.user.addrule lowuser "node"')
+            self.len(1, await core.nodes('[media:news=(m0,) :published=2022]'))
+            aslow = {'user': unfo.get('iden')}
+            q = 'media:news=(m0,) [-:published]'
+            msgs = await core.stormlist(q, opts=aslow)
+            self.stormIsInErr('must have permission node.prop.del.media:news.published', msgs)
+
+        # Now with del - old style perm
+        async with self.getTestCore() as core:  # type: s_cortex.Cortex
+            unfo = await core.addUser('lowuser')
+            await core.callStorm('auth.user.addrule lowuser "!node.prop.del.media:news:published"')
+            await core.callStorm('auth.user.addrule lowuser "node"')
+            self.len(1, await core.nodes('[media:news=(m0,) :published=2022]'))
+            aslow = {'user': unfo.get('iden')}
+            q = 'media:news=(m0,) [-:published]'
+            msgs = await core.stormlist(q, opts=aslow)
+            self.stormIsInErr('must have permission node.prop.del.media:news.published', msgs)
+
+        # This is a legal mix which has a logical equivalence to test case #7
+        async with self.getTestCore() as core:  # type: s_cortex.Cortex
+            unfo = await core.addUser('lowuser')
+            await core.callStorm('auth.user.addrule lowuser "!node.prop.set.media:news:published"')
+            await core.callStorm('auth.user.addrule lowuser node.prop.set')
+            await core.callStorm('auth.user.addrule lowuser node.add')
+            aslow = {'user': unfo.get('iden')}
+            q = '[media:news=(m0,) .seen=2022 :published=2022]'
+            msgs = await core.stormlist(q, opts=aslow)
+            self.stormIsInErr('must have permission node.prop.set.media:news.published', msgs)
+
+        # "Don't do this in production" example. Since the r1 DENY permission is not more precise
+        # than the R0 allow permission, we allow the action.
+        async with self.getTestCore() as core:  # type: s_cortex.Cortex
+            unfo = await core.addUser('lowuser')
+            await core.callStorm('auth.user.addrule lowuser "node.prop.set.media:news"')
+            await core.callStorm('auth.user.addrule lowuser "!node.prop.set.media:news:published"')
+            await core.callStorm('auth.user.addrule lowuser node')
+            aslow = {'user': unfo.get('iden')}
+            q = '[media:news=(m0,) .seen=2022 :published=2022]'
+            msgs = await core.stormlist(q, opts=aslow)
+            self.stormHasNoWarnErr(msgs)
+
+        # A valid construction - the user is granted one a new style prop set perm but denied others.
+        async with self.getTestCore() as core:  # type: s_cortex.Cortex
+            unfo = await core.addUser('lowuser')
+            await core.callStorm('auth.user.addrule lowuser "node.prop.set.media:news.published"')
+            await core.callStorm('auth.user.addrule lowuser "!node.prop.set"')
+            await core.callStorm('auth.user.addrule lowuser node.add')
+            aslow = {'user': unfo.get('iden')}
+            q = '[media:news=(m0,) :published=2022]'
+            msgs = await core.stormlist(q, opts=aslow)
+            self.stormHasNoWarnErr(msgs)
+
+        # A valid construction - the user is granted one a old style prop set perm but denied others.
+        # This is a deny with precedence.
+        async with self.getTestCore() as core:  # type: s_cortex.Cortex
+            unfo = await core.addUser('lowuser')
+            await core.callStorm('auth.user.addrule lowuser "node.prop.set.media:news:published"')
+            await core.callStorm('auth.user.addrule lowuser "!node.prop.set"')
+            await core.callStorm('auth.user.addrule lowuser node.add')
+            aslow = {'user': unfo.get('iden')}
+            q = '[media:news=(m0,) :published=2022]'
+            msgs = await core.stormlist(q, opts=aslow)
+            self.stormHasNoWarnErr(msgs)
+
+        # Same but with deletion
+        async with self.getTestCore() as core:  # type: s_cortex.Cortex
+            unfo = await core.addUser('lowuser')
+            await core.callStorm('auth.user.addrule lowuser "node.prop.del.media:news:published"')
+            await core.callStorm('auth.user.addrule lowuser "!node.prop.del"')
+            self.len(1, await core.nodes('[media:news=(m0,) :published=2022]'))
+            aslow = {'user': unfo.get('iden')}
+            q = 'media:news=(m0,) [-:published]'
+            msgs = await core.stormlist(q, opts=aslow)
+            self.stormHasNoWarnErr(msgs)
+
+        # "Don't do this in production" example. Since the r1 ALLOW permission is not more precise
+        # than the R0 allow permission, we deny the action.
+        async with self.getTestCore() as core:  # type: s_cortex.Cortex
+            unfo = await core.addUser('lowuser')
+            await core.callStorm('auth.user.addrule lowuser "node.prop.set.media:news:published"')
+            await core.callStorm('auth.user.addrule lowuser "!node.prop.set.media:news"')
+            await core.callStorm('auth.user.addrule lowuser node.add')
+            aslow = {'user': unfo.get('iden')}
+            q = '[media:news=(m0,) :published=2022]'
+            msgs = await core.stormlist(q, opts=aslow)
+            self.stormIsInErr('must have permission node.prop.set.media:news.published', msgs)
+
+        # Same but with deletion
+        async with self.getTestCore() as core:  # type: s_cortex.Cortex
+            unfo = await core.addUser('lowuser')
+            await core.callStorm('auth.user.addrule lowuser "node.prop.del.media:news:published"')
+            await core.callStorm('auth.user.addrule lowuser "!node.prop.del.media:news"')
+            self.len(1, await core.nodes('[media:news=(m0,) :published=2022]'))
+            aslow = {'user': unfo.get('iden')}
+            q = 'media:news=(m0,) [-:published]'
+            msgs = await core.stormlist(q, opts=aslow)
+            self.stormIsInErr('must have permission node.prop.del.media:news.published', msgs)