From 521ab2d56a8ed0e2e7556031e23130d62ff15b84 Mon Sep 17 00:00:00 2001 From: anjali9791 Date: Tue, 13 Aug 2024 23:14:12 +0530 Subject: [PATCH] =?UTF-8?q?feat:=20add=20support=20for=20expression=20in?= =?UTF-8?q?=20request=20body=20when=20fetching=20metada=E2=80=A6=20(#170)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * feat: add support for expression in request body when fetching metadata sources for appeal * add a condition in http mock call --------- Co-authored-by: anjali.agarwal --- core/appeal/service.go | 46 ++- core/appeal/service_test.go | 805 ++++++++++++++++++++++++++++++++++++ 2 files changed, 836 insertions(+), 15 deletions(-) diff --git a/core/appeal/service.go b/core/appeal/service.go index b8e012475..48e1d2552 100644 --- a/core/appeal/service.go +++ b/core/appeal/service.go @@ -1554,25 +1554,20 @@ func (s *Service) populateAppealMetadata(ctx context.Context, a *domain.Appeal, if cfg.URL == "" { return fmt.Errorf("URL cannot be empty for http type") } - if strings.Contains(cfg.URL, "$appeal") { - appealMap, err := a.ToMap() - if err != nil { - return fmt.Errorf("error converting appeal to map: %w", err) - } - params := map[string]interface{}{"appeal": appealMap} - url, err := evaluator.Expression(cfg.URL).EvaluateWithVars(params) - if err != nil { - return fmt.Errorf("error evaluating URL expression: %w", err) - } - urlStr, ok := url.(string) - if !ok { - return fmt.Errorf("URL expression must evaluate to a string") - } - cfg.URL = urlStr + + var err error + cfg.URL, err = evaluateExpressionWithAppeal(a, cfg.URL) + if err != nil { + return err } + cfg.Body, err = evaluateExpressionWithAppeal(a, cfg.Body) + if err != nil { + return err + } clientCreator := &http.HttpClientCreatorStruct{} metadataCl, err := http.NewHTTPClient(&cfg.HTTPClientConfig, clientCreator) + if err != nil { return fmt.Errorf("key: %s, %w", key, err) } @@ -1605,6 +1600,7 @@ func (s *Service) populateAppealMetadata(ctx context.Context, a *domain.Appeal, "response": responseMap, "appeal": a, } + value, err := metadata.EvaluateValue(params) if err != nil { return fmt.Errorf("error parsing value: %w", err) @@ -1785,3 +1781,23 @@ func (s *Service) prepareGrant(ctx context.Context, appeal *domain.Appeal) (newG func (s *Service) GetAppealsTotalCount(ctx context.Context, filters *domain.ListAppealsFilter) (int64, error) { return s.repo.GetAppealsTotalCount(ctx, filters) } + +func evaluateExpressionWithAppeal(a *domain.Appeal, expression string) (string, error) { + if expression != "" && strings.Contains(expression, "$appeal") { + appealMap, err := a.ToMap() + if err != nil { + return "", fmt.Errorf("error converting appeal to map: %w", err) + } + params := map[string]interface{}{"appeal": appealMap} + evaluated, err := evaluator.Expression(expression).EvaluateWithVars(params) + if err != nil { + return "", fmt.Errorf("error evaluating expression %w", err) + } + evaluatedStr, ok := evaluated.(string) + if !ok { + return "", fmt.Errorf("expression must evaluate to a string") + } + return evaluatedStr, nil + } + return expression, nil +} diff --git a/core/appeal/service_test.go b/core/appeal/service_test.go index 0e20a6d92..7c0dbc17e 100644 --- a/core/appeal/service_test.go +++ b/core/appeal/service_test.go @@ -25,6 +25,7 @@ import ( "github.com/stretchr/testify/assert" "github.com/stretchr/testify/mock" "github.com/stretchr/testify/suite" + "io" ) var ( @@ -1577,6 +1578,810 @@ func (s *ServiceTestSuite) TestCreate() { h.assertExpectations(s.T()) }) + s.Run("should return appeals on success with metadata sources", func() { + h := newServiceTestHelper() + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if r.Method == "GET" && r.URL.RawQuery == "/?user=addOnBehalfApprovedNotification-user" { + w.WriteHeader(http.StatusOK) + w.Write([]byte(`{"message": "success"}`)) + } else { + w.WriteHeader(http.StatusBadRequest) + } + + // Here you can specify what the server should return when it receives a request + w.WriteHeader(http.StatusOK) + w.Write([]byte(`{"message": "success"}`)) + })) + url := fmt.Sprintf("'%s?user=' + $appeal.account_id", server.URL) + expDate := timeNow.Add(23 * time.Hour) + + resources := []*domain.Resource{ + { + ID: "1", + Type: "resource_type_1", + ProviderType: "provider_type", + ProviderURN: "provider1", + Details: map[string]interface{}{ + "owner": []string{"resource.owner@email.com"}, + }, + }, + { + ID: "2", + Type: "resource_type_2", + ProviderType: "provider_type", + ProviderURN: "provider1", + Details: map[string]interface{}{ + "owner": []string{"resource.owner@email.com"}, + }, + }, + } + providers := []*domain.Provider{ + { + ID: "1", + Type: "provider_type", + URN: "provider1", + Config: &domain.ProviderConfig{ + Appeal: &domain.AppealConfig{ + AllowPermanentAccess: true, + AllowActiveAccessExtensionIn: "24h", + }, + Resources: []*domain.ResourceConfig{ + { + Type: "resource_type_1", + Policy: &domain.PolicyConfig{ // specify policy with version + ID: "policy_1", + Version: 1, + }, + Roles: []*domain.Role{ + { + ID: "role_id", + Permissions: []interface{}{"test-permission-1"}, + }, + }, + }, + { + Type: "resource_type_2", + Policy: &domain.PolicyConfig{ // specify policy without version (always use latest) + ID: "policy_2", + }, + Roles: []*domain.Role{ + { + ID: "role_id", + Permissions: []interface{}{"test-permission-1"}, + }, + }, + }, + }, + }, + }, + } + policies := []*domain.Policy{ + { + ID: "policy_1", + Version: 1, + Steps: []*domain.Step{ + { + Name: "step_1", + Strategy: "manual", + Approvers: []string{ + "$appeal.resource.details.owner", + }, + }, + { + Name: "step_2", + Strategy: "manual", + Approvers: []string{ + `$appeal.creator != nil ? $appeal.creator.managers : "approver@example.com"`, + }, + }, + }, + IAM: &domain.IAMConfig{ + Provider: "http", + Config: map[string]interface{}{ + "url": "http://localhost", + }, + Schema: map[string]string{ + "managers": `managers`, + "name": "name", + "role": `$response.roles[0].name`, + "roles": `map($response.roles, {#.name})`, + }, + }, + AppealConfig: &domain.PolicyAppealConfig{ + AllowOnBehalf: true, + AllowCreatorDetailsFailure: true, + MetadataSources: map[string]*domain.AppealMetadataSource{ + "source1": { + Name: "test", + Description: "test", + Type: "http", + Config: map[string]interface{}{ + "url": url, + "method": "GET", + }, + Value: "$response.body.message", + }, + }, + }, + }, + } + + expectedAppealsInsertionParam := []*domain.Appeal{ + { + ResourceID: resources[0].ID, + Resource: resources[0], + PolicyID: "policy_1", + PolicyVersion: 1, + Status: domain.AppealStatusPending, + AccountID: "addOnBehalfApprovedNotification-user", + AccountType: domain.DefaultAppealAccountType, + CreatedBy: accountID, + Creator: nil, + Role: "role_id", + Permissions: []string{"test-permission-1"}, + Approvals: []*domain.Approval{ + { + Name: "step_1", + Index: 0, + Status: domain.ApprovalStatusPending, + PolicyID: "policy_1", + PolicyVersion: 1, + Approvers: []string{"resource.owner@email.com"}, + }, + { + Name: "step_2", + Index: 1, + Status: domain.ApprovalStatusBlocked, + PolicyID: "policy_1", + PolicyVersion: 1, + Approvers: []string{"approver@example.com"}, + }, + }, + Description: "The answer is 42", + Details: map[string]interface{}{ + "__policy_metadata": map[string]interface{}{ + "source1": "success", + }, + }, + }, + } + expectedExistingAppeals := []*domain.Appeal{} + expectedActiveGrants := []domain.Grant{ + { + ID: "99", + AccountID: accountID, + ResourceID: "1", + Resource: &domain.Resource{ + ID: "1", + URN: "urn", + }, + Role: "role_id", + Status: domain.GrantStatusActive, + ExpirationDate: &expDate, + }, + } + expectedResult := []*domain.Appeal{ + { + ID: "1", + ResourceID: "1", + Resource: resources[0], + PolicyID: "policy_1", + PolicyVersion: 1, + Status: domain.AppealStatusPending, + AccountID: "addOnBehalfApprovedNotification-user", + AccountType: domain.DefaultAppealAccountType, + CreatedBy: accountID, + Creator: nil, + Role: "role_id", + Permissions: []string{"test-permission-1"}, + Approvals: []*domain.Approval{ + { + ID: "1", + Name: "step_1", + Index: 0, + Status: domain.ApprovalStatusPending, + PolicyID: "policy_1", + PolicyVersion: 1, + Approvers: []string{"resource.owner@email.com"}, + }, + { + ID: "2", + Name: "step_2", + Index: 1, + Status: domain.ApprovalStatusBlocked, + PolicyID: "policy_1", + PolicyVersion: 1, + Approvers: []string{"approver@example.com"}, + }, + }, + Description: "The answer is 42", + Details: map[string]interface{}{ + "__policy_metadata": map[string]interface{}{ + "source1": "success", + }, + }, + }, + } + expectedResourceFilters := domain.ListResourcesFilter{IDs: []string{resources[0].ID}} + expectedExistingAppealsFilters := &domain.ListAppealsFilter{ + Statuses: []string{domain.AppealStatusPending}, + AccountIDs: []string{"addOnBehalfApprovedNotification-user"}, + } + + appeals := []*domain.Appeal{ + { + CreatedBy: accountID, + AccountID: "addOnBehalfApprovedNotification-user", + ResourceID: "1", + Resource: &domain.Resource{ + ID: "1", + URN: "urn", + }, + Role: "role_id", + Description: "The answer is 42", + }, + } + + defer server.Close() + + h.mockResourceService.EXPECT(). + Find(mock.Anything, expectedResourceFilters).Return(resources, nil).Once() + h.mockProviderService.EXPECT(). + Find(mock.Anything).Return(providers, nil).Once() + h.mockPolicyService.EXPECT(). + Find(mock.Anything).Return(policies, nil).Once() + h.mockRepository.EXPECT(). + Find(h.ctxMatcher, expectedExistingAppealsFilters). + Return(expectedExistingAppeals, nil).Once() + for _, a := range appeals { + h.mockGrantService.EXPECT(). + List(h.ctxMatcher, domain.ListGrantsFilter{ + Statuses: []string{string(domain.GrantStatusActive)}, + AccountIDs: []string{a.AccountID}, + ResourceIDs: []string{a.ResourceID}, + Roles: []string{a.Role}, + OrderBy: []string{"updated_at:desc"}, + }). + Return(expectedActiveGrants, nil).Once() + } + h.mockProviderService.EXPECT(). + ValidateAppeal(mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return(nil) + h.mockProviderService.EXPECT(). + GetPermissions(mock.Anything, mock.Anything, mock.AnythingOfType("string"), "role_id"). + Return([]interface{}{"test-permission-1"}, nil) + h.mockIAMManager.EXPECT(). + ParseConfig(mock.Anything).Return(nil, nil) + h.mockIAMManager.EXPECT(). + GetClient(mock.Anything).Return(h.mockIAMClient, nil) + + h.mockIAMClient.EXPECT(). + GetUser(accountID).Return(nil, errors.New("404 not found")).Once() + h.mockRepository.EXPECT(). + BulkUpsert(h.ctxMatcher, expectedAppealsInsertionParam). + Return(nil). + Run(func(_a0 context.Context, appeals []*domain.Appeal) { + for i, a := range appeals { + a.ID = expectedResult[i].ID + for j, approval := range a.Approvals { + approval.ID = expectedResult[i].Approvals[j].ID + } + } + }). + Once() + h.mockNotifier.EXPECT(). + Notify(h.ctxMatcher, mock.Anything).Return(nil).Once() + h.mockAuditLogger.EXPECT(). + Log(h.ctxMatcher, appeal.AuditKeyBulkInsert, mock.Anything). + Return(nil).Once() + + actualError := h.service.Create(context.Background(), appeals) + + s.Nil(actualError) + s.Equal(expectedResult, appeals) + + time.Sleep(time.Millisecond) + h.assertExpectations(s.T()) + }) + + s.Run("should return appeals on success with metadata sources for invalid expression", func() { + h := newServiceTestHelper() + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + body, _ := io.ReadAll(r.Body) + if r.Method == "POST" && string(body) == "{\"user\": addOnBehalfApprovedNotification-user}" { + w.WriteHeader(http.StatusOK) + w.Write([]byte(`{"message": "success"}`)) + } else { + w.WriteHeader(http.StatusBadRequest) + } + })) + url := fmt.Sprintf("'%s?user= + $appeal.account_id", server.URL) + expDate := timeNow.Add(23 * time.Hour) + + resources := []*domain.Resource{ + { + ID: "1", + Type: "resource_type_1", + ProviderType: "provider_type", + ProviderURN: "provider1", + Details: map[string]interface{}{ + "owner": []string{"resource.owner@email.com"}, + }, + }, + { + ID: "2", + Type: "resource_type_2", + ProviderType: "provider_type", + ProviderURN: "provider1", + Details: map[string]interface{}{ + "owner": []string{"resource.owner@email.com"}, + }, + }, + } + providers := []*domain.Provider{ + { + ID: "1", + Type: "provider_type", + URN: "provider1", + Config: &domain.ProviderConfig{ + Appeal: &domain.AppealConfig{ + AllowPermanentAccess: true, + AllowActiveAccessExtensionIn: "24h", + }, + Resources: []*domain.ResourceConfig{ + { + Type: "resource_type_1", + Policy: &domain.PolicyConfig{ // specify policy with version + ID: "policy_1", + Version: 1, + }, + Roles: []*domain.Role{ + { + ID: "role_id", + Permissions: []interface{}{"test-permission-1"}, + }, + }, + }, + { + Type: "resource_type_2", + Policy: &domain.PolicyConfig{ // specify policy without version (always use latest) + ID: "policy_2", + }, + Roles: []*domain.Role{ + { + ID: "role_id", + Permissions: []interface{}{"test-permission-1"}, + }, + }, + }, + }, + }, + }, + } + policies := []*domain.Policy{ + { + ID: "policy_1", + Version: 1, + Steps: []*domain.Step{ + { + Name: "step_1", + Strategy: "manual", + Approvers: []string{ + "$appeal.resource.details.owner", + }, + }, + { + Name: "step_2", + Strategy: "manual", + Approvers: []string{ + `$appeal.creator != nil ? $appeal.creator.managers : "approver@example.com"`, + }, + }, + }, + IAM: &domain.IAMConfig{ + Provider: "http", + Config: map[string]interface{}{ + "url": "http://localhost", + }, + Schema: map[string]string{ + "managers": `managers`, + "name": "name", + "role": `$response.roles[0].name`, + "roles": `map($response.roles, {#.name})`, + }, + }, + AppealConfig: &domain.PolicyAppealConfig{ + AllowOnBehalf: true, + AllowCreatorDetailsFailure: true, + MetadataSources: map[string]*domain.AppealMetadataSource{ + "source1": { + Name: "test", + Description: "test", + Type: "http", + Config: map[string]interface{}{ + "url": url, + "method": "GET", + }, + Value: "$response.body.message", + }, + }, + }, + }, + } + expectedExistingAppeals := []*domain.Appeal{} + expectedActiveGrants := []domain.Grant{ + { + ID: "99", + AccountID: accountID, + ResourceID: "1", + Resource: &domain.Resource{ + ID: "1", + URN: "urn", + }, + Role: "role_id", + Status: domain.GrantStatusActive, + ExpirationDate: &expDate, + }, + } + expectedResourceFilters := domain.ListResourcesFilter{IDs: []string{resources[0].ID}} + expectedExistingAppealsFilters := &domain.ListAppealsFilter{ + Statuses: []string{domain.AppealStatusPending}, + AccountIDs: []string{"addOnBehalfApprovedNotification-user"}, + } + + appeals := []*domain.Appeal{ + { + CreatedBy: accountID, + AccountID: "addOnBehalfApprovedNotification-user", + ResourceID: "1", + Resource: &domain.Resource{ + ID: "1", + URN: "urn", + }, + Role: "role_id", + Description: "The answer is 42", + }, + } + + defer server.Close() + + h.mockResourceService.EXPECT(). + Find(mock.Anything, expectedResourceFilters).Return(resources, nil).Once() + h.mockProviderService.EXPECT(). + Find(mock.Anything).Return(providers, nil).Once() + h.mockPolicyService.EXPECT(). + Find(mock.Anything).Return(policies, nil).Once() + h.mockRepository.EXPECT(). + Find(h.ctxMatcher, expectedExistingAppealsFilters). + Return(expectedExistingAppeals, nil).Once() + for _, a := range appeals { + h.mockGrantService.EXPECT(). + List(h.ctxMatcher, domain.ListGrantsFilter{ + Statuses: []string{string(domain.GrantStatusActive)}, + AccountIDs: []string{a.AccountID}, + ResourceIDs: []string{a.ResourceID}, + Roles: []string{a.Role}, + OrderBy: []string{"updated_at:desc"}, + }). + Return(expectedActiveGrants, nil).Once() + } + h.mockProviderService.EXPECT(). + ValidateAppeal(mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return(nil) + h.mockProviderService.EXPECT(). + GetPermissions(mock.Anything, mock.Anything, mock.AnythingOfType("string"), "role_id"). + Return([]interface{}{"test-permission-1"}, nil) + + actualError := h.service.Create(context.Background(), appeals) + s.NotNil(actualError) + time.Sleep(time.Millisecond) + h.assertExpectations(s.T()) + }) + + s.Run("should return appeals on success with metadata sources for post method", func() { + h := newServiceTestHelper() + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + // Here you can specify what the server should return when it receives a request + + body, _ := io.ReadAll(r.Body) + if r.Method == "POST" && string(body) == "{\"user\": addOnBehalfApprovedNotification-user}" { + w.WriteHeader(http.StatusOK) + w.Write([]byte(`{"message": "success"}`)) + } else { + w.WriteHeader(http.StatusBadRequest) + } + })) + + body := "'{\"user\": ' + $appeal.account_id + '}'" + expDate := timeNow.Add(23 * time.Hour) + + resources := []*domain.Resource{ + { + ID: "1", + Type: "resource_type_1", + ProviderType: "provider_type", + ProviderURN: "provider1", + Details: map[string]interface{}{ + "owner": []string{"resource.owner@email.com"}, + }, + }, + { + ID: "2", + Type: "resource_type_2", + ProviderType: "provider_type", + ProviderURN: "provider1", + Details: map[string]interface{}{ + "owner": []string{"resource.owner@email.com"}, + }, + }, + } + providers := []*domain.Provider{ + { + ID: "1", + Type: "provider_type", + URN: "provider1", + Config: &domain.ProviderConfig{ + Appeal: &domain.AppealConfig{ + AllowPermanentAccess: true, + AllowActiveAccessExtensionIn: "24h", + }, + Resources: []*domain.ResourceConfig{ + { + Type: "resource_type_1", + Policy: &domain.PolicyConfig{ // specify policy with version + ID: "policy_1", + Version: 1, + }, + Roles: []*domain.Role{ + { + ID: "role_id", + Permissions: []interface{}{"test-permission-1"}, + }, + }, + }, + { + Type: "resource_type_2", + Policy: &domain.PolicyConfig{ // specify policy without version (always use latest) + ID: "policy_2", + }, + Roles: []*domain.Role{ + { + ID: "role_id", + Permissions: []interface{}{"test-permission-1"}, + }, + }, + }, + }, + }, + }, + } + policies := []*domain.Policy{ + { + ID: "policy_1", + Version: 1, + Steps: []*domain.Step{ + { + Name: "step_1", + Strategy: "manual", + Approvers: []string{ + "$appeal.resource.details.owner", + }, + }, + { + Name: "step_2", + Strategy: "manual", + Approvers: []string{ + `$appeal.creator != nil ? $appeal.creator.managers : "approver@example.com"`, + }, + }, + }, + IAM: &domain.IAMConfig{ + Provider: "http", + Config: map[string]interface{}{ + "url": "http://localhost", + }, + Schema: map[string]string{ + "managers": `managers`, + "name": "name", + "role": `$response.roles[0].name`, + "roles": `map($response.roles, {#.name})`, + }, + }, + AppealConfig: &domain.PolicyAppealConfig{ + AllowOnBehalf: true, + AllowCreatorDetailsFailure: true, + MetadataSources: map[string]*domain.AppealMetadataSource{ + "source1": { + Name: "test", + Description: "test", + Type: "http", + Config: map[string]interface{}{ + "url": server.URL, + "method": "POST", + "body": body, + }, + Value: "$response.body.message", + }, + }, + }, + }, + } + + expectedAppealsInsertionParam := []*domain.Appeal{ + { + ResourceID: resources[0].ID, + Resource: resources[0], + PolicyID: "policy_1", + PolicyVersion: 1, + Status: domain.AppealStatusPending, + AccountID: "addOnBehalfApprovedNotification-user", + AccountType: domain.DefaultAppealAccountType, + CreatedBy: accountID, + Creator: nil, + Role: "role_id", + Permissions: []string{"test-permission-1"}, + Approvals: []*domain.Approval{ + { + Name: "step_1", + Index: 0, + Status: domain.ApprovalStatusPending, + PolicyID: "policy_1", + PolicyVersion: 1, + Approvers: []string{"resource.owner@email.com"}, + }, + { + Name: "step_2", + Index: 1, + Status: domain.ApprovalStatusBlocked, + PolicyID: "policy_1", + PolicyVersion: 1, + Approvers: []string{"approver@example.com"}, + }, + }, + Description: "The answer is 42", + Details: map[string]interface{}{ + "__policy_metadata": map[string]interface{}{ + "source1": "success", + }, + }, + }, + } + expectedExistingAppeals := []*domain.Appeal{} + expectedActiveGrants := []domain.Grant{ + { + ID: "99", + AccountID: accountID, + ResourceID: "1", + Resource: &domain.Resource{ + ID: "1", + URN: "urn", + }, + Role: "role_id", + Status: domain.GrantStatusActive, + ExpirationDate: &expDate, + }, + } + expectedResult := []*domain.Appeal{ + { + ID: "1", + ResourceID: "1", + Resource: resources[0], + PolicyID: "policy_1", + PolicyVersion: 1, + Status: domain.AppealStatusPending, + AccountID: "addOnBehalfApprovedNotification-user", + AccountType: domain.DefaultAppealAccountType, + CreatedBy: accountID, + Creator: nil, + Role: "role_id", + Permissions: []string{"test-permission-1"}, + Approvals: []*domain.Approval{ + { + ID: "1", + Name: "step_1", + Index: 0, + Status: domain.ApprovalStatusPending, + PolicyID: "policy_1", + PolicyVersion: 1, + Approvers: []string{"resource.owner@email.com"}, + }, + { + ID: "2", + Name: "step_2", + Index: 1, + Status: domain.ApprovalStatusBlocked, + PolicyID: "policy_1", + PolicyVersion: 1, + Approvers: []string{"approver@example.com"}, + }, + }, + Description: "The answer is 42", + Details: map[string]interface{}{ + "__policy_metadata": map[string]interface{}{ + "source1": "success", + }, + }, + }, + } + expectedResourceFilters := domain.ListResourcesFilter{IDs: []string{resources[0].ID}} + expectedExistingAppealsFilters := &domain.ListAppealsFilter{ + Statuses: []string{domain.AppealStatusPending}, + AccountIDs: []string{"addOnBehalfApprovedNotification-user"}, + } + + appeals := []*domain.Appeal{ + { + CreatedBy: accountID, + AccountID: "addOnBehalfApprovedNotification-user", + ResourceID: "1", + Resource: &domain.Resource{ + ID: "1", + URN: "urn", + }, + Role: "role_id", + Description: "The answer is 42", + }, + } + + defer server.Close() + + h.mockResourceService.EXPECT(). + Find(mock.Anything, expectedResourceFilters).Return(resources, nil).Once() + h.mockProviderService.EXPECT(). + Find(mock.Anything).Return(providers, nil).Once() + h.mockPolicyService.EXPECT(). + Find(mock.Anything).Return(policies, nil).Once() + h.mockRepository.EXPECT(). + Find(h.ctxMatcher, expectedExistingAppealsFilters). + Return(expectedExistingAppeals, nil).Once() + for _, a := range appeals { + h.mockGrantService.EXPECT(). + List(h.ctxMatcher, domain.ListGrantsFilter{ + Statuses: []string{string(domain.GrantStatusActive)}, + AccountIDs: []string{a.AccountID}, + ResourceIDs: []string{a.ResourceID}, + Roles: []string{a.Role}, + OrderBy: []string{"updated_at:desc"}, + }). + Return(expectedActiveGrants, nil).Once() + } + h.mockProviderService.EXPECT(). + ValidateAppeal(mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return(nil) + h.mockProviderService.EXPECT(). + GetPermissions(mock.Anything, mock.Anything, mock.AnythingOfType("string"), "role_id"). + Return([]interface{}{"test-permission-1"}, nil) + h.mockIAMManager.EXPECT(). + ParseConfig(mock.Anything).Return(nil, nil) + h.mockIAMManager.EXPECT(). + GetClient(mock.Anything).Return(h.mockIAMClient, nil) + + h.mockIAMClient.EXPECT(). + GetUser(accountID).Return(nil, errors.New("404 not found")).Once() + h.mockRepository.EXPECT(). + BulkUpsert(h.ctxMatcher, expectedAppealsInsertionParam). + Return(nil). + Run(func(_a0 context.Context, appeals []*domain.Appeal) { + for i, a := range appeals { + a.ID = expectedResult[i].ID + for j, approval := range a.Approvals { + approval.ID = expectedResult[i].Approvals[j].ID + } + } + }). + Once() + h.mockNotifier.EXPECT(). + Notify(h.ctxMatcher, mock.Anything).Return(nil).Once() + h.mockAuditLogger.EXPECT(). + Log(h.ctxMatcher, appeal.AuditKeyBulkInsert, mock.Anything). + Return(nil).Once() + + actualError := h.service.Create(context.Background(), appeals) + + s.Nil(actualError) + s.Equal(expectedResult, appeals) + + time.Sleep(time.Millisecond) + h.assertExpectations(s.T()) + }) + s.Run("additional appeal creation", func() { s.Run("should use the overridding policy", func() { h := newServiceTestHelper()