permission-backend: add tests for bulk resourceRefs

Signed-off-by: Vincenzo Scamporlino <vincenzos@spotify.com>
2025-04-10 12:47:06 +02:00
parent 1ffe31cf69
commit 9692c85d7e
1 changed files with 78 additions and 0 deletions
@@ -154,6 +154,84 @@ describe('createRouter', () => {
      });
    });

+    it('calls the permission policy with batched resourceRefs', async () => {
+      policy.handle.mockResolvedValueOnce({
+        result: AuthorizeResult.CONDITIONAL,
+        pluginId: 'test-plugin',
+        resourceType: 'test-resource-1',
+        conditions: { rule: 'test-rule', params: ['abc'] },
+      });
+
+      mockApplyConditions.mockResolvedValueOnce([
+        {
+          id: '123',
+          result: AuthorizeResult.ALLOW,
+        },
+        {
+          id: '123',
+          result: AuthorizeResult.DENY,
+        },
+      ]);
+
+      const response = await request(app)
+        .post('/authorize')
+        .send({
+          items: [
+            {
+              id: '123',
+              permission: {
+                type: 'resource',
+                name: 'test.permission1',
+                attributes: {},
+                resourceType: 'test-resource-1',
+              },
+              resourceRefs: ['resource:1', 'resource:2'],
+            },
+            {
+              id: '234',
+              permission: {
+                type: 'basic',
+                name: 'test.permission2',
+                attributes: {},
+              },
+            },
+          ],
+        });
+
+      expect(response.status).toEqual(200);
+
+      expect(policy.handle).toHaveBeenCalledWith(
+        {
+          permission: {
+            type: 'resource',
+            name: 'test.permission1',
+            attributes: {},
+            resourceType: 'test-resource-1',
+          },
+        },
+        undefined,
+      );
+      expect(policy.handle).toHaveBeenCalledWith(
+        {
+          permission: {
+            type: 'basic',
+            name: 'test.permission2',
+            attributes: {},
+          },
+        },
+        undefined,
+      );
+
+      expect(policy.handle).toHaveBeenCalledTimes(2);
+
+      expect(response.body).toEqual({
+        items: [
+          { id: '123', result: [AuthorizeResult.ALLOW, AuthorizeResult.DENY] },
+          { id: '234', result: AuthorizeResult.DENY },
+        ],
+      });
+    });
+
    it('resolves identity from the Authorization header', async () => {
      const response = await request(app)
        .post('/authorize')