diff --git a/code/handlers/permissions.q b/code/handlers/permissions.q index 67592dd8d..93ca2726b 100644 --- a/code/handlers/permissions.q +++ b/code/handlers/permissions.q @@ -78,8 +78,10 @@ pdict:{[f;a] d:d,$[not ca:count a; (); f~`select; (); (1=count a) and (99h=type first a); first a; - /if projection first obtain a list of function and fixed parameters (fnfp) - 104h=type value f; [fnfp:value value f; (value[fnfp 0][1])!fnfp[1],a]; + /if projection first obtain a list of function and fixed parameters (fnfp) + /pargs contains all projected args with :: marking unfixed positions + /allargs fills the full param list, then replaces :: positions with actual args a + 104h=type value f; [fnfp:value value f;params:value[fnfp 0][1];pargs:1_ fnfp;allargs:(count params)#enlist[::];allargs[til count pargs]:pargs;allargs[where 101h=type each allargs]:a;params!allargs]; /get paramaters and make a dictionary with the arguments 101h<>type fp:value[value[f]][1]; fp!a; ((),(`$string til ca))!a @@ -179,7 +181,7 @@ mainexpr:{[u;e;b;pr] ]; / named function calls if[-11h=type f; - if[not fchk[u;f;1_ e]; $[b;'err[`func][f]; :0b]]; + if[not fchk[u;f;1_ (),e]; $[b;'err[`func][f]; :0b]]; $[b; :exe ie; :1b]; ]; / queries - select/update/delete diff --git a/tests/permissions/permissions.csv b/tests/permissions/permissions.csv index 58a9872fb..88ebfe4b4 100644 --- a/tests/permissions/permissions.csv +++ b/tests/permissions/permissions.csv @@ -64,6 +64,42 @@ fail,,,q,.pm.expr[`harry; ({x+a};1)]~2,,,harry cannot run regular lambda which a fail,,,q,.pm.expr[`harry; ("{x+a}";1)]~2,,,harry cannot run string lambda which accesses var a comment,,,,,,,test defined projection -run,,,q,fn:{x+y}[1],,,creating a projection +run,,,q,fn:{x+y}[1],,,creating a projection true,,,q,.pm.expr[`tom;(`fn;1)]~2,,,tom can run projection -fail,,,q,.pm.expr[`harry;(`fn;1)]~2,,,harry cannot run projection \ No newline at end of file +fail,,,q,.pm.expr[`harry;(`fn;1)]~2,,,harry cannot run projection + +comment,,,,,,,test projection handling for multiple fixed parameters +run,,,q,pf:{[w;x;y;z] w+x+y+z},,,define 4-arg function for projection tests +run,,,q,.pm.grantfunction[`pf;`role1;{1b}],,,grant role1 access to pf +run,,,q,p1:pf[1],,,projection with one fixed leading parameter +run,,,q,p2:pf[1;2],,,projection with two fixed leading parameters +run,,,q,p3:pf[;2;3],,,projection with fixed non-first parameters +run,,,q,p4:pf[;;;4],,,projection with fixed last paramater +true,,,q,10~.pm.expr[`tom;(`p1;2;3;4)],,,single fixed leading param projection works +true,,,q,10~.pm.expr[`tom;(`p2;3;4)],,,two fixed leading params projection works +true,,,q,10~.pm.expr[`tom;(`p3;1;4)],,,non-first fixed param projection works +true,,,q,10~.pm.expr[`tom;(`p4;1;2;3)],,,last fixed param projection works +fail,,,q,.pm.expr[`harry;(`p1;2;3;4)],,,harry cannot run projection with fixed leading param +fail,,,q,.pm.expr[`harry;(`p2;3;4)],,,harry cannot run projection with two fixed params +fail,,,q,.pm.expr[`harry;(`p3;1;4)],,,harry cannot run projection with non-first fixed param +fail,,,q,.pm.expr[`harry;(`p4;1;2;3)],,,harry cannot run projection with last fixed param + +comment,,,,,,,test named function call where expression is a symbol atom (1_ (),e fix - zero-arg case) +run,,,q,zerofunc:{[] `done},,,define zero-arg function for symbol atom expression tests +run,,,q,.pm.grantfunction[`zerofunc;`role1;{1b}],,,grant role1 access to zerofunc +true,,,q,.pm.allowed[`tom;`zerofunc],,,tom is allowed to call zero-arg function via symbol atom expression +true,,,q,not .pm.allowed[`harry;`zerofunc],,,harry is not allowed to call zero-arg function via symbol atom expression + +comment,,,,,,,test named function call where expression is a typed symbol list (1_ (),e fix - typed list case) +run,,,q,symarg:{[x] x},,,define function taking a symbol argument for typed symbol list expression tests +run,,,q,.pm.grantfunction[`symarg;`role1;{1b}],,,grant role1 unconditional access to symarg +true,,,q,.pm.allowed[`tom;`symarg`abc],,,tom is allowed to call function via typed symbol list expression +true,,,q,not .pm.allowed[`harry;`symarg`abc],,,harry is not allowed to call function via typed symbol list expression + +comment,,,,,,,test paramcheck correctly inspects args when expression is a typed symbol list +run,,,q,.pm.addrole[`role2;"role for isolated paramcheck test"],,,create new role without ALL access +run,,,q,.pm.adduser[`alice;`local;`md5;md5"pass"],,,create user assigned only to role2 +run,,,q,.pm.assignrole[`alice;`role2],,,assign role2 (no ALL grant) to alice +run,,,q,.pm.grantfunction[`symarg;`role2;{[d] `abc~d`x}],,,grant role2 access to symarg with paramcheck on arg value +true,,,q,.pm.allowed[`alice;`symarg`abc],,,paramcheck passes when correct symbol arg given +true,,,q,not .pm.allowed[`alice;`symarg`xyz],,,paramcheck fails when wrong symbol arg given \ No newline at end of file