From 9692c85d7ec22a31e82fe4a1b592c83fd36aa71a Mon Sep 17 00:00:00 2001
From: Vincenzo Scamporlino <vincenzos@spotify.com>
Date: Thu, 10 Apr 2025 12:47:06 +0200
Subject: [PATCH] permission-backend: add tests for bulk resourceRefs

Signed-off-by: Vincenzo Scamporlino <vincenzos@spotify.com>
---
 .../src/service/router.test.ts                | 78 +++++++++++++++++++
 1 file changed, 78 insertions(+)

diff --git a/plugins/permission-backend/src/service/router.test.ts b/plugins/permission-backend/src/service/router.test.ts
index 9c8fa4ad5f..fd5d8f67bd 100644
--- a/plugins/permission-backend/src/service/router.test.ts
+++ b/plugins/permission-backend/src/service/router.test.ts
@@ -154,6 +154,84 @@ describe('createRouter', () => {
       });
     });
 
+    it('calls the permission policy with batched resourceRefs', async () => {
+      policy.handle.mockResolvedValueOnce({
+        result: AuthorizeResult.CONDITIONAL,
+        pluginId: 'test-plugin',
+        resourceType: 'test-resource-1',
+        conditions: { rule: 'test-rule', params: ['abc'] },
+      });
+
+      mockApplyConditions.mockResolvedValueOnce([
+        {
+          id: '123',
+          result: AuthorizeResult.ALLOW,
+        },
+        {
+          id: '123',
+          result: AuthorizeResult.DENY,
+        },
+      ]);
+
+      const response = await request(app)
+        .post('/authorize')
+        .send({
+          items: [
+            {
+              id: '123',
+              permission: {
+                type: 'resource',
+                name: 'test.permission1',
+                attributes: {},
+                resourceType: 'test-resource-1',
+              },
+              resourceRefs: ['resource:1', 'resource:2'],
+            },
+            {
+              id: '234',
+              permission: {
+                type: 'basic',
+                name: 'test.permission2',
+                attributes: {},
+              },
+            },
+          ],
+        });
+
+      expect(response.status).toEqual(200);
+
+      expect(policy.handle).toHaveBeenCalledWith(
+        {
+          permission: {
+            type: 'resource',
+            name: 'test.permission1',
+            attributes: {},
+            resourceType: 'test-resource-1',
+          },
+        },
+        undefined,
+      );
+      expect(policy.handle).toHaveBeenCalledWith(
+        {
+          permission: {
+            type: 'basic',
+            name: 'test.permission2',
+            attributes: {},
+          },
+        },
+        undefined,
+      );
+
+      expect(policy.handle).toHaveBeenCalledTimes(2);
+
+      expect(response.body).toEqual({
+        items: [
+          { id: '123', result: [AuthorizeResult.ALLOW, AuthorizeResult.DENY] },
+          { id: '234', result: AuthorizeResult.DENY },
+        ],
+      });
+    });
+
     it('resolves identity from the Authorization header', async () => {
       const response = await request(app)
         .post('/authorize')