11import pytest
22from valkeytests .conftest import resource_port_tracker
33from valkey_bloom_test_case import ValkeyBloomTestCaseBase
4+ from util .waiters import *
45
56class TestBloomACLCategory (ValkeyBloomTestCaseBase ):
67
7- def test_bloom_acl_category (self ):
8+ def test_bloom_acl_category_permissions (self ):
89 # List of bloom commands and the expected returns if the command is valid
910 bloom_commands = [
1011 ('BF.ADD add_key item' , 1 ),
@@ -19,52 +20,65 @@ def test_bloom_acl_category(self):
1920 client = self .server .get_new_client ()
2021 # Get a list of all commands with the acl category bloom
2122 list_of_bloom_commands = client .execute_command ("COMMAND LIST FILTERBY ACLCAT bloom" )
23+ # Create users with differnt acl permissions
24+ client .execute_command ("ACL SETUSER nonbloomuser1 on >bloom_pass -@bloom" )
25+ client .execute_command ("ACL SETUSER nonbloomuser2 on >bloom_pass -@all" )
26+ client .execute_command ("ACL SETUSER bloomuser1 on >bloom_pass ~* &* +@all " )
27+ client .execute_command ("ACL SETUSER bloomuser2 on >bloom_pass ~* &* -@all +@bloom " )
28+ client .execute_command ("ACL SETUSER bloomuser3 on >bloom_pass ~* &* -@all +@write +@read " )
29+ client .execute_command ("ACL SETUSER bloomuser4 on >bloom_pass ~* &* -@all +@write +@bloom" )
30+ # Switch to the users with no bloom command access and check error occurs as expected
31+ for i in range (1 , 3 ):
32+ client .execute_command (f"AUTH nonbloomuser{ i } )
33+ for cmd in bloom_commands :
34+ self .verify_invalid_user_permissions (client , cmd , list_of_bloom_commands )
35+ # Switch to the users with bloom command access and check commands are run as expected
36+ for i in range (1 , 5 ):
37+ client .execute_command (f"AUTH bloomuser{ i } )
38+ for cmd in bloom_commands :
39+ self .verify_valid_user_permissions (client , cmd )
40+ self .client .execute_command ('FLUSHDB' )
41+ wait_for_equal (lambda : self .client .execute_command ('DBSIZE' ), 0 )
2242
23- # Create two users one with denied access to bloom commands and one with access to bloom commands and all keys
24- client .execute_command ("ACL SETUSER nonbloomuser on >bloom_pass -@bloom" )
25- client .execute_command ("ACL SETUSER bloomuser on >bloom_pass +@bloom ~*" )
43+ def verify_valid_user_permissions (self , client , cmd ):
44+ cmd_name = cmd [0 ].split ()[0 ]
45+ try :
46+ result = client .execute_command (cmd [0 ])
47+ if cmd [0 ].startswith ("BF.M" ):
48+ assert len (result ) == cmd [1 ]
49+ # The first add in a new bloom object should always return 1. For MEXISTS the first item we check will have been added as well so should exist
50+ assert result [0 ] == 1
51+ else :
52+ assert result == cmd [1 ], f"{ cmd_name }
53+ except Exception as e :
54+ assert False , f"bloomuser should be able to execute { cmd_name } { str (e )}
2655
27- # Switch to the user with no bloom command access and check error occurs as expected
28- client .execute_command ("AUTH nonbloomuser bloom_pass" )
29- for cmd in bloom_commands :
30- cmd_name = cmd [0 ].split ()[0 ]
31- # Check that each command we try to run appeared in the list of commands with the bloom acl category
32- assert cmd_name .encode () in list_of_bloom_commands
33- try :
34- result = client .execute_command (cmd [0 ])
35- assert False , f"User with no bloom category access shouldnt be able to run { cmd_name }
36- except Exception as e :
37- assert str (e ) == f"User nonbloomuser has no permissions to run the '{ cmd_name }
38-
39- # Switch to the user with bloom command access and check commands are run as expected
40- client .execute_command (f"AUTH bloomuser bloom_pass" )
41- for cmd in bloom_commands :
42- cmd_name = cmd [0 ].split ()[0 ]
43- try :
44- result = client .execute_command (cmd [0 ])
45- if cmd [0 ].startswith ("BF.M" ):
46- assert len (result ) == cmd [1 ]
47- # The first add in a new bloom object should always return 1. For MEXISTS the first item we check will have been added as well so should exist
48- assert result [0 ] == 1
49- else :
50- assert result == cmd [1 ], f"{ cmd_name }
51- except Exception as e :
52- assert False , f"bloomuser should be able to execute { cmd_name } { str (e )}
56+ def verify_invalid_user_permissions (self , client , cmd , list_of_bloom_commands ):
57+ cmd_name = cmd [0 ].split ()[0 ]
58+ # Check that each command we try to run appeared in the list of commands with the bloom acl category
59+ assert cmd_name .encode () in list_of_bloom_commands
60+ try :
61+ result = client .execute_command (cmd [0 ])
62+ assert False , f"User with no bloom category access shouldnt be able to run { cmd_name }
63+ except Exception as e :
64+ assert f"has no permissions to run the '{ cmd_name } in str (e )
5365
5466 def test_bloom_command_acl_categories (self ):
5567 # List of bloom commands and their acl categories
5668 bloom_commands = [
57- ('BF.ADD' , [b'write' , b'denyoom' , b'module' , b'fast' ]),
58- ('BF.EXISTS' , [b'readonly' , b'module' , b'fast' ]),
59- ('BF.MADD' , [b'write' , b'denyoom' , b'module' , b'fast' ]),
60- ('BF.MEXISTS' , [b'readonly' , b'module' , b'fast' ]),
61- ('BF.INSERT' , [b'write' , b'denyoom' , b'module' , b'fast' ]),
62- ('BF.INFO' , [b'readonly' , b'module' , b'fast' ]),
63- ('BF.CARD' , [b'readonly' , b'module' , b'fast' ]),
64- ('BF.RESERVE' , [b'write' , b'denyoom' , b'module' , b'fast' ]),
69+ ('BF.ADD' , [b'write' , b'denyoom' , b'module' , b'fast' ], [b'@write' , b'@fast' , b'@bloom' ]),
70+ ('BF.EXISTS' , [b'readonly' , b'module' , b'fast' ], [b'@read' , b'@fast' , b'@bloom' ]),
71+ ('BF.MADD' , [b'write' , b'denyoom' , b'module' , b'fast' ], [b'@write' , b'@fast' , b'@bloom' ]),
72+ ('BF.MEXISTS' , [b'readonly' , b'module' , b'fast' ], [b'@read' , b'@fast' , b'@bloom' ]),
73+ ('BF.INSERT' , [b'write' , b'denyoom' , b'module' , b'fast' ], [b'@write' , b'@fast' , b'@bloom' ]),
74+ ('BF.INFO' , [b'readonly' , b'module' , b'fast' ], [b'@read' , b'@fast' , b'@bloom' ]),
75+ ('BF.CARD' , [b'readonly' , b'module' , b'fast' ], [b'@read' , b'@fast' , b'@bloom' ]),
76+ ('BF.RESERVE' , [b'write' , b'denyoom' , b'module' , b'fast' ], [b'@write' , b'@fast' , b'@bloom' ]),
77+ ('BF.LOAD' , [b'write' , b'denyoom' , b'module' ], [b'@write' , b'@bloom' ]),
6578 ]
6679 for cmd in bloom_commands :
6780 # Get the info of the commands and compare the acl categories
6881 cmd_info = self .client .execute_command (f'COMMAND INFO { cmd [0 ]} )
6982 assert cmd_info [0 ][2 ] == cmd [1 ]
70- assert cmd_info [0 ][6 ] == [b'@bloom' ]
83+ for category in cmd [2 ]:
84+ assert category in cmd_info [0 ][6 ]
0 commit comments