diff --git a/src/iam/router.py b/src/iam/router.py index 5d824eb..fbe1c59 100644 --- a/src/iam/router.py +++ b/src/iam/router.py @@ -25,7 +25,7 @@ from psycopg.errors import UniqueViolation from src.iam.exceptions import GroupNotFoundException from src.organisation.dependencies import org_model_body_dependency from src.organisation.exceptions import OrgNotFoundException -from src.schemas import GroupSummary, OrgSummary, ResourceName +from src.schemas import GroupSummary, OrgSummary from src.service.dependencies import service_model_body_dependency from src.exceptions import ( ConflictException, @@ -118,7 +118,7 @@ async def can_act_on_resource( """ response = { "allowed": False, - "rn": ResourceName(organisation="", service="", resource=""), + "rn": request_model.rn, "action": "", "user": {"id": 0, "email": ""}, } @@ -127,7 +127,7 @@ async def can_act_on_resource( rn = request_model.rn action = request_model.action user_id = user_claims["db_id"] - rn_org = rn.organisation + rn_org = rn.organisation_id rn_service = rn.service rn_resource = rn.resource @@ -144,7 +144,7 @@ async def can_act_on_resource( .join(UserGroups, UserGroups.group_id == Group.id) .join(User, User.id == UserGroups.user_id) .filter(User.id == user_id) - .filter(Org.name == rn_org) + .filter(Org.id == rn_org) .filter(Service.name == rn_service) .filter(Perm.resource == rn_resource) .filter(Perm.action == action) @@ -154,7 +154,8 @@ async def can_act_on_resource( response["allowed"] = True else: response["allowed"] = False - except Exception: + except Exception as e: + print(e) response["allowed"] = False return response diff --git a/src/schemas.py b/src/schemas.py index 30f4f90..8bb4fa2 100644 --- a/src/schemas.py +++ b/src/schemas.py @@ -59,7 +59,6 @@ class ServiceSummary(CustomBaseModel): name: str -class ResourceName(ServiceNameMixin): - organisation: str +class ResourceName(ServiceNameMixin, OrgIDMixin): resource: str instance: Optional[str] = None diff --git a/test/test_iam.py b/test/test_iam.py index e65b630..e234417 100644 --- a/test/test_iam.py +++ b/test/test_iam.py @@ -15,7 +15,7 @@ async def test_post_act_on_resource_endpoint_success(default_client: AsyncClient body = { "rn": { "service": "Test Service", - "organisation": "Org One", + "organisation_id": 1, "resource": "test_resource", "instance": None, }, @@ -33,6 +33,8 @@ async def test_post_act_on_resource_endpoint_success(default_client: AsyncClient assert resp.status_code == 200 assert data["allowed"] is True + print(data) + @pytest.mark.parametrize( "service, api_key", @@ -118,10 +120,10 @@ async def test_act_on_resource_endpoint_status_checks( @pytest.mark.parametrize( "service, org, resource, action, expected_response", [ - ("Test Service", "Org One", "test_resource", "read", True), - ("Test Service", "Org One", "test_resource", "create", False), - ("Test Service", "Org One", "no_access_here", "read", False), - ("Test Service", "Org Two", "test_resource", "read", False), + ("Test Service", 1, "test_resource", "read", True), + ("Test Service", 1, "test_resource", "create", False), + ("Test Service", 1, "no_access_here", "read", False), + ("Test Service", 2, "test_resource", "read", False), ], ) @pytest.mark.anyio @@ -134,7 +136,7 @@ async def test_act_on_resource_logic( expected_response: bool, ): body = { - "rn": {"service": service, "organisation": org, "resource": resource}, + "rn": {"service": service, "organisation_id": org, "resource": resource}, "action": action, } headers = {