Skip to content

Commit 04a40e4

Browse files
marieflorescontactmarieflorescontact
committed
[backend] improve authorized members tests for Cas IR(#4538)
1 parent 8f35d05 commit 04a40e4

File tree

1 file changed

+183
-50
lines changed

1 file changed

+183
-50
lines changed

‎opencti-platform/opencti-graphql/tests/02-integration/02-resolvers/container-authorized-members-test.ts

+183-50
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,9 @@ import {
1111
PLATFORM_ORGANIZATION,
1212
queryAsAdmin,
1313
securityQuery,
14-
USER_EDITOR
14+
USER_EDITOR,
1515
} from '../../utils/testQuery';
16-
import { queryAsUserWithSuccess } from '../../utils/testQueryHelper';
16+
import { queryAsUserIsExpectedForbidden } from '../../utils/testQueryHelper';
1717
import { executionContext, SYSTEM_USER } from '../../../src/utils/access';
1818
import { initCreateEntitySettings } from '../../../src/modules/entitySetting/entitySetting-domain';
1919
import { ENTITY_TYPE_CONTAINER_CASE_INCIDENT } from '../../../src/modules/case/case-incident/case-incident-types';
@@ -40,7 +40,6 @@ const READ_QUERY = gql`
4040
id
4141
standard_id
4242
name
43-
description
4443
authorized_members {
4544
id
4645
access_right
@@ -50,35 +49,6 @@ const READ_QUERY = gql`
5049
}
5150
`;
5251

53-
const LIST_QUERY = gql`
54-
query caseIncidents(
55-
$first: Int
56-
$after: ID
57-
$orderBy: CaseIncidentsOrdering
58-
$orderMode: OrderingMode
59-
$filters: FilterGroup
60-
$search: String
61-
$toStix: Boolean
62-
) {
63-
caseIncidents(
64-
first: $first
65-
after: $after
66-
orderBy: $orderBy
67-
orderMode: $orderMode
68-
filters: $filters
69-
search: $search
70-
toStix: $toStix
71-
) {
72-
edges {
73-
node {
74-
id
75-
standard_id
76-
}
77-
}
78-
}
79-
}
80-
`;
81-
8252
const DELETE_QUERY = gql`
8353
mutation CaseIncidentDelete($id: ID!) {
8454
caseIncidentDelete(id: $id)
@@ -103,7 +73,9 @@ const EDIT_AUTHORIZED_MEMBERS_QUERY = gql`
10373
`;
10474

10575
describe('Case Incident Response standard behavior with authorized_members activation from entity', () => {
106-
let caseIncidentResponseAuthorizedMembersFromEntity: CaseIncident;
76+
let caseIncident: CaseIncident;
77+
let userEditorId: string;
78+
// 1. On créé un case incident => on vérifie que l'editor y a accès, que les authorized members sont vide, que le user access right est admin
10779
it('should Case Incident Response created', async () => {
10880
// Create Case Incident Response
10981
const caseIncidentResponseCreateQueryResult = await queryAsAdmin({
@@ -119,13 +91,38 @@ describe('Case Incident Response standard behavior with authorized_members activ
11991
expect(caseIncidentResponseCreateQueryResult?.data?.caseIncidentAdd.authorized_members).not.toBeUndefined();
12092
expect(caseIncidentResponseCreateQueryResult?.data?.caseIncidentAdd.authorized_members).toEqual([]); // authorized members not activated
12193
expect(caseIncidentResponseCreateQueryResult?.data?.caseIncidentAdd.currentUserAccessRight).toEqual('admin'); // CurrentUser should be admin if authorized members not activated
122-
caseIncidentResponseAuthorizedMembersFromEntity = caseIncidentResponseCreateQueryResult?.data?.caseIncidentAdd;
123-
94+
caseIncident = caseIncidentResponseCreateQueryResult?.data?.caseIncidentAdd;
95+
});
96+
it('should Editor User access Case Incident Response', async () => {
97+
const caseIRQueryResult = await editorQuery({ query: READ_QUERY, variables: { id: caseIncident.id } });
98+
expect(caseIRQueryResult).not.toBeNull();
99+
expect(caseIRQueryResult?.data?.caseIncident).not.toBeUndefined();
100+
expect(caseIRQueryResult?.data?.caseIncident.id).toEqual(caseIncident.id);
101+
});
102+
// On essaye de modifier les authorized members avec le user editor => on vérifie qu'il n'a pas les droits et qu'il se prend une erreur forbidden
103+
it('should Editor User not edit authorized members if not in authorized members', async () => {
104+
userEditorId = await getUserIdByEmail(USER_EDITOR.email);
105+
const authorizedMembers = {
106+
id: caseIncident.id,
107+
input: [
108+
{
109+
id: userEditorId,
110+
access_right: 'view'
111+
},
112+
]
113+
};
114+
await queryAsUserIsExpectedForbidden(USER_EDITOR.client, {
115+
query: EDIT_AUTHORIZED_MEMBERS_QUERY,
116+
variables: authorizedMembers,
117+
});
118+
});
119+
// On essaye de modifier les authorized members avec l'admin (seulement admin) => on vérifie que ça a bien fonctionné avec l'admin, et on vérifie que l'editor n'a pas accès au case incident
120+
it('should Admin User edit authorized members', async () => {
124121
// Activate Authorized members
125122
await queryAsAdmin({
126123
query: EDIT_AUTHORIZED_MEMBERS_QUERY,
127124
variables: {
128-
id: caseIncidentResponseAuthorizedMembersFromEntity?.id,
125+
id: caseIncident?.id,
129126
input: [
130127
{
131128
id: ADMIN_USER.id,
@@ -137,7 +134,7 @@ describe('Case Incident Response standard behavior with authorized_members activ
137134
// Verify if authorized members have been edited
138135
const caseIncidentResponseUpdatedQueryResult = await queryAsAdmin({
139136
query: READ_QUERY,
140-
variables: { id: caseIncidentResponseAuthorizedMembersFromEntity.id }
137+
variables: { id: caseIncident.id }
141138
});
142139
expect(caseIncidentResponseUpdatedQueryResult).not.toBeNull();
143140
expect(caseIncidentResponseUpdatedQueryResult?.data?.caseIncident.authorized_members).not.toBeUndefined();
@@ -148,13 +145,19 @@ describe('Case Incident Response standard behavior with authorized_members activ
148145
}
149146
]);
150147
});
151-
it('should Case Incident Response get current User access right', async () => {
152-
// Add new authorized members
153-
const userEditorId = await getUserIdByEmail(USER_EDITOR.email);
148+
it('should Editor User not access Case Incident Response', async () => {
149+
const caseIRQueryResult = await editorQuery({ query: READ_QUERY, variables: { id: caseIncident.id } });
150+
expect(caseIRQueryResult).not.toBeNull();
151+
expect(caseIRQueryResult?.data?.caseIncident).not.toBeUndefined();
152+
expect(caseIRQueryResult?.data?.caseIncident).toBeNull();
153+
});
154+
// On modifie les authorized members avec l'admin en ajoutant l'editor en view => on vérifie que l'editor a bien accès au case incident
155+
it('should Admin User edit authorized members: Editor has view access right', async () => {
156+
// Add Editor User in authorized members
154157
await queryAsAdmin({
155158
query: EDIT_AUTHORIZED_MEMBERS_QUERY,
156159
variables: {
157-
id: caseIncidentResponseAuthorizedMembersFromEntity.id,
160+
id: caseIncident.id,
158161
input: [
159162
{
160163
id: ADMIN_USER.id,
@@ -167,22 +170,152 @@ describe('Case Incident Response standard behavior with authorized_members activ
167170
]
168171
}
169172
});
170-
// Get current User access right
171-
const currentUserAccessRightQueryResult = await queryAsUserWithSuccess(USER_EDITOR.client, {
173+
// Verify if authorized members have been edited
174+
const caseIncidentResponseUpdatedQueryResult = await queryAsAdmin({
172175
query: READ_QUERY,
173-
variables: { id: caseIncidentResponseAuthorizedMembersFromEntity.id },
176+
variables: { id: caseIncident.id }
174177
});
175-
expect(currentUserAccessRightQueryResult).not.toBeNull();
176-
expect(currentUserAccessRightQueryResult?.data?.caseIncident.currentUserAccessRight).toEqual('view');
178+
expect(caseIncidentResponseUpdatedQueryResult).not.toBeNull();
179+
expect(caseIncidentResponseUpdatedQueryResult?.data?.caseIncident.authorized_members).not.toBeUndefined();
180+
expect(caseIncidentResponseUpdatedQueryResult?.data?.caseIncident.authorized_members).toEqual([
181+
{
182+
id: ADMIN_USER.id,
183+
access_right: 'admin'
184+
},
185+
{
186+
id: userEditorId,
187+
access_right: 'view'
188+
}
189+
]);
177190
});
178-
it('should Case Incident Response deleted', async () => {
179-
// Delete the case
191+
it('should Editor User access Case Incident Response', async () => {
192+
const caseIRQueryResult = await editorQuery({ query: READ_QUERY, variables: { id: caseIncident.id } });
193+
expect(caseIRQueryResult).not.toBeNull();
194+
expect(caseIRQueryResult?.data?.caseIncident).not.toBeUndefined();
195+
expect(caseIRQueryResult?.data?.caseIncident.id).toEqual(caseIncident.id);
196+
});
197+
// On essaye d'editer le case avec l'editor => forbidden parce qu'il a seulement l'accès en view
198+
it('should Editor User not edit case incident with view access right', async () => {
199+
const authorizedMembers = {
200+
id: caseIncident.id,
201+
input: [
202+
{
203+
id: userEditorId,
204+
access_right: 'admin'
205+
},
206+
]
207+
};
208+
await queryAsUserIsExpectedForbidden(USER_EDITOR.client, {
209+
query: EDIT_AUTHORIZED_MEMBERS_QUERY,
210+
variables: authorizedMembers,
211+
});
212+
});
213+
// On modifie les authorized members avec l'admin en mettant l'editor en 'edit', et on vérifie qu'il peut bien éditer un case incident (description)
214+
it('should Admin User edit authorized members: Editor has edit access right', async () => {
215+
await queryAsAdmin({
216+
query: EDIT_AUTHORIZED_MEMBERS_QUERY,
217+
variables: {
218+
id: caseIncident.id,
219+
input: [
220+
{
221+
id: ADMIN_USER.id,
222+
access_right: 'admin'
223+
},
224+
{
225+
id: userEditorId,
226+
access_right: 'edit'
227+
}
228+
]
229+
}
230+
});
231+
// Verify if authorized members have been edited
232+
const caseIncidentResponseUpdatedQueryResult = await queryAsAdmin({
233+
query: READ_QUERY,
234+
variables: { id: caseIncident.id }
235+
});
236+
expect(caseIncidentResponseUpdatedQueryResult).not.toBeNull();
237+
expect(caseIncidentResponseUpdatedQueryResult?.data?.caseIncident.authorized_members).not.toBeUndefined();
238+
expect(caseIncidentResponseUpdatedQueryResult?.data?.caseIncident.authorized_members).toEqual([
239+
{
240+
id: ADMIN_USER.id,
241+
access_right: 'admin'
242+
},
243+
{
244+
id: userEditorId,
245+
access_right: 'edit'
246+
}
247+
]);
248+
});
249+
it('should Editor User edit case incident', async () => {
250+
const UPDATE_QUERY = gql`
251+
mutation CaseIncident($id: ID!, $input: [EditInput]!) {
252+
stixDomainObjectEdit(id: $id) {
253+
fieldPatch(input: $input) {
254+
id
255+
... on Case {
256+
name
257+
}
258+
}
259+
}
260+
}
261+
`;
262+
const queryResult = await editorQuery({
263+
query: UPDATE_QUERY,
264+
variables: { id: caseIncident.id, input: { key: 'name', value: ['Case Incident Response - updated'] } },
265+
});
266+
expect(queryResult?.data?.stixDomainObjectEdit.fieldPatch.name).toEqual('Case Incident Response - updated');
267+
});
268+
// l'editor essaye de delete le case incident => forbidden parce qu'il a seulement l'accès en edit
269+
it('should Editor User not delete case incident with edit access right', async () => {
270+
await queryAsUserIsExpectedForbidden(USER_EDITOR.client, {
271+
query: DELETE_QUERY,
272+
variables: { id: caseIncident.id },
273+
});
274+
});
275+
// On modifie les authorized members avec l'admin en mettant l'editor en 'admin', et on delete le case avec l'editor
276+
it('should Admin User edit authorized members: Editor has admin access right', async () => {
180277
await queryAsAdmin({
278+
query: EDIT_AUTHORIZED_MEMBERS_QUERY,
279+
variables: {
280+
id: caseIncident.id,
281+
input: [
282+
{
283+
id: ADMIN_USER.id,
284+
access_right: 'admin'
285+
},
286+
{
287+
id: userEditorId,
288+
access_right: 'admin'
289+
}
290+
]
291+
}
292+
});
293+
// Verify if authorized members have been edited
294+
const caseIncidentResponseUpdatedQueryResult = await queryAsAdmin({
295+
query: READ_QUERY,
296+
variables: { id: caseIncident.id }
297+
});
298+
expect(caseIncidentResponseUpdatedQueryResult).not.toBeNull();
299+
expect(caseIncidentResponseUpdatedQueryResult?.data?.caseIncident.authorized_members).not.toBeUndefined();
300+
expect(caseIncidentResponseUpdatedQueryResult?.data?.caseIncident.authorized_members).toEqual([
301+
{
302+
id: ADMIN_USER.id,
303+
access_right: 'admin'
304+
},
305+
{
306+
id: userEditorId,
307+
access_right: 'admin'
308+
}
309+
]);
310+
});
311+
it('should Editor User Case Incident Response deleted', async () => {
312+
// Delete the case
313+
await editorQuery({
181314
query: DELETE_QUERY,
182-
variables: { id: caseIncidentResponseAuthorizedMembersFromEntity.id },
315+
variables: { id: caseIncident.id },
183316
});
184317
// Verify is no longer found
185-
const queryResult = await queryAsAdmin({ query: READ_QUERY, variables: { id: caseIncidentResponseAuthorizedMembersFromEntity.id } });
318+
const queryResult = await queryAsAdmin({ query: READ_QUERY, variables: { id: caseIncident.id } });
186319
expect(queryResult).not.toBeNull();
187320
expect(queryResult?.data?.caseIncident).toBeNull();
188321
});

0 commit comments

Comments
 (0)