view schema/manage_users_tests.sql @ 207:88d21c29cf04

Care for the fact that role attributes are not inherited Tests are now run with login roles instead of abstract base roles. create_user has become a SECURITY DEFINER function, thus circumventing RLS policies and that a sys_admin cannot CREATE ROLEs by himself. A test has been added to showcase the intentional error in case the name of an abstract base role is used as a new username.
author Tom Gottfried <tom@intevation.de>
date Mon, 23 Jul 2018 11:29:41 +0200
parents b67208d82543
children 57dfab80973c
line wrap: on
line source

--
-- pgTAP test script for user management functions
--

SET search_path TO public, gemma, gemma_waterway, gemma_fairway;

SET SESSION AUTHORIZATION admin_at;

SELECT throws_ok($$
    SELECT sys_admin.create_user(
        'waterway_user', 'test0', 'secret', 'AT', NULL, 'test0')
    $$,
    42501, NULL,
    'Less privileged user cannot call function in schema sys_admin');

SET SESSION AUTHORIZATION sys_admin1;

SELECT lives_ok($$
    SELECT sys_admin.create_user(
        'waterway_user', 'test1', 'secret', 'AT', NULL, 'test1')
    $$,
    'New waterway user can be added');

SELECT throws_ok($$
    SELECT sys_admin.create_user(
        'invalid', 'test2', 'secret', 'AT', NULL, 'test2')
    $$,
    42704, NULL,
    'Valid role name has to be provided');

SELECT throws_ok($$
    SELECT sys_admin.create_user(
        'waterway_user', NULL, 'secret', 'AT', NULL, 'test3')
    $$,
    23502, NULL,
    'username is mandatory');
-- Though other arguments are mandatory, too, there are no explicit tests

SELECT throws_ok($$
    SELECT sys_admin.create_user(
        'waterway_user', 'waterway_user', 'secret', 'AT', NULL, 'test4')
    $$,
    42710, NULL,
    'Reserved role names cannot be used as username');

SELECT throws_ok($$
    SELECT sys_admin.create_user(
        'waterway_user', 'user_at', 'secret', 'AT', NULL, 'test4')
    $$,
    23505, NULL,
    'No duplicate user name is allowed');

SELECT throws_ok($$
    SELECT sys_admin.create_user(
        'waterway_user', 'test2', 'secret', 'AT', NULL, 'xxx')
    $$,
    23505, NULL,
    'No duplicate e-mail adress is allowed');