Authorization 4.3 - Integration tests

Owned by Yaojie Feng
Last updated: Aug 19, 2017
2 min read

Namespaces

Operation
Privileges Required (Proposed)
Integration test name
Create

ADMIN

BasicAuthorizationTestBase.testNamespcePrivileges
Update  
DeleteADMIN on the namespace, and all entities in the namespace
BasicAuthorizationTestBase.testNamespcePrivileges
View/ListAny privilege on the namespace or any of its descendants.

BasicAuthorizationTestBase.testCreatedDeletedPrivileges

This needs to have a more comprehensive test to cover the list of as many entities as possible.

Get Namespace MetaAny privilege on the namespace or any of its descendants.This can be easily added to test and this is covered in unit test.


Artifacts

Operation
Privileges Required (Proposed)
Integration test name
AddADMIN
Integration tests only tests deploy app with artifact
Add a propertyADMIN 
Remove a propertyADMIN 
Use to deploy an appADMIN | READAppAuthorizationTestBase.testDeployApp
DeleteADMIN 
View/ListAny privilege on the artifact 
Get artifact info/summary/detailADMIN | READ 
  We have tests in unit test but not in integration tests

 

Applications

Operation
Privileges Required (Proposed)
Integration test name
Add

ADMIN

*Also see artifact privileges and principal privileges

AppAuthorizationTestBase.testDeployApp
DeleteADMINAppAuthorizationTestBase.testDeployApp
View/ListAny privilege on the application or any of its descendants.can easily add
Get application detailADMIN | READcan easily add
   

 

Programs

Operation
Privileges Required (Proposed)
Integration test name
Start, Stop, or DebugEXECUTEAppAuthorizationTestBase.testDatasetInProgram
Set instancesADMIN 
Set runtime argumentsADMIN 
Retrieve runtime argumentsREAD | EXECUTE | ADMIN 
Retrieve status AppAuthorizationTestBase.testDatasetInProgram
View/List easily add
Get program specificationADMIN | READ 

 

Datasets

Operation
Privileges Required (Proposed)
Integration Test Name
CreateADMINBasicAuthorizationTestBase.testDatasetPrivileges
ReadREADAppAuthorizationTestBase.testDatasetInProgram
Retrieving propertiesAny of READ, WRITE, ADMIN, or EXECUTEeasily add
WriteWRITEAppAuthorizationTestBase.testDatasetInProgram
UpdateADMINBasicAuthorizationTestBase.testDatasetPrivileges
UpgradeADMIN 
TruncateADMINBasicAuthorizationTestBase.testDatasetPrivileges
DropADMINBasicAuthorizationTestBase.testDatasetPrivileges
View/List BasicAuthorizationTestBase.testDatasetPrivileges
Get dataset metaADMIN | READ | WRITEBasicAuthorizationTestBase.testDatasetPrivileges

 

Dataset Modules

Operation
Privileges Required (Proposed)
Integration Test Name
DeployADMIN 
DeleteADMIN 
Delete-all in the namespaceADMIN on all dataset modules in the namespace 
View/List  
Get module metaADMIN | READ 
  Unit test covers add module during app deployment

 

Dataset Types

Operation
Privileges Required (Proposed)
Integration test name
View/List easy to add
Get dataset type metaADMIN | READBasicAuthorizationTestBase.testDatasetPrivileges

 

Secure Keys

Operation
Privileges Required (Proposed)
Integration test name
CreateADMIN 
DeleteADMIN 
View/List  
ReadREAD (on the key) 
  We dont have test for any of them

 

Streams

Operation
Privileges Required (Proposed)
Integration test name
CreateADMINBasicAuthorizationTestBase.testStreamPrivileges
Retrieving eventsREADBasicAuthorizationTestBase.testStreamPrivileges
Sending events to a stream (sync, async, or batch)WRITEBasicAuthorizationTestBase.testStreamPrivileges
DropADMINBasicAuthorizationTestBase.testStreamPrivileges
Drop-all in the namespaceADMIN on all the streams in the namespace 
UpdateADMIN 
TruncateADMIN 
View/List Easy to add
Get stream propertyADMIN | READEasy to add

 

Principal

Operation
Privileges Required (Proposed)
Integration test name
Deploy an app to impersonate a principalADMINAppImpersonationAuthorizationTest(in pr)
Create a namespace with owner prinicpalADMINNamespaceImpersonationBasicAuthorizationTest
Create a dataset with owner prinicpalADMINAppImpersonationAuthorizationTest(in pr)
Create a stream with owner prinicpalADMIN 

 

More in integration tests:

  1. Test creating namespaces with two different clients and try to delete them to test the explore user name issue(in pr)
  2. test namespace creation with different owners and make sure the owner is correct(in pr)
  3. all basic tests with ns/app impersonation, custom mapping 
  4. role based auth test(in pr)

 

More to do list:

  1. test create dataset with an unauthorized dataset type
  2. test CDAP-8568 with minimal privilege required

 

 

Â