Skip to content

Commit b2c88cc

Browse files
spezaspeza
committed
Write some cache tests and remove store dependency for RBAC handler (encapsulate in service)
1 parent 8e21c68 commit b2c88cc

File tree

6 files changed

+161
-15
lines changed

6 files changed

+161
-15
lines changed

‎handlers/handler.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ func (s *GaiaHandler) InitHandlers(e *echo.Echo) error {
3030
// --- Register handlers at echo instance ---
3131
storeService, _ := services.StorageService()
3232

33-
rbacSvc := rbac.NewService(storeService, rbac.NewCache(time.Minute*30))
33+
rbacSvc := rbac.NewService(storeService, rbac.NewCache(time.Minute*30, time.Minute*5))
3434
rbacEnforcer := rbac.NewPolicyEnforcer(rbacSvc)
3535
policyEnforcer := newPolicyEnforcerMiddleware(rbacEnforcer)
3636

@@ -52,7 +52,7 @@ func (s *GaiaHandler) InitHandlers(e *echo.Echo) error {
5252
perms.GET("", PermissionGetAll)
5353

5454
// RBAC
55-
rbacHandler := newRBACHandler(storeService, rbacSvc, resourcehelper.NewMarshaller())
55+
rbacHandler := newRBACHandler(rbacSvc, resourcehelper.NewMarshaller())
5656
e.GET(p+"rbac/policy/:name", rbacHandler.RBACPolicyResourceGet)
5757
e.POST(p+"rbac/policy", rbacHandler.RBACPolicyResourcePut)
5858
e.PUT(p+"rbac/policy/:name/bind/:username", rbacHandler.RBACPolicyBindingPut)

‎handlers/rbac.go

+5-7
Original file line numberDiff line numberDiff line change
@@ -9,17 +9,15 @@ import (
99
"github.com/gaia-pipeline/gaia"
1010
"github.com/gaia-pipeline/gaia/helper/resourcehelper"
1111
"github.com/gaia-pipeline/gaia/security/rbac"
12-
gStore "github.com/gaia-pipeline/gaia/store"
1312
)
1413

1514
type rbacHandler struct {
16-
store gStore.RBACStore
1715
svc rbac.Service
1816
rbacMarshaller resourcehelper.Marshaller
1917
}
2018

21-
func newRBACHandler(store gStore.RBACStore, svc rbac.Service, rbacMarshaller resourcehelper.Marshaller) *rbacHandler {
22-
return &rbacHandler{store: store, svc: svc, rbacMarshaller: rbacMarshaller}
19+
func newRBACHandler(svc rbac.Service, rbacMarshaller resourcehelper.Marshaller) *rbacHandler {
20+
return &rbacHandler{svc: svc, rbacMarshaller: rbacMarshaller}
2321
}
2422

2523
// RBACPolicyResourcePut creates or updates a new authorization.policy resource.
@@ -67,9 +65,9 @@ func (h rbacHandler) RBACPolicyBindingPut(c echo.Context) error {
6765
name := c.Param("name")
6866
username := c.Param("username")
6967

70-
if err := h.store.RBACPolicyBindingPut(username, name); err != nil {
71-
gaia.Cfg.Logger.Error("failed to put auth assignment: " + err.Error())
72-
return c.String(http.StatusBadRequest, "Error getting policy.")
68+
if err := h.svc.PutUserBinding(username, name); err != nil {
69+
gaia.Cfg.Logger.Error("failed to put policy binding: " + err.Error())
70+
return c.String(http.StatusBadRequest, "Error saving policy binding.")
7371
}
7472

7573
return c.String(http.StatusOK, "Successfully assignment role")

‎security/rbac/cache.go

+15-3
Original file line numberDiff line numberDiff line change
@@ -27,12 +27,24 @@ type cache struct {
2727
}
2828

2929
// NewCache creates a new cache. This cache works using expiration based eviction.
30-
func NewCache(expiration time.Duration) Cache {
31-
return &cache{
30+
func NewCache(expiration time.Duration, interval time.Duration) Cache {
31+
c := &cache{
3232
items: make(map[string]cacheItem),
3333
expiration: expiration,
3434
mu: sync.Mutex{},
3535
}
36+
37+
ticker := time.NewTicker(interval)
38+
go func() {
39+
for {
40+
select {
41+
case <-ticker.C:
42+
c.EvictExpired()
43+
}
44+
}
45+
}()
46+
47+
return c
3648
}
3749

3850
// Put creates or updates an item. This uses the default expiration time.
@@ -78,7 +90,7 @@ func (c *cache) EvictExpired() {
7890
}
7991
}
8092

81-
// Clear and invalidate the whole cache
93+
// Clear and invalidate the whole cache.
8294
func (c *cache) Clear() {
8395
defer c.mu.Unlock()
8496
c.mu.Lock()

‎security/rbac/cache_test.go

+130
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
package rbac
2+
3+
import (
4+
"github.com/gaia-pipeline/gaia"
5+
"gotest.tools/assert"
6+
"gotest.tools/assert/cmp"
7+
"sync"
8+
"testing"
9+
"time"
10+
)
11+
12+
var testItem = gaia.RBACEvaluatedPermissions{
13+
PipelineNamespace: {
14+
GetAction: map[gaia.RBACPolicyResource]string{
15+
"*": "allow",
16+
},
17+
},
18+
}
19+
20+
var testMap = map[string]cacheItem{
21+
"item": {
22+
value: testItem,
23+
expiration: time.Now().Add(1 * time.Minute).UnixNano(),
24+
},
25+
"item_expired": {
26+
value: testItem,
27+
expiration: time.Now().Add(-1 * time.Minute).UnixNano(),
28+
},
29+
}
30+
31+
func TestCache_Get_ValidItem_ReturnsValue(t *testing.T) {
32+
cache := cache{
33+
expiration: time.Millisecond * 10,
34+
items: testMap,
35+
mu: sync.Mutex{},
36+
}
37+
38+
value, ok := cache.Get("item")
39+
40+
assert.Check(t, cmp.DeepEqual(value, testMap["item"].value))
41+
assert.Check(t, cmp.Equal(ok, true))
42+
}
43+
44+
func TestCache_Get_MissingItem_ReturnsEmptyStructAndFalse(t *testing.T) {
45+
cache := cache{
46+
expiration: time.Millisecond * 10,
47+
items: map[string]cacheItem{},
48+
mu: sync.Mutex{},
49+
}
50+
51+
value, ok := cache.Get("missing")
52+
53+
assert.Check(t, cmp.DeepEqual(value, gaia.RBACEvaluatedPermissions{}))
54+
assert.Check(t, cmp.Equal(ok, false))
55+
}
56+
57+
func TestCache_Get_ExpiredItem_ReturnsEmptyStructAndFalse(t *testing.T) {
58+
cache := cache{
59+
expiration: time.Millisecond * 10,
60+
items: testMap,
61+
mu: sync.Mutex{},
62+
}
63+
64+
value, ok := cache.Get("item_expired")
65+
66+
assert.Check(t, cmp.DeepEqual(value, gaia.RBACEvaluatedPermissions{}))
67+
assert.Check(t, cmp.Equal(ok, false))
68+
}
69+
70+
func TestCache_Put_Item_ReturnsItem(t *testing.T) {
71+
cache := cache{
72+
expiration: time.Minute * 1,
73+
items: map[string]cacheItem{},
74+
mu: sync.Mutex{},
75+
}
76+
77+
value := cache.Put("item", testItem)
78+
79+
assert.Check(t, cmp.DeepEqual(value, testItem))
80+
}
81+
82+
func TestCache_EvictExpired(t *testing.T) {
83+
cache := cache{
84+
expiration: time.Minute * 1,
85+
items: map[string]cacheItem{
86+
"expired_01": {
87+
value: testItem,
88+
expiration: time.Now().Add(-2 * time.Minute).UnixNano(),
89+
},
90+
"valid_01": {
91+
value: testItem,
92+
expiration: time.Now().Add(2 * time.Minute).UnixNano(),
93+
},
94+
"expired_02": {
95+
value: testItem,
96+
expiration: time.Now().Add(-2 * time.Minute).UnixNano(),
97+
},
98+
},
99+
mu: sync.Mutex{},
100+
}
101+
102+
cache.EvictExpired()
103+
104+
_, p1 := cache.items["expired_01"]
105+
assert.Check(t, cmp.Equal(p1, false))
106+
_, p2 := cache.items["valid_01"]
107+
assert.Check(t, cmp.Equal(p2, true))
108+
_, p3 := cache.items["expired_01"]
109+
assert.Check(t, cmp.Equal(p3, false))
110+
}
111+
112+
func TestCache_ClearCache(t *testing.T) {
113+
cache := cache{
114+
expiration: time.Minute * 1,
115+
items: map[string]cacheItem{
116+
"expired_01": {
117+
value: testItem,
118+
expiration: time.Now().Add(-2 * time.Minute).UnixNano(),
119+
},
120+
"valid_01": {
121+
value: testItem,
122+
expiration: time.Now().Add(2 * time.Minute).UnixNano(),
123+
},
124+
},
125+
mu: sync.Mutex{},
126+
}
127+
128+
cache.Clear()
129+
assert.Check(t, cmp.Len(cache.items, 0))
130+
}

‎security/rbac/enforcer_test.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -70,11 +70,11 @@ func (s mockSvc) PutPolicy(policy gaia.RBACPolicyResourceV1) error {
7070
}
7171

7272
func (s mockSvc) GetUserEvaluatedPolicies(username string) (gaia.RBACEvaluatedPermissions, bool) {
73-
panic("implement me")
73+
return make(gaia.RBACEvaluatedPermissions), false
7474
}
7575

7676
func (s mockSvc) PutUserEvaluatedPolicies(username string, perms gaia.RBACEvaluatedPermissions) error {
77-
panic("implement me")
77+
return nil
7878
}
7979

8080
func TestPolicyEnforcer_Enforce_WithMissingPolicyStatement_ReturnsError(t *testing.T) {

‎security/rbac/service.go

+7-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ package rbac
22

33
import (
44
"fmt"
5-
5+
66
"github.com/gaia-pipeline/gaia"
77
"github.com/gaia-pipeline/gaia/store"
88
)
@@ -13,6 +13,7 @@ type Service interface {
1313
PutPolicy(policy gaia.RBACPolicyResourceV1) error
1414
GetUserEvaluatedPolicies(username string) (gaia.RBACEvaluatedPermissions, bool)
1515
PutUserEvaluatedPolicies(username string, perms gaia.RBACEvaluatedPermissions) error
16+
PutUserBinding(username string, policy string) error
1617
}
1718

1819
type service struct {
@@ -58,3 +59,8 @@ func (s *service) PutUserEvaluatedPolicies(username string, perms gaia.RBACEvalu
5859
s.evaluatedPermsCache.Put(username, perms)
5960
return nil
6061
}
62+
63+
// PutUserBinding saves a user policy binding into the store.
64+
func (s *service) PutUserBinding(username string, policy string) error {
65+
return s.store.RBACPolicyBindingPut(username, policy)
66+
}

0 commit comments

Comments
 (0)