Implement ACLs

test/test_db.py

@@ -2,18 +2,21 @@ import pytest
 
 import ttfrog.app
 from ttfrog import schema
+from grung.db import GrungDB
+from tinydb.storages import MemoryStorage
 
 
 @pytest.fixture
 def app():
+    fixture_db = GrungDB.with_schema(schema, storage=MemoryStorage)
     ttfrog.app.load_config(defaults=None, IN_MEMORY_DB=1)
-    ttfrog.app.initialize()
+    ttfrog.app.initialize(db=fixture_db, force=True)
     yield ttfrog.app
-    ttfrog.app.db.close()
+    ttfrog.app.db.truncate()
 
 
 def test_create(app):
-    user = schema.User(name="john", email="john@foo")
+    user = schema.User(name="john", email="john@foo", password="powerfulCat")
     assert user.uid
     assert user._metadata.fields["uid"].unique
 
@@ -34,7 +37,29 @@ def test_create(app):
     assert after_update == john_something
     assert before_update != after_update
 
-    players = schema.Group(name="players", users=[john_something])
-    players = app.db.save(players)
-    players.users[0]["name"] = "fnord"
-    app.db.save(players)
+
+def test_permissions(app):
+    john = app.db.save(schema.User(name="john", email="john@foo", password="powerfulCat"))
+    players = app.db.save(schema.Group(name="players", members=[john]))
+    notes = app.db.save(schema.Page(name="notes"))
+
+    # default read-only
+    assert players.can_read(notes, app.db)
+    assert not players.can_write(notes, app.db)
+    assert not players.can_delete(notes, app.db)
+
+    # set to rw, no delete
+    notes.set_permissions(players, [schema.Permissions.READ, schema.Permissions.WRITE], app.db)
+    assert players.can_read(notes, app.db)
+    assert players.can_write(notes, app.db)
+    assert not players.can_delete(notes, app.db)
+
+    # members of the group inherit group permissions
+    assert john.can_read(notes, app.db)
+    assert john.can_write(notes, app.db)
+    assert not john.can_delete(notes, app.db)
+
+    # permissions are the union of user + group permissions
+    notes.set_permissions(john, [schema.Permissions.DELETE], app.db)
+    assert not players.can_delete(notes, app.db)
+    assert john.can_delete(notes, app.db)