[PATCH pve-access-control v3 4/5] fix #7520: test: add unit tests for sdn acl migration logic

[David Riley <d.riley@proxmox.com>]

Add unit tests to validate the behavior of the SDN VNet access
migration logic.

The tests cover multiple migration edge cases:
* VNet migration between zones
* Subtree retention, moving multiple VLAN tags under a VNet
* Unconfigured resources, ensuring empty source paths do not create
  empty target nodes
* Conflict prevention, aborting on destination collisions

Link: https://bugzilla.proxmox.com/show_bug.cgi?id=7520
Signed-off-by: David Riley <d.riley@proxmox.com>
---
 src/test/Makefile                  |   2 +
 src/test/sdn_acl_migration.cfg     |  13 ++++
 src/test/sdn_acl_migration_test.pl | 118 +++++++++++++++++++++++++++++
 3 files changed, 133 insertions(+)
 create mode 100644 src/test/sdn_acl_migration.cfg
 create mode 100644 src/test/sdn_acl_migration_test.pl

diff --git a/src/test/Makefile b/src/test/Makefile
index 2f44186..7d4267f 100644
--- a/src/test/Makefile
+++ b/src/test/Makefile
@@ -15,3 +15,5 @@ check:
 	perl -I.. realm_sync_test.pl
 	perl -I.. api-tests.pl
 	perl -I.. sdn_acl_pruning_test.pl
+	perl -I.. sdn_acl_migration_test.pl
+
diff --git a/src/test/sdn_acl_migration.cfg b/src/test/sdn_acl_migration.cfg
new file mode 100644
index 0000000..58a1b17
--- /dev/null
+++ b/src/test/sdn_acl_migration.cfg
@@ -0,0 +1,13 @@
+user:user1@pve:1:0::::::
+role:SDNAdmin:SDN.Allocate,SDN.Audit
+
+acl:1:/sdn/zones/zone1/vnet1:user1@pve:SDNAdmin:
+acl:1:/sdn/zones/zone1/vnet2:user1@pve:SDNAdmin:
+acl:1:/sdn/zones/zone1/vnet2/100:user1@pve:SDNAdmin:
+acl:1:/sdn/zones/zone1/vnet2/200:user1@pve:SDNAdmin:
+
+acl:1:/sdn/zones/zone1/vnet3:user1@pve:SDNAdmin:
+acl:1:/sdn/zones/zone2/vnet3:user1@pve:SDNAdmin:
+
+acl:1:/sdn/zones/zone1/vnet5:user1@pve:SDNAdmin:
+acl:1:/sdn/zones/zone2/vnet5/300:user1@pve:SDNAdmin:
diff --git a/src/test/sdn_acl_migration_test.pl b/src/test/sdn_acl_migration_test.pl
new file mode 100644
index 0000000..043c012
--- /dev/null
+++ b/src/test/sdn_acl_migration_test.pl
@@ -0,0 +1,118 @@
+#!/usr/bin/env perl
+
+use strict;
+use warnings;
+
+use lib qw(..);
+
+use PVE::Tools;
+use Test::More;
+use Test::MockModule;
+
+use PVE::AccessControl;
+use PVE::RPCEnvironment;
+
+my $cluster_module = Test::MockModule->new('PVE::Cluster');
+$cluster_module->noop('cfs_update');
+
+my $cfgfn = "sdn_acl_migration.cfg";
+my $raw_cfg = PVE::Tools::file_get_contents($cfgfn);
+my $mocked_user_cfg_tree = PVE::AccessControl::parse_user_config("user.cfg", $raw_cfg);
+
+my $access_control_module = Test::MockModule->new('PVE::AccessControl');
+
+# Mocking
+$access_control_module->mock(
+    'cfs_read_file',
+    sub {
+        my ($filename) = @_;
+        return $mocked_user_cfg_tree if $filename eq 'user.cfg';
+        die "mock cfs_read_file: unexpected file $filename";
+    },
+);
+
+$access_control_module->mock(
+    'cfs_write_file',
+    sub {
+        my ($filename, $cfg) = @_;
+        $mocked_user_cfg_tree = $cfg if $filename eq 'user.cfg';
+    },
+);
+
+$access_control_module->mock(
+    'lock_user_config',
+    sub {
+        my ($code, $errmsg) = @_;
+        eval { $code->() };
+        if (my $err = $@) {
+            die "$errmsg: $err\n";
+        }
+    },
+);
+
+my $rpcenv = PVE::RPCEnvironment->init('cli');
+$rpcenv->{user_cfg} = $mocked_user_cfg_tree;
+
+sub check_roles {
+    my ($user, $path, $expected_result) = @_;
+
+    my $roles = PVE::AccessControl::roles($rpcenv->{user_cfg}, $user, $path);
+    my $res = join(',', sort keys %$roles);
+
+    is($res, $expected_result, "Roles for $user on $path should be '$expected_result'");
+}
+
+# Tests
+# Check ACLs pre migration
+check_roles('user1@pve', '/sdn/zones/zone1/vnet1', 'SDNAdmin');
+check_roles('user1@pve', '/sdn/zones/zone1/vnet2/100', 'SDNAdmin');
+check_roles('user1@pve', '/sdn/zones/zone1/vnet2/200', 'SDNAdmin');
+
+# Migration
+my $migrations = [
+    { src_path => ['zones', 'zone1', 'vnet1'], dest_path => ['zones', 'zone2', 'vnet1'] },
+    { src_path => ['zones', 'zone1', 'vnet2'], dest_path => ['zones', 'zone2', 'vnet2'] },
+    { src_path => ['zones', 'zone1', 'vnet4'], dest_path => ['zones', 'zone2', 'vnet4'] }, # Ghost move (no ACLs exist)
+];
+PVE::AccessControl::migrate_sdn_resource_access($migrations);
+
+$rpcenv->{user_cfg} = $mocked_user_cfg_tree;
+
+# Check ACLs after migration
+# source paths
+check_roles('user1@pve', '/sdn/zones/zone1/vnet1', '');
+check_roles('user1@pve', '/sdn/zones/zone1/vnet2', '');
+check_roles('user1@pve', '/sdn/zones/zone1/vnet2/100', '');
+check_roles('user1@pve', '/sdn/zones/zone1/vnet2/200', '');
+
+# destionation paths
+check_roles('user1@pve', '/sdn/zones/zone2/vnet1', 'SDNAdmin');
+check_roles('user1@pve', '/sdn/zones/zone2/vnet2', 'SDNAdmin');
+check_roles('user1@pve', '/sdn/zones/zone2/vnet2/100', 'SDNAdmin');
+check_roles('user1@pve', '/sdn/zones/zone2/vnet2/200', 'SDNAdmin');
+
+# fictional move
+check_roles('user1@pve', '/sdn/zones/zone1/vnet4', '');
+check_roles('user1@pve', '/sdn/zones/zone2/vnet4', '');
+
+# conflict without vlan tag
+eval {
+    PVE::AccessControl::migrate_sdn_resource_access([
+        { src_path => ['zones', 'zone1', 'vnet3'], dest_path => ['zones', 'zone2', 'vnet3'] }
+    ]);
+};
+ok($@, "Migration must abort if direct target destination node already exists");
+like($@, qr/already has permissions configured/, "Error message matches custom conflict string");
+
+# conflict with vlan tag
+eval {
+    PVE::AccessControl::migrate_sdn_resource_access([
+        { src_path => ['zones', 'zone1', 'vnet5'], dest_path => ['zones', 'zone2', 'vnet5'] }
+    ]);
+};
+ok($@, "Migration must abort if a child of the target destination node already exists");
+like($@, qr/already has permissions configured/, "Error message matches custom conflict string");
+
+done_testing();
+
+exit(0);
-- 
2.47.3