refactor

Signed-off-by: Sylwester Piskozub <sylwesterpiskozub@gmail.com>

Author: Piskoo

app/controlplane/pkg/biz/apitoken.go

@@ -35,21 +35,14 @@ type APITokenJWTConfig struct {
 	SymmetricHmacKey string
 }
 
-// OrgLevelAPITokenPolicies are additional policies granted only to org-level tokens.
+// orgLevelTokenPolicies are additional policies granted only to org-level tokens.
 // They allow managing project-scoped tokens.
-var OrgLevelAPITokenPolicies = []*authz.Policy{
+var orgLevelTokenPolicies = []*authz.Policy{
 	authz.PolicyAPITokenCreate,
 	authz.PolicyAPITokenList,
 	authz.PolicyAPITokenRevoke,
 }
 
-// withOrgLevelPolicies returns a new slice with OrgLevelAPITokenPolicies appended.
-func withOrgLevelPolicies(policies []*authz.Policy) []*authz.Policy {
-	result := make([]*authz.Policy, len(policies), len(policies)+len(OrgLevelAPITokenPolicies))
-	copy(result, policies)
-	return append(result, OrgLevelAPITokenPolicies...)
-}
-
 // APIToken is used for unattended access to the control plane API.
 type APIToken struct {
 	ID          uuid.UUID
@@ -221,7 +214,7 @@ func (uc *APITokenUseCase) Create(ctx context.Context, name string, description
 
 	// Org-level tokens additionally get project-level API token management policies
 	if projectID == nil && orgUUID != nil {
-		policies = withOrgLevelPolicies(policies)
+		policies = append(policies, orgLevelTokenPolicies...)
 	}
 
 	// NOTE: the expiration time is stored just for reference, it's also encoded in the JWT

app/controlplane/pkg/biz/apitoken_integration_test.go

@@ -145,29 +145,55 @@ func (s *apiTokenTestSuite) TestCreate() {
 }
 
 func (s *apiTokenTestSuite) TestAuthzPolicies() {
-	// a new token has a new set of policies associated
-	token, err := s.APIToken.Create(context.Background(), randomName(), nil, nil, &s.org.ID)
-	require.NoError(s.T(), err)
+	ctx := context.Background()
 
-	// With the new architecture, API token policies are stored in the database, not in Casbin
-	// Verify that the token has the default policies stored
-	expectedPolicies := make([]*authz.Policy, 0, len(s.APIToken.DefaultAuthzPolicies)+len(biz.OrgLevelAPITokenPolicies))
-	expectedPolicies = append(expectedPolicies, s.APIToken.DefaultAuthzPolicies...)
-	expectedPolicies = append(expectedPolicies, biz.OrgLevelAPITokenPolicies...)
-	s.Require().NotNil(token.Policies)
-	s.Len(token.Policies, len(expectedPolicies))
-
-	// Check that all default policies for org-scoped token are present
-	for _, expectedPolicy := range expectedPolicies {
-		found := false
-		for _, actualPolicy := range token.Policies {
-			if actualPolicy.Resource == expectedPolicy.Resource && actualPolicy.Action == expectedPolicy.Action {
-				found = true
-				break
+	s.Run("project-level token gets default policies", func() {
+		token, err := s.APIToken.Create(ctx, randomName(), nil, nil, &s.org.ID, biz.APITokenWithProject(s.p1))
+		require.NoError(s.T(), err)
+		s.Require().NotNil(token.Policies)
+		s.Len(token.Policies, len(s.APIToken.DefaultAuthzPolicies))
+
+		for _, p := range s.APIToken.DefaultAuthzPolicies {
+			found := false
+			for _, actual := range token.Policies {
+				if actual.Resource == p.Resource && actual.Action == p.Action {
+					found = true
+					break
+				}
 			}
+			s.True(found, fmt.Sprintf("policy %s:%s not found", p.Resource, p.Action))
 		}
-		s.True(found, fmt.Sprintf("policy %s:%s not found", expectedPolicy.Resource, expectedPolicy.Action))
-	}
+	})
+
+	s.Run("org-level token gets default plus token management policies", func() {
+		token, err := s.APIToken.Create(ctx, randomName(), nil, nil, &s.org.ID)
+		require.NoError(s.T(), err)
+		s.Require().NotNil(token.Policies)
+
+		// All default policies must be present
+		for _, p := range s.APIToken.DefaultAuthzPolicies {
+			found := false
+			for _, actual := range token.Policies {
+				if actual.Resource == p.Resource && actual.Action == p.Action {
+					found = true
+					break
+				}
+			}
+			s.True(found, fmt.Sprintf("default policy %s:%s not found", p.Resource, p.Action))
+		}
+
+		// Additional org-level token management policies must be present
+		for _, p := range []*authz.Policy{authz.PolicyAPITokenCreate, authz.PolicyAPITokenList, authz.PolicyAPITokenRevoke} {
+			found := false
+			for _, actual := range token.Policies {
+				if actual.Resource == p.Resource && actual.Action == p.Action {
+					found = true
+					break
+				}
+			}
+			s.True(found, fmt.Sprintf("org policy %s:%s not found", p.Resource, p.Action))
+		}
+	})
 }
 
 func (s *apiTokenTestSuite) TestRevoke() {