[PATCH pve-access-control v3 2/5] fix #7520: test: add unit tests for sdn acl pruning logic

[David Riley <d.riley@proxmox.com>]

Add unit tests to validate the behavior of the SDN resource access
pruning logic.

The tests cover all designated SDN resource paths including zones,
vnets (with/without tags), controllers, prefix-lists, route-maps, and
fabrics, ensuring explicit permissions are dropped when resources are
deleted.

Link: https://bugzilla.proxmox.com/show_bug.cgi?id=7520
Signed-off-by: David Riley <d.riley@proxmox.com>
---
 src/test/Makefile                |   1 +
 src/test/sdn_acl_pruning.cfg     |  22 ++++++
 src/test/sdn_acl_pruning_test.pl | 116 +++++++++++++++++++++++++++++++
 3 files changed, 139 insertions(+)
 create mode 100644 src/test/sdn_acl_pruning.cfg
 create mode 100644 src/test/sdn_acl_pruning_test.pl

diff --git a/src/test/Makefile b/src/test/Makefile
index 53f2da7..2f44186 100644
--- a/src/test/Makefile
+++ b/src/test/Makefile
@@ -14,3 +14,4 @@ check:
 	perl -I.. perm-test8.pl
 	perl -I.. realm_sync_test.pl
 	perl -I.. api-tests.pl
+	perl -I.. sdn_acl_pruning_test.pl
diff --git a/src/test/sdn_acl_pruning.cfg b/src/test/sdn_acl_pruning.cfg
new file mode 100644
index 0000000..f8b47a6
--- /dev/null
+++ b/src/test/sdn_acl_pruning.cfg
@@ -0,0 +1,22 @@
+user:user1@pve:1:0::::::
+user:user2@pve:1:0::::::
+user:user3@pve:1:0::::::
+
+group:admins:user3@pve:::
+role:SDNAdmin:SDN.Allocate,SDN.Audit
+role:SDNAudit:SDN.Audit
+
+acl:1:/sdn/zones/zone1:@admins:SDNAdmin:
+acl:1:/sdn/zones/zone2:@admins:SDNAdmin:
+
+acl:1:/sdn/zones/zone1/vnet1:user1@pve:SDNAdmin:
+acl:1:/sdn/zones/zone1/vnet1/10:user1@pve:SDNAdmin:
+acl:1:/sdn/zones/zone1/vnet2:user1@pve:SDNAdmin:
+acl:1:/sdn/zones/zone1/vnet2/100:user1@pve:SDNAudit:
+
+acl:1:/sdn/zones/zone2:user1@pve:SDNAdmin:
+
+acl:1:/sdn/controllers/control:user2@pve:SDNAdmin:
+acl:1:/sdn/prefix-lists/list:user2@pve:SDNAdmin:
+acl:1:/sdn/route-maps/map:user2@pve:SDNAdmin:
+acl:1:/sdn/fabrics/fabric:user2@pve:SDNAdmin:
diff --git a/src/test/sdn_acl_pruning_test.pl b/src/test/sdn_acl_pruning_test.pl
new file mode 100644
index 0000000..60f6c9b
--- /dev/null
+++ b/src/test/sdn_acl_pruning_test.pl
@@ -0,0 +1,116 @@
+#!/usr/bin/env perl
+
+use strict;
+use warnings;
+
+use lib qw(..);
+
+use PVE::Tools;
+use Test::More;
+use Test::MockModule;
+
+use PVE::AccessControl;
+use PVE::RPCEnvironment;
+
+my $cluster_module = Test::MockModule->new('PVE::Cluster');
+$cluster_module->noop('cfs_update');
+
+my $cfgfn = "sdn_acl_pruning.cfg";
+my $raw_cfg = PVE::Tools::file_get_contents($cfgfn);
+my $mocked_user_cfg_tree = PVE::AccessControl::parse_user_config("user.cfg", $raw_cfg);
+
+my $access_control_module = Test::MockModule->new('PVE::AccessControl');
+
+# Mocking
+$access_control_module->mock(
+    'cfs_read_file',
+    sub {
+        my ($filename) = @_;
+        return $mocked_user_cfg_tree if $filename eq 'user.cfg';
+        die "mock cfs_read_file: unexpected file $filename";
+    },
+);
+
+$access_control_module->mock(
+    'cfs_write_file',
+    sub {
+        my ($filename, $cfg) = @_;
+        $mocked_user_cfg_tree = $cfg if $filename eq 'user.cfg';
+    },
+);
+
+$access_control_module->mock(
+    'lock_user_config',
+    sub {
+        my ($code, $errmsg) = @_;
+        eval { $code->() };
+        if (my $err = $@) {
+            die "$errmsg: $err\n";
+        }
+    },
+);
+
+my $rpcenv = PVE::RPCEnvironment->init('cli');
+$rpcenv->{user_cfg} = $mocked_user_cfg_tree;
+
+sub check_roles {
+    my ($user, $path, $expected_result) = @_;
+
+    my $roles = PVE::AccessControl::roles($rpcenv->{user_cfg}, $user, $path);
+    my $res = join(',', sort keys %$roles);
+
+    is($res, $expected_result, "Roles for $user on $path should be '$expected_result'");
+}
+
+# Tests
+# Check ACLs state before pruning
+# User3 (Group)
+check_roles('user3@pve', '/sdn/zones/zone1', 'SDNAdmin');
+check_roles('user3@pve', '/sdn/zones/zone2', 'SDNAdmin');
+
+# vnets
+check_roles('user1@pve', '/sdn/zones/zone1/vnet1', 'SDNAdmin');
+check_roles('user1@pve', '/sdn/zones/zone1/vnet1/10', 'SDNAdmin');
+check_roles('user1@pve', '/sdn/zones/zone1/vnet2', 'SDNAdmin');
+check_roles('user1@pve', '/sdn/zones/zone1/vnet2/100', 'SDNAudit');
+
+# controllers, prefix-lists, route-maps, fabrics
+check_roles('user2@pve', '/sdn/controllers/control', 'SDNAdmin');
+check_roles('user2@pve', '/sdn/prefix-lists/list', 'SDNAdmin');
+check_roles('user2@pve', '/sdn/route-maps/map', 'SDNAdmin');
+check_roles('user2@pve', '/sdn/fabrics/fabric', 'SDNAdmin');
+
+# Prune
+my $paths_to_delete = [
+    ['zones', 'zone2'],
+
+    ['zones', 'zone1', 'vnet1'],
+    ['zones', 'zone1', 'vnet2', '100'],
+
+    ['controllers', 'control'],
+    ['prefix-lists', 'list'],
+    ['route-maps', 'map'],
+    ['fabrics', 'fabric'],
+];
+PVE::AccessControl::remove_sdn_resource_access($paths_to_delete);
+
+$rpcenv->{user_cfg} = $mocked_user_cfg_tree;
+
+# Check ACLs after pruning
+check_roles('user3@pve', '/sdn/zones/zone1', 'SDNAdmin');
+check_roles('user3@pve', '/sdn/zones/zone2', '');
+
+check_roles('user1@pve', '/sdn/zones/zone1/vnet1', '');
+check_roles('user1@pve', '/sdn/zones/zone1/vnet1/10', '');
+
+check_roles('user1@pve', '/sdn/zones/zone1/vnet2', 'SDNAdmin');
+check_roles('user1@pve', '/sdn/zones/zone1/vnet2/100', 'SDNAdmin');
+
+check_roles('user2@pve', '/sdn/controllers/control', '');
+check_roles('user2@pve', '/sdn/prefix-lists/list', '');
+check_roles('user2@pve', '/sdn/route-maps/map', '');
+check_roles('user2@pve', '/sdn/fabrics/fabric', '');
+
+done_testing();
+
+exit(0);
-- 
2.47.3