Repository navigation
Conversation
…tor lacks is refused The LeanerCloud#226 self-promotion test covered only adding the Administrators group, so nothing committed proved the membership grant ceiling on a self-edit is general rather than an admin:* special case. A self-edit adding a group with an ordinary, non-carved-out permission the actor does not hold (here view:recommendations) passes guardSelfEscalation, since the actor holds update:users, nothing is carved out and no account scope widens. Only the grant ceiling, measured against the actor's prior permissions, refuses it. Add TestMembershipCeiling_UpdateUser_SelfEditNonAdminPermissionAboveCeilingRefused next to the existing membership ceiling tests. It asserts ErrPermissionCeiling (not ErrSelfEscalation), that the error names view:recommendations, and that UpdateUserAdminFields is never reached. Restricting the membership ceiling to admin:* only survives the rest of the internal/auth unit suite and is killed only by this test. Closes LeanerCloud#419 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
IAmJSD
added
impact/internal
Contributor
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Comment |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Test-only change. It closes the coverage gap that the review of #405 (the PR for #226) found.
The #226 self-promotion test (
TestMembershipCeiling_UpdateUser_UpdateUsersOnlyCannotSelfPromoteToAdmin) only covers adding the Administrators group. No committed test proved that the membership grant ceiling on a self-edit applies in general and isn't just a special case foradmin:*.On a self-edit,
guardGroupChangerunsguardSelfEscalationfirst. That check allows adding a group with an ordinary, non-carved-out permission the actor doesn't hold (hereview:recommendations), because:update:users,The change is refused only by
checkMembershipGrantCeilingWithPerms, which compares against the actor's prior permissions. Behavior onmainis already correct, so no production code changes.Change
internal/auth/membership_ceiling_test.go: addsTestMembershipCeiling_UpdateUser_SelfEditNonAdminPermissionAboveCeilingRefusednext to the existing membership ceiling tests. It reuses the shared fixtures (stubActorPermissions,updateUsersOnly,newCeilingService). An actor holding onlyupdate:usersedits itself to add a "Recommendation Viewers" group that carriesview:recommendations. The test asserts:errors.Is(err, ErrPermissionCeiling),ErrSelfEscalation, which pins that the ceiling is what refuses the change, not the self-escalation guard,view:recommendations,UpdateUserAdminFieldsis never called. No stub is registered for it either, so a write that gets through panics the mock.Closes #419
Verification
All of this is unit/mock evidence (testify
MockStore). The issue is about service-layer guard logic, not DB behavior, so no integration test was added. There is no concurrent-caller surface here because nothing is written.The new test passes on unmodified
maincode as expected, since it pins existing behavior. To show it can fail, two guard mutations were applied locally and then reverted (git statuswas clean apart from the test file afterwards):internal/authunit suiteguardGroupChangeself-edit branch returnsnilinstead ofcheckMembershipGrantCeilingWithPerms(ctx, heldBefore, added)UpdateUserAdminFieldscall atservice_user.go:360)checkMembershipGrantCeilingWithPermsrefuses non-carved-out permissions only whenperm.Action == ActionAdmin(an admin-only special case)go test ./internal/auth/ -count=1 -skip '<new test>'givesokM2 is the regression the issue describes. Before this PR, no
internal/authunit test would catch it.Commands run (Go 1.26.9, with
AWS_CONFIG_FILE=/dev/null AWS_SHARED_CREDENTIALS_FILE=/dev/null AWS_EC2_METADATA_DISABLED=true):gocyclo: not applicable (no non-test files changed).
Combined-tree verification. This branch was tested together with the other queued branches on a local, never-pushed tree:
queue/platform@936996ad= origin/maina14dc8f2plus these heads, merged in this order:fix/issue-72andfix/issue-312conflict on one line ininternal/api/handler_dashboard.go(both change thecalculateCommitmentMetricscall). The tree used #72's side with #312's validatedprovidervariable; whichever PR merges second takes that same resolution.Linux, Go 1.26.9,
AWS_CONFIG_FILE=/dev/null AWS_SHARED_CREDENTIALS_FILE=/dev/null AWS_EC2_METADATA_DISABLED=true; Docker Postgres via testcontainers:936996ad:go build ./...,go vet ./...,go vet -tags integration ./...and the fullgo test -race -short -count=1 ./....936996ad: golangci-lint v2.10.1 found 0 issues on every changed package, with and without--build-tags integration.tests/e2eis a separate module, so it was vetted under its owne2etag.gocyclo -over 10is silent on the changed non-test files.-tags integration -count=1, 60-minute local timeout because the VM was shared):936996ad, these pass:internal/server,internal/credentials,internal/scheduler,internal/database/postgres/migrations,internal/purchaseandinternal/api.internal/configpasses exceptTestPostgresStoreDB_ResolveStaleRIExchange_ValidatesCloudCheck, which fails the same way on unmodified main (fixed by fix(config): compare resolve checked_at at the database's microsecond precision #1252).26795376, same branches at earlier heads):internal/analytics,internal/auth,internal/commitmentopts,internal/databaseandcmd/lambda/clear-rate-limitall pass. The later fixes don't touch those packages.httpToLambdaRequestsignature change;scripts/setup-git-secrets.shpatterns in a fresh repo with an isolated HOME, found nothing in the changed files, and a planted fake key was flagged.scripts/test-git-secrets-allowlist.sh: 137 PASS, 0 FAIL.Out of scope
update:users-only actor adding a non-admin permission group to another user) goes throughcheckMembershipGrantCeilingand is likewise covered only for Administrators. This PR doesn't pin it because the issue asks only for the self-edit case. It may be worth a follow-up test.Labels
Could a maintainer please mirror the issue's triage labels onto this PR:
impact/internal,type/chore,triaged,priority/p3,severity/low,urgency/eventually,effort/xs.🤖 Generated with Claude Code