Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions code/handlers/permissions.q
Original file line number Diff line number Diff line change
Expand Up @@ -78,8 +78,10 @@ pdict:{[f;a]
d:d,$[not ca:count a; ();
f~`select; ();
(1=count a) and (99h=type first a); first a;
/if projection first obtain a list of function and fixed parameters (fnfp)
104h=type value f; [fnfp:value value f; (value[fnfp 0][1])!fnfp[1],a];
/if projection first obtain a list of function and fixed parameters (fnfp)
/pargs contains all projected args with :: marking unfixed positions
/allargs fills the full param list, then replaces :: positions with actual args a
104h=type value f; [fnfp:value value f;params:value[fnfp 0][1];pargs:1_ fnfp;allargs:(count params)#enlist[::];allargs[til count pargs]:pargs;allargs[where 101h=type each allargs]:a;params!allargs];
/get paramaters and make a dictionary with the arguments
101h<>type fp:value[value[f]][1]; fp!a;
((),(`$string til ca))!a
Expand Down Expand Up @@ -179,7 +181,7 @@ mainexpr:{[u;e;b;pr]
];
/ named function calls
if[-11h=type f;
if[not fchk[u;f;1_ e]; $[b;'err[`func][f]; :0b]];
if[not fchk[u;f;1_ (),e]; $[b;'err[`func][f]; :0b]];
$[b; :exe ie; :1b];
];
/ queries - select/update/delete
Expand Down
40 changes: 38 additions & 2 deletions tests/permissions/permissions.csv
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,42 @@ fail,,,q,.pm.expr[`harry; ({x+a};1)]~2,,,harry cannot run regular lambda which a
fail,,,q,.pm.expr[`harry; ("{x+a}";1)]~2,,,harry cannot run string lambda which accesses var a

comment,,,,,,,test defined projection
run,,,q,fn:{x+y}[1],,,creating a projection
run,,,q,fn:{x+y}[1],,,creating a projection
true,,,q,.pm.expr[`tom;(`fn;1)]~2,,,tom can run projection
fail,,,q,.pm.expr[`harry;(`fn;1)]~2,,,harry cannot run projection
fail,,,q,.pm.expr[`harry;(`fn;1)]~2,,,harry cannot run projection

comment,,,,,,,test projection handling for multiple fixed parameters
run,,,q,pf:{[w;x;y;z] w+x+y+z},,,define 4-arg function for projection tests
run,,,q,.pm.grantfunction[`pf;`role1;{1b}],,,grant role1 access to pf
run,,,q,p1:pf[1],,,projection with one fixed leading parameter
run,,,q,p2:pf[1;2],,,projection with two fixed leading parameters
run,,,q,p3:pf[;2;3],,,projection with fixed non-first parameters
run,,,q,p4:pf[;;;4],,,projection with fixed last paramater
true,,,q,10~.pm.expr[`tom;(`p1;2;3;4)],,,single fixed leading param projection works
true,,,q,10~.pm.expr[`tom;(`p2;3;4)],,,two fixed leading params projection works
true,,,q,10~.pm.expr[`tom;(`p3;1;4)],,,non-first fixed param projection works
true,,,q,10~.pm.expr[`tom;(`p4;1;2;3)],,,last fixed param projection works
fail,,,q,.pm.expr[`harry;(`p1;2;3;4)],,,harry cannot run projection with fixed leading param
fail,,,q,.pm.expr[`harry;(`p2;3;4)],,,harry cannot run projection with two fixed params
fail,,,q,.pm.expr[`harry;(`p3;1;4)],,,harry cannot run projection with non-first fixed param
fail,,,q,.pm.expr[`harry;(`p4;1;2;3)],,,harry cannot run projection with last fixed param

comment,,,,,,,test named function call where expression is a symbol atom (1_ (),e fix - zero-arg case)
run,,,q,zerofunc:{[] `done},,,define zero-arg function for symbol atom expression tests
run,,,q,.pm.grantfunction[`zerofunc;`role1;{1b}],,,grant role1 access to zerofunc
true,,,q,.pm.allowed[`tom;`zerofunc],,,tom is allowed to call zero-arg function via symbol atom expression
true,,,q,not .pm.allowed[`harry;`zerofunc],,,harry is not allowed to call zero-arg function via symbol atom expression

comment,,,,,,,test named function call where expression is a typed symbol list (1_ (),e fix - typed list case)
run,,,q,symarg:{[x] x},,,define function taking a symbol argument for typed symbol list expression tests
run,,,q,.pm.grantfunction[`symarg;`role1;{1b}],,,grant role1 unconditional access to symarg
true,,,q,.pm.allowed[`tom;`symarg`abc],,,tom is allowed to call function via typed symbol list expression
true,,,q,not .pm.allowed[`harry;`symarg`abc],,,harry is not allowed to call function via typed symbol list expression

comment,,,,,,,test paramcheck correctly inspects args when expression is a typed symbol list
run,,,q,.pm.addrole[`role2;"role for isolated paramcheck test"],,,create new role without ALL access
run,,,q,.pm.adduser[`alice;`local;`md5;md5"pass"],,,create user assigned only to role2
run,,,q,.pm.assignrole[`alice;`role2],,,assign role2 (no ALL grant) to alice
run,,,q,.pm.grantfunction[`symarg;`role2;{[d] `abc~d`x}],,,grant role2 access to symarg with paramcheck on arg value
true,,,q,.pm.allowed[`alice;`symarg`abc],,,paramcheck passes when correct symbol arg given
true,,,q,not .pm.allowed[`alice;`symarg`xyz],,,paramcheck fails when wrong symbol arg given