fix #3668: realm-sync: replace 'full' & 'purge' with 'remove-vanished'

[pve-access-control.git] / src / test / realm_sync_test.pl

#!/usr/bin/perl

use strict;
use warnings;

use Test::MockModule;
use Test::More;
use Storable qw(dclone);

use PVE::AccessControl;
use PVE::API2::Domains;

my $domainscfg = {
    ids => {
	"pam" => { type => 'pam' },
	"pve" => { type => 'pve' },
	"syncedrealm" => { type => 'ldap' }
    },
};

my $initialusercfg = {
    users => {
	'root@pam' => { username => 'root', },
	'user1@syncedrealm' => {
	    username => 'user1',
	    enable => 1,
	    'keys' => 'some',
	},
	'user2@syncedrealm' => {
	    username => 'user2',
	    enable => 1,
	},
	'user3@syncedrealm' => {
	    username => 'user3',
	    enable => 1,
	},
    },
    groups => {
	'group1-syncedrealm' => { users => {}, },
	'group2-syncedrealm' => { users => {}, },
    },
    acl => {
	'/' => {
	    users => {
		'user3@syncedrealm' => {},
	    },
	    groups => {},
	},
    },
};

my $sync_response = {
    user => [
	{
	    attributes => { 'uid' => ['user1'], },
	    dn => 'uid=user1,dc=syncedrealm',
	},
	{
	    attributes => { 'uid' => ['user2'], },
	    dn => 'uid=user2,dc=syncedrealm',
	},
	{
	    attributes => { 'uid' => ['user4'], },
	    dn => 'uid=user4,dc=syncedrealm',
	},
    ],
    groups => [
	{
	    dn => 'dc=group1,dc=syncedrealm',
	    members => [
		'uid=user1,dc=syncedrealm',
	    ],
	},
	{
	    dn => 'dc=group3,dc=syncedrealm',
	    members => [
		'uid=nonexisting,dc=syncedrealm',
	    ],
	}
    ],
};

my $returned_user_cfg = {};

# mocking all cluster and ldap operations
my $pve_cluster_module = Test::MockModule->new('PVE::Cluster');
$pve_cluster_module->mock(
    cfs_update => sub {},
    cfs_read_file => sub {
	my ($filename) = @_;
	if ($filename eq 'domains.cfg') { return dclone($domainscfg); }
	if ($filename eq 'user.cfg') { return dclone($initialusercfg); }
	die "unexpected cfs_read_file";
    },
    cfs_write_file => sub {
	my ($filename, $data) = @_;
	if ($filename eq 'user.cfg') {
	    $returned_user_cfg = $data;
	    return;
	}
	die "unexpected cfs_read_file";
    },
    cfs_lock_file => sub {
	my ($filename, $timeout, $code) = @_;
	return $code->();
    },
);

my $pve_api_domains = Test::MockModule->new('PVE::API2::Domains');
$pve_api_domains->mock(
    cfs_read_file => sub { PVE::Cluster::cfs_read_file(@_); },
    cfs_write_file => sub { PVE::Cluster::cfs_write_file(@_); },
);

my $pve_accesscontrol = Test::MockModule->new('PVE::AccessControl');
$pve_accesscontrol->mock(
    cfs_lock_file => sub { PVE::Cluster::cfs_lock_file(@_); },
);

my $pve_rpcenvironment = Test::MockModule->new('PVE::RPCEnvironment');
$pve_rpcenvironment->mock(
    get => sub { return bless {}, 'PVE::RPCEnvironment'; },
    get_user => sub { return 'root@pam'; },
    fork_worker => sub {
	my ($class, $workertype, $id, $user, $code) = @_;

	return $code->();
    },
);

my $pve_ldap_module = Test::MockModule->new('PVE::LDAP');
$pve_ldap_module->mock(
    ldap_connect => sub { return {}; },
    ldap_bind => sub {},
    query_users => sub {
	return $sync_response->{user};
    },
    query_groups => sub {
	return $sync_response->{groups};
    },
);

my $pve_auth_ldap = Test::MockModule->new('PVE::Auth::LDAP');
$pve_auth_ldap->mock(
    connect_and_bind => sub { return {}; },
);

my $tests = [
    [
	"non-full without purge",
	{
	    realm => 'syncedrealm',
	    full => 0,
	    purge => 0,
	    scope => 'both',
	},
	{
	    users => {
		'root@pam' => { username => 'root', },
		'user1@syncedrealm' => {
		    username => 'user1',
		    enable => 1,
		    'keys' => 'some',
		},
		'user2@syncedrealm' => {
		    username => 'user2',
		    enable => 1,
		},
		'user3@syncedrealm' => {
		    username => 'user3',
		    enable => 1,
		},
		'user4@syncedrealm' => {
		    username => 'user4',
		    enable => 1,
		},
	    },
	    groups => {
		'group1-syncedrealm' => {
		    users => {
			'user1@syncedrealm' => 1,
		    },
		},
		'group2-syncedrealm' => { users => {}, },
		'group3-syncedrealm' => { users => {}, },
	    },
	    acl => {
		'/' => {
		    users => {
			'user3@syncedrealm' => {},
		    },
		    groups => {},
		},
	    },
	},
    ],
    [
	"full without purge",
	{
	    realm => 'syncedrealm',
	    full => 1,
	    purge => 0,
	    scope => 'both',
	},
	{
	    users => {
		'root@pam' => { username => 'root', },
		'user1@syncedrealm' => {
		    username => 'user1',
		    enable => 1,
		},
		'user2@syncedrealm' => {
		    username => 'user2',
		    enable => 1,
		},
		'user4@syncedrealm' => {
		    username => 'user4',
		    enable => 1,
		},
	    },
	    groups => {
		'group1-syncedrealm' => {
		    users => {
			'user1@syncedrealm' => 1,
		    },
		},
		'group3-syncedrealm' => { users => {}, }
	    },
	    acl => {
		'/' => {
		    users => {
			'user3@syncedrealm' => {},
		    },
		    groups => {},
		},
	    },
	},
    ],
    [
	"non-full with purge",
	{
	    realm => 'syncedrealm',
	    full => 0,
	    purge => 1,
	    scope => 'both',
	},
	{
	    users => {
		'root@pam' => { username => 'root', },
		'user1@syncedrealm' => {
		    username => 'user1',
		    enable => 1,
		    'keys' => 'some',
		},
		'user2@syncedrealm' => {
		    username => 'user2',
		    enable => 1,
		},
		'user3@syncedrealm' => {
		    username => 'user3',
		    enable => 1,
		},
		'user4@syncedrealm' => {
		    username => 'user4',
		    enable => 1,
		},
	    },
	    groups => {
		'group1-syncedrealm' => {
		    users => {
			'user1@syncedrealm' => 1,
		    },
		},
		'group2-syncedrealm' => { users => {}, },
		'group3-syncedrealm' => { users => {}, },
	    },
	    acl => {
		'/' => {
		    users => {},
		    groups => {},
		},
	    },
	},
    ],
    [
	"full with purge",
	{
	    realm => 'syncedrealm',
	    full => 1,
	    purge => 1,
	    scope => 'both',
	},
	{
	    users => {
		'root@pam' => { username => 'root', },
		'user1@syncedrealm' => {
		    username => 'user1',
		    enable => 1,
		},
		'user2@syncedrealm' => {
		    username => 'user2',
		    enable => 1,
		},
		'user4@syncedrealm' => {
		    username => 'user4',
		    enable => 1,
		},
	    },
	    groups => {
		'group1-syncedrealm' => {
		    users => {
			'user1@syncedrealm' => 1,
		    },
		},
		'group3-syncedrealm' => { users => {}, },
	    },
	    acl => {
		'/' => {
		    users => {},
		    groups => {},
		},
	    },
	},
    ],
];

for my $test (@$tests) {
    my $name = $test->[0];
    my $parameters = $test->[1];
    my $expected = $test->[2];
    $returned_user_cfg = {};
    PVE::API2::Domains->sync($parameters);
    is_deeply($returned_user_cfg, $expected, $name);
}

done_testing();