summaryrefslogtreecommitdiff
path: root/share/www/script/test/reader_acl.js
diff options
context:
space:
mode:
Diffstat (limited to 'share/www/script/test/reader_acl.js')
-rw-r--r--share/www/script/test/reader_acl.js198
1 files changed, 0 insertions, 198 deletions
diff --git a/share/www/script/test/reader_acl.js b/share/www/script/test/reader_acl.js
deleted file mode 100644
index cc249ea4..00000000
--- a/share/www/script/test/reader_acl.js
+++ /dev/null
@@ -1,198 +0,0 @@
-// Licensed under the Apache License, Version 2.0 (the "License"); you may not
-// use this file except in compliance with the License. You may obtain a copy
-// of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-// WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-// License for the specific language governing permissions and limitations under
-// the License.
-
-couchTests.reader_acl = function(debug) {
- // this tests read access control
-
- var usersDb = new CouchDB("test_suite_users", {"X-Couch-Full-Commit":"false"});
- var secretDb = new CouchDB("test_suite_db", {"X-Couch-Full-Commit":"false"});
- function testFun() {
- try {
- usersDb.deleteDb();
- usersDb.createDb();
- secretDb.deleteDb();
- secretDb.createDb();
-
- // create a user with top-secret-clearance
- var jchrisUserDoc = CouchDB.prepareUserDoc({
- name: "jchris@apache.org",
- roles : ["top-secret"]
- }, "funnybone");
- T(usersDb.save(jchrisUserDoc).ok);
- usersDb.ensureFullCommit();
-
- T(CouchDB.session().userCtx.name == null);
-
- // set secret db to be read controlled
- T(secretDb.save({_id:"baz",foo:"bar"}).ok);
- T(secretDb.open("baz").foo == "bar");
-
- T(secretDb.setSecObj({
- "readers" : {
- roles : ["super-secret-club"],
- names : ["joe","barb"]
- }
- }).ok);
- } finally {
- CouchDB.logout();
- }
- }
-
- // split into 2 funs so we can test restart behavior
- function testFun2() {
- try {
- // can't read it as jchris b/c he's missing the needed role
- T(CouchDB.login("jchris@apache.org", "funnybone").ok);
- T(CouchDB.session().userCtx.name == "jchris@apache.org");
-
- try {
- secretDb.open("baz");
- T(false && "can't open a doc from a secret db") ;
- } catch(e) {
- T(true)
- }
-
- CouchDB.logout();
-
- // make anyone with the top-secret role an admin
- // db admins are automatically readers
- T(secretDb.setSecObj({
- "admins" : {
- roles : ["top-secret"],
- names : []
- },
- "readers" : {
- roles : ["super-secret-club"],
- names : ["joe","barb"]
- }
- }).ok);
-
-
- T(CouchDB.login("jchris@apache.org", "funnybone").ok);
-
- // db admin can read
- T(secretDb.open("baz").foo == "bar");
-
- // and run temp views
- TEquals(secretDb.query(function(doc) {
- emit(null, null)
- }).total_rows, 1);
-
- CouchDB.logout();
- T(CouchDB.session().userCtx.roles.indexOf("_admin") != -1);
-
- // admin now adds the top-secret role to the db's readers
- // and removes db-admins
- T(secretDb.setSecObj({
- "admins" : {
- roles : [],
- names : []
- },
- "readers" : {
- roles : ["super-secret-club", "top-secret"],
- names : ["joe","barb"]
- }
- }).ok);
-
- // server _admin can always read
- T(secretDb.open("baz").foo == "bar");
-
- // and run temp views
- TEquals(secretDb.query(function(doc) {
- emit(null, null)
- }).total_rows, 1);
-
- T(secretDb.save({
- "_id" : "_design/foo",
- views : {
- bar : {
- map : "function(doc){emit(null, null)}"
- }
- }
- }).ok)
-
- // now top-secret users can read too
- T(CouchDB.login("jchris@apache.org", "funnybone").ok);
- T(CouchDB.session().userCtx.roles.indexOf("_admin") == -1);
- T(secretDb.open("baz").foo == "bar");
- // readers can query stored views
- T(secretDb.view("foo/bar").total_rows == 1);
-
- // readers can't do temp views
- try {
- var results = secretDb.query(function(doc) {
- emit(null, null);
- });
- T(false && "temp view should be admin only");
- } catch (e) {
- T(true && "temp view is admin only");
- }
-
-
- CouchDB.logout();
-
- // can't set non string reader names or roles
- try {
- secretDb.setSecObj({
- "readers" : {
- roles : ["super-secret-club", {"top-secret":"awesome"}],
- names : ["joe","barb"]
- }
- })
- T(false && "only string roles");
- } catch (e) {}
-
- try {
- secretDb.setSecObj({
- "readers" : {
- roles : ["super-secret-club", {"top-secret":"awesome"}],
- names : ["joe",22]
- }
- });
- T(false && "only string names");
- } catch (e) {}
-
- try {
- secretDb.setSecObj({
- "readers" : {
- roles : ["super-secret-club", {"top-secret":"awesome"}],
- names : "joe"
- }
- });
- T(false && "only lists of names");
- } catch (e) {}
- } finally {
- CouchDB.logout();
- }
- };
-
- run_on_modified_server(
- [{section: "httpd",
- key: "authentication_handlers",
- value: "{couch_httpd_auth, cookie_authentication_handler}, {couch_httpd_auth, default_authentication_handler}"},
- {section: "couch_httpd_auth",
- key: "authentication_db", value: "test_suite_users"}],
- testFun
- );
-
- // security changes will always commit synchronously
- restartServer();
-
- run_on_modified_server(
- [{section: "httpd",
- key: "authentication_handlers",
- value: "{couch_httpd_auth, cookie_authentication_handler}, {couch_httpd_auth, default_authentication_handler}"},
- {section: "couch_httpd_auth",
- key: "authentication_db", value: "test_suite_users"}],
- testFun2
- );
-}