<s> __all__ = [ <EOL> '<STR_LIT>' <EOL> ] <EOL> import bson <EOL> from st2common . triggers import register_internal_trigger_types <EOL> from st2common . rbac . types import PermissionType <EOL> from st2common . rbac . types import ResourceType <EOL> from st2common . persistence . auth import User <EOL> from st2common . persistence . rbac import Role <EOL> from st2common . persistence . rbac import UserRoleAssignment <EOL> from st2common . persistence . rbac import PermissionGrant <EOL> from st2common . persistence . rule import Rule <EOL> from st2common . persistence . rule_enforcement import RuleEnforcement <EOL> from st2common . models . db . auth import UserDB <EOL> from st2common . models . db . rbac import RoleDB <EOL> from st2common . models . db . rbac import UserRoleAssignmentDB <EOL> from st2common . models . db . rbac import PermissionGrantDB <EOL> from st2common . models . db . rule import RuleDB <EOL> from st2common . models . db . rule_enforcement import RuleEnforcementDB <EOL> from st2common . rbac . resolvers import RuleEnforcementPermissionsResolver <EOL> from tests . unit . test_rbac_resolvers import BasePermissionsResolverTestCase <EOL> class RuleEnforcementPermissionsResolverTestCase ( BasePermissionsResolverTestCase ) : <EOL> def setUp ( self ) : <EOL> super ( RuleEnforcementPermissionsResolverTestCase , self ) . setUp ( ) <EOL> register_internal_trigger_types ( ) <EOL> user_1_db = UserDB ( name = '<STR_LIT>' ) <EOL> user_1_db = User . add_or_update ( user_1_db ) <EOL> self . users [ '<STR_LIT>' ] = user_1_db <EOL> user_2_db = UserDB ( name = '<STR_LIT>' ) <EOL> user_2_db = User . add_or_update ( user_2_db ) <EOL> self . users [ '<STR_LIT>' ] = user_2_db <EOL> user_3_db = UserDB ( name = '<STR_LIT>' ) <EOL> user_3_db = User . add_or_update ( user_3_db ) <EOL> self . users [ '<STR_LIT>' ] = user_3_db <EOL> user_4_db = UserDB ( name = '<STR_LIT>' ) <EOL> user_4_db = User . add_or_update ( user_4_db ) <EOL> self . users [ '<STR_LIT>' ] = user_4_db <EOL> user_5_db = UserDB ( name = '<STR_LIT>' ) <EOL> user_5_db = User . add_or_update ( user_5_db ) <EOL> self . users [ '<STR_LIT>' ] = user_5_db <EOL> user_6_db = UserDB ( name = '<STR_LIT>' ) <EOL> user_6_db = User . add_or_update ( user_6_db ) <EOL> self . users [ '<STR_LIT>' ] = user_6_db <EOL> user_7_db = UserDB ( name = '<STR_LIT>' ) <EOL> user_7_db = User . add_or_update ( user_7_db ) <EOL> self . users [ '<STR_LIT>' ] = user_7_db <EOL> user_8_db = UserDB ( name = '<STR_LIT>' ) <EOL> user_8_db = User . add_or_update ( user_8_db ) <EOL> self . users [ '<STR_LIT>' ] = user_8_db <EOL> user_9_db = UserDB ( name = '<STR_LIT>' ) <EOL> user_9_db = User . add_or_update ( user_9_db ) <EOL> self . users [ '<STR_LIT>' ] = user_9_db <EOL> user_10_db = UserDB ( name = '<STR_LIT>' ) <EOL> user_10_db = User . add_or_update ( user_10_db ) <EOL> self . users [ '<STR_LIT>' ] = user_10_db <EOL> rule_1_db = RuleDB ( pack = '<STR_LIT>' , name = '<STR_LIT>' , action = { '<STR_LIT>' : '<STR_LIT>' } , <EOL> trigger = '<STR_LIT>' ) <EOL> rule_1_db = Rule . add_or_update ( rule_1_db ) <EOL> self . resources [ '<STR_LIT>' ] = rule_1_db <EOL> rule_enforcement_1_db = RuleEnforcementDB ( trigger_instance_id = str ( bson . ObjectId ( ) ) , <EOL> execution_id = str ( bson . ObjectId ( ) ) , <EOL> rule = { '<STR_LIT>' : rule_1_db . ref , <EOL> '<STR_LIT>' : rule_1_db . uid , <EOL> '<STR_LIT:id>' : str ( rule_1_db . id ) } ) <EOL> rule_enforcement_1_db = RuleEnforcement . add_or_update ( rule_enforcement_1_db ) <EOL> self . resources [ '<STR_LIT>' ] = rule_enforcement_1_db <EOL> rule_2_db = RuleDB ( pack = '<STR_LIT>' , name = '<STR_LIT>' ) <EOL> rule_2_db = Rule . add_or_update ( rule_2_db ) <EOL> self . resources [ '<STR_LIT>' ] = rule_2_db <EOL> rule_enforcement_2_db = RuleEnforcementDB ( trigger_instance_id = str ( bson . ObjectId ( ) ) , <EOL> execution_id = str ( bson . ObjectId ( ) ) , <EOL> rule = { '<STR_LIT>' : rule_2_db . ref , <EOL> '<STR_LIT>' : rule_2_db . uid , <EOL> '<STR_LIT:id>' : str ( rule_2_db . id ) } ) <EOL> rule_enforcement_2_db = RuleEnforcement . add_or_update ( rule_enforcement_2_db ) <EOL> self . resources [ '<STR_LIT>' ] = rule_enforcement_2_db <EOL> rule_3_db = RuleDB ( pack = '<STR_LIT>' , name = '<STR_LIT>' ) <EOL> rule_3_db = Rule . add_or_update ( rule_3_db ) <EOL> self . resources [ '<STR_LIT>' ] = rule_3_db <EOL> rule_enforcement_3_db = RuleEnforcementDB ( trigger_instance_id = str ( bson . ObjectId ( ) ) , <EOL> execution_id = str ( bson . ObjectId ( ) ) , <EOL> rule = { '<STR_LIT>' : rule_3_db . ref , <EOL> '<STR_LIT>' : rule_3_db . uid , <EOL> '<STR_LIT:id>' : str ( rule_3_db . id ) } ) <EOL> rule_enforcement_3_db = RuleEnforcement . add_or_update ( rule_enforcement_3_db ) <EOL> self . resources [ '<STR_LIT>' ] = rule_enforcement_3_db <EOL> grant_db = PermissionGrantDB ( resource_uid = self . resources [ '<STR_LIT>' ] . get_uid ( ) , <EOL> resource_type = ResourceType . PACK , <EOL> permission_types = [ PermissionType . RULE_VIEW ] ) <EOL> grant_db = PermissionGrant . add_or_update ( grant_db ) <EOL> permission_grants = [ str ( grant_db . id ) ] <EOL> role_3_db = RoleDB ( name = '<STR_LIT>' , <EOL> permission_grants = permission_grants ) <EOL> role_3_db = Role . add_or_update ( role_3_db ) <EOL> self . roles [ '<STR_LIT>' ] = role_3_db <EOL> grant_db = PermissionGrantDB ( resource_uid = self . resources [ '<STR_LIT>' ] . get_uid ( ) , <EOL> resource_type = ResourceType . RULE , <EOL> permission_types = [ PermissionType . RULE_VIEW ] ) <EOL> grant_db = PermissionGrant . add_or_update ( grant_db ) <EOL> permission_grants = [ str ( grant_db . id ) ] <EOL> role_4_db = RoleDB ( name = '<STR_LIT>' , permission_grants = permission_grants ) <EOL> role_4_db = Role . add_or_update ( role_4_db ) <EOL> self . roles [ '<STR_LIT>' ] = role_4_db <EOL> grant_db = PermissionGrantDB ( resource_uid = self . resources [ '<STR_LIT>' ] . get_uid ( ) , <EOL> resource_type = ResourceType . PACK , <EOL> permission_types = [ PermissionType . RULE_ALL ] ) <EOL> grant_db = PermissionGrant . add_or_update ( grant_db ) <EOL> permission_grants = [ str ( grant_db . id ) ] <EOL> role_4_db = RoleDB ( name = '<STR_LIT>' , <EOL> permission_grants = permission_grants ) <EOL> role_4_db = Role . add_or_update ( role_4_db ) <EOL> self . roles [ '<STR_LIT>' ] = role_4_db <EOL> grant_db = PermissionGrantDB ( resource_uid = self . resources [ '<STR_LIT>' ] . get_uid ( ) , <EOL> resource_type = ResourceType . RULE , <EOL> permission_types = [ PermissionType . RULE_ALL ] ) <EOL> grant_db = PermissionGrant . add_or_update ( grant_db ) <EOL> permission_grants = [ str ( grant_db . id ) ] <EOL> role_4_db = RoleDB ( name = '<STR_LIT>' , permission_grants = permission_grants ) <EOL> role_4_db = Role . add_or_update ( role_4_db ) <EOL> self . roles [ '<STR_LIT>' ] = role_4_db <EOL> grant_db = PermissionGrantDB ( resource_uid = self . resources [ '<STR_LIT>' ] . get_uid ( ) , <EOL> resource_type = ResourceType . RULE , <EOL> permission_types = [ PermissionType . RULE_MODIFY ] ) <EOL> grant_db = PermissionGrant . add_or_update ( grant_db ) <EOL> permission_grants = [ str ( grant_db . id ) ] <EOL> role_5_db = RoleDB ( name = '<STR_LIT>' , <EOL> permission_grants = permission_grants ) <EOL> role_5_db = Role . add_or_update ( role_5_db ) <EOL> self . roles [ '<STR_LIT>' ] = role_5_db <EOL> grant_db = PermissionGrantDB ( resource_uid = self . resources [ '<STR_LIT>' ] . get_uid ( ) , <EOL> resource_type = ResourceType . PACK , <EOL> permission_types = [ PermissionType . RULE_CREATE ] ) <EOL> grant_db = PermissionGrant . add_or_update ( grant_db ) <EOL> permission_grants = [ str ( grant_db . id ) ] <EOL> role_6_db = RoleDB ( name = '<STR_LIT>' , <EOL> permission_grants = permission_grants ) <EOL> role_6_db = Role . add_or_update ( role_6_db ) <EOL> self . roles [ '<STR_LIT>' ] = role_6_db <EOL> grant_db = PermissionGrantDB ( resource_uid = self . resources [ '<STR_LIT>' ] . get_uid ( ) , <EOL> resource_type = ResourceType . PACK , <EOL> permission_types = [ PermissionType . RULE_ALL ] ) <EOL> grant_db = PermissionGrant . add_or_update ( grant_db ) <EOL> permission_grants = [ str ( grant_db . id ) ] <EOL> role_7_db = RoleDB ( name = '<STR_LIT>' , <EOL> permission_grants = permission_grants ) <EOL> role_7_db = Role . add_or_update ( role_7_db ) <EOL> self . roles [ '<STR_LIT>' ] = role_7_db <EOL> grant_db = PermissionGrantDB ( resource_uid = self . resources [ '<STR_LIT>' ] . get_uid ( ) , <EOL> resource_type = ResourceType . RULE , <EOL> permission_types = [ PermissionType . RULE_CREATE ] ) <EOL> grant_db = PermissionGrant . add_or_update ( grant_db ) <EOL> permission_grants = [ str ( grant_db . id ) ] <EOL> role_8_db = RoleDB ( name = '<STR_LIT>' , <EOL> permission_grants = permission_grants ) <EOL> role_8_db = Role . add_or_update ( role_8_db ) <EOL> self . roles [ '<STR_LIT>' ] = role_8_db <EOL> grant_db = PermissionGrantDB ( resource_uid = self . resources [ '<STR_LIT>' ] . get_uid ( ) , <EOL> resource_type = ResourceType . RULE , <EOL> permission_types = [ PermissionType . RULE_ALL ] ) <EOL> grant_db = PermissionGrant . add_or_update ( grant_db ) <EOL> permission_grants = [ str ( grant_db . id ) ] <EOL> role_9_db = RoleDB ( name = '<STR_LIT>' , <EOL> permission_grants = permission_grants ) <EOL> role_9_db = Role . add_or_update ( role_9_db ) <EOL> self . roles [ '<STR_LIT>' ] = role_9_db <EOL> grant_db = PermissionGrantDB ( resource_uid = None , <EOL> resource_type = None , <EOL> permission_types = [ PermissionType . RULE_LIST ] ) <EOL> grant_db = PermissionGrant . add_or_update ( grant_db ) <EOL> permission_grants = [ str ( grant_db . id ) ] <EOL> role_10_db = RoleDB ( name = '<STR_LIT>' , <EOL> permission_grants = permission_grants ) <EOL> role_10_db = Role . add_or_update ( role_10_db ) <EOL> self . roles [ '<STR_LIT>' ] = role_10_db <EOL> user_db = self . users [ '<STR_LIT>' ] <EOL> role_assignment_db = UserRoleAssignmentDB ( <EOL> user = user_db . name , <EOL> role = self . roles [ '<STR_LIT>' ] . name ) <EOL> UserRoleAssignment . add_or_update ( role_assignment_db ) <EOL> user_db = self . users [ '<STR_LIT>' ] <EOL> role_assignment_db = UserRoleAssignmentDB ( user = user_db . name , <EOL> role = self . roles [ '<STR_LIT>' ] . name ) <EOL> UserRoleAssignment . add_or_update ( role_assignment_db ) <EOL> user_db = self . users [ '<STR_LIT>' ] <EOL> role_assignment_db = UserRoleAssignmentDB ( <EOL> user = user_db . name , <EOL> role = self . roles [ '<STR_LIT>' ] . name ) <EOL> UserRoleAssignment . add_or_update ( role_assignment_db ) <EOL> user_db = self . users [ '<STR_LIT>' ] <EOL> role_assignment_db = UserRoleAssignmentDB ( <EOL> user = user_db . name , <EOL> role = self . roles [ '<STR_LIT>' ] . name ) <EOL> UserRoleAssignment . add_or_update ( role_assignment_db ) <EOL> user_db = self . users [ '<STR_LIT>' ] <EOL> role_assignment_db = UserRoleAssignmentDB ( <EOL> user = user_db . name , <EOL> role = self . roles [ '<STR_LIT>' ] . name ) <EOL> UserRoleAssignment . add_or_update ( role_assignment_db ) <EOL> user_db = self . users [ '<STR_LIT>' ] <EOL> role_assignment_db = UserRoleAssignmentDB ( <EOL> user = user_db . name , <EOL> role = self . roles [ '<STR_LIT>' ] . name ) <EOL> UserRoleAssignment . add_or_update ( role_assignment_db ) <EOL> user_db = self . users [ '<STR_LIT>' ] <EOL> role_assignment_db = UserRoleAssignmentDB ( <EOL> user = user_db . name , <EOL> role = self . roles [ '<STR_LIT>' ] . name ) <EOL> UserRoleAssignment . add_or_update ( role_assignment_db ) <EOL> user_db = self . users [ '<STR_LIT>' ] <EOL> role_assignment_db = UserRoleAssignmentDB ( <EOL> user = user_db . name , <EOL> role = self . roles [ '<STR_LIT>' ] . name ) <EOL> UserRoleAssignment . add_or_update ( role_assignment_db ) <EOL> user_db = self . users [ '<STR_LIT>' ] <EOL> role_assignment_db = UserRoleAssignmentDB ( <EOL> user = user_db . name , <EOL> role = self . roles [ '<STR_LIT>' ] . name ) <EOL> UserRoleAssignment . add_or_update ( role_assignment_db ) <EOL> user_db = self . users [ '<STR_LIT>' ] <EOL> role_assignment_db = UserRoleAssignmentDB ( <EOL> user = user_db . name , <EOL> role = self . roles [ '<STR_LIT>' ] . name ) <EOL> UserRoleAssignment . add_or_update ( role_assignment_db ) <EOL> def test_user_has_permission ( self ) : <EOL> resolver = RuleEnforcementPermissionsResolver ( ) <EOL> user_db = self . users [ '<STR_LIT>' ] <EOL> permission_type = PermissionType . RULE_ENFORCEMENT_LIST <EOL> self . assertTrue ( resolver . user_has_permission ( user_db = user_db , <EOL> permission_type = permission_type ) ) <EOL> user_db = self . users [ '<STR_LIT>' ] <EOL> self . assertTrue ( resolver . user_has_permission ( user_db = user_db , <EOL> permission_type = permission_type ) ) <EOL> user_db = self . users [ '<STR_LIT>' ] <EOL> self . assertFalse ( resolver . user_has_permission ( user_db = user_db , <EOL> permission_type = permission_type ) ) <EOL> user_db = self . users [ '<STR_LIT>' ] <EOL> self . assertFalse ( resolver . user_has_permission ( user_db = user_db , <EOL> permission_type = permission_type ) ) <EOL> user_db = self . users [ '<STR_LIT>' ] <EOL> self . assertTrue ( resolver . user_has_permission ( user_db = user_db , <EOL> permission_type = permission_type ) ) <EOL> def test_user_has_resource_db_permission ( self ) : <EOL> resolver = RuleEnforcementPermissionsResolver ( ) <EOL> all_permission_types = PermissionType . get_valid_permissions_for_resource_type ( <EOL> ResourceType . RULE_ENFORCEMENT ) <EOL> resource_db = self . resources [ '<STR_LIT>' ] <EOL> user_db = self . users [ '<STR_LIT>' ] <EOL> self . assertTrue ( self . _user_has_resource_db_permissions ( <EOL> resolver = resolver , <EOL> user_db = user_db , <EOL> resource_db = resource_db , <EOL> permission_types = all_permission_types ) ) <EOL> user_db = self . users [ '<STR_LIT>' ] <EOL> self . assertTrue ( resolver . user_has_resource_db_permission ( <EOL> user_db = user_db , <EOL> resource_db = self . resources [ '<STR_LIT>' ] , <EOL> permission_type = PermissionType . RULE_ENFORCEMENT_VIEW ) ) <EOL> self . assertTrue ( resolver . user_has_resource_db_permission ( <EOL> user_db = user_db , <EOL> resource_db = self . resources [ '<STR_LIT>' ] , <EOL> permission_type = PermissionType . RULE_ENFORCEMENT_VIEW ) ) <EOL> user_db = self . users [ '<STR_LIT>' ] <EOL> self . assertFalse ( self . _user_has_resource_db_permissions ( <EOL> resolver = resolver , <EOL> user_db = user_db , <EOL> resource_db = resource_db , <EOL> permission_types = all_permission_types ) ) <EOL> user_db = self . users [ '<STR_LIT>' ] <EOL> self . assertFalse ( self . _user_has_resource_db_permissions ( <EOL> resolver = resolver , <EOL> user_db = user_db , <EOL> resource_db = resource_db , <EOL> permission_types = all_permission_types ) ) <EOL> user_db = self . users [ '<STR_LIT>' ] <EOL> self . assertFalse ( resolver . user_has_resource_db_permission ( <EOL> user_db = user_db , <EOL> resource_db = self . resources [ '<STR_LIT>' ] , <EOL> permission_type = PermissionType . RULE_ENFORCEMENT_VIEW ) ) <EOL> self . assertFalse ( resolver . user_has_resource_db_permission ( <EOL> user_db = user_db , <EOL> resource_db = self . resources [ '<STR_LIT>' ] , <EOL> permission_type = PermissionType . RULE_ENFORCEMENT_VIEW ) ) <EOL> user_db = self . users [ '<STR_LIT>' ] <EOL> self . assertTrue ( resolver . user_has_resource_db_permission ( <EOL> user_db = user_db , <EOL> resource_db = self . resources [ '<STR_LIT>' ] , <EOL> permission_type = PermissionType . RULE_ENFORCEMENT_VIEW ) ) <EOL> self . assertTrue ( resolver . user_has_resource_db_permission ( <EOL> user_db = user_db , <EOL> resource_db = self . resources [ '<STR_LIT>' ] , <EOL> permission_type = PermissionType . RULE_ENFORCEMENT_VIEW ) ) <EOL> user_db = self . users [ '<STR_LIT>' ] <EOL> self . assertTrue ( resolver . user_has_resource_db_permission ( <EOL> user_db = user_db , <EOL> resource_db = self . resources [ '<STR_LIT>' ] , <EOL> permission_type = PermissionType . RULE_ENFORCEMENT_VIEW ) ) <EOL> user_db = self . users [ '<STR_LIT>' ] <EOL> resource_db = self . resources [ '<STR_LIT>' ] <EOL> self . assertTrue ( self . _user_has_resource_db_permissions ( <EOL> resolver = resolver , <EOL> user_db = user_db , <EOL> resource_db = resource_db , <EOL> permission_types = all_permission_types ) ) <EOL> user_db = self . users [ '<STR_LIT>' ] <EOL> resource_db = self . resources [ '<STR_LIT>' ] <EOL> self . assertTrue ( self . _user_has_resource_db_permissions ( <EOL> resolver = resolver , <EOL> user_db = user_db , <EOL> resource_db = resource_db , <EOL> permission_types = all_permission_types ) ) <EOL> user_db = self . users [ '<STR_LIT>' ] <EOL> resource_db = self . resources [ '<STR_LIT>' ] <EOL> self . assertTrue ( resolver . user_has_resource_db_permission ( <EOL> user_db = user_db , <EOL> resource_db = resource_db , <EOL> permission_type = PermissionType . RULE_ENFORCEMENT_VIEW ) ) </s>
