Add tests to lock down interaction between service keys and service instance sharing - #987
Merged
elenasharma merged 11 commits intoNov 16, 2017
Conversation
|
Hey jenspinney! Thanks for submitting this pull request! I'm here to inform the recipients of the pull request that you and the commit authors have already signed the CLA. |
|
We have created an issue in Pivotal Tracker to manage this: https://www.pivotaltracker.com/story/show/152723172 The labels on this github issue will be updated when the story is started. |
4 tasks
ablease
force-pushed
the
pr-service-instance-sharing-add-tests-service-keys
branch
from
November 14, 2017 10:35
dd866d2 to
8aa4b51
Compare
4 tasks
* The broker can return a shareable field as part of the service metadata response to /v2/catalog. [#152540454] Signed-off-by: Sam Gunaratne <sgunaratne@pivotal.io>
[#151909779]
… instance * This behaviour already existed, this commit just adds additional tests [#150973376] Signed-off-by: Denise Yu <dyu@pivotal.io>
* Only developers who have write access to the service instance can perform an update. [#150973390] Signed-off-by: Derik Evangelista <devangelista@pivotal.io>
or unshare [#151441010] Signed-off-by: Denise Yu <dyu@pivotal.io>
* The intended behavior is that users who have access to a shared service instance, but not developer access to the originating space of the instance may not create service keys from the instance. * This behavior was already correct. This commit simply adds tests to lock down the behavior. [#152592943] Signed-off-by: Jen Spinney <jennifer.spinney@suse.com>
* The intended behavior is that users who have access to a shared service instance, but not developer access to the originating space of the instance may not list service keys for the instance. * This behavior was already correct. This commit simply adds tests to lock down the behavior. [#151950132] Signed-off-by: Denise Yu <dyu@pivotal.io>
* The intended behavior is that users who have access to a shared service instance, but not developer access to the originating space of the instance may not delete service key associated with the instance. * This behavior was already correct. This commit simply adds tests to lock down the behavior. [#152721273] Signed-off-by: Jen Spinney <jennifer.spinney@suse.com>
* The intended behavior is that users who have access to a shared service instance, but not developer access to the originating space of the instance may not GET specific service keys for the instance. * This behavior was already correct. This commit simply adds tests to lock down the behavior. [#152721273] Signed-off-by: Denise Yu <dyu@pivotal.io>
deniseyu
force-pushed
the
pr-service-instance-sharing-add-tests-service-keys
branch
from
November 16, 2017 16:45
8aa4b51 to
72ef6b7
Compare
deniseyu
deleted the
pr-service-instance-sharing-add-tests-service-keys
branch
November 28, 2017 16:48
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Story Links
As an app dev, I cannot create a service key for a service instance that I do not have access to (i.e. has been shared with me). #152592943
As an app dev, I cannot list service keys for a service instance that I do not have access to (i.e. has been shared with me). #151950132
As an app dev, I cannot view a specific service key or delete a service key for a service instance that I do not have access to (i.e. has been shared with me).
#152721273
NOTE: This PR builds on top of #984, which should be merged first. The actual changes on top of #984 can be viewed in this diff.
What
This PR adds tests at the controller unit test level to lock down forbidden iteractions between users who have access to a service instance because it was shared with them and service keys.
Users who gain access to a service instance via service instance sharing (but do not have write permission on the space where the service instance was created) may not:
This behavior was already correct. This PR simply adds tests so that the permissions don't accidentally loosen in the future.
PR
masterbranchbundle exec rakeThanks, sapi (@jenspinney and @deniseyu)