Browse Source
Introduce comprehensive tests for policy validation logic, including owner and policy admin scenarios. Update `HandlePolicyConfigUpdate` to differentiate permissions for owners and policy admins, enforcing stricter field restrictions and validation flows.main
mleku
1 month ago
8 changed files with 1627 additions and 46 deletions
@ -0,0 +1,525 @@
@@ -0,0 +1,525 @@
|
||||
package policy |
||||
|
||||
import ( |
||||
"encoding/json" |
||||
"fmt" |
||||
"os" |
||||
"path/filepath" |
||||
"sort" |
||||
"sync" |
||||
|
||||
"git.mleku.dev/mleku/nostr/encoders/hex" |
||||
"lol.mleku.dev/log" |
||||
"next.orly.dev/pkg/utils" |
||||
) |
||||
|
||||
// =============================================================================
|
||||
// Policy Composition Types
|
||||
// =============================================================================
|
||||
|
||||
// PolicyAdminContribution represents extensions/additions from a policy admin.
|
||||
// Policy admins can extend the base owner policy but cannot modify protected fields
|
||||
// (owners, policy_admins) or reduce owner-granted permissions.
|
||||
type PolicyAdminContribution struct { |
||||
// AdminPubkey is the hex-encoded pubkey of the policy admin who made this contribution
|
||||
AdminPubkey string `json:"admin_pubkey"` |
||||
// CreatedAt is the Unix timestamp when this contribution was created
|
||||
CreatedAt int64 `json:"created_at"` |
||||
// EventID is the Nostr event ID that created this contribution (for audit trail)
|
||||
EventID string `json:"event_id,omitempty"` |
||||
|
||||
// KindWhitelistAdd adds kinds to the whitelist (OR with owner's whitelist)
|
||||
KindWhitelistAdd []int `json:"kind_whitelist_add,omitempty"` |
||||
// KindBlacklistAdd adds kinds to the blacklist (overrides whitelist)
|
||||
KindBlacklistAdd []int `json:"kind_blacklist_add,omitempty"` |
||||
|
||||
// RulesExtend extends existing rules defined by the owner
|
||||
RulesExtend map[int]RuleExtension `json:"rules_extend,omitempty"` |
||||
// RulesAdd adds new rules for kinds not defined by the owner
|
||||
RulesAdd map[int]Rule `json:"rules_add,omitempty"` |
||||
|
||||
// GlobalExtend extends the global rule
|
||||
GlobalExtend *RuleExtension `json:"global_extend,omitempty"` |
||||
} |
||||
|
||||
// RuleExtension defines how a policy admin can extend an existing owner rule.
|
||||
// All fields are additive - they extend, not replace, the owner's configuration.
|
||||
type RuleExtension struct { |
||||
// WriteAllowAdd adds pubkeys to the write allow list
|
||||
WriteAllowAdd []string `json:"write_allow_add,omitempty"` |
||||
// WriteDenyAdd adds pubkeys to the write deny list (overrides allow)
|
||||
WriteDenyAdd []string `json:"write_deny_add,omitempty"` |
||||
// ReadAllowAdd adds pubkeys to the read allow list
|
||||
ReadAllowAdd []string `json:"read_allow_add,omitempty"` |
||||
// ReadDenyAdd adds pubkeys to the read deny list (overrides allow)
|
||||
ReadDenyAdd []string `json:"read_deny_add,omitempty"` |
||||
|
||||
// SizeLimitOverride can only make the limit MORE permissive (larger)
|
||||
SizeLimitOverride *int64 `json:"size_limit_override,omitempty"` |
||||
// ContentLimitOverride can only make the limit MORE permissive (larger)
|
||||
ContentLimitOverride *int64 `json:"content_limit_override,omitempty"` |
||||
// MaxAgeOfEventOverride can only make the limit MORE permissive (older allowed)
|
||||
MaxAgeOfEventOverride *int64 `json:"max_age_of_event_override,omitempty"` |
||||
// MaxAgeEventInFutureOverride can only make the limit MORE permissive (further future allowed)
|
||||
MaxAgeEventInFutureOverride *int64 `json:"max_age_event_in_future_override,omitempty"` |
||||
|
||||
// WriteAllowFollows extends the follow whitelist feature
|
||||
WriteAllowFollows *bool `json:"write_allow_follows,omitempty"` |
||||
// FollowsWhitelistAdminsAdd adds admin pubkeys whose follows are whitelisted
|
||||
FollowsWhitelistAdminsAdd []string `json:"follows_whitelist_admins_add,omitempty"` |
||||
} |
||||
|
||||
// ComposedPolicy manages the base owner policy and policy admin contributions.
|
||||
// It computes an effective merged policy at runtime.
|
||||
type ComposedPolicy struct { |
||||
// OwnerPolicy is the base policy set by owners
|
||||
OwnerPolicy *P |
||||
// Contributions is a map of event ID -> contribution for deduplication
|
||||
Contributions map[string]*PolicyAdminContribution |
||||
// contributionsMx protects the contributions map
|
||||
contributionsMx sync.RWMutex |
||||
// configDir is the directory where policy files are stored
|
||||
configDir string |
||||
} |
||||
|
||||
// =============================================================================
|
||||
// Protected Field Validation
|
||||
// =============================================================================
|
||||
|
||||
// ProtectedFields are fields that only owners can modify
|
||||
var ProtectedFields = []string{"owners", "policy_admins"} |
||||
|
||||
// ValidateOwnerPolicy validates a policy update from an owner.
|
||||
// Ensures owners list is non-empty.
|
||||
func ValidateOwnerPolicy(policy *P) error { |
||||
if len(policy.Owners) == 0 { |
||||
return fmt.Errorf("owners list cannot be empty: at least one owner must be defined") |
||||
} |
||||
|
||||
// Validate all owner pubkeys are valid hex
|
||||
for _, owner := range policy.Owners { |
||||
if len(owner) != 64 { |
||||
return fmt.Errorf("invalid owner pubkey length: %q (expected 64 hex characters)", owner) |
||||
} |
||||
if _, err := hex.Dec(owner); err != nil { |
||||
return fmt.Errorf("invalid owner pubkey format: %q: %v", owner, err) |
||||
} |
||||
} |
||||
|
||||
// Validate all policy admin pubkeys are valid hex
|
||||
for _, admin := range policy.PolicyAdmins { |
||||
if len(admin) != 64 { |
||||
return fmt.Errorf("invalid policy_admin pubkey length: %q (expected 64 hex characters)", admin) |
||||
} |
||||
if _, err := hex.Dec(admin); err != nil { |
||||
return fmt.Errorf("invalid policy_admin pubkey format: %q: %v", admin, err) |
||||
} |
||||
} |
||||
|
||||
return nil |
||||
} |
||||
|
||||
// ValidatePolicyAdminContribution validates a contribution from a policy admin.
|
||||
// Ensures no protected fields are modified and extensions are valid.
|
||||
func ValidatePolicyAdminContribution( |
||||
ownerPolicy *P, |
||||
contribution *PolicyAdminContribution, |
||||
existingContributions map[string]*PolicyAdminContribution, |
||||
) error { |
||||
// Validate the admin pubkey is valid
|
||||
if len(contribution.AdminPubkey) != 64 { |
||||
return fmt.Errorf("invalid admin pubkey length") |
||||
} |
||||
|
||||
// Validate kind additions don't conflict with owner blacklist
|
||||
// (though PA can add to blacklist to override whitelist)
|
||||
|
||||
// Validate rule extensions
|
||||
for kind, ext := range contribution.RulesExtend { |
||||
ownerRule, exists := ownerPolicy.rules[kind] |
||||
if !exists { |
||||
return fmt.Errorf("cannot extend rule for kind %d: not defined in owner policy (use rules_add instead)", kind) |
||||
} |
||||
|
||||
// Validate size limit overrides are more permissive
|
||||
if ext.SizeLimitOverride != nil && ownerRule.SizeLimit != nil { |
||||
if *ext.SizeLimitOverride < *ownerRule.SizeLimit { |
||||
return fmt.Errorf("size_limit_override for kind %d must be >= owner's limit (%d)", kind, *ownerRule.SizeLimit) |
||||
} |
||||
} |
||||
|
||||
if ext.ContentLimitOverride != nil && ownerRule.ContentLimit != nil { |
||||
if *ext.ContentLimitOverride < *ownerRule.ContentLimit { |
||||
return fmt.Errorf("content_limit_override for kind %d must be >= owner's limit (%d)", kind, *ownerRule.ContentLimit) |
||||
} |
||||
} |
||||
|
||||
if ext.MaxAgeOfEventOverride != nil && ownerRule.MaxAgeOfEvent != nil { |
||||
if *ext.MaxAgeOfEventOverride < *ownerRule.MaxAgeOfEvent { |
||||
return fmt.Errorf("max_age_of_event_override for kind %d must be >= owner's limit (%d)", kind, *ownerRule.MaxAgeOfEvent) |
||||
} |
||||
} |
||||
|
||||
// Validate pubkey formats in allow/deny lists
|
||||
for _, pk := range ext.WriteAllowAdd { |
||||
if len(pk) != 64 { |
||||
return fmt.Errorf("invalid pubkey in write_allow_add for kind %d: %q", kind, pk) |
||||
} |
||||
} |
||||
for _, pk := range ext.WriteDenyAdd { |
||||
if len(pk) != 64 { |
||||
return fmt.Errorf("invalid pubkey in write_deny_add for kind %d: %q", kind, pk) |
||||
} |
||||
} |
||||
for _, pk := range ext.ReadAllowAdd { |
||||
if len(pk) != 64 { |
||||
return fmt.Errorf("invalid pubkey in read_allow_add for kind %d: %q", kind, pk) |
||||
} |
||||
} |
||||
for _, pk := range ext.ReadDenyAdd { |
||||
if len(pk) != 64 { |
||||
return fmt.Errorf("invalid pubkey in read_deny_add for kind %d: %q", kind, pk) |
||||
} |
||||
} |
||||
} |
||||
|
||||
// Validate rules_add are for kinds not already defined by owner
|
||||
for kind := range contribution.RulesAdd { |
||||
if _, exists := ownerPolicy.rules[kind]; exists { |
||||
return fmt.Errorf("cannot add rule for kind %d: already defined in owner policy (use rules_extend instead)", kind) |
||||
} |
||||
} |
||||
|
||||
return nil |
||||
} |
||||
|
||||
// =============================================================================
|
||||
// Policy Composition Logic
|
||||
// =============================================================================
|
||||
|
||||
// NewComposedPolicy creates a new composed policy from an owner policy.
|
||||
func NewComposedPolicy(ownerPolicy *P, configDir string) *ComposedPolicy { |
||||
return &ComposedPolicy{ |
||||
OwnerPolicy: ownerPolicy, |
||||
Contributions: make(map[string]*PolicyAdminContribution), |
||||
configDir: configDir, |
||||
} |
||||
} |
||||
|
||||
// AddContribution adds a policy admin contribution.
|
||||
// Returns error if validation fails.
|
||||
func (cp *ComposedPolicy) AddContribution(contribution *PolicyAdminContribution) error { |
||||
cp.contributionsMx.Lock() |
||||
defer cp.contributionsMx.Unlock() |
||||
|
||||
// Validate the contribution
|
||||
if err := ValidatePolicyAdminContribution(cp.OwnerPolicy, contribution, cp.Contributions); err != nil { |
||||
return err |
||||
} |
||||
|
||||
// Store the contribution
|
||||
cp.Contributions[contribution.EventID] = contribution |
||||
|
||||
// Persist to disk
|
||||
if err := cp.saveContribution(contribution); err != nil { |
||||
log.W.F("failed to persist contribution: %v", err) |
||||
} |
||||
|
||||
return nil |
||||
} |
||||
|
||||
// RemoveContribution removes a policy admin contribution by event ID.
|
||||
func (cp *ComposedPolicy) RemoveContribution(eventID string) { |
||||
cp.contributionsMx.Lock() |
||||
defer cp.contributionsMx.Unlock() |
||||
|
||||
delete(cp.Contributions, eventID) |
||||
|
||||
// Remove from disk
|
||||
if cp.configDir != "" { |
||||
contribPath := filepath.Join(cp.configDir, "policy-contributions", eventID+".json") |
||||
os.Remove(contribPath) |
||||
} |
||||
} |
||||
|
||||
// GetEffectivePolicy computes the merged effective policy.
|
||||
// Composition rules:
|
||||
// - Whitelists are unioned (OR)
|
||||
// - Blacklists are unioned and override whitelists
|
||||
// - Limits use the most permissive value
|
||||
// - Conflicts between PAs: oldest created_at wins (except deny always wins)
|
||||
func (cp *ComposedPolicy) GetEffectivePolicy() *P { |
||||
cp.contributionsMx.RLock() |
||||
defer cp.contributionsMx.RUnlock() |
||||
|
||||
// Clone the owner policy as base
|
||||
effective := cp.cloneOwnerPolicy() |
||||
|
||||
// Sort contributions by created_at (oldest first for conflict resolution)
|
||||
sorted := cp.getSortedContributions() |
||||
|
||||
// Apply each contribution
|
||||
for _, contrib := range sorted { |
||||
cp.applyContribution(effective, contrib) |
||||
} |
||||
|
||||
// Repopulate binary caches
|
||||
effective.Global.populateBinaryCache() |
||||
for kind := range effective.rules { |
||||
rule := effective.rules[kind] |
||||
rule.populateBinaryCache() |
||||
effective.rules[kind] = rule |
||||
} |
||||
|
||||
return effective |
||||
} |
||||
|
||||
// cloneOwnerPolicy creates a deep copy of the owner policy.
|
||||
func (cp *ComposedPolicy) cloneOwnerPolicy() *P { |
||||
// Marshal and unmarshal to create a deep copy
|
||||
data, _ := json.Marshal(cp.OwnerPolicy) |
||||
var cloned P |
||||
json.Unmarshal(data, &cloned) |
||||
|
||||
// Copy the manager reference (not cloned)
|
||||
cloned.manager = cp.OwnerPolicy.manager |
||||
|
||||
return &cloned |
||||
} |
||||
|
||||
// getSortedContributions returns contributions sorted by created_at.
|
||||
func (cp *ComposedPolicy) getSortedContributions() []*PolicyAdminContribution { |
||||
sorted := make([]*PolicyAdminContribution, 0, len(cp.Contributions)) |
||||
for _, contrib := range cp.Contributions { |
||||
sorted = append(sorted, contrib) |
||||
} |
||||
sort.Slice(sorted, func(i, j int) bool { |
||||
return sorted[i].CreatedAt < sorted[j].CreatedAt |
||||
}) |
||||
return sorted |
||||
} |
||||
|
||||
// applyContribution applies a single contribution to the effective policy.
|
||||
func (cp *ComposedPolicy) applyContribution(effective *P, contrib *PolicyAdminContribution) { |
||||
// Apply kind whitelist additions (OR)
|
||||
for _, kind := range contrib.KindWhitelistAdd { |
||||
if !containsInt(effective.Kind.Whitelist, kind) { |
||||
effective.Kind.Whitelist = append(effective.Kind.Whitelist, kind) |
||||
} |
||||
} |
||||
|
||||
// Apply kind blacklist additions (OR, overrides whitelist)
|
||||
for _, kind := range contrib.KindBlacklistAdd { |
||||
if !containsInt(effective.Kind.Blacklist, kind) { |
||||
effective.Kind.Blacklist = append(effective.Kind.Blacklist, kind) |
||||
} |
||||
} |
||||
|
||||
// Apply rule extensions
|
||||
for kind, ext := range contrib.RulesExtend { |
||||
if rule, exists := effective.rules[kind]; exists { |
||||
cp.applyRuleExtension(&rule, &ext, contrib.CreatedAt) |
||||
effective.rules[kind] = rule |
||||
} |
||||
} |
||||
|
||||
// Apply new rules
|
||||
for kind, rule := range contrib.RulesAdd { |
||||
if _, exists := effective.rules[kind]; !exists { |
||||
if effective.rules == nil { |
||||
effective.rules = make(map[int]Rule) |
||||
} |
||||
effective.rules[kind] = rule |
||||
} |
||||
} |
||||
|
||||
// Apply global rule extension
|
||||
if contrib.GlobalExtend != nil { |
||||
cp.applyRuleExtension(&effective.Global, contrib.GlobalExtend, contrib.CreatedAt) |
||||
} |
||||
} |
||||
|
||||
// applyRuleExtension applies a rule extension to an existing rule.
|
||||
func (cp *ComposedPolicy) applyRuleExtension(rule *Rule, ext *RuleExtension, _ int64) { |
||||
// Add to allow lists (OR)
|
||||
for _, pk := range ext.WriteAllowAdd { |
||||
if !containsString(rule.WriteAllow, pk) { |
||||
rule.WriteAllow = append(rule.WriteAllow, pk) |
||||
} |
||||
} |
||||
for _, pk := range ext.ReadAllowAdd { |
||||
if !containsString(rule.ReadAllow, pk) { |
||||
rule.ReadAllow = append(rule.ReadAllow, pk) |
||||
} |
||||
} |
||||
|
||||
// Add to deny lists (OR, overrides allow) - deny always wins
|
||||
for _, pk := range ext.WriteDenyAdd { |
||||
if !containsString(rule.WriteDeny, pk) { |
||||
rule.WriteDeny = append(rule.WriteDeny, pk) |
||||
} |
||||
} |
||||
for _, pk := range ext.ReadDenyAdd { |
||||
if !containsString(rule.ReadDeny, pk) { |
||||
rule.ReadDeny = append(rule.ReadDeny, pk) |
||||
} |
||||
} |
||||
|
||||
// Apply limit overrides (most permissive wins)
|
||||
if ext.SizeLimitOverride != nil { |
||||
if rule.SizeLimit == nil || *ext.SizeLimitOverride > *rule.SizeLimit { |
||||
rule.SizeLimit = ext.SizeLimitOverride |
||||
} |
||||
} |
||||
if ext.ContentLimitOverride != nil { |
||||
if rule.ContentLimit == nil || *ext.ContentLimitOverride > *rule.ContentLimit { |
||||
rule.ContentLimit = ext.ContentLimitOverride |
||||
} |
||||
} |
||||
if ext.MaxAgeOfEventOverride != nil { |
||||
if rule.MaxAgeOfEvent == nil || *ext.MaxAgeOfEventOverride > *rule.MaxAgeOfEvent { |
||||
rule.MaxAgeOfEvent = ext.MaxAgeOfEventOverride |
||||
} |
||||
} |
||||
if ext.MaxAgeEventInFutureOverride != nil { |
||||
if rule.MaxAgeEventInFuture == nil || *ext.MaxAgeEventInFutureOverride > *rule.MaxAgeEventInFuture { |
||||
rule.MaxAgeEventInFuture = ext.MaxAgeEventInFutureOverride |
||||
} |
||||
} |
||||
|
||||
// Enable WriteAllowFollows if requested (OR logic)
|
||||
if ext.WriteAllowFollows != nil && *ext.WriteAllowFollows { |
||||
rule.WriteAllowFollows = true |
||||
} |
||||
|
||||
// Add to follows whitelist admins
|
||||
for _, pk := range ext.FollowsWhitelistAdminsAdd { |
||||
if !containsString(rule.FollowsWhitelistAdmins, pk) { |
||||
rule.FollowsWhitelistAdmins = append(rule.FollowsWhitelistAdmins, pk) |
||||
} |
||||
} |
||||
} |
||||
|
||||
// =============================================================================
|
||||
// Persistence
|
||||
// =============================================================================
|
||||
|
||||
// saveContribution persists a contribution to disk.
|
||||
func (cp *ComposedPolicy) saveContribution(contrib *PolicyAdminContribution) error { |
||||
if cp.configDir == "" { |
||||
return nil |
||||
} |
||||
|
||||
contribDir := filepath.Join(cp.configDir, "policy-contributions") |
||||
if err := os.MkdirAll(contribDir, 0755); err != nil { |
||||
return err |
||||
} |
||||
|
||||
contribPath := filepath.Join(contribDir, contrib.EventID+".json") |
||||
data, err := json.MarshalIndent(contrib, "", " ") |
||||
if err != nil { |
||||
return err |
||||
} |
||||
|
||||
return os.WriteFile(contribPath, data, 0644) |
||||
} |
||||
|
||||
// LoadContributions loads all contributions from disk.
|
||||
func (cp *ComposedPolicy) LoadContributions() error { |
||||
if cp.configDir == "" { |
||||
return nil |
||||
} |
||||
|
||||
contribDir := filepath.Join(cp.configDir, "policy-contributions") |
||||
if _, err := os.Stat(contribDir); os.IsNotExist(err) { |
||||
return nil // No contributions yet
|
||||
} |
||||
|
||||
entries, err := os.ReadDir(contribDir) |
||||
if err != nil { |
||||
return err |
||||
} |
||||
|
||||
cp.contributionsMx.Lock() |
||||
defer cp.contributionsMx.Unlock() |
||||
|
||||
for _, entry := range entries { |
||||
if entry.IsDir() || filepath.Ext(entry.Name()) != ".json" { |
||||
continue |
||||
} |
||||
|
||||
contribPath := filepath.Join(contribDir, entry.Name()) |
||||
data, err := os.ReadFile(contribPath) |
||||
if err != nil { |
||||
log.W.F("failed to read contribution %s: %v", entry.Name(), err) |
||||
continue |
||||
} |
||||
|
||||
var contrib PolicyAdminContribution |
||||
if err := json.Unmarshal(data, &contrib); err != nil { |
||||
log.W.F("failed to parse contribution %s: %v", entry.Name(), err) |
||||
continue |
||||
} |
||||
|
||||
// Validate against current owner policy
|
||||
if err := ValidatePolicyAdminContribution(cp.OwnerPolicy, &contrib, cp.Contributions); err != nil { |
||||
log.W.F("contribution %s is no longer valid: %v (skipping)", entry.Name(), err) |
||||
continue |
||||
} |
||||
|
||||
cp.Contributions[contrib.EventID] = &contrib |
||||
} |
||||
|
||||
log.I.F("loaded %d policy admin contributions", len(cp.Contributions)) |
||||
return nil |
||||
} |
||||
|
||||
// =============================================================================
|
||||
// Owner Detection
|
||||
// =============================================================================
|
||||
|
||||
// IsOwner checks if the given pubkey is an owner.
|
||||
// The pubkey parameter should be binary ([]byte), not hex-encoded.
|
||||
func (p *P) IsOwner(pubkey []byte) bool { |
||||
if len(pubkey) == 0 { |
||||
return false |
||||
} |
||||
|
||||
p.policyFollowsMx.RLock() |
||||
defer p.policyFollowsMx.RUnlock() |
||||
|
||||
for _, owner := range p.ownersBin { |
||||
if utils.FastEqual(owner, pubkey) { |
||||
return true |
||||
} |
||||
} |
||||
return false |
||||
} |
||||
|
||||
// IsOwnerOrPolicyAdmin checks if the given pubkey is an owner or policy admin.
|
||||
// The pubkey parameter should be binary ([]byte), not hex-encoded.
|
||||
func (p *P) IsOwnerOrPolicyAdmin(pubkey []byte) bool { |
||||
return p.IsOwner(pubkey) || p.IsPolicyAdmin(pubkey) |
||||
} |
||||
|
||||
// =============================================================================
|
||||
// Helper Functions
|
||||
// =============================================================================
|
||||
|
||||
func containsInt(slice []int, val int) bool { |
||||
for _, v := range slice { |
||||
if v == val { |
||||
return true |
||||
} |
||||
} |
||||
return false |
||||
} |
||||
|
||||
func containsString(slice []string, val string) bool { |
||||
for _, v := range slice { |
||||
if v == val { |
||||
return true |
||||
} |
||||
} |
||||
return false |
||||
} |
||||
@ -0,0 +1,690 @@
@@ -0,0 +1,690 @@
|
||||
package policy |
||||
|
||||
import ( |
||||
"encoding/json" |
||||
"testing" |
||||
) |
||||
|
||||
// TestValidateOwnerPolicyUpdate tests owner-specific validation
|
||||
func TestValidateOwnerPolicyUpdate(t *testing.T) { |
||||
// Create a base policy
|
||||
basePolicy := &P{ |
||||
DefaultPolicy: "allow", |
||||
Owners: []string{"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}, |
||||
PolicyAdmins: []string{"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}, |
||||
} |
||||
|
||||
tests := []struct { |
||||
name string |
||||
newPolicy string |
||||
expectError bool |
||||
errorMsg string |
||||
}{ |
||||
{ |
||||
name: "valid owner update with non-empty owners", |
||||
newPolicy: `{ |
||||
"default_policy": "deny", |
||||
"owners": ["cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"], |
||||
"policy_admins": ["dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"] |
||||
}`, |
||||
expectError: false, |
||||
}, |
||||
{ |
||||
name: "invalid - empty owners list", |
||||
newPolicy: `{ |
||||
"default_policy": "deny", |
||||
"owners": [], |
||||
"policy_admins": ["dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"] |
||||
}`, |
||||
expectError: true, |
||||
errorMsg: "owners list cannot be empty", |
||||
}, |
||||
{ |
||||
name: "invalid - missing owners field", |
||||
newPolicy: `{ |
||||
"default_policy": "deny", |
||||
"policy_admins": ["dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"] |
||||
}`, |
||||
expectError: true, |
||||
errorMsg: "owners list cannot be empty", |
||||
}, |
||||
{ |
||||
name: "invalid - bad owner pubkey format", |
||||
newPolicy: `{ |
||||
"default_policy": "deny", |
||||
"owners": ["not-a-valid-pubkey"] |
||||
}`, |
||||
expectError: true, |
||||
errorMsg: "invalid owner pubkey", |
||||
}, |
||||
{ |
||||
name: "valid - owner can add multiple owners", |
||||
newPolicy: `{ |
||||
"default_policy": "deny", |
||||
"owners": [ |
||||
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", |
||||
"cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc" |
||||
] |
||||
}`, |
||||
expectError: false, |
||||
}, |
||||
} |
||||
|
||||
for _, tt := range tests { |
||||
t.Run(tt.name, func(t *testing.T) { |
||||
err := basePolicy.ValidateOwnerPolicyUpdate([]byte(tt.newPolicy)) |
||||
if tt.expectError { |
||||
if err == nil { |
||||
t.Errorf("expected error containing %q, got nil", tt.errorMsg) |
||||
} else if tt.errorMsg != "" && !containsSubstring(err.Error(), tt.errorMsg) { |
||||
t.Errorf("expected error containing %q, got %q", tt.errorMsg, err.Error()) |
||||
} |
||||
} else { |
||||
if err != nil { |
||||
t.Errorf("unexpected error: %v", err) |
||||
} |
||||
} |
||||
}) |
||||
} |
||||
} |
||||
|
||||
// TestValidatePolicyAdminUpdate tests policy admin validation
|
||||
func TestValidatePolicyAdminUpdate(t *testing.T) { |
||||
// Create a base policy with known owners and admins
|
||||
ownerPubkey := "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" |
||||
adminPubkey := "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" |
||||
allowedPubkey := "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc" |
||||
|
||||
baseJSON := `{ |
||||
"default_policy": "allow", |
||||
"owners": ["` + ownerPubkey + `"], |
||||
"policy_admins": ["` + adminPubkey + `"], |
||||
"kind": { |
||||
"whitelist": [1, 3, 7] |
||||
}, |
||||
"rules": { |
||||
"1": { |
||||
"description": "Text notes", |
||||
"write_allow": ["` + allowedPubkey + `"], |
||||
"size_limit": 10000 |
||||
} |
||||
} |
||||
}` |
||||
|
||||
basePolicy := &P{} |
||||
if err := json.Unmarshal([]byte(baseJSON), basePolicy); err != nil { |
||||
t.Fatalf("failed to create base policy: %v", err) |
||||
} |
||||
|
||||
adminPubkeyBin := make([]byte, 32) |
||||
for i := range adminPubkeyBin { |
||||
adminPubkeyBin[i] = 0xbb |
||||
} |
||||
|
||||
tests := []struct { |
||||
name string |
||||
newPolicy string |
||||
expectError bool |
||||
errorMsg string |
||||
}{ |
||||
{ |
||||
name: "valid - policy admin can extend write_allow", |
||||
newPolicy: `{ |
||||
"default_policy": "allow", |
||||
"owners": ["` + ownerPubkey + `"], |
||||
"policy_admins": ["` + adminPubkey + `"], |
||||
"kind": { |
||||
"whitelist": [1, 3, 7] |
||||
}, |
||||
"rules": { |
||||
"1": { |
||||
"description": "Text notes", |
||||
"write_allow": ["` + allowedPubkey + `", "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"], |
||||
"size_limit": 10000 |
||||
} |
||||
} |
||||
}`, |
||||
expectError: false, |
||||
}, |
||||
{ |
||||
name: "valid - policy admin can add to kind whitelist", |
||||
newPolicy: `{ |
||||
"default_policy": "allow", |
||||
"owners": ["` + ownerPubkey + `"], |
||||
"policy_admins": ["` + adminPubkey + `"], |
||||
"kind": { |
||||
"whitelist": [1, 3, 7, 30023] |
||||
}, |
||||
"rules": { |
||||
"1": { |
||||
"description": "Text notes", |
||||
"write_allow": ["` + allowedPubkey + `"], |
||||
"size_limit": 10000 |
||||
} |
||||
} |
||||
}`, |
||||
expectError: false, |
||||
}, |
||||
{ |
||||
name: "valid - policy admin can increase size limit", |
||||
newPolicy: `{ |
||||
"default_policy": "allow", |
||||
"owners": ["` + ownerPubkey + `"], |
||||
"policy_admins": ["` + adminPubkey + `"], |
||||
"kind": { |
||||
"whitelist": [1, 3, 7] |
||||
}, |
||||
"rules": { |
||||
"1": { |
||||
"description": "Text notes", |
||||
"write_allow": ["` + allowedPubkey + `"], |
||||
"size_limit": 20000 |
||||
} |
||||
} |
||||
}`, |
||||
expectError: false, |
||||
}, |
||||
{ |
||||
name: "invalid - policy admin cannot modify owners", |
||||
newPolicy: `{ |
||||
"default_policy": "allow", |
||||
"owners": ["dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"], |
||||
"policy_admins": ["` + adminPubkey + `"], |
||||
"kind": { |
||||
"whitelist": [1, 3, 7] |
||||
}, |
||||
"rules": { |
||||
"1": { |
||||
"description": "Text notes", |
||||
"write_allow": ["` + allowedPubkey + `"], |
||||
"size_limit": 10000 |
||||
} |
||||
} |
||||
}`, |
||||
expectError: true, |
||||
errorMsg: "cannot modify the 'owners' field", |
||||
}, |
||||
{ |
||||
name: "invalid - policy admin cannot modify policy_admins", |
||||
newPolicy: `{ |
||||
"default_policy": "allow", |
||||
"owners": ["` + ownerPubkey + `"], |
||||
"policy_admins": ["dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"], |
||||
"kind": { |
||||
"whitelist": [1, 3, 7] |
||||
}, |
||||
"rules": { |
||||
"1": { |
||||
"description": "Text notes", |
||||
"write_allow": ["` + allowedPubkey + `"], |
||||
"size_limit": 10000 |
||||
} |
||||
} |
||||
}`, |
||||
expectError: true, |
||||
errorMsg: "cannot modify the 'policy_admins' field", |
||||
}, |
||||
{ |
||||
name: "invalid - policy admin cannot remove from kind whitelist", |
||||
newPolicy: `{ |
||||
"default_policy": "allow", |
||||
"owners": ["` + ownerPubkey + `"], |
||||
"policy_admins": ["` + adminPubkey + `"], |
||||
"kind": { |
||||
"whitelist": [1, 3] |
||||
}, |
||||
"rules": { |
||||
"1": { |
||||
"description": "Text notes", |
||||
"write_allow": ["` + allowedPubkey + `"], |
||||
"size_limit": 10000 |
||||
} |
||||
} |
||||
}`, |
||||
expectError: true, |
||||
errorMsg: "cannot remove kind 7 from whitelist", |
||||
}, |
||||
{ |
||||
name: "invalid - policy admin cannot remove from write_allow", |
||||
newPolicy: `{ |
||||
"default_policy": "allow", |
||||
"owners": ["` + ownerPubkey + `"], |
||||
"policy_admins": ["` + adminPubkey + `"], |
||||
"kind": { |
||||
"whitelist": [1, 3, 7] |
||||
}, |
||||
"rules": { |
||||
"1": { |
||||
"description": "Text notes", |
||||
"write_allow": [], |
||||
"size_limit": 10000 |
||||
} |
||||
} |
||||
}`, |
||||
expectError: true, |
||||
errorMsg: "cannot remove pubkey", |
||||
}, |
||||
{ |
||||
name: "invalid - policy admin cannot reduce size limit", |
||||
newPolicy: `{ |
||||
"default_policy": "allow", |
||||
"owners": ["` + ownerPubkey + `"], |
||||
"policy_admins": ["` + adminPubkey + `"], |
||||
"kind": { |
||||
"whitelist": [1, 3, 7] |
||||
}, |
||||
"rules": { |
||||
"1": { |
||||
"description": "Text notes", |
||||
"write_allow": ["` + allowedPubkey + `"], |
||||
"size_limit": 5000 |
||||
} |
||||
} |
||||
}`, |
||||
expectError: true, |
||||
errorMsg: "cannot reduce size_limit", |
||||
}, |
||||
{ |
||||
name: "invalid - policy admin cannot remove rule", |
||||
newPolicy: `{ |
||||
"default_policy": "allow", |
||||
"owners": ["` + ownerPubkey + `"], |
||||
"policy_admins": ["` + adminPubkey + `"], |
||||
"kind": { |
||||
"whitelist": [1, 3, 7] |
||||
}, |
||||
"rules": {} |
||||
}`, |
||||
expectError: true, |
||||
errorMsg: "cannot remove rule for kind 1", |
||||
}, |
||||
{ |
||||
name: "valid - policy admin can add blacklist entries for non-admin users", |
||||
newPolicy: `{ |
||||
"default_policy": "allow", |
||||
"owners": ["` + ownerPubkey + `"], |
||||
"policy_admins": ["` + adminPubkey + `"], |
||||
"kind": { |
||||
"whitelist": [1, 3, 7], |
||||
"blacklist": [4] |
||||
}, |
||||
"rules": { |
||||
"1": { |
||||
"description": "Text notes", |
||||
"write_allow": ["` + allowedPubkey + `"], |
||||
"write_deny": ["eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee"], |
||||
"size_limit": 10000 |
||||
} |
||||
} |
||||
}`, |
||||
expectError: false, |
||||
}, |
||||
{ |
||||
name: "invalid - policy admin cannot blacklist owner in write_deny", |
||||
newPolicy: `{ |
||||
"default_policy": "allow", |
||||
"owners": ["` + ownerPubkey + `"], |
||||
"policy_admins": ["` + adminPubkey + `"], |
||||
"kind": { |
||||
"whitelist": [1, 3, 7] |
||||
}, |
||||
"rules": { |
||||
"1": { |
||||
"description": "Text notes", |
||||
"write_allow": ["` + allowedPubkey + `"], |
||||
"write_deny": ["` + ownerPubkey + `"], |
||||
"size_limit": 10000 |
||||
} |
||||
} |
||||
}`, |
||||
expectError: true, |
||||
errorMsg: "cannot blacklist owner", |
||||
}, |
||||
{ |
||||
name: "invalid - policy admin cannot blacklist other policy admin", |
||||
newPolicy: `{ |
||||
"default_policy": "allow", |
||||
"owners": ["` + ownerPubkey + `"], |
||||
"policy_admins": ["` + adminPubkey + `"], |
||||
"kind": { |
||||
"whitelist": [1, 3, 7] |
||||
}, |
||||
"rules": { |
||||
"1": { |
||||
"description": "Text notes", |
||||
"write_allow": ["` + allowedPubkey + `"], |
||||
"write_deny": ["` + adminPubkey + `"], |
||||
"size_limit": 10000 |
||||
} |
||||
} |
||||
}`, |
||||
expectError: true, |
||||
errorMsg: "cannot blacklist policy admin", |
||||
}, |
||||
{ |
||||
name: "valid - policy admin can blacklist whitelisted non-admin user", |
||||
newPolicy: `{ |
||||
"default_policy": "allow", |
||||
"owners": ["` + ownerPubkey + `"], |
||||
"policy_admins": ["` + adminPubkey + `"], |
||||
"kind": { |
||||
"whitelist": [1, 3, 7] |
||||
}, |
||||
"rules": { |
||||
"1": { |
||||
"description": "Text notes", |
||||
"write_allow": ["` + allowedPubkey + `"], |
||||
"write_deny": ["` + allowedPubkey + `"], |
||||
"size_limit": 10000 |
||||
} |
||||
} |
||||
}`, |
||||
expectError: false, |
||||
}, |
||||
} |
||||
|
||||
for _, tt := range tests { |
||||
t.Run(tt.name, func(t *testing.T) { |
||||
err := basePolicy.ValidatePolicyAdminUpdate([]byte(tt.newPolicy), adminPubkeyBin) |
||||
if tt.expectError { |
||||
if err == nil { |
||||
t.Errorf("expected error containing %q, got nil", tt.errorMsg) |
||||
} else if tt.errorMsg != "" && !containsSubstring(err.Error(), tt.errorMsg) { |
||||
t.Errorf("expected error containing %q, got %q", tt.errorMsg, err.Error()) |
||||
} |
||||
} else { |
||||
if err != nil { |
||||
t.Errorf("unexpected error: %v", err) |
||||
} |
||||
} |
||||
}) |
||||
} |
||||
} |
||||
|
||||
// TestIsOwner tests the IsOwner method
|
||||
func TestIsOwner(t *testing.T) { |
||||
ownerPubkey := "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" |
||||
nonOwnerPubkey := "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" |
||||
|
||||
_ = nonOwnerPubkey // Silence unused variable warning
|
||||
|
||||
policyJSON := `{ |
||||
"default_policy": "allow", |
||||
"owners": ["` + ownerPubkey + `"] |
||||
}` |
||||
|
||||
policy, err := New([]byte(policyJSON)) |
||||
if err != nil { |
||||
t.Fatalf("failed to create policy: %v", err) |
||||
} |
||||
|
||||
// Create binary pubkeys
|
||||
ownerBin := make([]byte, 32) |
||||
for i := range ownerBin { |
||||
ownerBin[i] = 0xaa |
||||
} |
||||
|
||||
nonOwnerBin := make([]byte, 32) |
||||
for i := range nonOwnerBin { |
||||
nonOwnerBin[i] = 0xbb |
||||
} |
||||
|
||||
tests := []struct { |
||||
name string |
||||
pubkey []byte |
||||
expected bool |
||||
}{ |
||||
{ |
||||
name: "owner is recognized", |
||||
pubkey: ownerBin, |
||||
expected: true, |
||||
}, |
||||
{ |
||||
name: "non-owner is not recognized", |
||||
pubkey: nonOwnerBin, |
||||
expected: false, |
||||
}, |
||||
{ |
||||
name: "nil pubkey returns false", |
||||
pubkey: nil, |
||||
expected: false, |
||||
}, |
||||
{ |
||||
name: "empty pubkey returns false", |
||||
pubkey: []byte{}, |
||||
expected: false, |
||||
}, |
||||
} |
||||
|
||||
for _, tt := range tests { |
||||
t.Run(tt.name, func(t *testing.T) { |
||||
result := policy.IsOwner(tt.pubkey) |
||||
if result != tt.expected { |
||||
t.Errorf("expected %v, got %v", tt.expected, result) |
||||
} |
||||
}) |
||||
} |
||||
} |
||||
|
||||
// TestStringSliceEqual tests the helper function
|
||||
func TestStringSliceEqual(t *testing.T) { |
||||
tests := []struct { |
||||
name string |
||||
a []string |
||||
b []string |
||||
expected bool |
||||
}{ |
||||
{ |
||||
name: "equal slices same order", |
||||
a: []string{"a", "b", "c"}, |
||||
b: []string{"a", "b", "c"}, |
||||
expected: true, |
||||
}, |
||||
{ |
||||
name: "equal slices different order", |
||||
a: []string{"a", "b", "c"}, |
||||
b: []string{"c", "a", "b"}, |
||||
expected: true, |
||||
}, |
||||
{ |
||||
name: "different lengths", |
||||
a: []string{"a", "b"}, |
||||
b: []string{"a", "b", "c"}, |
||||
expected: false, |
||||
}, |
||||
{ |
||||
name: "different contents", |
||||
a: []string{"a", "b", "c"}, |
||||
b: []string{"a", "b", "d"}, |
||||
expected: false, |
||||
}, |
||||
{ |
||||
name: "empty slices", |
||||
a: []string{}, |
||||
b: []string{}, |
||||
expected: true, |
||||
}, |
||||
{ |
||||
name: "nil slices", |
||||
a: nil, |
||||
b: nil, |
||||
expected: true, |
||||
}, |
||||
{ |
||||
name: "nil vs empty", |
||||
a: nil, |
||||
b: []string{}, |
||||
expected: true, |
||||
}, |
||||
{ |
||||
name: "duplicates in both", |
||||
a: []string{"a", "a", "b"}, |
||||
b: []string{"a", "b", "a"}, |
||||
expected: true, |
||||
}, |
||||
} |
||||
|
||||
for _, tt := range tests { |
||||
t.Run(tt.name, func(t *testing.T) { |
||||
result := stringSliceEqual(tt.a, tt.b) |
||||
if result != tt.expected { |
||||
t.Errorf("expected %v, got %v", tt.expected, result) |
||||
} |
||||
}) |
||||
} |
||||
} |
||||
|
||||
// TestPolicyAdminContributionValidation tests the contribution validation
|
||||
func TestPolicyAdminContributionValidation(t *testing.T) { |
||||
ownerPubkey := "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" |
||||
adminPubkey := "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" |
||||
|
||||
ownerPolicy := &P{ |
||||
DefaultPolicy: "allow", |
||||
Owners: []string{ownerPubkey}, |
||||
PolicyAdmins: []string{adminPubkey}, |
||||
Kind: Kinds{ |
||||
Whitelist: []int{1, 3, 7}, |
||||
}, |
||||
rules: map[int]Rule{ |
||||
1: { |
||||
Description: "Text notes", |
||||
SizeLimit: ptr(int64(10000)), |
||||
}, |
||||
}, |
||||
} |
||||
|
||||
tests := []struct { |
||||
name string |
||||
contribution *PolicyAdminContribution |
||||
expectError bool |
||||
errorMsg string |
||||
}{ |
||||
{ |
||||
name: "valid - add kinds to whitelist", |
||||
contribution: &PolicyAdminContribution{ |
||||
AdminPubkey: adminPubkey, |
||||
CreatedAt: 1234567890, |
||||
EventID: "event123", |
||||
KindWhitelistAdd: []int{30023}, |
||||
}, |
||||
expectError: false, |
||||
}, |
||||
{ |
||||
name: "valid - add to blacklist", |
||||
contribution: &PolicyAdminContribution{ |
||||
AdminPubkey: adminPubkey, |
||||
CreatedAt: 1234567890, |
||||
EventID: "event123", |
||||
KindBlacklistAdd: []int{4}, |
||||
}, |
||||
expectError: false, |
||||
}, |
||||
{ |
||||
name: "valid - extend existing rule with larger limit", |
||||
contribution: &PolicyAdminContribution{ |
||||
AdminPubkey: adminPubkey, |
||||
CreatedAt: 1234567890, |
||||
EventID: "event123", |
||||
RulesExtend: map[int]RuleExtension{ |
||||
1: { |
||||
SizeLimitOverride: ptr(int64(20000)), |
||||
}, |
||||
}, |
||||
}, |
||||
expectError: false, |
||||
}, |
||||
{ |
||||
name: "invalid - extend non-existent rule", |
||||
contribution: &PolicyAdminContribution{ |
||||
AdminPubkey: adminPubkey, |
||||
CreatedAt: 1234567890, |
||||
EventID: "event123", |
||||
RulesExtend: map[int]RuleExtension{ |
||||
999: { |
||||
SizeLimitOverride: ptr(int64(20000)), |
||||
}, |
||||
}, |
||||
}, |
||||
expectError: true, |
||||
errorMsg: "cannot extend rule for kind 999", |
||||
}, |
||||
{ |
||||
name: "invalid - size limit override smaller than owner's", |
||||
contribution: &PolicyAdminContribution{ |
||||
AdminPubkey: adminPubkey, |
||||
CreatedAt: 1234567890, |
||||
EventID: "event123", |
||||
RulesExtend: map[int]RuleExtension{ |
||||
1: { |
||||
SizeLimitOverride: ptr(int64(5000)), |
||||
}, |
||||
}, |
||||
}, |
||||
expectError: true, |
||||
errorMsg: "size_limit_override for kind 1 must be >=", |
||||
}, |
||||
{ |
||||
name: "valid - add new rule for undefined kind", |
||||
contribution: &PolicyAdminContribution{ |
||||
AdminPubkey: adminPubkey, |
||||
CreatedAt: 1234567890, |
||||
EventID: "event123", |
||||
RulesAdd: map[int]Rule{ |
||||
30023: { |
||||
Description: "Long-form content", |
||||
SizeLimit: ptr(int64(100000)), |
||||
}, |
||||
}, |
||||
}, |
||||
expectError: false, |
||||
}, |
||||
{ |
||||
name: "invalid - add rule for already-defined kind", |
||||
contribution: &PolicyAdminContribution{ |
||||
AdminPubkey: adminPubkey, |
||||
CreatedAt: 1234567890, |
||||
EventID: "event123", |
||||
RulesAdd: map[int]Rule{ |
||||
1: { |
||||
Description: "Trying to override", |
||||
}, |
||||
}, |
||||
}, |
||||
expectError: true, |
||||
errorMsg: "cannot add rule for kind 1: already defined", |
||||
}, |
||||
{ |
||||
name: "invalid - bad pubkey length in extension", |
||||
contribution: &PolicyAdminContribution{ |
||||
AdminPubkey: "short", |
||||
CreatedAt: 1234567890, |
||||
EventID: "event123", |
||||
}, |
||||
expectError: true, |
||||
errorMsg: "invalid admin pubkey length", |
||||
}, |
||||
} |
||||
|
||||
for _, tt := range tests { |
||||
t.Run(tt.name, func(t *testing.T) { |
||||
err := ValidatePolicyAdminContribution(ownerPolicy, tt.contribution, nil) |
||||
if tt.expectError { |
||||
if err == nil { |
||||
t.Errorf("expected error containing %q, got nil", tt.errorMsg) |
||||
} else if tt.errorMsg != "" && !containsSubstring(err.Error(), tt.errorMsg) { |
||||
t.Errorf("expected error containing %q, got %q", tt.errorMsg, err.Error()) |
||||
} |
||||
} else { |
||||
if err != nil { |
||||
t.Errorf("unexpected error: %v", err) |
||||
} |
||||
} |
||||
}) |
||||
} |
||||
} |
||||
|
||||
// Helper function for generic pointer
|
||||
func ptr[T any](v T) *T { |
||||
return &v |
||||
} |
||||
Loading…
Reference in new issue