remove: remove obsolete nested roles user and admin

pkg/web/iam/roles.go

@@ -6,9 +6,7 @@ package iam
 
 const (
 	OsiViewer         = "osi.viewer"
-	User              = "user" // Stays to ensure backwards compatibility
 	OsiUser           = "osi.user"
-	Admin             = "admin" // Stays to ensure backwards compatibility
 	OsiAdmin          = "osi.admin"
 	Notification      = "opensight_notification_role" // Only a service user
 	NotificationAdmin = "notification.admin"          // Same as Admin

pkg/web/integrationTests/testJwtParser.go

@@ -8,13 +8,12 @@ import (
 	"context"
 	"fmt"
 	"strings"
-	"testing"
 
 	"github.com/golang-jwt/jwt/v5"
 	"github.com/greenbone/keycloak-client-golang/auth"
 )
 
-func NewTestJwtParser(t *testing.T) func(
+func NewTestJwtParser() func(
 	ctx context.Context,
 	authorizationHeader string,
 	originHeader string,

pkg/web/mailcontroller/checkMailServer.go

@@ -29,7 +29,7 @@ func AddCheckMailServerController(
 	}
 
 	group := router.Group("/notification-channel/mail").
-		Use(middleware.AuthorizeRoles(auth, iam.Admin, iam.OsiAdmin, iam.NotificationAdmin)...)
+		Use(middleware.AuthorizeRoles(auth, iam.OsiAdmin, iam.NotificationAdmin)...)
 
 	group.POST("/check", ctrl.CheckMailServer)
 

pkg/web/mailcontroller/checkMailServer_test.go

@@ -29,7 +29,7 @@ func setup(t *testing.T) (*gin.Engine, *mocks.MailChannelService) {
 
 	notificationChannelServicer := mocks.NewMailChannelService(t)
 
-	authMiddleware, err := auth.NewGinAuthMiddleware(integrationTests.NewTestJwtParser(t))
+	authMiddleware, err := auth.NewGinAuthMiddleware(integrationTests.NewTestJwtParser())
 	require.NoError(t, err)
 
 	AddCheckMailServerController(engine, notificationChannelServicer, authMiddleware, registry)
@@ -161,10 +161,8 @@ func TestCheckMailServer_Permissions(t *testing.T) {
 	}{
 		// ensure this is the same as in iam/roles.go
 		{iam.OsiViewer, false},
-		{iam.User, false},
 		{iam.OsiUser, false},
 		{iam.OsiAdmin, true},
-		{iam.Admin, true},
 		{iam.NotificationAdmin, true},
 		{iam.Notification, false},
 	}

pkg/web/mailcontroller/mailController.go

@@ -56,7 +56,7 @@ func (mc *MailController) configureMappings(r errmap.ErrorRegistry) {
 
 func (mc *MailController) registerRoutes(router gin.IRouter, auth gin.HandlerFunc) {
 	group := router.Group("/notification-channel/mail").
-		Use(middleware.AuthorizeRoles(auth, iam.Admin, iam.OsiAdmin, iam.NotificationAdmin)...)
+		Use(middleware.AuthorizeRoles(auth, iam.OsiAdmin, iam.NotificationAdmin)...)
 	group.POST("", mc.CreateMailChannel)
 	group.GET("", mc.ListMailChannelsByType)
 	group.PUT("/:id", mc.UpdateMailChannel)

pkg/web/mailcontroller/mailController_integration_test.go

@@ -6,9 +6,12 @@ import (
 	"testing"
 
 	"github.com/gin-gonic/gin"
+	"github.com/greenbone/keycloak-client-golang/auth"
 	"github.com/greenbone/opensight-golang-libraries/pkg/httpassert"
 	"github.com/greenbone/opensight-notification-service/pkg/services/notificationchannelservice"
 	"github.com/greenbone/opensight-notification-service/pkg/web/errmap"
+	"github.com/greenbone/opensight-notification-service/pkg/web/iam"
+	"github.com/greenbone/opensight-notification-service/pkg/web/integrationTests"
 	"github.com/greenbone/opensight-notification-service/pkg/web/testhelper"
 	"github.com/jmoiron/sqlx"
 	_ "github.com/lib/pq"
@@ -23,12 +26,14 @@ func TestIntegration_MailController_CRUD(t *testing.T) {
 	t.Run("Perform all the CRUD operations", func(t *testing.T) {
 		router, db := setupTestRouter(t)
 		defer func() { _ = db.Close() }()
+		jwt := integrationTests.CreateJwtTokenWithRole(iam.NotificationAdmin)
 
 		request := httpassert.New(t, router)
 
 		// --- Create ---
 		var mailId string
 		request.Post("/notification-channel/mail").
+			AuthJwt(jwt).
 			JsonContentObject(valid).
 			Expect().
 			StatusCode(http.StatusCreated).
@@ -47,6 +52,7 @@ func TestIntegration_MailController_CRUD(t *testing.T) {
 
 		// --- List ---
 		request.Get("/notification-channel/mail").
+			AuthJwt(jwt).
 			Expect().
 			StatusCode(http.StatusOK).
 			JsonPath("$", httpassert.HasSize(1)).
@@ -68,6 +74,7 @@ func TestIntegration_MailController_CRUD(t *testing.T) {
 		newName := "updated"
 		updated.ChannelName = newName
 		request.Put("/notification-channel/mail/"+mailId).
+			AuthJwt(jwt).
 			JsonContentObject(updated).
 			Expect().
 			StatusCode(http.StatusOK).
@@ -85,11 +92,13 @@ func TestIntegration_MailController_CRUD(t *testing.T) {
 
 		// --- Delete ---
 		request.Delete("/notification-channel/mail/" + mailId).
+			AuthJwt(jwt).
 			Expect().
 			StatusCode(http.StatusNoContent)
 
 		// --- List after delete ---
 		request.Get("/notification-channel/mail").
+			AuthJwt(jwt).
 			Expect().
 			StatusCode(http.StatusOK).
 			JsonPath("$", httpassert.HasSize(0))
@@ -98,12 +107,14 @@ func TestIntegration_MailController_CRUD(t *testing.T) {
 	t.Run("Update password with Update Mail", func(t *testing.T) {
 		router, db := setupTestRouter(t)
 		defer db.Close()
+		jwt := integrationTests.CreateJwtTokenWithRole(iam.NotificationAdmin)
 
 		request := httpassert.New(t, router)
 		var mailId string
 
 		// --- Create ---
 		request.Post("/notification-channel/mail").
+			AuthJwt(jwt).
 			JsonContentObject(valid).
 			Expect().
 			StatusCode(http.StatusCreated).
@@ -132,6 +143,7 @@ func TestIntegration_MailController_CRUD(t *testing.T) {
 		newName := "updated"
 		updated.ChannelName = newName
 		request.Put("/notification-channel/mail/"+mailId).
+			AuthJwt(jwt).
 			JsonContentObject(updated).
 			Expect().
 			StatusCode(http.StatusOK).
@@ -162,8 +174,10 @@ func setupTestRouter(t *testing.T) (*gin.Engine, *sqlx.DB) {
 
 	registry := errmap.NewRegistry()
 	router := testhelper.NewTestWebEngine(registry)
+	authMiddleware, err := auth.NewGinAuthMiddleware(integrationTests.NewTestJwtParser())
+	require.NoError(t, err)
 
-	NewMailController(router, svc, mailSvc, testhelper.MockAuthMiddlewareWithAdmin, registry)
+	NewMailController(router, svc, mailSvc, authMiddleware, registry)
 
 	return router, db
 }

pkg/web/mailcontroller/mailController_test.go

@@ -41,11 +41,13 @@ func getValidNotificationChannel() models.NotificationChannel {
 	}
 }
 
-func setupRouter(service *mocks.NotificationChannelService, mailService *mocks.MailChannelService) *gin.Engine {
+func setupRouter(t *testing.T, service *mocks.NotificationChannelService, mailService *mocks.MailChannelService) *gin.Engine {
 	registry := errmap.NewRegistry()
 	engine := testhelper.NewTestWebEngine(registry)
+	authMiddleware, err := auth.NewGinAuthMiddleware(integrationTests.NewTestJwtParser())
+	require.NoError(t, err)
 
-	NewMailController(engine, service, mailService, testhelper.MockAuthMiddlewareWithAdmin, registry)
+	NewMailController(engine, service, mailService, authMiddleware, registry)
 	return engine
 }
 
@@ -96,17 +98,18 @@ func TestMailController_CreateMailChannel(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			jwt := integrationTests.CreateJwtTokenWithRole(iam.NotificationAdmin)
 			mockService := mocks.NewNotificationChannelService(t)
 			mockMailService := mocks.NewMailChannelService(t)
-			router := setupRouter(mockService, mockMailService)
+			router := setupRouter(t, mockService, mockMailService)
 
 			if tt.wantStatusCode == http.StatusCreated || tt.wantStatusCode == http.StatusInternalServerError {
 				mockMailService.On("CreateMailChannel", mock.Anything, mock.Anything).
 					Return(tt.mockReturn, tt.mockErr).
 					Once()
 			}
 
-			req := httpassert.New(t, router).Post("/notification-channel/mail")
+			req := httpassert.New(t, router).Post("/notification-channel/mail").AuthJwt(jwt)
 			if tt.input != nil {
 				req.JsonContentObject(tt.input)
 			}
@@ -174,14 +177,15 @@ func TestMailController_ListMailChannelsByType(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			jwt := integrationTests.CreateJwtTokenWithRole(iam.NotificationAdmin)
 			mockService := mocks.NewNotificationChannelService(t)
-			router := setupRouter(mockService, nil)
+			router := setupRouter(t, mockService, nil)
 
 			mockService.On("ListNotificationChannelsByType", mock.Anything, tt.queryType).
 				Return(tt.mockReturn, tt.mockErr).
 				Once()
 
-			req := httpassert.New(t, router).Get("/notification-channel/mail")
+			req := httpassert.New(t, router).Get("/notification-channel/mail").AuthJwt(jwt)
 			resp := req.Expect()
 			resp.StatusCode(tt.wantStatusCode)
 			if tt.wantStatusCode == http.StatusOK {
@@ -244,16 +248,17 @@ func TestMailController_UpdateMailChannel(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			jwt := integrationTests.CreateJwtTokenWithRole(iam.NotificationAdmin)
 			mockService := mocks.NewNotificationChannelService(t)
 			mockMailService := mocks.NewMailChannelService(t)
-			router := setupRouter(mockService, mockMailService)
+			router := setupRouter(t, mockService, mockMailService)
 
 			if tt.wantStatusCode == http.StatusOK || tt.wantStatusCode == http.StatusInternalServerError {
 				mockService.On("UpdateNotificationChannel", mock.Anything, tt.id, mock.Anything).
 					Return(tt.mockReturn, tt.mockErr).
 					Once()
 			}
-			req := httpassert.New(t, router).Put("/notification-channel/mail/" + tt.id)
+			req := httpassert.New(t, router).Put("/notification-channel/mail/" + tt.id).AuthJwt(jwt)
 			if tt.input != nil {
 				req.JsonContentObject(tt.input)
 			}
@@ -308,14 +313,15 @@ func TestMailController_DeleteMailChannel(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			jwt := integrationTests.CreateJwtTokenWithRole(iam.NotificationAdmin)
 			mockService := mocks.NewNotificationChannelService(t)
-			router := setupRouter(mockService, nil)
+			router := setupRouter(t, mockService, nil)
 
 			mockService.On("DeleteNotificationChannel", mock.Anything, tt.id).
 				Return(tt.mockErr).
 				Once()
 
-			req := httpassert.New(t, router).Delete("/notification-channel/mail/" + tt.id)
+			req := httpassert.New(t, router).Delete("/notification-channel/mail/" + tt.id).AuthJwt(jwt)
 			resp := req.Expect()
 			resp.StatusCode(tt.wantStatusCode)
 			if tt.wantStatusCode == http.StatusNoContent {
@@ -341,7 +347,7 @@ func setupWithAuth(t *testing.T) *gin.Engine {
 	notificationChannelService := mocks.NewNotificationChannelService(t)
 	mailChannelService := mocks.NewMailChannelService(t)
 
-	authMiddleware, err := auth.NewGinAuthMiddleware(integrationTests.NewTestJwtParser(t))
+	authMiddleware, err := auth.NewGinAuthMiddleware(integrationTests.NewTestJwtParser())
 	require.NoError(t, err)
 
 	notificationChannelService.EXPECT().ListNotificationChannelsByType(mock.Anything, mock.Anything).Maybe().Return(nil, nil)
@@ -372,10 +378,8 @@ func TestMailController_Permissions(t *testing.T) {
 	}{
 		// ensure this is the same as in iam/roles.go
 		{iam.OsiViewer, false},
-		{iam.User, false},
 		{iam.OsiUser, false},
 		{iam.OsiAdmin, true},
-		{iam.Admin, true},
 		{iam.NotificationAdmin, true},
 		{iam.Notification, false},
 	}

pkg/web/mailcontroller/negative_usecases_test.go

@@ -6,6 +6,8 @@ import (
 	"time"
 
 	"github.com/greenbone/opensight-golang-libraries/pkg/httpassert"
+	"github.com/greenbone/opensight-notification-service/pkg/web/iam"
+	"github.com/greenbone/opensight-notification-service/pkg/web/integrationTests"
 	"github.com/greenbone/opensight-notification-service/pkg/web/testhelper"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -19,12 +21,14 @@ func TestIntegration_MailController_Negative_Cases(t *testing.T) {
 	t.Run("Check if Create/List/Update Mail Notification doesnt return password", func(t *testing.T) {
 		router, db := setupTestRouter(t)
 		defer db.Close()
+		jwt := integrationTests.CreateJwtTokenWithRole(iam.NotificationAdmin)
 
 		request := httpassert.New(t, router)
 
 		var mailId string
 		// --- Create ---
 		createBody := request.Post("/notification-channel/mail").
+			AuthJwt(jwt).
 			JsonContentObject(valid).
 			Expect().
 			StatusCode(http.StatusCreated).
@@ -36,6 +40,7 @@ func TestIntegration_MailController_Negative_Cases(t *testing.T) {
 
 		// --- List ---
 		listBody := request.Get("/notification-channel/mail").
+			AuthJwt(jwt).
 			Expect().
 			StatusCode(http.StatusOK).
 			JsonPath("$", httpassert.HasSize(1)).
@@ -48,6 +53,7 @@ func TestIntegration_MailController_Negative_Cases(t *testing.T) {
 		newName := "updated"
 		updated.ChannelName = newName
 		updateBody := request.Put("/notification-channel/mail/"+mailId).
+			AuthJwt(jwt).
 			JsonContentObject(updated).
 			Expect().
 			StatusCode(http.StatusOK).
@@ -60,12 +66,14 @@ func TestIntegration_MailController_Negative_Cases(t *testing.T) {
 	t.Run("Do not update password in Update Mail if it passed as nil", func(t *testing.T) {
 		router, db := setupTestRouter(t)
 		defer db.Close()
+		jwt := integrationTests.CreateJwtTokenWithRole(iam.NotificationAdmin)
 
 		request := httpassert.New(t, router)
 		var mailId string
 
 		// --- Create ---
 		request.Post("/notification-channel/mail").
+			AuthJwt(jwt).
 			JsonContentObject(valid).
 			Expect().
 			StatusCode(http.StatusCreated).
@@ -84,6 +92,7 @@ func TestIntegration_MailController_Negative_Cases(t *testing.T) {
 		newName := "updated"
 		updated.ChannelName = newName
 		request.Put("/notification-channel/mail/"+mailId).
+			AuthJwt(jwt).
 			JsonContentObject(updated).
 			Expect().
 			StatusCode(http.StatusOK).
@@ -99,19 +108,22 @@ func TestIntegration_MailController_Negative_Cases(t *testing.T) {
 	t.Run("Creating two Mail configs with same name", func(t *testing.T) {
 		router, db := setupTestRouter(t)
 		defer db.Close()
+		jwt := integrationTests.CreateJwtTokenWithRole(iam.NotificationAdmin)
 
 		request := httpassert.New(t, router)
 		var mailId string
 
 		// --- Create ---
 		request.Post("/notification-channel/mail").
+			AuthJwt(jwt).
 			JsonContentObject(valid).
 			Expect().
 			StatusCode(http.StatusCreated).
 			JsonPath("$.id", httpassert.ExtractTo(&mailId))
 		require.NotEmpty(t, mailId)
 
 		request.Post("/notification-channel/mail").
+			AuthJwt(jwt).
 			JsonContentObject(valid).
 			Expect().
 			StatusCode(http.StatusUnprocessableEntity)

pkg/web/mattermostcontroller/mattermostController.go

@@ -34,7 +34,7 @@ func NewMattermostController(
 	}
 
 	group := router.Group("/notification-channel/mattermost").
-		Use(middleware.AuthorizeRoles(auth, iam.Admin, iam.OsiAdmin, iam.NotificationAdmin)...)
+		Use(middleware.AuthorizeRoles(auth, iam.OsiAdmin, iam.NotificationAdmin)...)
 	group.Use(errorHandler(gin.ErrorTypePrivate))
 
 	group.POST("", ctrl.createMattermostChannel)

pkg/web/mattermostcontroller/mattermostController_test.go

@@ -27,7 +27,7 @@ func setupWithAuth(t *testing.T) *gin.Engine {
 	notificationChannelService := mocks.NewNotificationChannelService(t)
 	mattermostChannelService := mocks.NewMattermostChannelService(t)
 
-	authMiddleware, err := auth.NewGinAuthMiddleware(integrationTests.NewTestJwtParser(t))
+	authMiddleware, err := auth.NewGinAuthMiddleware(integrationTests.NewTestJwtParser())
 	require.NoError(t, err)
 
 	notificationChannelService.EXPECT().ListNotificationChannelsByType(mock.Anything, mock.Anything).Maybe().Return(nil, nil)
@@ -58,10 +58,8 @@ func TestMattermostController_Permissions(t *testing.T) {
 	}{
 		// ensure this is the same as in iam/roles.go
 		{iam.OsiViewer, false},
-		{iam.User, false},
 		{iam.OsiUser, false},
 		{iam.OsiAdmin, true},
-		{iam.Admin, true},
 		{iam.NotificationAdmin, true},
 		{iam.Notification, false},
 	}