sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-06 05:29:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

Relax profile command ACLs

Browse Source
This commit is contained in:
Theodor S. Midtlien
2026-07-25 16:09:22 +02:00
parent cd98648a67
commit ae9ee15501
3 changed files with 25 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/internal/ipcauth/interceptor_test.go
+7 -3
View File
@@ -42,9 +42,11 @@ func ctxWith(id Identity) context.Context {
}
const (
up = servicePath + "Up"
list = servicePath + "ListProfiles"
unkwn = servicePath + "SomeFutureMethod"
up = servicePath + "Up"
list = servicePath + "ListProfiles"
unkwn = servicePath + "SomeFutureMethod"
down = servicePath + "Down"
switchp = servicePath + "SwitchProfile"
)
func TestInterceptorAuthorize(t *testing.T) {
@@ -65,6 +67,8 @@ func TestInterceptorAuthorize(t *testing.T) {
{"uid owner allowed", Ownership{Owners: []string{"uid:1000"}}, nil, ctxWith(Identity{UID: 1000}), up, false},
{"non-owner denied", Ownership{Owners: []string{"uid:1000"}}, nil, ctxWith(Identity{UID: 2000}), up, true},
{"handler-authorized bypass", Ownership{Owners: []string{"uid:1000"}}, nil, ctxWith(Identity{UID: 2000}), list, false},
{"down allowed while another user's profile active", Ownership{Owners: []string{"uid:1000"}}, nil, ctxWith(Identity{UID: 2000}), down, false},
{"switch-profile bypasses active-profile gate", Ownership{Owners: []string{"uid:1000"}}, nil, ctxWith(Identity{UID: 2000}), switchp, false},
{"unknown method gated", Ownership{Owners: []string{"uid:1000"}}, nil, ctxWith(Identity{UID: 2000}), unkwn, true},
{"primary gid owner", Ownership{Owners: []string{"gid:5000"}}, nil, ctxWith(Identity{UID: 2000, GID: 5000}), up, false},
{"group-name owner via resolver", Ownership{Owners: []string{"group:admins"}},