feat: option to disallow public org registration (#6917)

* feat: return 404 or 409 if org reg disallowed * fix: system limit permissions * feat: add iam limits api * feat: disallow public org registrations on default instance * add integration test * test: integration * fix test * docs: describe public org registrations * avoid updating docs deps * fix system limits integration test * silence integration tests * fix linting * ignore strange linter complaints * review * improve reset properties naming * redefine the api * use restrictions aggregate * test query * simplify and test projection * test commands * fix unit tests * move integration test * support restrictions on default instance * also test GetRestrictions * self review * lint * abstract away resource owner * fix tests * lint
2025-08-11 20:17:32 +00:00 · 2023-11-22 10:29:38 +01:00
parent 5fa596a871
commit 76fe032b5f
45 changed files with 1280 additions and 123 deletions
--- a/internal/query/restrictions_test.go
+++ b/internal/query/restrictions_test.go
@@ -0,0 +1,111 @@
+package query
+
+import (
+	"database/sql"
+	"database/sql/driver"
+	"errors"
+	"fmt"
+	"regexp"
+	"testing"
+)
+
+var (
+	expectedRestrictionsQuery = regexp.QuoteMeta("SELECT projections.restrictions.aggregate_id," +
+		" projections.restrictions.creation_date," +
+		" projections.restrictions.change_date," +
+		" projections.restrictions.resource_owner," +
+		" projections.restrictions.sequence," +
+		" projections.restrictions.disallow_public_org_registration" +
+		" FROM projections.restrictions" +
+		" AS OF SYSTEM TIME '-1 ms'",
+	)
+
+	restrictionsCols = []string{
+		"aggregate_id",
+		"creation_date",
+		"change_date",
+		"resource_owner",
+		"sequence",
+		"disallow_public_org_registration",
+	}
+)
+
+func Test_RestrictionsPrepare(t *testing.T) {
+	type want struct {
+		sqlExpectations sqlExpectation
+		err             checkErr
+		object          interface{}
+	}
+	tests := []struct {
+		name    string
+		prepare interface{}
+		want    want
+	}{
+		{
+			name:    "prepareRestrictionsQuery no result",
+			prepare: prepareRestrictionsQuery,
+			want: want{
+				sqlExpectations: mockQueryScanErr(
+					expectedRestrictionsQuery,
+					nil,
+					nil,
+				),
+				err: func(err error) (error, bool) {
+					if !errors.Is(err, sql.ErrNoRows) {
+						return fmt.Errorf("err should be sql.ErrNoRows got: %w", err), false
+					}
+					return nil, true
+				},
+				object: Restrictions{},
+			},
+		},
+		{
+			name:    "prepareRestrictionsQuery",
+			prepare: prepareRestrictionsQuery,
+			want: want{
+				sqlExpectations: mockQuery(
+					expectedRestrictionsQuery,
+					restrictionsCols,
+					[]driver.Value{
+						"restrictions1",
+						testNow,
+						testNow,
+						"instance1",
+						0,
+						true,
+					},
+				),
+				object: Restrictions{
+					AggregateID:                   "restrictions1",
+					CreationDate:                  testNow,
+					ChangeDate:                    testNow,
+					ResourceOwner:                 "instance1",
+					Sequence:                      0,
+					DisallowPublicOrgRegistration: true,
+				},
+			},
+		},
+		{
+			name:    "prepareRestrictionsQuery sql err",
+			prepare: prepareRestrictionsQuery,
+			want: want{
+				sqlExpectations: mockQueryErr(
+					expectedRestrictionsQuery,
+					sql.ErrConnDone,
+				),
+				err: func(err error) (error, bool) {
+					if !errors.Is(err, sql.ErrConnDone) {
+						return fmt.Errorf("err should be sql.ErrConnDone got: %w", err), false
+					}
+					return nil, true
+				},
+				object: (*Restrictions)(nil),
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assertPrepare(t, tt.prepare, tt.want.object, tt.want.sqlExpectations, tt.want.err, defaultPrepareArgs...)
+		})
+	}
+}