Fixed issues with resource token #13855
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -531,21 +531,21 @@ def test_partitioned_collection_document_crud_and_query(self): | |
| def test_partitioned_collection_permissions(self): | ||
| created_db = self.databaseForTest | ||
|
|
||
| collection_id = 'test_partitioned_collection_permissions all collection' + str(uuid.uuid4()) | ||
|
|
||
| all_collection = created_db.create_container( | ||
| id=collection_id, | ||
| partition_key=PartitionKey(path='/key', kind=documents.PartitionKind.Hash) | ||
| ) | ||
|
|
||
| collection_id = 'test_partitioned_collection_permissions read collection' + str(uuid.uuid4()) | ||
|
|
||
| read_collection = created_db.create_container( | ||
| id=collection_id, | ||
| partition_key=PartitionKey(path='/key', kind=documents.PartitionKind.Hash) | ||
| ) | ||
|
|
||
| user = created_db.create_user(body={'id': 'user' + str(uuid.uuid4())}) | ||
|
|
||
| permission_definition = { | ||
| 'id': 'all permission', | ||
|
|
@@ -567,8 +567,8 @@ def test_partitioned_collection_permissions(self): | |
|
|
||
| resource_tokens = {} | ||
| # storing the resource tokens based on Resource IDs | ||
| resource_tokens["dbs/" + created_db.id + "/colls/" + all_collection.id] = (all_permission.properties['_token']) | ||
| resource_tokens["dbs/" + created_db.id + "/colls/" + read_collection.id] = (read_permission.properties['_token']) | ||
|
Member
There was a problem hiding this comment. Was the existing test invalid in some way?
Contributor
Author
There was a problem hiding this comment. So the way in which resource tokens were implemented were faulty. resource tokens are supposed to be a map of resource link to token . i.e {"dbs/mydb/coll/mycoll1": "token1", "dbs/mydb/colls/mycoll2": "token2"} (this is the implementation in the .Net SDK and is the spec as well). But in the python sdk currently, we expect to get it to be a map of resource id to token. i.e {"mycoll1": "token1", "mycoll2": "token2"}. This is faulty since the same collection name can exist in 2 different databases.
Member
There was a problem hiding this comment. Thanks, but is it possible any customers were using the old faulty pattern? For example by manually building this dictionary? Or if they had done that would it not have worked?
Contributor
There was a problem hiding this comment. @annatisch It is possible that some cases would have worked but that is not intentional. We consider it a bug and fixed the same issue in JS SDK recently. Previous versions of the Cosmos SDK were all based on
Member
There was a problem hiding this comment. I would still prefer this to be backwards compatible - but if you've rolled out the same change in other languages I guess that's okay. |
||
|
|
||
| restricted_client = cosmos_client.CosmosClient( | ||
| CRUDTests.host, resource_tokens, "Session", connection_policy=CRUDTests.connectionPolicy) | ||
|
|
@@ -1302,71 +1302,48 @@ def __SetupEntities(client): | |
| """ | ||
| # create database | ||
| db = self.databaseForTest | ||
| # create collection | ||
| collection = db.create_container( | ||
| id='test_authorization' + str(uuid.uuid4()), | ||
| partition_key=PartitionKey(path='/id', kind='Hash') | ||
| ) | ||
| # create document1 | ||
| document = collection.create_item( | ||
| body={'id': 'doc1', | ||
| 'spam': 'eggs', | ||
| 'key': 'value'}, | ||
| ) | ||
|
|
||
| # create user | ||
| user = db.create_user(body={'id': 'user' + str(uuid.uuid4())}) | ||
|
|
||
| # create permission for collection | ||
| permission = { | ||
| 'id': 'permission On Coll', | ||
| 'permissionMode': documents.PermissionMode.Read, | ||
| 'resource': "dbs/" + db.id + "/colls/" + collection.id | ||
| } | ||
| permission_on_coll = user.create_permission(body=permission) | ||
| self.assertIsNotNone(permission_on_coll.properties['_token'], | ||
| 'permission token is invalid') | ||
|
|
||
| # create permission for document | ||
| permission = { | ||
| 'id': 'permission On Doc', | ||
| 'permissionMode': documents.PermissionMode.All, | ||
| 'resource': "dbs/" + db.id + "/colls/" + collection.id + "/docs/" + document["id"] | ||
| } | ||
| permission_on_doc = user.create_permission(body=permission) | ||
| self.assertIsNotNone(permission_on_doc.properties['_token'], | ||
| 'permission token is invalid') | ||
|
|
||
| entities = { | ||
| 'db': db, | ||
| 'coll': collection, | ||
| 'doc': document, | ||
| 'user': user, | ||
| 'permissionOnColl': permission_on_coll, | ||
| 'permissionOnDoc': permission_on_doc, | ||
| } | ||
| return entities | ||
|
|
||
|
|
@@ -1382,60 +1359,61 @@ def __SetupEntities(client): | |
| connection_policy=CRUDTests.connectionPolicy) | ||
| # setup entities | ||
| entities = __SetupEntities(client) | ||
| resource_tokens = {"dbs/" + entities['db'].id + "/colls/" + entities['coll'].id: | ||
| entities['permissionOnColl'].properties['_token']} | ||
| col_client = cosmos_client.CosmosClient( | ||
| CRUDTests.host, resource_tokens,"Session", connection_policy=CRUDTests.connectionPolicy) | ||
| db = entities['db'] | ||
|
|
||
| old_client_connection = db.client_connection | ||
| db.client_connection = col_client.client_connection | ||
| # 1. Success-- Use Col Permission to Read | ||
| success_coll = db.get_container_client(container=entities['coll']) | ||
| # 2. Failure-- Use Col Permission to delete | ||
| self.__AssertHTTPFailureWithStatus(StatusCodes.FORBIDDEN, | ||
| db.delete_container, | ||
| success_coll) | ||
| # 3. Success-- Use Col Permission to Read All Docs | ||
| success_documents = list(success_coll.read_all_items()) | ||
| self.assertTrue(success_documents != None, | ||
| 'error reading documents') | ||
| self.assertEqual(len(success_documents), | ||
| 1, | ||
| 'Expected 1 Document to be succesfully read') | ||
| # 4. Success-- Use Col Permission to Read Doc | ||
|
|
||
| docId = entities['doc']['id'] | ||
| success_doc = success_coll.read_item( | ||
| item=docId, | ||
| partition_key=docId | ||
| ) | ||
| self.assertTrue(success_doc != None, 'error reading document') | ||
| self.assertEqual( | ||
| success_doc['id'], | ||
| entities['doc']['id'], | ||
| 'Expected to read children using parent permissions') | ||
|
|
||
| #5. Failure-- Use Col Permission to Delete Doc | ||
| self.__AssertHTTPFailureWithStatus(StatusCodes.FORBIDDEN, | ||
| success_coll.delete_item, | ||
| docId, docId) | ||
|
|
||
| resource_tokens = {"dbs/" + entities['db'].id + "/colls/" + entities['coll'].id + "/docs/" + docId : | ||
| entities['permissionOnDoc'].properties['_token']} | ||
|
|
||
| doc_client = cosmos_client.CosmosClient( | ||
| CRUDTests.host, resource_tokens,"Session", connection_policy=CRUDTests.connectionPolicy) | ||
|
|
||
| #6. Success-- Use Doc permission to read doc | ||
| read_doc = doc_client.get_database_client(db.id).get_container_client(success_coll.id).read_item(docId, docId) | ||
| self.assertEqual(read_doc["id"], docId) | ||
|
|
||
| #6. Success-- Use Doc permission to delete doc | ||
| doc_client.get_database_client(db.id).get_container_client(success_coll.id).delete_item(docId, docId) | ||
| self.assertEqual(read_doc["id"], docId) | ||
|
|
||
| db.client_connection = old_client_connection | ||
| db.delete_container(entities['coll']) | ||
|
|
||
| def test_trigger_crud(self): | ||
| # create database | ||
|
|
||
Uh oh!
There was an error while loading. Please reload this page.