1package accesscontrol23import (4 "testing"56 "gno.land/p/nt/testutils/v0"7 "gno.land/p/nt/uassert/v0"8)910var (11 testAdmin = testutils.TestAddress("acAdmin")12 testOperator = testutils.TestAddress("acOperator")13 testUser = testutils.TestAddress("acUser")14 testOther = testutils.TestAddress("acOther")15)1617func testIsAdmin(addr address) bool {18 return addr == testAdmin19}2021func testIsOperator(addr address) bool {22 return addr == testOperator23}2425func probeMustGetAdminCaller(cur realm, isAdmin AuthCheck) address {26 return MustGetAdminCaller(0, cur, isAdmin)27}2829func probeAssertIsAdmin(cur realm, isAdmin AuthCheck) address {30 AssertIsAdmin(0, cur, isAdmin)31 return ""32}3334func probeMustGetUserCaller(cur realm) address {35 return MustGetUserCaller(0, cur)36}3738func probeMustGetAdminOrOperatorCaller(cur realm, isAdmin AuthCheck, isOperator AuthCheck) address {39 return MustGetAdminOrOperatorCaller(0, cur, isAdmin, isOperator)40}4142func probeAssertIsAdminOrOperator(cur realm, isAdmin AuthCheck, isOperator AuthCheck) address {43 AssertIsAdminOrOperator(0, cur, isAdmin, isOperator)44 return ""45}4647func TestAccessControl(cur realm, t *testing.T) {48 tests := []struct {49 label string50 setup func(realm) realm51 call func(realm, realm) address52 panicKind string53 panicMsg string54 wantCaller address55 }{56 {57 label: "current realm",58 setup: func(cur realm) realm {59 return cur60 },61 call: func(cur realm, rlm realm) address {62 AssertCurrentRealm(0, rlm)63 return ""64 },65 },66 {67 label: "stale realm",68 setup: func(cur realm) realm {69 testing.SetRealm(testing.NewCodeRealm("gno.land/r/akkadia/beta/accesscontrol_stale_probe"))70 return cur.Previous()71 },72 call: func(cur realm, rlm realm) address {73 AssertCurrentRealm(0, rlm)74 return ""75 },76 panicKind: "panic",77 panicMsg: "spoofed realm",78 },79 {80 label: "admin caller",81 setup: func(cur realm) realm {82 testing.SetRealm(testing.NewUserRealm(testAdmin))83 return nil84 },85 call: func(cur realm, rlm realm) address {86 return probeMustGetAdminCaller(cross(cur), testIsAdmin)87 },88 wantCaller: testAdmin,89 },90 {91 label: "assert admin caller",92 setup: func(cur realm) realm {93 testing.SetRealm(testing.NewUserRealm(testAdmin))94 return nil95 },96 call: func(cur realm, rlm realm) address {97 return probeAssertIsAdmin(cross(cur), testIsAdmin)98 },99 },100 {101 label: "unauthorized admin caller",102 setup: func(cur realm) realm {103 testing.SetRealm(testing.NewUserRealm(testOther))104 return nil105 },106 call: func(cur realm, rlm realm) address {107 return probeMustGetAdminCaller(cross(cur), testIsAdmin)108 },109 panicKind: "abort",110 panicMsg: "admin access required",111 },112 {113 label: "direct user caller",114 setup: func(cur realm) realm {115 testing.SetRealm(testing.NewUserRealm(testUser))116 return nil117 },118 call: func(cur realm, rlm realm) address {119 return probeMustGetUserCaller(cross(cur))120 },121 wantCaller: testUser,122 },123 {124 label: "code realm rejected as user caller",125 setup: func(cur realm) realm {126 testing.SetRealm(testing.NewCodeRealm("gno.land/r/akkadia/beta/accesscontrol_relay"))127 return nil128 },129 call: func(cur realm, rlm realm) address {130 return probeMustGetUserCaller(cross(cur))131 },132 panicKind: "abort",133 panicMsg: "contract calls not allowed: function must be called directly by user",134 },135 {136 label: "admin caller for admin or operator",137 setup: func(cur realm) realm {138 testing.SetRealm(testing.NewUserRealm(testAdmin))139 return nil140 },141 call: func(cur realm, rlm realm) address {142 return probeMustGetAdminOrOperatorCaller(cross(cur), testIsAdmin, testIsOperator)143 },144 wantCaller: testAdmin,145 },146 {147 label: "operator caller for admin or operator",148 setup: func(cur realm) realm {149 testing.SetRealm(testing.NewUserRealm(testOperator))150 return nil151 },152 call: func(cur realm, rlm realm) address {153 return probeMustGetAdminOrOperatorCaller(cross(cur), testIsAdmin, testIsOperator)154 },155 wantCaller: testOperator,156 },157 {158 label: "assert admin or operator",159 setup: func(cur realm) realm {160 testing.SetRealm(testing.NewUserRealm(testOperator))161 return nil162 },163 call: func(cur realm, rlm realm) address {164 return probeAssertIsAdminOrOperator(cross(cur), testIsAdmin, testIsOperator)165 },166 },167 {168 label: "unauthorized admin or operator caller",169 setup: func(cur realm) realm {170 testing.SetRealm(testing.NewUserRealm(testOther))171 return nil172 },173 call: func(cur realm, rlm realm) address {174 return probeMustGetAdminOrOperatorCaller(cross(cur), testIsAdmin, testIsOperator)175 },176 panicKind: "abort",177 panicMsg: "admin or operator access required",178 },179 {180 label: "admin origin",181 setup: func(cur realm) realm {182 testing.SetOriginCaller(testAdmin)183 return nil184 },185 call: func(cur realm, rlm realm) address {186 return MustGetAdminOrigin(testIsAdmin)187 },188 wantCaller: testAdmin,189 },190 {191 label: "assert admin origin",192 setup: func(cur realm) realm {193 testing.SetOriginCaller(testAdmin)194 return nil195 },196 call: func(cur realm, rlm realm) address {197 AssertIsAdminOrigin(testIsAdmin)198 return ""199 },200 },201 {202 label: "unauthorized admin origin",203 setup: func(cur realm) realm {204 testing.SetOriginCaller(testOther)205 return nil206 },207 call: func(cur realm, rlm realm) address {208 return MustGetAdminOrigin(testIsAdmin)209 },210 panicKind: "panic",211 panicMsg: "admin access required",212 },213 {214 label: "nil admin check",215 setup: func(cur realm) realm {216 return cur217 },218 call: func(cur realm, rlm realm) address {219 return MustGetAdminCaller(0, rlm, nil)220 },221 panicKind: "panic",222 panicMsg: "admin auth check is nil",223 },224 {225 label: "nil origin admin check",226 setup: func(cur realm) realm {227 return nil228 },229 call: func(cur realm, rlm realm) address {230 return MustGetAdminOrigin(nil)231 },232 panicKind: "panic",233 panicMsg: "admin auth check is nil",234 },235 {236 label: "nil operator check",237 setup: func(cur realm) realm {238 return cur239 },240 call: func(cur realm, rlm realm) address {241 return MustGetAdminOrOperatorCaller(0, rlm, testIsAdmin, nil)242 },243 panicKind: "panic",244 panicMsg: "operator auth check is nil",245 },246 }247248 for _, tt := range tests {249 rlm := tt.setup(cur)250 call := func() {251 got := tt.call(cur, rlm)252 if tt.wantCaller != "" {253 uassert.Equal(t, tt.wantCaller.String(), got.String())254 }255 }256257 if tt.panicKind == "panic" {258 uassert.PanicsWithMessage(t, cur, tt.panicMsg, call)259 continue260 }261 if tt.panicKind == "abort" {262 uassert.AbortsWithMessage(t, cur, tt.panicMsg, call)263 continue264 }265 call()266 }267}268Signatures reconstructed verbatim from vm/qfuncs — interface params keep their inline definitions.