tenants

backend/tests/tenants_flow.rs

@@ -0,0 +1,51 @@
+use anyhow::Result;
+use axum::http::StatusCode;
+use chrono::Utc;
+use diesel::prelude::*;
+use papercrate::models::TenantStatus;
+use papercrate::schema::tenants::dsl as tenants_dsl;
+use papercrate::test_support::{acquire_db_lock, TestApp, TestUserRole};
+use serde_json::json;
+use uuid::Uuid;
+
+#[tokio::test]
+async fn tenant_management_is_scoped_to_memberships() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let app = TestApp::new().await?;
+
+    let username = "tenant-owner";
+    app.insert_user(username, TestUserRole::Owner).await?;
+    let token = app.login_token(username, "irrelevant").await?;
+
+    let other_tenant_id = app
+        .with_conn(|conn| {
+            let other_id = Uuid::new_v4();
+            let now = Utc::now().naive_utc();
+            diesel::insert_into(tenants_dsl::tenants)
+                .values((
+                    tenants_dsl::id.eq(other_id),
+                    tenants_dsl::name.eq(format!("foreign-{other_id}")),
+                    tenants_dsl::storage_root.eq(Some(format!("test-tenants/{other_id}/"))),
+                    tenants_dsl::quickwit_index.eq(None::<String>),
+                    tenants_dsl::config.eq(json!({})),
+                    tenants_dsl::created_at.eq(now),
+                    tenants_dsl::updated_at.eq(now),
+                    tenants_dsl::status.eq(TenantStatus::Active),
+                    tenants_dsl::created_by.eq(None::<Uuid>),
+                ))
+                .execute(conn)?;
+            Ok(other_id)
+        })
+        .await?;
+
+    let response = app
+        .patch_json(
+            &format!("/api/tenants/{other_tenant_id}"),
+            &json!({ "name": "should-not-work" }),
+            Some(&token),
+        )
+        .await?;
+
+    assert_eq!(response.status(), StatusCode::FORBIDDEN);
+    Ok(())
+}