Change: Unify permission tests & test all endpoints

Author: alex-heine

pkg/web/mailcontroller/checkMailServer_test.go

@@ -1,7 +1,13 @@
+// SPDX-FileCopyrightText: 2026 Greenbone AG <https://greenbone.net>
+//
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
 package mailcontroller
 
 import (
 	"net/http"
+	"net/http/httptest"
+	"strings"
 	"testing"
 
 	"github.com/gin-gonic/gin"
@@ -23,22 +29,11 @@ func setup(t *testing.T) (*gin.Engine, *mocks.MailChannelService) {
 
 	notificationChannelServicer := mocks.NewMailChannelService(t)
 
-	AddCheckMailServerController(engine, notificationChannelServicer, testhelper.MockAuthMiddlewareWithAdmin, registry)
-	return engine, notificationChannelServicer
-}
-
-func setupCheckMailServerWithAuth(t *testing.T) *gin.Engine {
-	registry := errmap.NewRegistry()
-	engine := testhelper.NewTestWebEngine(registry)
-	mailChannelService := mocks.NewMailChannelService(t)
-
 	authMiddleware, err := auth.NewGinAuthMiddleware(integrationTests.NewTestJwtParser(t))
 	require.NoError(t, err)
 
-	mailChannelService.On("CheckNotificationChannelConnectivity", mock.Anything, mock.Anything).Maybe().Return(nil)
-
-	AddCheckMailServerController(engine, mailChannelService, authMiddleware, registry)
-	return engine
+	AddCheckMailServerController(engine, notificationChannelServicer, authMiddleware, registry)
+	return engine, notificationChannelServicer
 }
 
 func TestCheckMailServer(t *testing.T) {
@@ -58,6 +53,7 @@ func TestCheckMailServer(t *testing.T) {
 				"username": "testUser",
 				"password": "123"
 			}`).
+			AuthJwt(integrationTests.CreateJwtTokenWithRole(iam.NotificationAdmin)).
 			Expect().
 			StatusCode(http.StatusNoContent).
 			NoContent()
@@ -69,6 +65,7 @@ func TestCheckMailServer(t *testing.T) {
 		httpassert.New(t, engine).
 			Post("/notification-channel/mail/check").
 			Content(`-`).
+			AuthJwt(integrationTests.CreateJwtTokenWithRole(iam.NotificationAdmin)).
 			Expect().
 			StatusCode(http.StatusBadRequest).
 			Json(`{
@@ -84,6 +81,7 @@ func TestCheckMailServer(t *testing.T) {
 		httpassert.New(t, engine).
 			Post("/notification-channel/mail/check").
 			Content(`{}`).
+			AuthJwt(integrationTests.CreateJwtTokenWithRole(iam.NotificationAdmin)).
 			Expect().
 			StatusCode(http.StatusBadRequest).
 			Json(`{
@@ -109,6 +107,7 @@ func TestCheckMailServer(t *testing.T) {
 				"username": "",
 				"password": ""
 			}`).
+			AuthJwt(integrationTests.CreateJwtTokenWithRole(iam.NotificationAdmin)).
 			Expect().
 			StatusCode(http.StatusBadRequest).
 			Json(`{
@@ -135,6 +134,7 @@ func TestCheckMailServer(t *testing.T) {
 				"isAuthenticationRequired": false,
 				"isTlsEnforced": false
 			}`).
+			AuthJwt(integrationTests.CreateJwtTokenWithRole(iam.NotificationAdmin)).
 			Expect().
 			StatusCode(http.StatusUnprocessableEntity).
 			Json(`{
@@ -144,44 +144,52 @@ func TestCheckMailServer(t *testing.T) {
 	})
 }
 
-func TestCheckMailServer_ForbiddenRoles(t *testing.T) {
+func TestCheckMailServer_Permissions(t *testing.T) {
 	t.Parallel()
 
-	forbiddenRoles := []string{iam.OsiViewer, iam.User, iam.OsiUser, iam.OsiAdmin, iam.Notification}
-
-	for _, role := range forbiddenRoles {
-		t.Run("Check mail server is forbidden for role "+role, func(t *testing.T) {
-			t.Parallel()
-
-			router := setupCheckMailServerWithAuth(t)
+	var endpoints = []struct {
+		name   string
+		method string
+		path   string
+	}{
+		{"Create mail channel", http.MethodPost, "/notification-channel/mail/check"},
+	}
 
-			httpassert.New(t, router).
-				Post("/notification-channel/mail/check").
-				AuthJwt(integrationTests.CreateJwtTokenWithRole(role)).
-				Content(`{"domain":"example.com","port":123}`).
-				Expect().
-				StatusCode(http.StatusForbidden)
-		})
+	tests := []struct {
+		role      string
+		wantAllow bool
+	}{
+		// ensure this is the same as in iam/roles.go
+		{iam.OsiViewer, false},
+		{iam.User, false},
+		{iam.OsiUser, false},
+		{iam.OsiAdmin, false},
+		{iam.Admin, true},
+		{iam.NotificationAdmin, true},
+		{iam.Notification, false},
 	}
-}
 
-func TestCheckMailServer_AllowedRoles(t *testing.T) {
-	t.Parallel()
+	for _, tt := range tests {
+		for _, ep := range endpoints {
+			t.Run(ep.name+" as "+tt.role, func(t *testing.T) {
+				t.Parallel()
 
-	allowedRoles := []string{iam.Admin, iam.NotificationAdmin}
+				router, notificationChannelServicer := setup(t)
+				notificationChannelServicer.EXPECT().CheckNotificationChannelConnectivity(mock.Anything, mock.Anything).Maybe().Return(nil)
 
-	for _, role := range allowedRoles {
-		t.Run("Check mail server is allowed for role "+role, func(t *testing.T) {
-			t.Parallel()
+				req, _ := http.NewRequest(ep.method, ep.path, strings.NewReader(`{"domain":"example.com","port":123}`))
+				req.Header.Set("Authorization", "Bearer "+integrationTests.CreateJwtTokenWithRole(tt.role))
 
-			router := setupCheckMailServerWithAuth(t)
+				w := httptest.NewRecorder()
+				router.ServeHTTP(w, req)
 
-			httpassert.New(t, router).
-				Post("/notification-channel/mail/check").
-				AuthJwt(integrationTests.CreateJwtTokenWithRole(role)).
-				Content(`{"domain":"example.com","port":123}`).
-				Expect().
-				StatusCode(http.StatusNoContent)
-		})
+				if tt.wantAllow {
+					require.NotEqual(t, http.StatusUnauthorized, w.Code)
+					require.NotEqual(t, http.StatusForbidden, w.Code)
+				} else {
+					require.Equal(t, http.StatusForbidden, w.Code)
+				}
+			})
+		}
 	}
 }

pkg/web/mailcontroller/mailController_test.go

@@ -1,8 +1,13 @@
+// SPDX-FileCopyrightText: 2026 Greenbone AG <https://greenbone.net>
+//
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
 package mailcontroller
 
 import (
 	"errors"
 	"net/http"
+	"net/http/httptest"
 	"testing"
 
 	"github.com/gin-gonic/gin"
@@ -339,18 +344,17 @@ func setupWithAuth(t *testing.T) *gin.Engine {
 	authMiddleware, err := auth.NewGinAuthMiddleware(integrationTests.NewTestJwtParser(t))
 	require.NoError(t, err)
 
-	notificationChannelService.On("ListNotificationChannelsByType", mock.Anything, mock.Anything).Maybe().Return(nil, nil)
+	notificationChannelService.EXPECT().ListNotificationChannelsByType(mock.Anything, mock.Anything).Maybe().Return(nil, nil)
+	notificationChannelService.EXPECT().DeleteNotificationChannel(mock.Anything, mock.Anything).Maybe().Return(nil, nil)
 
 	NewMailController(router, notificationChannelService, mailChannelService, authMiddleware, registry)
 	return router
 }
 
-func TestMailController_ForbiddenRoles(t *testing.T) {
+func TestMailController_Permissions(t *testing.T) {
 	t.Parallel()
 
-	forbiddenRoles := []string{iam.OsiViewer, iam.User, iam.OsiUser, iam.OsiAdmin, iam.Notification}
-
-	endpoints := []struct {
+	var endpoints = []struct {
 		name   string
 		method string
 		path   string
@@ -362,39 +366,39 @@ func TestMailController_ForbiddenRoles(t *testing.T) {
 		{"Check mail server", http.MethodPost, "/notification-channel/mail/" + uuid.NewString() + "/check"},
 	}
 
-	for _, role := range forbiddenRoles {
+	tests := []struct {
+		role      string
+		wantAllow bool
+	}{
+		// ensure this is the same as in iam/roles.go
+		{iam.OsiViewer, false},
+		{iam.User, false},
+		{iam.OsiUser, false},
+		{iam.OsiAdmin, false},
+		{iam.Admin, true},
+		{iam.NotificationAdmin, true},
+		{iam.Notification, false},
+	}
+
+	for _, tt := range tests {
 		for _, ep := range endpoints {
-			t.Run(ep.name+" is forbidden for role "+role, func(t *testing.T) {
+			t.Run(ep.name+" as "+tt.role, func(t *testing.T) {
 				t.Parallel()
 
 				router := setupWithAuth(t)
 
-				httpassert.New(t, router).
-					Perform(ep.method, ep.path).
-					AuthJwt(integrationTests.CreateJwtTokenWithRole(role)).
-					Expect().
-					StatusCode(http.StatusForbidden)
+				req, _ := http.NewRequest(ep.method, ep.path, nil)
+				req.Header.Set("Authorization", "Bearer "+integrationTests.CreateJwtTokenWithRole(tt.role))
+				w := httptest.NewRecorder()
+				router.ServeHTTP(w, req)
+
+				if tt.wantAllow {
+					require.NotEqual(t, http.StatusUnauthorized, w.Code)
+					require.NotEqual(t, http.StatusForbidden, w.Code)
+				} else {
+					require.Equal(t, http.StatusForbidden, w.Code)
+				}
 			})
 		}
 	}
 }
-
-func TestMailController_AllowedRoles(t *testing.T) {
-	t.Parallel()
-
-	allowedRoles := []string{iam.Admin, iam.NotificationAdmin}
-
-	for _, role := range allowedRoles {
-		t.Run("List mail channels is allowed for role "+role, func(t *testing.T) {
-			t.Parallel()
-
-			router := setupWithAuth(t)
-
-			httpassert.New(t, router).
-				Get("/notification-channel/mail").
-				AuthJwt(integrationTests.CreateJwtTokenWithRole(role)).
-				Expect().
-				StatusCode(http.StatusOK)
-		})
-	}
-}

pkg/web/mattermostcontroller/mattermostController_test.go

@@ -1,13 +1,17 @@
+// SPDX-FileCopyrightText: 2026 Greenbone AG <https://greenbone.net>
+//
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
 package mattermostcontroller
 
 import (
 	"net/http"
+	"net/http/httptest"
 	"testing"
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
 	"github.com/greenbone/keycloak-client-golang/auth"
-	"github.com/greenbone/opensight-golang-libraries/pkg/httpassert"
 	"github.com/greenbone/opensight-notification-service/pkg/services/notificationchannelservice/mocks"
 	"github.com/greenbone/opensight-notification-service/pkg/web/errmap"
 	"github.com/greenbone/opensight-notification-service/pkg/web/iam"
@@ -17,7 +21,7 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func setup(t *testing.T) *gin.Engine {
+func setupWithAuth(t *testing.T) *gin.Engine {
 	registry := errmap.NewRegistry()
 	router := testhelper.NewTestWebEngine(registry)
 	notificationChannelService := mocks.NewNotificationChannelService(t)
@@ -26,60 +30,61 @@ func setup(t *testing.T) *gin.Engine {
 	authMiddleware, err := auth.NewGinAuthMiddleware(integrationTests.NewTestJwtParser(t))
 	require.NoError(t, err)
 
-	// We only test permissions, the method itself is not part of these tests.
-	notificationChannelService.
-		On("ListNotificationChannelsByType", mock.Anything, mock.Anything).
-		Maybe().
-		Return(nil, nil)
+	notificationChannelService.EXPECT().ListNotificationChannelsByType(mock.Anything, mock.Anything).Maybe().Return(nil, nil)
+	notificationChannelService.EXPECT().DeleteNotificationChannel(mock.Anything, mock.Anything).Maybe().Return(nil, nil)
 
 	NewMattermostController(router, notificationChannelService, mattermostChannelService, authMiddleware, registry)
 	return router
 }
 
-func TestMattermostController_ForbiddenRoles(t *testing.T) {
-	router := setup(t)
-
-	forbiddenRoles := []string{iam.OsiViewer, iam.User, iam.OsiUser, iam.OsiAdmin, iam.Notification}
+func TestMattermostController_Permissions(t *testing.T) {
+	t.Parallel()
 
-	type endpoint struct {
+	var endpoints = []struct {
 		name   string
 		method string
 		path   string
-	}
-
-	endpoints := []endpoint{
+	}{
 		{"Create mattermost channel", http.MethodPost, "/notification-channel/mattermost"},
 		{"List mattermost channels", http.MethodGet, "/notification-channel/mattermost"},
 		{"Update mattermost channel", http.MethodPut, "/notification-channel/mattermost/" + uuid.NewString()},
 		{"Delete mattermost channel", http.MethodDelete, "/notification-channel/mattermost/" + uuid.NewString()},
 		{"Check mattermost channel", http.MethodPost, "/notification-channel/mattermost/check"},
 	}
 
-	for _, role := range forbiddenRoles {
-		for _, ep := range endpoints {
-			t.Run(ep.name+" is forbidden for role "+role, func(t *testing.T) {
-				httpassert.New(t, router).
-					Perform(ep.method, ep.path).
-					AuthJwt(integrationTests.CreateJwtTokenWithRole(role)).
-					Expect().
-					StatusCode(http.StatusForbidden)
-			})
-		}
+	tests := []struct {
+		role      string
+		wantAllow bool
+	}{
+		// ensure this is the same as in iam/roles.go
+		{iam.OsiViewer, false},
+		{iam.User, false},
+		{iam.OsiUser, false},
+		{iam.OsiAdmin, false},
+		{iam.Admin, true},
+		{iam.NotificationAdmin, true},
+		{iam.Notification, false},
 	}
-}
 
-func TestMattermostController_AllowedRoles(t *testing.T) {
-	router := setup(t)
+	for _, tt := range tests {
+		for _, ep := range endpoints {
+			t.Run(ep.name+" as "+tt.role, func(t *testing.T) {
+				t.Parallel()
+
+				router := setupWithAuth(t)
 
-	allowedRoles := []string{iam.Admin, iam.NotificationAdmin}
+				req, _ := http.NewRequest(ep.method, ep.path, nil)
+				req.Header.Set("Authorization", "Bearer "+integrationTests.CreateJwtTokenWithRole(tt.role))
+				w := httptest.NewRecorder()
+				router.ServeHTTP(w, req)
 
-	for _, role := range allowedRoles {
-		t.Run("Access is granted for role "+role, func(t *testing.T) {
-			httpassert.New(t, router).
-				Get(`/notification-channel/mattermost`).
-				AuthJwt(integrationTests.CreateJwtTokenWithRole(role)).
-				Expect().
-				StatusCode(http.StatusOK)
-		})
+				if tt.wantAllow {
+					require.NotEqual(t, http.StatusUnauthorized, w.Code)
+					require.NotEqual(t, http.StatusForbidden, w.Code)
+				} else {
+					require.Equal(t, http.StatusForbidden, w.Code)
+				}
+			})
+		}
 	}
 }