File size: 6,365 Bytes
60e3a80
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
import hypothesis.strategies as st
import tempfile
from typing import Any, Dict, List, Optional
import yaml

import string

from chromadb import TokenTransportHeader
from chromadb.test.property.strategies import collection_name


@st.composite
def many_unique_names(draw: st.DrawFn) -> List[str]:
    # This is ugly -- is there a better way to guarantee ("guarantee")
    # that we have enough unique names?

    # 10 tests, <= 10 users, 2 iterations through the space, <= 2 names per action
    length = len(valid_action_space) * 10 * 10 * 2 * 2
    names = draw(
        st.lists(
            collection_name(),
            min_size=length,
            max_size=length,
        )
    )
    seen = set()
    unseen = []
    for name in names:
        if name in seen:
            continue
        seen.add(name)
        unseen.append(name)
    return unseen


@st.composite
def random_token(draw: st.DrawFn) -> str:
    return draw(
        st.text(alphabet=string.ascii_letters + string.digits, min_size=1, max_size=50)
    )


@st.composite
def random_token_transport_header(draw: st.DrawFn) -> Optional[str]:
    return draw(
        st.sampled_from(
            [
                TokenTransportHeader.AUTHORIZATION,
                TokenTransportHeader.X_CHROMA_TOKEN,
                None,
            ]
        )
    )


@st.composite
def random_user_name(draw: st.DrawFn) -> str:
    return draw(st.text(alphabet=string.ascii_letters, min_size=1, max_size=20))


@st.composite
def random_users_with_tokens(draw: st.DrawFn) -> List[Dict[str, Any]]:
    users = draw(
        st.lists(
            st.fixed_dictionaries(
                {
                    "id": random_user_name(),
                    "tokens": st.lists(random_token(), min_size=3, max_size=10),
                }
            ),
            min_size=1,
            max_size=1,
        )
    )
    unseen_users = []
    seen_users = set()
    seen_tokens = set()
    for user in users:
        if user["id"] in seen_users:
            break
        for token in user["tokens"]:
            if token in seen_tokens:
                break
    else:
        seen_users.add(user["id"])
        for token in user["tokens"]:
            seen_tokens.add(token)

        unseen_users.append(user)
    return unseen_users


@st.composite
def token_test_conf(draw: st.DrawFn) -> Dict[str, Any]:
    users = draw(random_users_with_tokens())
    filename = _dump_to_tmpfile({"users": users})
    return {"users": users, "filename": filename}


valid_action_space = [
    "system:reset",
    "tenant:create_tenant",
    "tenant:get_tenant",
    "db:create_database",
    "db:get_database",
    "db:list_collections",
    "db:create_collection",
    "db:get_or_create_collection",
    "collection:get_collection",
    "collection:delete_collection",
    "collection:update_collection",
    "collection:add",
    "collection:delete",
    "collection:get",
    "collection:query",
    "collection:peek",
    "collection:count",
    "collection:update",
    "collection:upsert",
]


def unauthorized_actions(authorized_actions: List[str]) -> List[str]:
    return [action for action in valid_action_space if action not in authorized_actions]


@st.composite
def random_role_name(draw: st.DrawFn) -> str:
    return draw(st.text(alphabet=string.ascii_letters, min_size=1, max_size=20))


@st.composite
def random_action(draw: st.DrawFn) -> str:
    return draw(st.sampled_from(valid_action_space))


@st.composite
def random_allowed_actions_for_role(draw: st.DrawFn) -> List[str]:
    actions = draw(st.sets(random_action(), min_size=1, max_size=10))

    if any(
        action in actions
        for action in [
            "collection:add",
            "collection:delete",
            "collection:get",
            "collection:query",
            "collection:peek",
            "collection:update",
            "collection:upsert",
            "collection:count",
            "collection:update_collection",
            "collection:delete_collection",
        ]
    ):
        actions.add("collection:get_collection")

    if "collection:peek" in actions:
        actions.add("collection:get")

    actions.add("tenant:get_tenant")
    actions.add("db:get_database")
    return list(actions)


@st.composite
def random_roles(draw: st.DrawFn) -> List[Dict[str, Any]]:
    roles = draw(
        st.lists(
            st.fixed_dictionaries(
                {"id": random_role_name(), "actions": random_allowed_actions_for_role()}
            ),
            min_size=1,
            max_size=10,
        ),
    )
    unseen_roles = []
    seen = set()
    for role in roles:
        if role["id"] in seen:
            continue
        seen.add(role["id"])
        unseen_roles.append(role)
    return unseen_roles


def _transform_roles_for_flush(roles: List[Dict[str, Any]]) -> Dict[str, Any]:
    roles_mapping = {}
    for role in roles:
        roles_mapping.update({role["id"]: {"actions": role["actions"]}})
    return roles_mapping


@st.composite
def random_users_and_roles(draw: st.DrawFn) -> Dict[str, Any]:
    users = draw(random_users_with_tokens())
    roles = draw(random_roles())
    for user in users:
        role_index = draw(st.integers(min_value=0, max_value=len(roles) - 1))
        user["role"] = roles[role_index]["id"]
    return {"users": users, "roles": roles}


def _root_user_and_role() -> Dict[str, Any]:
    return {
        "users": [{"id": "__root__", "tokens": ["__root__"], "role": "__root__"}],
        "roles": [{"id": "__root__", "actions": valid_action_space}],
    }


@st.composite
def rbac_test_conf(draw: st.DrawFn) -> Dict[str, Any]:
    users_and_roles = draw(random_users_and_roles())
    root_user_and_role = _root_user_and_role()
    users_and_roles["users"].extend(root_user_and_role["users"])
    users_and_roles["roles"].extend(root_user_and_role["roles"])

    filename = _dump_to_tmpfile(
        {
            "users": users_and_roles["users"],
            "roles_mapping": _transform_roles_for_flush(users_and_roles["roles"]),
        }
    )
    return {
        "users": users_and_roles["users"],
        "roles": users_and_roles["roles"],
        "filename": filename,
    }


def _dump_to_tmpfile(data: Any) -> str:
    tmp = tempfile.NamedTemporaryFile(delete=False)
    with open(tmp.name, "w") as f:
        yaml.dump(data, f)
    return tmp.name