File

spec/core_storagemanager_spec.lua @ 12642:9061f9621330

Switch to a new role-based authorization framework, removing is_admin() We began moving away from simple "is this user an admin?" permission checks before 0.12, with the introduction of mod_authz_internal and the ability to dynamically change the roles of individual users. The approach in 0.12 still had various limitations however, and apart from the introduction of roles other than "admin" and the ability to pull that info from storage, not much actually changed. This new framework shakes things up a lot, though aims to maintain the same functionality and behaviour on the surface for a default Prosody configuration. That is, if you don't take advantage of any of the new features, you shouldn't notice any change. The biggest change visible to developers is that usermanager.is_admin() (and the auth provider is_admin() method) have been removed. Gone. Completely. Permission checks should now be performed using a new module API method: module:may(action_name, context) This method accepts an action name, followed by either a JID (string) or (preferably) a table containing 'origin'/'session' and 'stanza' fields (e.g. the standard object passed to most events). It will return true if the action should be permitted, or false/nil otherwise. Modules should no longer perform permission checks based on the role name. E.g. a lot of code previously checked if the user's role was prosody:admin before permitting some action. Since many roles might now exist with similar permissions, and the permissions of prosody:admin may be redefined dynamically, it is no longer suitable to use this method for permission checks. Use module:may(). If you start an action name with ':' (recommended) then the current module's name will automatically be used as a prefix. To define a new permission, use the new module API: module:default_permission(role_name, action_name) module:default_permissions(role_name, { action_name[, action_name...] }) This grants the specified role permission to execute the named action(s) by default. This may be overridden via other mechanisms external to your module. The built-in roles that developers should use are: - prosody:user (normal user) - prosody:admin (host admin) - prosody:operator (global admin) The new prosody:operator role is intended for server-wide actions (such as shutting down Prosody). Finally, all usage of is_admin() in modules has been fixed by this commit. Some of these changes were trickier than others, but no change is expected to break existing deployments. EXCEPT: mod_auth_ldap no longer supports the ldap_admin_filter option. It's very possible nobody is using this, but if someone is then we can later update it to pull roles from LDAP somehow.
author Matthew Wild <mwild1@gmail.com>
date Wed, 15 Jun 2022 12:15:01 +0100
parent 12600:3d3a0c4e2662
child 12956:52fcdfe710ca
line wrap: on
line source

local unpack = table.unpack;
local server = require "net.server_select";
package.loaded["net.server"] = server;

local st = require "util.stanza";

local function mock_prosody()
	_G.prosody = {
		core_post_stanza = function () end;
		events = require "util.events".new();
		hosts = {};
		paths = {
			data = "./data";
		};
	};
end

local configs = {
	memory = {
		storage = "memory";
	};
	internal = {
		storage = "internal";
	};
	sqlite = {
		storage = "sql";
		sql = { driver = "SQLite3", database = "prosody-tests.sqlite" };
	};
	mysql = {
		storage = "sql";
		sql = { driver = "MySQL",  database = "prosody", username = "prosody", password = "secret", host = "localhost" };
	};
	postgres = {
		storage = "sql";
		sql = { driver = "PostgreSQL", database = "prosody", username = "prosody", password = "secret", host = "localhost" };
	};
};

local test_host = "storage-unit-tests.invalid";

describe("storagemanager", function ()
	for backend, backend_config in pairs(configs) do
		local tagged_name = "#"..backend;
		if backend ~= backend_config.storage then
			tagged_name = tagged_name.." #"..backend_config.storage;
		end
		insulate(tagged_name.." #storage backend", function ()
			mock_prosody();

			local config = require "core.configmanager";
			local sm = require "core.storagemanager";
			local hm = require "core.hostmanager";
			local mm = require "core.modulemanager";

			-- Simple check to ensure insulation is working correctly
			assert.is_nil(config.get(test_host, "storage"));

			for k, v in pairs(backend_config) do
				config.set(test_host, k, v);
			end
			assert(hm.activate(test_host, {}));
			sm.initialize_host(test_host);
			assert(mm.load(test_host, "storage_"..backend_config.storage));

			describe("key-value stores", function ()
				-- These tests rely on being executed in order, disable any order
				-- randomization for this block
				randomize(false);

				local store;
				it("may be opened", function ()
					store = assert(sm.open(test_host, "test"));
				end);

				local simple_data = { foo = "bar" };

				it("may set data for a user", function ()
					assert(store:set("user9999", simple_data));
				end);

				it("may get data for a user", function ()
					assert.same(simple_data, assert(store:get("user9999")));
				end);

				it("may remove data for a user", function ()
					assert(store:set("user9999", nil));
					local ret, err = store:get("user9999");
					assert.is_nil(ret);
					assert.is_nil(err);
				end);
			end);

			describe("map stores", function ()
				-- These tests rely on being executed in order, disable any order
				-- randomization for this block
				randomize(false);

				local store, kv_store;
				it("may be opened", function ()
					store = assert(sm.open(test_host, "test-map", "map"));
				end);

				it("may be opened as a keyval store", function ()
					kv_store = assert(sm.open(test_host, "test-map", "keyval"));
				end);

				it("may set a specific key for a user", function ()
					assert(store:set("user9999", "foo", "bar"));
					assert.same(kv_store:get("user9999"), { foo = "bar" });
				end);

				it("may get a specific key for a user", function ()
					assert.equal("bar", store:get("user9999", "foo"));
				end);

				it("may find all users with a specific key", function ()
					assert.is_function(store.get_all);
					assert(store:set("user9999b", "bar", "bar"));
					assert(store:set("user9999c", "foo", "blah"));
					local ret, err = store:get_all("foo");
					assert.is_nil(err);
					assert.same({ user9999 = "bar", user9999c = "blah" }, ret);
				end);

				it("rejects empty or non-string keys to get_all", function ()
					assert.is_function(store.get_all);
					do
						local ret, err = store:get_all("");
						assert.is_nil(ret);
						assert.is_not_nil(err);
					end
					do
						local ret, err = store:get_all(true);
						assert.is_nil(ret);
						assert.is_not_nil(err);
					end
				end);

				it("rejects empty or non-string keys to delete_all", function ()
					assert.is_function(store.delete_all);
					do
						local ret, err = store:delete_all("");
						assert.is_nil(ret);
						assert.is_not_nil(err);
					end
					do
						local ret, err = store:delete_all(true);
						assert.is_nil(ret);
						assert.is_not_nil(err);
					end
				end);

				it("may delete all instances of a specific key", function ()
					assert.is_function(store.delete_all);
					assert(store:set("user9999b", "foo", "hello"));

					assert(store:delete_all("bar"));
					-- Ensure key was deleted
					do
						local ret, err = store:get("user9999b", "bar");
						assert.is_nil(ret);
						assert.is_nil(err);
					end
					-- Ensure other users/keys are intact
					do
						local ret, err = store:get("user9999", "foo");
						assert.equal("bar", ret);
						assert.is_nil(err);
					end
					do
						local ret, err = store:get("user9999b", "foo");
						assert.equal("hello", ret);
						assert.is_nil(err);
					end
					do
						local ret, err = store:get("user9999c", "foo");
						assert.equal("blah", ret);
						assert.is_nil(err);
					end
				end);

				it("may remove data for a specific key for a user", function ()
					assert(store:set("user9999", "foo", nil));
					do
						local ret, err = store:get("user9999", "foo");
						assert.is_nil(ret);
						assert.is_nil(err);
					end

					assert(store:set("user9999b", "foo", nil));
					do
						local ret, err = store:get("user9999b", "foo");
						assert.is_nil(ret);
						assert.is_nil(err);
					end
				end);
			end);

			describe("archive stores", function ()
				randomize(false);

				local archive;
				it("can be opened", function ()
					archive = assert(sm.open(test_host, "test-archive", "archive"));
				end);

				local test_stanza = st.stanza("test", { xmlns = "urn:example:foo" })
					:tag("foo"):up()
					:tag("foo"):up()
					:reset();
				local test_time = 1539204123;

				local test_data = {
					{ nil, test_stanza, test_time, "contact@example.com" };
					{ nil, test_stanza, test_time+1, "contact2@example.com" };
					{ nil, test_stanza, test_time+2, "contact2@example.com" };
					{ nil, test_stanza, test_time-1, "contact2@example.com" };
					{ nil, test_stanza, test_time-1, "contact3@example.com" };
					{ nil, test_stanza, test_time+0, "contact3@example.com" };
					{ nil, test_stanza, test_time+1, "contact3@example.com" };
				};

				it("can be added to", function ()
					for _, data_item in ipairs(test_data) do
						local id = archive:append("user", unpack(data_item, 1, 4));
						assert.truthy(id);
						data_item[1] = id;
					end
				end);

				describe("can be queried", function ()
					it("for all items", function ()
						-- luacheck: ignore 211/err
						local data, err = archive:find("user", {});
						assert.truthy(data);
						local count = 0;
						for id, item, when in data do
							count = count + 1;
							assert.truthy(id);
							assert(st.is_stanza(item));
							assert.equal("test", item.name);
							assert.equal("urn:example:foo", item.attr.xmlns);
							assert.equal(2, #item.tags);
							assert.equal(test_data[count][3], when);
						end
						assert.equal(#test_data, count);
					end);

					it("by JID", function ()
						-- luacheck: ignore 211/err
						local data, err = archive:find("user", {
							with = "contact@example.com";
						});
						assert.truthy(data);
						local count = 0;
						for id, item, when in data do
							count = count + 1;
							assert.truthy(id);
							assert(st.is_stanza(item));
							assert.equal("test", item.name);
							assert.equal("urn:example:foo", item.attr.xmlns);
							assert.equal(2, #item.tags);
							assert.equal(test_time, when);
						end
						assert.equal(1, count);
					end);

					it("by time (end)", function ()
						-- luacheck: ignore 211/err
						local data, err = archive:find("user", {
							["end"] = test_time;
						});
						assert.truthy(data);
						local count = 0;
						for id, item, when in data do
							count = count + 1;
							assert.truthy(id);
							assert(st.is_stanza(item));
							assert.equal("test", item.name);
							assert.equal("urn:example:foo", item.attr.xmlns);
							assert.equal(2, #item.tags);
							assert(test_time >= when);
						end
						assert.equal(4, count);
					end);

					it("by time (start)", function ()
						-- luacheck: ignore 211/err
						local data, err = archive:find("user", {
							["start"] = test_time;
						});
						assert.truthy(data);
						local count = 0;
						for id, item, when in data do
							count = count + 1;
							assert.truthy(id);
							assert(st.is_stanza(item));
							assert.equal("test", item.name);
							assert.equal("urn:example:foo", item.attr.xmlns);
							assert.equal(2, #item.tags);
							assert(test_time <= when);
						end
						assert.equal(#test_data - 2, count);
					end);

					it("by time (start+end)", function ()
						-- luacheck: ignore 211/err
						local data, err = archive:find("user", {
							["start"] = test_time;
							["end"] = test_time+1;
						});
						assert.truthy(data);
						local count = 0;
						for id, item, when in data do
							count = count + 1;
							assert.truthy(id);
							assert(st.is_stanza(item));
							assert.equal("test", item.name);
							assert.equal("urn:example:foo", item.attr.xmlns);
							assert.equal(2, #item.tags);
							assert(when >= test_time, ("%d >= %d"):format(when, test_time));
							assert(when <= test_time+1, ("%d <= %d"):format(when, test_time+1));
						end
						assert.equal(4, count);
					end);

					it("by id (after)", function ()
						-- luacheck: ignore 211/err
						local data, err = archive:find("user", {
							["after"] = test_data[2][1];
						});
						assert.truthy(data);
						local count = 0;
						for id, item in data do
							count = count + 1;
							assert.truthy(id);
							assert.equal(test_data[2+count][1], id);
							assert(st.is_stanza(item));
							assert.equal("test", item.name);
							assert.equal("urn:example:foo", item.attr.xmlns);
							assert.equal(2, #item.tags);
						end
						assert.equal(5, count);
					end);

					it("by id (before)", function ()
						-- luacheck: ignore 211/err
						local data, err = archive:find("user", {
							["before"] = test_data[4][1];
						});
						assert.truthy(data);
						local count = 0;
						for id, item in data do
							count = count + 1;
							assert.truthy(id);
							assert.equal(test_data[count][1], id);
							assert(st.is_stanza(item));
							assert.equal("test", item.name);
							assert.equal("urn:example:foo", item.attr.xmlns);
							assert.equal(2, #item.tags);
						end
						assert.equal(3, count);
					end);

					it("by id (before and after) #full_id_range", function ()
						assert.truthy(archive.caps and archive.caps.full_id_range, "full ID range support")
						local data, err = archive:find("user", {
								["after"] = test_data[1][1];
								["before"] = test_data[4][1];
							});
						assert.truthy(data, err);
						local count = 0;
						for id, item in data do
							count = count + 1;
							assert.truthy(id);
							assert.equal(test_data[1+count][1], id);
							assert(st.is_stanza(item));
							assert.equal("test", item.name);
							assert.equal("urn:example:foo", item.attr.xmlns);
							assert.equal(2, #item.tags);
						end
						assert.equal(2, count);
					end);

					it("by multiple ids", function ()
						assert.truthy(archive.caps and archive.caps.ids, "Multiple ID query")
						local data, err = archive:find("user", {
								["ids"] = {
									test_data[2][1];
									test_data[4][1];
								};
							});
						assert.truthy(data, err);
						local count = 0;
						for id, item in data do
							count = count + 1;
							assert.truthy(id);
							assert.equal(test_data[count==1 and 2 or 4][1], id);
							assert(st.is_stanza(item));
							assert.equal("test", item.name);
							assert.equal("urn:example:foo", item.attr.xmlns);
							assert.equal(2, #item.tags);
						end
						assert.equal(2, count);

					end);


					it("can be queried in reverse", function ()

						local data, err = archive:find("user", {
								reverse = true;
								limit = 3;
							});
						assert.truthy(data, err);

						local i = #test_data;
						for id, item in data do
							assert.truthy(id);
							assert.equal(test_data[i][1], id);
							assert(st.is_stanza(item));
							assert.equal("test", item.name);
							assert.equal("urn:example:foo", item.attr.xmlns);
							assert.equal(2, #item.tags);
							i = i - 1;
						end

					end);


				end);

				it("can selectively delete items", function ()
					local delete_id;
					do
						local data = assert(archive:find("user", {}));
						local count = 0;
						for id, item, when in data do --luacheck: ignore 213/item 213/when
							count = count + 1;
							if count == 2 then
								delete_id = id;
							end
							assert.truthy(id);
						end
						assert.equal(#test_data, count);
					end

					assert(archive:delete("user", { key = delete_id }));

					do
						local data = assert(archive:find("user", {}));
						local count = 0;
						for id, item, when in data do --luacheck: ignore 213/item 213/when
							count = count + 1;
							assert.truthy(id);
							assert.not_equal(delete_id, id);
						end
						assert.equal(#test_data-1, count);
					end
				end);

				it("can be purged", function ()
					-- luacheck: ignore 211/err
					local ok, err = archive:delete("user");
					assert.truthy(ok);
					local data, err = archive:find("user", {
						with = "contact@example.com";
					});
					assert.truthy(data);
					local count = 0;
					for id, item, when in data do -- luacheck: ignore id item when
						count = count + 1;
					end
					assert.equal(0, count);
				end);

				it("can truncate the oldest items", function ()
					local username = "user-truncate";
					for i = 1, 10 do
						assert(archive:append(username, nil, test_stanza, i, "contact@example.com"));
					end
					assert(archive:delete(username, { truncate = 3 }));

					do
						local data = assert(archive:find(username, {}));
						local count = 0;
						for id, item, when in data do --luacheck: ignore 213/when
							count = count + 1;
							assert.truthy(id);
							assert(st.is_stanza(item));
							assert(when > 7, ("%d > 7"):format(when));
						end
						assert.equal(3, count);
					end
				end);

				it("overwrites existing keys with new data", function ()
					local prefix = ("a"):rep(50);
					local username = "user-overwrite";
					local a1 = assert(archive:append(username, prefix.."-1", test_stanza, test_time, "contact@example.com"));
					local a2 = assert(archive:append(username, prefix.."-2", test_stanza, test_time, "contact@example.com"));
					local ids = { a1, a2, };

					do
						local data = assert(archive:find(username, {}));
						local count = 0;
						for id, item, when in data do --luacheck: ignore 213/when
							count = count + 1;
							assert.truthy(id);
							assert.equals(ids[count], id);
							assert(st.is_stanza(item));
						end
						assert.equal(2, count);
					end

					local new_stanza = st.clone(test_stanza);
					new_stanza.attr.foo = "bar";
					assert(archive:append(username, a2, new_stanza, test_time+1, "contact2@example.com"));

					do
						local data = assert(archive:find(username, {}));
						local count = 0;
						for id, item, when in data do
							count = count + 1;
							assert.truthy(id);
							assert.equals(ids[count], id);
							assert(st.is_stanza(item));
							if count == 2 then
								assert.equals(test_time+1, when);
								assert.equals("bar", item.attr.foo);
							end
						end
						assert.equal(2, count);
					end
				end);

				it("can contain multiple long unique keys #issue1073", function ()
					local prefix = ("a"):rep(50);
					assert(archive:append("user-issue1073", prefix.."-1", test_stanza, test_time, "contact@example.com"));
					assert(archive:append("user-issue1073", prefix.."-2", test_stanza, test_time, "contact@example.com"));

					local data = assert(archive:find("user-issue1073", {}));
					local count = 0;
					for id, item, when in data do --luacheck: ignore 213/when
						count = count + 1;
						assert.truthy(id);
						assert(st.is_stanza(item));
					end
					assert.equal(2, count);
					assert(archive:delete("user-issue1073"));
				end);

				it("can be treated as a map store", function ()
					assert.falsy(archive:get("mapuser", "no-such-id"));
					assert.falsy(archive:set("mapuser", "no-such-id", test_stanza));

					local id = archive:append("mapuser", nil, test_stanza, test_time, "contact@example.com");
					do
						local stanza_roundtrip, when, with = archive:get("mapuser", id);
						assert.same(tostring(test_stanza), tostring(stanza_roundtrip), "same stanza is returned");
						assert.equal(test_time, when, "same 'when' is returned");
						assert.equal("contact@example.com", with, "same 'with' is returned");
					end

					local replacement_stanza = st.stanza("test", { xmlns = "urn:example:foo" })
						:tag("bar"):up()
						:reset();
					assert(archive:set("mapuser", id, replacement_stanza, test_time+1));

					do
						local replaced, when, with = archive:get("mapuser", id);
						assert.same(tostring(replacement_stanza), tostring(replaced), "replaced stanza is returned");
						assert.equal(test_time+1, when, "modified 'when' is returned");
						assert.equal("contact@example.com", with, "original 'with' is returned");
					end
				end);

				it("the summary api works", function()
					assert.truthy(archive:delete("summary-user"));
					local first_sid = archive:append("summary-user", nil, test_stanza, test_time, "contact@example.com");
					local second_sid = archive:append("summary-user", nil, test_stanza, test_time+1, "contact@example.com");
					assert.truthy(first_sid and second_sid, "preparations failed")
					---

					local user_summary, err = archive:summary("summary-user");
					assert.is_table(user_summary, err);
					assert.same({ ["contact@example.com"] = 2 }, user_summary.counts, "summary.counts matches");
					assert.same({ ["contact@example.com"] = test_time }, user_summary.earliest, "summary.earliest matches");
					assert.same({ ["contact@example.com"] = test_time+1 }, user_summary.latest, "summary.latest matches");
					if user_summary.body then
						assert.same({ ["contact@example.com"] = test_stanza:get_child_text("body") }, user_summary.body, "summary.body matches");
					end
				end);

			end);
		end);
	end
end);