-
Notifications
You must be signed in to change notification settings - Fork 4.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
change capabilities logic for sudo prefixes #5647
Conversation
…ties prefix logic
}) | ||
); | ||
assert.ok(model.get('canRead')); | ||
assert.notOk(model.get('canCreate'), 'sudo requires the capability to be set as well'); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think this doesn't have to do with sudo, just that create
wasn't in the capabilities list.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
it's in every test so I just left it
assert.ok(model.get('canUpdate'), 'should not require sudo if it has update'); | ||
assert.notOk(model.get('canDelete')); | ||
assert.notOk(model.get('canList')); | ||
}); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can we add another test for the paths in the SUDO_PREFIX arg too to make sure they are requiring sudo?
So for path: 'sys/leases/revoke-prefix/aws'
with capabilities "update", canUpdate
should be false, but with "update", "sudo", canUpdate
should be true.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I added a couple. Do they look right?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yassss - perfect!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Woot, nice! I think it'd be good to cover the other case too (where we want to require sudo because the API does). Hopefully all this can be simplified in the future with OpenAPI though 🤞.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Awesome! 👍
specifically for sys/leases/revoke with update capability