more tests

Signed-off-by: Jari Kolehmainen <jari.kolehmainen@gmail.com>

packages/core/src/common/cluster/request-namespace-list-permissions.test.ts

@@ -9,9 +9,9 @@ import { getDiForUnitTesting } from "../../main/getDiForUnitTesting";
 import type { RequestNamespaceListPermissionsFor } from "./request-namespace-list-permissions.injectable";
 import requestNamespaceListPermissionsForInjectable from "./request-namespace-list-permissions.injectable";
 
-const createFakeProxyConfig = (statusResponse: Promise<V1SubjectRulesReviewStatus>) => ({
+const createFakeProxyConfig = (statusResponse: Promise<{ body: { status: V1SubjectRulesReviewStatus }}>) => ({
   makeApiClient: () => ({
-    createSelfSubjectRulesReview: (): Promise<V1SubjectRulesReviewStatus> => statusResponse,
+    createSelfSubjectRulesReview: (): Promise<{ body: { status: V1SubjectRulesReviewStatus }}> => statusResponse,
   }),
 });
 
@@ -28,9 +28,13 @@ describe("requestNamespaceListPermissions", () => {
     it("returns truthy function", async () => {
       const requestPermissions = requestNamespaceListPermissions(createFakeProxyConfig(
         new Promise((resolve) => resolve({
+          body: {
+            status: {
               incomplete: true,
               resourceRules: [],
               nonResourceRules: [],
+            },
+          },
         })),
       ) as any);
 
@@ -66,6 +70,8 @@ describe("requestNamespaceListPermissions", () => {
     it("return truthy function", async () => {
       const requestPermissions = requestNamespaceListPermissions(createFakeProxyConfig(
         new Promise((resolve) => resolve({
+          body: {
+            status: {
               incomplete: false,
               resourceRules: [
                 {
@@ -78,6 +84,8 @@ describe("requestNamespaceListPermissions", () => {
                 },
               ],
               nonResourceRules: [],
+            },
+          },
         })),
       ) as any);
 
@@ -96,6 +104,8 @@ describe("requestNamespaceListPermissions", () => {
     it("return truthy function", async () => {
       const requestPermissions = requestNamespaceListPermissions(createFakeProxyConfig(
         new Promise((resolve) => resolve({
+          body: {
+            status: {
               incomplete: false,
               resourceRules: [
                 {
@@ -108,6 +118,8 @@ describe("requestNamespaceListPermissions", () => {
                 },
               ],
               nonResourceRules: [],
+            },
+          },
         })),
       ) as any);
 
@@ -126,6 +138,8 @@ describe("requestNamespaceListPermissions", () => {
     it("return truthy function", async () => {
       const requestPermissions = requestNamespaceListPermissions(createFakeProxyConfig(
         new Promise((resolve) => resolve({
+          body: {
+            status: {
               incomplete: false,
               resourceRules: [
                 {
@@ -139,6 +153,8 @@ describe("requestNamespaceListPermissions", () => {
                 },
               ],
               nonResourceRules: [],
+            },
+          },
         })),
       ) as any);
 
@@ -157,6 +173,8 @@ describe("requestNamespaceListPermissions", () => {
     it("return truthy function", async () => {
       const requestPermissions = requestNamespaceListPermissions(createFakeProxyConfig(
         new Promise((resolve) => resolve({
+          body: {
+            status: {
               incomplete: false,
               resourceRules: [
                 {
@@ -169,6 +187,8 @@ describe("requestNamespaceListPermissions", () => {
                 },
               ],
               nonResourceRules: [],
+            },
+          },
         })),
       ) as any);
 
@@ -187,6 +207,8 @@ describe("requestNamespaceListPermissions", () => {
     it("return truthy function", async () => {
       const requestPermissions = requestNamespaceListPermissions(createFakeProxyConfig(
         new Promise((resolve) => resolve({
+          body: {
+            status: {
               incomplete: false,
               resourceRules: [
                 {
@@ -199,6 +221,8 @@ describe("requestNamespaceListPermissions", () => {
                 },
               ],
               nonResourceRules: [],
+            },
+          },
         })),
       ) as any);
 
@@ -217,6 +241,8 @@ describe("requestNamespaceListPermissions", () => {
     it("return truthy function", async () => {
       const requestPermissions = requestNamespaceListPermissions(createFakeProxyConfig(
         new Promise((resolve) => resolve({
+          body: {
+            status: {
               incomplete: false,
               resourceRules: [
                 {
@@ -230,6 +256,8 @@ describe("requestNamespaceListPermissions", () => {
                 },
               ],
               nonResourceRules: [],
+            },
+          },
         })),
       ) as any);
 
@@ -243,4 +271,66 @@ describe("requestNamespaceListPermissions", () => {
       })).toBeTruthy();
     });
   });
+
+  describe("when resourceRules has matching resource without list verb", () => {
+    it("return truthy function", async () => {
+      const requestPermissions = requestNamespaceListPermissions(createFakeProxyConfig(
+        new Promise((resolve) => resolve({
+          body: {
+            status: {
+              incomplete: false,
+              resourceRules: [
+                {
+                  apiGroups: [""],
+                  resources: ["pods"],
+                  verbs: ["get"],
+                },
+              ],
+              nonResourceRules: [],
+            },
+          },
+        })),
+      ) as any);
+
+      const permissionCheck = await requestPermissions("fake-namespace");
+
+      expect(permissionCheck({
+        apiName: "pods",
+        group: "",
+        kind: "Pod",
+        namespaced: true,
+      })).toBeFalsy();
+    });
+  });
+
+  describe("when resourceRules has no matching resource with list verb", () => {
+    it("return truthy function", async () => {
+      const requestPermissions = requestNamespaceListPermissions(createFakeProxyConfig(
+        new Promise((resolve) => resolve({
+          body: {
+            status: {
+              incomplete: false,
+              resourceRules: [
+                {
+                  apiGroups: [""],
+                  resources: ["services"],
+                  verbs: ["list"],
+                },
+              ],
+              nonResourceRules: [],
+            },
+          },
+        })),
+      ) as any);
+
+      const permissionCheck = await requestPermissions("fake-namespace");
+
+      expect(permissionCheck({
+        apiName: "pods",
+        group: "",
+        kind: "Pod",
+        namespaced: true,
+      })).toBeFalsy();
+    });
+  });
 });