feat: Introduce integration testing

.github/workflows/ci.yml

@@ -53,6 +53,9 @@ jobs:
       - name: Run tests
         run: cargo nextest run
 
+      - name: Run tests
+        run: cargo nextest run --test integration
+
       - name: Run Doc tests
         run: cargo test --doc
 

.github/workflows/functional.yml

@@ -104,8 +104,8 @@ jobs:
           curl http://localhost:8080/v3/auth/tokens -H "X-Auth-Token: ${TOKEN2}" -H "X-Subject-Token: ${TOKEN2}" | jq
           curl http://localhost:5001/v3/auth/tokens -H "X-Auth-Token: ${TOKEN2}" -H "X-Subject-Token: ${TOKEN2}" | jq
 
-      - name: Run functional tests
-        run: cargo test --test functional
+      - name: Run api tests
+        run: cargo test --test api
 
       - name: Run interop tests
         run: cargo test --test interop

Cargo.toml

@@ -77,7 +77,7 @@ hyper-util = { version = "0.1", features = ["tokio", "http1"] }
 keycloak = { version = "26.4" }
 mockall = { version = "0.14" }
 reqwest = { version = "0.12", features = ["json", "multipart"] }
-sea-orm = { version = "1.1", features = ["mock"]}
+sea-orm = { version = "1.1", features = ["mock", "sqlx-sqlite" ]}
 serde_urlencoded = { version = "0.7" }
 tempfile = { version = "3.23" }
 thirtyfour = "0.36"
@@ -111,10 +111,14 @@ name = "github"
 path = "tests/github/main.rs"
 test = false
 
+[[test]]
+name = "integration"
+path = "tests/integration/main.rs"
+test = false
 
 [[test]]
-name = "functional"
-path = "tests/functional/main.rs"
+name = "api"
+path = "tests/api/main.rs"
 test = false
 
 [lints.rust]

src/assignment/backend/sql/assignment/list.rs

@@ -58,17 +58,20 @@ pub async fn list(
             .filter(db_assignment::Column::Type.is_in([
                 DbAssignmentType::UserProject,
                 DbAssignmentType::GroupProject,
-            ]));
+            ]))
+            .filter(db_assignment::Column::Inherited.eq(false));
     } else if let Some(val) = &params.domain_id {
         select_assignment = select_assignment
             .filter(db_assignment::Column::TargetId.eq(val))
             .filter(
                 db_assignment::Column::Type
                     .is_in([DbAssignmentType::UserDomain, DbAssignmentType::GroupDomain]),
-            );
+            )
+            .filter(db_assignment::Column::Inherited.eq(false));
     } else {
-        select_system_assignment =
-            select_system_assignment.filter(db_system_assignment::Column::TargetId.eq("system"));
+        select_system_assignment = select_system_assignment
+            .filter(db_system_assignment::Column::TargetId.eq("system"))
+            .filter(db_system_assignment::Column::Inherited.eq(false));
     }
 
     let results: Result<Vec<Assignment>, _> = if let Some(true) = &params.include_names {
@@ -254,8 +257,8 @@ mod tests {
                 ),
                 Transaction::from_sql_and_values(
                     DatabaseBackend::Postgres,
-                    r#"SELECT "system_assignment"."type", "system_assignment"."actor_id", "system_assignment"."target_id", "system_assignment"."role_id", "system_assignment"."inherited" FROM "system_assignment" WHERE "system_assignment"."target_id" = $1"#,
-                    ["system".into()]
+                    r#"SELECT "system_assignment"."type", "system_assignment"."actor_id", "system_assignment"."target_id", "system_assignment"."role_id", "system_assignment"."inherited" FROM "system_assignment" WHERE "system_assignment"."target_id" = $1 AND "system_assignment"."inherited" = $2"#,
+                    ["system".into(), false.into()]
                 ),
             ]
         );
@@ -310,8 +313,8 @@ mod tests {
                 ),
                 Transaction::from_sql_and_values(
                     DatabaseBackend::Postgres,
-                    r#"SELECT "system_assignment"."type", "system_assignment"."actor_id", "system_assignment"."target_id", "system_assignment"."role_id", "system_assignment"."inherited" FROM "system_assignment" WHERE "system_assignment"."role_id" = $1 AND "system_assignment"."target_id" = $2"#,
-                    ["1".into(), "system".into()]
+                    r#"SELECT "system_assignment"."type", "system_assignment"."actor_id", "system_assignment"."target_id", "system_assignment"."role_id", "system_assignment"."inherited" FROM "system_assignment" WHERE "system_assignment"."role_id" = $1 AND "system_assignment"."target_id" = $2 AND "system_assignment"."inherited" = $3"#,
+                    ["1".into(), "system".into(), false.into()]
                 ),
             ]
         );
@@ -349,8 +352,13 @@ mod tests {
             db.into_transaction_log(),
             [Transaction::from_sql_and_values(
                 DatabaseBackend::Postgres,
-                r#"SELECT CAST("assignment"."type" AS "text"), "assignment"."actor_id", "assignment"."target_id", "assignment"."role_id", "assignment"."inherited" FROM "assignment" WHERE "assignment"."target_id" = $1 AND "assignment"."type" IN (CAST($2 AS "type"), CAST($3 AS "type"))"#,
-                ["target".into(), "UserProject".into(), "GroupProject".into()]
+                r#"SELECT CAST("assignment"."type" AS "text"), "assignment"."actor_id", "assignment"."target_id", "assignment"."role_id", "assignment"."inherited" FROM "assignment" WHERE "assignment"."target_id" = $1 AND "assignment"."type" IN (CAST($2 AS "type"), CAST($3 AS "type")) AND "assignment"."inherited" = $4"#,
+                [
+                    "target".into(),
+                    "UserProject".into(),
+                    "GroupProject".into(),
+                    false.into()
+                ]
             ),]
         );
     }
@@ -404,8 +412,8 @@ mod tests {
                 ),
                 Transaction::from_sql_and_values(
                     DatabaseBackend::Postgres,
-                    r#"SELECT "system_assignment"."type" AS "A_type", "system_assignment"."actor_id" AS "A_actor_id", "system_assignment"."target_id" AS "A_target_id", "system_assignment"."role_id" AS "A_role_id", "system_assignment"."inherited" AS "A_inherited", "role"."id" AS "B_id", "role"."name" AS "B_name", "role"."extra" AS "B_extra", "role"."domain_id" AS "B_domain_id", "role"."description" AS "B_description" FROM "system_assignment" LEFT JOIN "role" ON "system_assignment"."role_id" = "role"."id" WHERE "system_assignment"."target_id" = $1"#,
-                    ["system".into()]
+                    r#"SELECT "system_assignment"."type" AS "A_type", "system_assignment"."actor_id" AS "A_actor_id", "system_assignment"."target_id" AS "A_target_id", "system_assignment"."role_id" AS "A_role_id", "system_assignment"."inherited" AS "A_inherited", "role"."id" AS "B_id", "role"."name" AS "B_name", "role"."extra" AS "B_extra", "role"."domain_id" AS "B_domain_id", "role"."description" AS "B_description" FROM "system_assignment" LEFT JOIN "role" ON "system_assignment"."role_id" = "role"."id" WHERE "system_assignment"."target_id" = $1 AND "system_assignment"."inherited" = $2"#,
+                    ["system".into(), false.into()]
                 ),
             ]
         );

src/assignment/error.rs

@@ -18,6 +18,7 @@ use crate::assignment::backend::error::*;
 use crate::assignment::types::assignment::RoleAssignmentListForMultipleActorTargetParametersBuilderError;
 use crate::assignment::types::*;
 use crate::identity::error::IdentityProviderError;
+use crate::resource::error::ResourceProviderError;
 
 #[derive(Error, Debug)]
 pub enum AssignmentProviderError {
@@ -43,13 +44,20 @@ pub enum AssignmentProviderError {
     #[error(transparent)]
     AssignmentDatabaseError { source: AssignmentDatabaseError },
 
-    /// Identity provider error
+    /// Identity provider error.
     #[error(transparent)]
     IdentityProvider {
         #[from]
         source: IdentityProviderError,
     },
 
+    /// Resource provider error.
+    #[error(transparent)]
+    ResourceProvider {
+        #[from]
+        source: ResourceProviderError,
+    },
+
     /// Invalid assignment type.
     #[error("{0}")]
     InvalidAssignmentType(String),

src/assignment/mod.rs

@@ -29,6 +29,7 @@ use crate::config::Config;
 use crate::identity::IdentityApi;
 use crate::keystone::ServiceState;
 use crate::plugin_manager::PluginManager;
+use crate::resource::ResourceApi;
 
 #[cfg(test)]
 pub use mock::MockAssignmentProvider;
@@ -51,9 +52,9 @@ impl AssignmentProvider {
         } else {
             match config.assignment.driver.as_str() {
                 "sql" => Box::new(SqlBackend::default()),
-                _ => {
+                other => {
                     return Err(AssignmentProviderError::UnsupportedDriver(
-                        config.assignment.driver.clone(),
+                        other.to_string(),
                     ));
                 }
             }
@@ -92,40 +93,54 @@ impl AssignmentApi for AssignmentProvider {
         state: &ServiceState,
         params: &RoleAssignmentListParameters,
     ) -> Result<impl IntoIterator<Item = Assignment>, AssignmentProviderError> {
-        if let Some(true) = &params.effective {
-            let mut request = RoleAssignmentListForMultipleActorTargetParametersBuilder::default();
-            let mut actors: Vec<String> = Vec::new();
-            let mut targets: Vec<RoleAssignmentTarget> = Vec::new();
-            if let Some(role_id) = &params.role_id {
-                request.role_id(role_id);
-            }
-            if let Some(uid) = &params.user_id {
-                actors.push(uid.into());
-            }
-            if let Some(true) = &params.effective
-                && let Some(uid) = &params.user_id
+        let mut request = RoleAssignmentListForMultipleActorTargetParametersBuilder::default();
+        let mut actors: Vec<String> = Vec::new();
+        let mut targets: Vec<RoleAssignmentTarget> = Vec::new();
+        if let Some(role_id) = &params.role_id {
+            request.role_id(role_id);
+        }
+        if let Some(uid) = &params.user_id {
+            actors.push(uid.into());
+        }
+        if let Some(true) = &params.effective
+            && let Some(uid) = &params.user_id
+        {
+            let users = state
+                .provider
+                .get_identity_provider()
+                .list_groups_of_user(state, uid)
+                .await?;
+            actors.extend(users.into_iter().map(|x| x.id));
+        };
+        if let Some(val) = &params.project_id {
+            targets.push(RoleAssignmentTarget {
+                target_id: val.clone(),
+                inherited: Some(false),
+            });
+            if let Some(parents) = state
+                .provider
+                .get_resource_provider()
+                .get_project_parents(state, val)
+                .await?
             {
-                let users = state
-                    .provider
-                    .get_identity_provider()
-                    .list_groups_of_user(state, uid)
-                    .await?;
-                actors.extend(users.into_iter().map(|x| x.id));
-            };
-            if let Some(val) = &params.project_id {
-                targets.push(RoleAssignmentTarget {
-                    target_id: val.clone(),
-                    ..Default::default()
+                parents.iter().for_each(|parent_project| {
+                    targets.push(RoleAssignmentTarget {
+                        target_id: parent_project.id.clone(),
+                        inherited: Some(true),
+                    });
                 });
             }
-            request.targets(targets);
-            request.actors(actors);
-            self.backend_driver
-                .list_assignments_for_multiple_actors_and_targets(state, &request.build()?)
-                .await
-        } else {
-            self.backend_driver.list_assignments(state, params).await
+        } else if let Some(val) = &params.domain_id {
+            targets.push(RoleAssignmentTarget {
+                target_id: val.clone(),
+                inherited: Some(false),
+            });
         }
+        request.targets(targets);
+        request.actors(actors);
+        self.backend_driver
+            .list_assignments_for_multiple_actors_and_targets(state, &request.build()?)
+            .await
     }
 
     /// Create assignment grant.

src/assignment/types/assignment.rs

@@ -29,9 +29,9 @@ pub struct Assignment {
     pub actor_id: String,
     /// The target id.
     pub target_id: String,
-    /// The assignment type
+    /// The assignment type.
     pub r#type: AssignmentType,
-    /// Inherited flag
+    /// Inherited flag.
     pub inherited: bool,
 }