From ebf96ba60ae1b16b3b9c627cef85c169715ac067 Mon Sep 17 00:00:00 2001
From: Shahzad Lone <shahzadlone@gmail.com>
Date: Thu, 28 Nov 2024 06:38:00 +0800
Subject: [PATCH] PR(TEST): Add tests where requests without identity can not
 access (after revokation)

---
 .../delete/with_target_all_actors_test.go     | 165 +++++++++++++++++-
 1 file changed, 163 insertions(+), 2 deletions(-)

diff --git a/tests/integration/acp/relationship/doc_actor/delete/with_target_all_actors_test.go b/tests/integration/acp/relationship/doc_actor/delete/with_target_all_actors_test.go
index 14c0121a41..9db120ce91 100644
--- a/tests/integration/acp/relationship/doc_actor/delete/with_target_all_actors_test.go
+++ b/tests/integration/acp/relationship/doc_actor/delete/with_target_all_actors_test.go
@@ -165,7 +165,7 @@ func TestACP_OwnerRevokesAccessFromAllNonExplicitActors_ActorsCanNotReadAnymore(
 				},
 			},
 
-			testUtils.DeleteDocActorRelationship{ // Revoke access from all actors, not explictly allowed.
+			testUtils.DeleteDocActorRelationship{ // Revoke access from all actors, (ones given access through * implicitly).
 				RequestorIdentity: testUtils.ClientIdentity(1),
 
 				TargetIdentity: testUtils.AllClientIdentities(),
@@ -444,7 +444,7 @@ func TestACP_OwnerRevokesAccessFromAllNonExplicitActors_ExplicitActorsCanStillRe
 				},
 			},
 
-			testUtils.DeleteDocActorRelationship{ // Revoke access from all actors, not explictly allowed.
+			testUtils.DeleteDocActorRelationship{ // Revoke access from all actors, (ones given access through * implicitly).
 				RequestorIdentity: testUtils.ClientIdentity(1),
 
 				TargetIdentity: testUtils.AllClientIdentities(),
@@ -546,3 +546,164 @@ func TestACP_OwnerRevokesAccessFromAllNonExplicitActors_ExplicitActorsCanStillRe
 
 	testUtils.ExecuteTestCase(t, test)
 }
+
+func TestACP_OwnerRevokesAccessFromAllNonExplicitActors_NonIdentityRequestsCanNotReadAnymore(t *testing.T) {
+	expectedPolicyID := "fc56b7509c20ac8ce682b3b9b4fdaad868a9c70dda6ec16720298be64f16e9a4"
+
+	test := testUtils.TestCase{
+
+		Description: "Test acp, owner revokes read access from actors that were given read access implicitly, non-identity actors can't read anymore",
+
+		Actions: []any{
+			testUtils.AddPolicy{
+
+				Identity: testUtils.ClientIdentity(1),
+
+				Policy: `
+                    name: Test Policy
+
+                    description: A Policy
+
+                    actor:
+                      name: actor
+
+                    resources:
+                      users:
+                        permissions:
+                          read:
+                            expr: owner + reader + writer
+
+                          write:
+                            expr: owner + writer
+
+                          nothing:
+                            expr: dummy
+
+                        relations:
+                          owner:
+                            types:
+                              - actor
+
+                          reader:
+                            types:
+                              - actor
+
+                          writer:
+                            types:
+                              - actor
+
+                          admin:
+                            manages:
+                              - reader
+                            types:
+                              - actor
+
+                          dummy:
+                            types:
+                              - actor
+                `,
+
+				ExpectedPolicyID: expectedPolicyID,
+			},
+
+			testUtils.SchemaUpdate{
+				Schema: fmt.Sprintf(`
+						type Users @policy(
+							id: "%s",
+							resource: "users"
+						) {
+							name: String
+							age: Int
+						}
+					`,
+					expectedPolicyID,
+				),
+			},
+
+			testUtils.CreateDoc{
+				Identity: testUtils.ClientIdentity(1),
+
+				CollectionID: 0,
+
+				Doc: `
+					{
+						"name": "Shahzad",
+						"age": 28
+					}
+				`,
+			},
+
+			testUtils.AddDocActorRelationship{
+				RequestorIdentity: testUtils.ClientIdentity(1),
+
+				TargetIdentity: testUtils.AllClientIdentities(), // Give implicit access to all identities.
+
+				CollectionID: 0,
+
+				DocID: 0,
+
+				Relation: "reader",
+
+				ExpectedExistence: false,
+			},
+
+			testUtils.Request{
+				Identity: testUtils.NoIdentity(), // Can read even without identity
+
+				Request: `
+					query {
+						Users {
+							_docID
+							name
+							age
+						}
+					}
+				`,
+
+				Results: map[string]any{
+					"Users": []map[string]any{
+						{
+							"_docID": "bae-9d443d0c-52f6-568b-8f74-e8ff0825697b",
+							"name":   "Shahzad",
+							"age":    int64(28),
+						},
+					},
+				},
+			},
+
+			testUtils.DeleteDocActorRelationship{ // Revoke access from all actors, (ones given access through * implicitly).
+				RequestorIdentity: testUtils.ClientIdentity(1),
+
+				TargetIdentity: testUtils.AllClientIdentities(),
+
+				CollectionID: 0,
+
+				DocID: 0,
+
+				Relation: "reader",
+
+				ExpectedRecordFound: true,
+			},
+
+			testUtils.Request{
+				Identity: testUtils.NoIdentity(), // Can not read anymore
+
+				Request: `
+					query {
+						Users {
+							_docID
+							name
+							age
+						}
+					}
+				`,
+
+				Results: map[string]any{
+					"Users": []map[string]any{}, // Can't see the documents now
+				},
+			},
+		},
+	}
+
+	testUtils.ExecuteTestCase(t, test)
+}