Add users list support in store check tests

aaguiarz · aaguiarz · commit 2ca7968c32f1 · 2025-06-09T12:36:40.000-03:00
diff --git a/README.md b/README.md
@@ -303,6 +303,13 @@ tests:
           assertions:
             member: true
             moderator: false
+      # checks can also be defined for multiple users sharing the same expectation
+      - object: group:employees
+        users:
+          - user: user:3
+          - user: user:4
+        assertions:
+          member: true
 ```
 
 If using `output-file`, the response will be written to the specified file on disk. If the desired file already exists, you will be prompted to overwrite the file.
@@ -558,19 +565,26 @@ tests: # required
   - name: test-1
     description: testing that the model works # optional
     # tuple_file: ./tuples.json # tuples that would apply per test
-    tuples:
-      - user: user:anne
-        relation: owner
-        object: folder:1
-    check: # a set of checks to run
-      - user: user:anne
-        object: folder:1
-        assertions:
-          # a set of expected results for each relation
-          can_view: true
-          can_write: true
-          can_share: false
-    list_objects: # a set of list objects to run
+      tuples:
+        - user: user:anne
+          relation: owner
+          object: folder:1
+      check: # a set of checks to run
+        - user: user:anne
+          object: folder:1
+          assertions:
+            # a set of expected results for each relation
+            can_view: true
+            can_write: true
+            can_share: false
+        # checks can group multiple users that share the same expected results
+        - object: folder:2
+          users:
+            - user:beth
+            - user:carl
+          assertions:
+            can_view: false
+      list_objects: # a set of list objects to run
       - user: user:anne
         type: folder
         assertions:
diff --git a/cmd/store/import.go b/cmd/store/import.go
@@ -232,13 +232,20 @@ func getCheckAssertions(checkTests []storetest.ModelTestCheck) []client.ClientAs
 	var assertions []client.ClientAssertion
 
 	for _, checkTest := range checkTests {
-		for relation, expectation := range checkTest.Assertions {
-			assertions = append(assertions, client.ClientAssertion{
-				User:        checkTest.User,
-				Relation:    relation,
-				Object:      checkTest.Object,
-				Expectation: expectation,
-			})
+		users := []string{checkTest.User}
+		if len(checkTest.Users) > 0 {
+			users = checkTest.Users
+		}
+
+		for _, user := range users {
+			for relation, expectation := range checkTest.Assertions {
+				assertions = append(assertions, client.ClientAssertion{
+					User:        user,
+					Relation:    relation,
+					Object:      checkTest.Object,
+					Expectation: expectation,
+				})
+			}
 		}
 	}
 
diff --git a/cmd/store/import_test.go b/cmd/store/import_test.go
@@ -21,6 +21,21 @@ func TestImportStore(t *testing.T) {
 		Object:      "document:doc1",
 		Expectation: true,
 	}}
+
+	multiUserAssertions := []client.ClientAssertion{
+		{
+			User:        "user:anne",
+			Relation:    "reader",
+			Object:      "document:doc1",
+			Expectation: true,
+		},
+		{
+			User:        "user:peter",
+			Relation:    "reader",
+			Object:      "document:doc1",
+			Expectation: true,
+		},
+	}
 	modelID, storeID := "model-1", "store-1"
 	expectedOptions := client.ClientWriteAssertionsOptions{AuthorizationModelId: &modelID, StoreId: &storeID}
 
@@ -38,9 +53,9 @@ func TestImportStore(t *testing.T) {
 			mockCreateStore:     true,
 			testStore: storetest.StoreData{
 				Model: `type user
-					type document
-						relations
-							define reader: [user]`,
+                                        type document
+                                                relations
+                                                        define reader: [user]`,
 				Tests: []storetest.ModelTest{
 					{
 						Name: "Test",
@@ -55,6 +70,30 @@ func TestImportStore(t *testing.T) {
 				},
 			},
 		},
+		{
+			name:                "import store with multi user assertions",
+			mockWriteAssertions: true,
+			mockWriteModel:      true,
+			mockCreateStore:     true,
+			testStore: storetest.StoreData{
+				Model: `type user
+                                        type document
+                                                relations
+                                                        define reader: [user]`,
+				Tests: []storetest.ModelTest{
+					{
+						Name: "Test",
+						Check: []storetest.ModelTestCheck{
+							{
+								Users:      []string{"user:anne", "user:peter"},
+								Object:     "document:doc1",
+								Assertions: map[string]bool{"reader": true},
+							},
+						},
+					},
+				},
+			},
+		},
 		{
 			name:                "create new store without assertions",
 			mockWriteAssertions: false,
@@ -107,7 +146,11 @@ func TestImportStore(t *testing.T) {
 			defer mockCtrl.Finish()
 
 			if test.mockWriteAssertions {
-				setupWriteAssertionsMock(mockCtrl, mockFgaClient, expectedAssertions, expectedOptions)
+				expected := expectedAssertions
+				if test.name == "import store with multi user assertions" {
+					expected = multiUserAssertions
+				}
+				setupWriteAssertionsMock(mockCtrl, mockFgaClient, expected, expectedOptions)
 			} else {
 				mockFgaClient.EXPECT().WriteAssertions(gomock.Any()).Times(0)
 			}
diff --git a/internal/storetest/localtest.go b/internal/storetest/localtest.go
@@ -24,55 +24,63 @@ func RunLocalCheckTest(
 	tuples []client.ClientContextualTupleKey,
 	options ModelTestOptions,
 ) []ModelTestCheckSingleResult {
-	results := []ModelTestCheckSingleResult{}
 
-	for relation, expectation := range checkTest.Assertions {
-		result := ModelTestCheckSingleResult{
-			Request: client.ClientCheckRequest{
-				User:             checkTest.User,
-				Relation:         relation,
-				Object:           checkTest.Object,
-				ContextualTuples: tuples,
-				Context:          checkTest.Context,
-			},
-			Expected: expectation,
-		}
-
-		var (
-			ctx *structpb.Struct
-			err error
-		)
+	results := []ModelTestCheckSingleResult{}
 
-		if checkTest.Context != nil {
-			ctx, err = structpb.NewStruct(*checkTest.Context)
-		}
+	users := []string{checkTest.User}
+	if len(checkTest.Users) > 0 {
+		users = checkTest.Users
+	}
 
-		if err != nil {
-			result.Error = err
-		} else {
-			response, err := RunSingleLocalCheckTest(fgaServer,
-				&pb.CheckRequest{
-					StoreId:              *options.StoreID,
-					AuthorizationModelId: *options.ModelID,
-					TupleKey: &pb.CheckRequestTupleKey{
-						User:     checkTest.User,
-						Relation: relation,
-						Object:   checkTest.Object,
-					},
-					Context: ctx,
+	for _, user := range users {
+		for relation, expectation := range checkTest.Assertions {
+			result := ModelTestCheckSingleResult{
+				Request: client.ClientCheckRequest{
+					User:             user,
+					Relation:         relation,
+					Object:           checkTest.Object,
+					ContextualTuples: tuples,
+					Context:          checkTest.Context,
 				},
+				Expected: expectation,
+			}
+
+			var (
+				ctx *structpb.Struct
+				err error
 			)
+
+			if checkTest.Context != nil {
+				ctx, err = structpb.NewStruct(*checkTest.Context)
+			}
+
 			if err != nil {
 				result.Error = err
-			}
+			} else {
+				response, err := RunSingleLocalCheckTest(fgaServer,
+					&pb.CheckRequest{
+						StoreId:              *options.StoreID,
+						AuthorizationModelId: *options.ModelID,
+						TupleKey: &pb.CheckRequestTupleKey{
+							User:     user,
+							Relation: relation,
+							Object:   checkTest.Object,
+						},
+						Context: ctx,
+					},
+				)
+				if err != nil {
+					result.Error = err
+				}
 
-			if response != nil {
-				result.Got = &response.Allowed
-				result.TestResult = result.IsPassing()
+				if response != nil {
+					result.Got = &response.Allowed
+					result.TestResult = result.IsPassing()
+				}
 			}
-		}
 
-		results = append(results, result)
+			results = append(results, result)
+		}
 	}
 
 	return results
diff --git a/internal/storetest/remotetest.go b/internal/storetest/remotetest.go
@@ -34,19 +34,26 @@ func RunRemoteCheckTest(
 ) []ModelTestCheckSingleResult {
 	results := []ModelTestCheckSingleResult{}
 
-	for relation, expectation := range checkTest.Assertions {
-		result := RunSingleRemoteCheckTest(
-			fgaClient,
-			client.ClientCheckRequest{
-				User:             checkTest.User,
-				Relation:         relation,
-				Object:           checkTest.Object,
-				Context:          checkTest.Context,
-				ContextualTuples: tuples,
-			},
-			expectation,
-		)
-		results = append(results, result)
+	users := []string{checkTest.User}
+	if len(checkTest.Users) > 0 {
+		users = checkTest.Users
+	}
+
+	for _, user := range users {
+		for relation, expectation := range checkTest.Assertions {
+			result := RunSingleRemoteCheckTest(
+				fgaClient,
+				client.ClientCheckRequest{
+					User:             user,
+					Relation:         relation,
+					Object:           checkTest.Object,
+					Context:          checkTest.Context,
+					ContextualTuples: tuples,
+				},
+				expectation,
+			)
+			results = append(results, result)
+		}
 	}
 
 	return results
diff --git a/internal/storetest/storedata.go b/internal/storetest/storedata.go
@@ -31,6 +31,7 @@ import (
 
 type ModelTestCheck struct {
 	User       string                  `json:"user"       yaml:"user"`
+	Users      []string                `json:"users"      yaml:"users"`
 	Object     string                  `json:"object"     yaml:"object"`
 	Context    *map[string]interface{} `json:"context"    yaml:"context,omitempty"`
 	Assertions map[string]bool         `json:"assertions" yaml:"assertions"`
