Add sentryctl dashboards permissions list|grant|revoke

PUT/DELETE /dashboards/{id}/permissions/{userId} (per-resource dashboard grants, built earlier this phase) had no caller but Go tests and curl -- named as a real, disclosed gap in docs/phase-4-runbook.md. Adds a CLI surface: sentryctl dashboards permissions list/grant/revoke, following the existing dashboards subcommand pattern. grant/revoke needed a new httpclient.go helper (httpMutateNoBody) since both endpoints respond 204 No Content -- the existing helpers all expect a JSON body to pretty-print. grant validates the role client-side (viewer/editor only, mirroring api/dashboards.validGrantRole) before making a request, since Admin/Owner already have tenant-wide dashboard access and a resource-level grant can never raise someone past Editor. Verified with real httptest.Server round trips (method, path, request body, and error-body parsing on a 501 from a deployment with no enterprise permission service wired in) -- the same pattern every other sentryctl subcommand's tests already use, no fake/mock client needed since sentryctl itself is just an HTTP client with no store of its own.
2026-08-14 23:09:33 -07:00
parent abeee0076b
commit 3cf1320881
7 changed files with 282 additions and 9 deletions
@@ -2,7 +2,11 @@ package main

 import (
 	"bytes"
+	"io"
+	"net/http"
+	"net/http/httptest"
 	"reflect"
+	"strings"
 	"testing"
 )

@@ -41,3 +45,135 @@ func TestCmdDashboardsGetMissingID(t *testing.T) {
 		t.Fatalf("code = %d, want 1", code)
 	}
 }
+
+func TestCmdDashboardsPermissionsMissingSubcommand(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	code := cmdDashboards([]string{"permissions"}, &stdout, &stderr)
+	if code != 1 {
+		t.Fatalf("code = %d, want 1", code)
+	}
+}
+
+func TestCmdDashboardsPermissionsListMissingID(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	code := cmdDashboards([]string{"permissions", "list"}, &stdout, &stderr)
+	if code != 1 {
+		t.Fatalf("code = %d, want 1", code)
+	}
+}
+
+func TestCmdDashboardsPermissionsListSuccess(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodGet || r.URL.Path != "/dashboards/dash-1/permissions" {
+			t.Errorf("unexpected request: %s %s", r.Method, r.URL.Path)
+		}
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte(`[{"UserID":"user-2","Role":"editor"}]`))
+	}))
+	defer srv.Close()
+
+	var stdout, stderr bytes.Buffer
+	code := cmdDashboards([]string{"permissions", "list", "dash-1", "--api", srv.URL}, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("code = %d, want 0; stderr=%s", code, stderr.String())
+	}
+	if !strings.Contains(stdout.String(), "user-2") {
+		t.Fatalf("stdout = %q, want it to contain the listed grant", stdout.String())
+	}
+}
+
+func TestCmdDashboardsPermissionsGrantMissingArgs(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	code := cmdDashboards([]string{"permissions", "grant", "dash-1"}, &stdout, &stderr)
+	if code != 1 {
+		t.Fatalf("code = %d, want 1", code)
+	}
+}
+
+func TestCmdDashboardsPermissionsGrantInvalidRole(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	code := cmdDashboards([]string{"permissions", "grant", "dash-1", "user-2", "owner"}, &stdout, &stderr)
+	if code != 1 {
+		t.Fatalf("code = %d, want 1", code)
+	}
+	if !strings.Contains(stderr.String(), "viewer") {
+		t.Fatalf("stderr = %q, want it to explain the allowed roles", stderr.String())
+	}
+}
+
+func TestCmdDashboardsPermissionsGrantSuccess(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPut || r.URL.Path != "/dashboards/dash-1/permissions/user-2" {
+			t.Errorf("unexpected request: %s %s", r.Method, r.URL.Path)
+		}
+		body, _ := io.ReadAll(r.Body)
+		if !strings.Contains(string(body), `"role":"editor"`) {
+			t.Errorf("body = %q, want it to carry role=editor", body)
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	defer srv.Close()
+
+	var stdout, stderr bytes.Buffer
+	code := cmdDashboards([]string{"permissions", "grant", "dash-1", "user-2", "editor", "--api", srv.URL}, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("code = %d, want 0; stderr=%s", code, stderr.String())
+	}
+	if !strings.Contains(stdout.String(), "granted") {
+		t.Fatalf("stdout = %q, want a confirmation", stdout.String())
+	}
+}
+
+func TestCmdDashboardsPermissionsGrantServerError(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusNotImplemented)
+		w.Write([]byte(`{"error":"dashboard permission grants are not available on this deployment"}`))
+	}))
+	defer srv.Close()
+
+	var stdout, stderr bytes.Buffer
+	code := cmdDashboards([]string{"permissions", "grant", "dash-1", "user-2", "editor", "--api", srv.URL}, &stdout, &stderr)
+	if code != 1 {
+		t.Fatalf("code = %d, want 1", code)
+	}
+	if !strings.Contains(stderr.String(), "not available on this deployment") {
+		t.Fatalf("stderr = %q, want the server's actual error message surfaced", stderr.String())
+	}
+}
+
+func TestCmdDashboardsPermissionsRevokeMissingArgs(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	code := cmdDashboards([]string{"permissions", "revoke", "dash-1"}, &stdout, &stderr)
+	if code != 1 {
+		t.Fatalf("code = %d, want 1", code)
+	}
+}
+
+func TestCmdDashboardsPermissionsRevokeSuccess(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodDelete || r.URL.Path != "/dashboards/dash-1/permissions/user-2" {
+			t.Errorf("unexpected request: %s %s", r.Method, r.URL.Path)
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	defer srv.Close()
+
+	var stdout, stderr bytes.Buffer
+	code := cmdDashboards([]string{"permissions", "revoke", "dash-1", "user-2", "--api", srv.URL}, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("code = %d, want 0; stderr=%s", code, stderr.String())
+	}
+	if !strings.Contains(stdout.String(), "revoked") {
+		t.Fatalf("stdout = %q, want a confirmation", stdout.String())
+	}
+}
+
+func TestCmdDashboardsPermissionsUnknownSubcommand(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	code := cmdDashboards([]string{"permissions", "bogus"}, &stdout, &stderr)
+	if code != 1 {
+		t.Fatalf("code = %d, want 1", code)
+	}
+}