Helper for validating RBAC list actions
List RBAC actions typically perform soft authorization checks meaning
that the response bodies omit resources that the user isn't authorized
to see.
For example, if an admin user creates a user, member role might not be
able to see that user when listing all the users in a tenant,
depending on the RBAC rule.
This patch set adds override_role_and_validate_list function to
RbacUtils to validate RBAC flows for API list actions.
Change-Id: I5f39efc8aa0004d4ad435cbd6b8fb037c33832d6
diff --git a/releasenotes/notes/override-role-and-validate-list-d3b80f773674a652.yaml b/releasenotes/notes/override-role-and-validate-list-d3b80f773674a652.yaml
new file mode 100644
index 0000000..de05b76
--- /dev/null
+++ b/releasenotes/notes/override-role-and-validate-list-d3b80f773674a652.yaml
@@ -0,0 +1,37 @@
+---
+features:
+ - |
+ In order to test the list actions which doesn't have its own policy,
+ implemented the ``override_role_and_validate_list`` function.
+ The function has two modes:
+
+ * Validating the number of the resources in a ``ResponseBody`` before
+ calling the ``override_role`` and after.
+
+ .. code-block:: python
+
+ # make sure at least one resource is available
+ self.ntp_client.create_policy_dscp_marking_rule()
+ # the list of resources available for a user with admin role
+ admin_resources = self.ntp_client.list_dscp_marking_rules(
+ policy_id=self.policy_id)["dscp_marking_rules"]
+ with self.rbac_utils.override_role_and_validate_list(
+ self, admin_resources=admin_resources) as ctx:
+ # the list of resources available for a user with member role
+ ctx.resources = self.ntp_client.list_dscp_marking_rules(
+ policy_id=self.policy_id)["dscp_marking_rules"]
+
+ * Validating that a resource, created before ``override_role``, is not
+ present in a ``ResponseBody``.
+
+ .. code-block:: python
+
+ # the resource created by a user with admin role
+ admin_resource_id = (
+ self.ntp_client.create_dscp_marking_rule()
+ ["dscp_marking_rule"]["id'])
+ with self.rbac_utils.override_role_and_validate_list(
+ self, admin_resource_id=admin_resource_id) as ctx:
+ # the list of resources available for a user wirh member role
+ ctx.resources = self.ntp_client.list_dscp_marking_rules(
+ policy_id=self.policy_id)["dscp_marking_rules"]