admin/n8n-enterprise-unlocked
1
0
Fork 0
mirror of https://github.com/Abdulazizzn/n8n-enterprise-unlocked.git synced 2025-12-17 10:02:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: RBAC (#8922)

Browse Source 
Signed-off-by: Oleg Ivaniv <me@olegivaniv.com>
Co-authored-by: Val <68596159+valya@users.noreply.github.com>
Co-authored-by: कारतोफ्फेलस्क्रिप्ट™ <aditya@netroy.in>
Co-authored-by: Valya Bullions <valya@n8n.io>
Co-authored-by: Danny Martini <danny@n8n.io>
Co-authored-by: Danny Martini <despair.blue@gmail.com>
Co-authored-by: Iván Ovejero <ivov.src@gmail.com>
Co-authored-by: Omar Ajoue <krynble@gmail.com>
Co-authored-by: oleg <me@olegivaniv.com>
Co-authored-by: Michael Kret <michael.k@radency.com>
Co-authored-by: Michael Kret <88898367+michael-radency@users.noreply.github.com>
Co-authored-by: Elias Meire <elias@meire.dev>
Co-authored-by: Giulio Andreini <andreini@netseven.it>
Co-authored-by: Giulio Andreini <g.andreini@gmail.com>
Co-authored-by: Ayato Hayashi <go12limchangyong@gmail.com>
This commit is contained in:
Csaba Tuncsik
2024-05-17 10:53:15 +02:00
committed by GitHub
parent b1f977ebd0
commit 596c472ecc
292 changed files with 14129 additions and 3989 deletions
Download Patch File Download Diff File Expand all files Collapse all files

152
packages/cli/test/integration/CredentialsHelper.test.ts Normal file
View File

@@ -0,0 +1,152 @@
import Container from 'typedi';
import * as testDb from '../integration/shared/testDb';
import { CredentialsHelper } from '@/CredentialsHelper';
import { createOwner, createAdmin, createMember } from './shared/db/users';
import type { User } from '@/databases/entities/User';
import { saveCredential } from './shared/db/credentials';
import { randomCredentialPayload } from './shared/random';
import { createTeamProject, linkUserToProject } from './shared/db/projects';
let credentialHelper: CredentialsHelper;
let owner: User;
let admin: User;
let member: User;
beforeAll(async () => {
await testDb.init();
credentialHelper = Container.get(CredentialsHelper);
owner = await createOwner();
admin = await createAdmin();
member = await createMember();
});
afterAll(async () => {
await testDb.terminate();
});
describe('CredentialsHelper', () => {
describe('credentialOwnedBySuperUsers', () => {
test.each([
{
testName: 'owners are super users',
user: () => owner,
credentialRole: 'credential:owner',
expectedResult: true,
} as const,
{
testName: 'admins are super users',
user: () => admin,
credentialRole: 'credential:owner',
expectedResult: true,
} as const,
{
testName: 'owners need to own the credential',
user: () => owner,
credentialRole: 'credential:user',
expectedResult: false,
} as const,
{
testName: 'admins need to own the credential',
user: () => admin,
credentialRole: 'credential:user',
expectedResult: false,
} as const,
{
testName: 'members are no super users',
user: () => member,
credentialRole: 'credential:owner',
expectedResult: false,
} as const,
])('$testName', async ({ user, credentialRole, expectedResult }) => {
const credential = await saveCredential(randomCredentialPayload(), {
user: user(),
role: credentialRole,
});
const result = await credentialHelper.credentialCanUseExternalSecrets(credential);
expect(result).toBe(expectedResult);
});
test('credential in team project with instance owner as an admin can use external secrets', async () => {
const teamProject = await createTeamProject();
const [credential] = await Promise.all([
await saveCredential(randomCredentialPayload(), {
project: teamProject,
role: 'credential:owner',
}),
await linkUserToProject(owner, teamProject, 'project:admin'),
await linkUserToProject(member, teamProject, 'project:admin'),
]);
const result = await credentialHelper.credentialCanUseExternalSecrets(credential);
expect(result).toBe(true);
});
test('credential in team project with instance admin as an admin can use external secrets', async () => {
const teamProject = await createTeamProject();
const [credential] = await Promise.all([
await saveCredential(randomCredentialPayload(), {
project: teamProject,
role: 'credential:owner',
}),
await linkUserToProject(admin, teamProject, 'project:admin'),
await linkUserToProject(member, teamProject, 'project:admin'),
]);
const result = await credentialHelper.credentialCanUseExternalSecrets(credential);
expect(result).toBe(true);
});
test('credential in team project with instance owner as an editor cannot use external secrets', async () => {
const teamProject = await createTeamProject();
const [credential] = await Promise.all([
await saveCredential(randomCredentialPayload(), {
project: teamProject,
role: 'credential:owner',
}),
await linkUserToProject(owner, teamProject, 'project:editor'),
await linkUserToProject(member, teamProject, 'project:admin'),
]);
const result = await credentialHelper.credentialCanUseExternalSecrets(credential);
expect(result).toBe(false);
});
test('credential in team project with instance admin as an editor cannot use external secrets', async () => {
const teamProject = await createTeamProject();
const [credential] = await Promise.all([
await saveCredential(randomCredentialPayload(), {
project: teamProject,
role: 'credential:owner',
}),
await linkUserToProject(admin, teamProject, 'project:editor'),
await linkUserToProject(member, teamProject, 'project:admin'),
]);
const result = await credentialHelper.credentialCanUseExternalSecrets(credential);
expect(result).toBe(false);
});
test('credential in team project with no instance admin or owner as part of the project cannot use external secrets', async () => {
const teamProject = await createTeamProject();
const [credential] = await Promise.all([
await saveCredential(randomCredentialPayload(), {
project: teamProject,
role: 'credential:owner',
}),
await linkUserToProject(member, teamProject, 'project:admin'),
]);
const result = await credentialHelper.credentialCanUseExternalSecrets(credential);
expect(result).toBe(false);
});
});
});