[FAB-8990] deliver uses generated mocks and ginkgo

Refactor deliver to use generated mocks and demonstrate
unit testing via ginkgo.

Change-Id: Ib00fec78bc0be9b22f977748185b8c4879d77f0c
Signed-off-by: Matthew Sykes <sykesmat@us.ibm.com>
Signed-off-by: Will Lahti <wtlahti@us.ibm.com>

Author: wlahti

common/deliver/acl.go

@@ -13,47 +13,55 @@ import (
 	"github.com/pkg/errors"
 )
 
-type expiresAtFunc func(identityBytes []byte) time.Time
+// ExpiresAtFunc is used to extract the time at which an identity expires.
+type ExpiresAtFunc func(identityBytes []byte) time.Time
 
-// acSupport provides the backing resources needed to support access control validation
-type acSupport interface {
-	// Sequence returns the current config sequence number, can be used to detect config changes
+// ConfigSequencer provides the sequence number of the current config block.
+type ConfigSequencer interface {
 	Sequence() uint64
 }
 
-func newSessionAC(sup acSupport, env *common.Envelope, poliyChecker PolicyChecker, channel string, expiresAt expiresAtFunc) (*sessionAC, error) {
+// NewSessionAC creates an instance of SessionAccessControl. This constructor will
+// return an error if a signature header cannot be extracted from the envelope.
+func NewSessionAC(chain ConfigSequencer, env *common.Envelope, policyChecker PolicyChecker, channelID string, expiresAt ExpiresAtFunc) (*SessionAccessControl, error) {
 	signedData, err := env.AsSignedData()
 	if err != nil {
 		return nil, err
 	}
 
-	return &sessionAC{
-		env:            env,
-		channel:        channel,
-		acSupport:      sup,
-		checkPolicy:    poliyChecker,
+	return &SessionAccessControl{
+		envelope:       env,
+		channelID:      channelID,
+		sequencer:      chain,
+		policyChecker:  policyChecker,
 		sessionEndTime: expiresAt(signedData[0].Identity),
 	}, nil
 }
 
-type sessionAC struct {
-	acSupport
-	checkPolicy        PolicyChecker
-	channel            string
-	env                *common.Envelope
+// SessionAccessControl holds access control related data for a common Envelope
+// that is used to determine if a request is allowed for the identity
+// associated with the request envelope.
+type SessionAccessControl struct {
+	sequencer          ConfigSequencer
+	policyChecker      PolicyChecker
+	channelID          string
+	envelope           *common.Envelope
 	lastConfigSequence uint64
 	sessionEndTime     time.Time
 	usedAtLeastOnce    bool
 }
 
-func (ac *sessionAC) evaluate() error {
+// Evaluate uses the PolicyChecker to determine if a request should be allowed.
+// The decision is cached until the identity expires or the chain configuration
+// changes.
+func (ac *SessionAccessControl) Evaluate() error {
 	if !ac.sessionEndTime.IsZero() && time.Now().After(ac.sessionEndTime) {
 		return errors.Errorf("client identity expired %v before", time.Since(ac.sessionEndTime))
 	}
 
 	policyCheckNeeded := !ac.usedAtLeastOnce
 
-	if currentConfigSequence := ac.Sequence(); currentConfigSequence > ac.lastConfigSequence {
+	if currentConfigSequence := ac.sequencer.Sequence(); currentConfigSequence > ac.lastConfigSequence {
 		ac.lastConfigSequence = currentConfigSequence
 		policyCheckNeeded = true
 	}
@@ -63,6 +71,5 @@ func (ac *sessionAC) evaluate() error {
 	}
 
 	ac.usedAtLeastOnce = true
-	return ac.checkPolicy(ac.env, ac.channel)
-
+	return ac.policyChecker.CheckPolicy(ac.envelope, ac.channelID)
 }

common/deliver/acl_test.go

@@ -4,164 +4,133 @@ Copyright IBM Corp. All Rights Reserved.
 SPDX-License-Identifier: Apache-2.0
 */
 
-package deliver
+package deliver_test
 
 import (
-	"testing"
 	"time"
 
-	"github.com/hyperledger/fabric/protos/common"
+	"github.com/hyperledger/fabric/common/deliver"
+	"github.com/hyperledger/fabric/common/deliver/mock"
+	cb "github.com/hyperledger/fabric/protos/common"
 	"github.com/hyperledger/fabric/protos/utils"
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/mock"
 )
 
-type mockACSupport struct {
-	mock.Mock
-}
+var _ = Describe("SessionAccessControl", func() {
+	var (
+		fakeChain         *mock.Chain
+		envelope          *cb.Envelope
+		fakePolicyChecker *mock.PolicyChecker
+		expiresAt         deliver.ExpiresAtFunc
+	)
+
+	BeforeEach(func() {
+		envelope = &cb.Envelope{
+			Payload: utils.MarshalOrPanic(&cb.Payload{
+				Header: &cb.Header{},
+			}),
+		}
+
+		fakeChain = &mock.Chain{}
+		fakePolicyChecker = &mock.PolicyChecker{}
+		expiresAt = func([]byte) time.Time { return time.Time{} }
+	})
 
-func (s *mockACSupport) ExpiresAt(identityBytes []byte) time.Time {
-	return s.Called().Get(0).(time.Time)
-}
+	It("evaluates the policy", func() {
+		sac, err := deliver.NewSessionAC(fakeChain, envelope, fakePolicyChecker, "chain-id", expiresAt)
+		Expect(err).NotTo(HaveOccurred())
 
-func (s *mockACSupport) Sequence() uint64 {
-	return s.Called().Get(0).(uint64)
-}
+		err = sac.Evaluate()
+		Expect(err).NotTo(HaveOccurred())
 
-func createEnvelope() *common.Envelope {
-	chHdr := utils.MakeChannelHeader(common.HeaderType_DELIVER_SEEK_INFO, 0, "mychannel", 0)
-	siHdr := utils.MakeSignatureHeader(nil, nil)
-	paylBytes := utils.MarshalOrPanic(&common.Payload{
-		Header: utils.MakePayloadHeader(chHdr, siHdr),
+		Expect(fakePolicyChecker.CheckPolicyCallCount()).To(Equal(1))
+		env, cid := fakePolicyChecker.CheckPolicyArgsForCall(0)
+		Expect(env).To(Equal(envelope))
+		Expect(cid).To(Equal("chain-id"))
 	})
 
-	return &common.Envelope{Payload: paylBytes}
-}
+	Context("when policy evaluation returns an error", func() {
+		BeforeEach(func() {
+			fakePolicyChecker.CheckPolicyReturns(errors.New("no-access-for-you"))
+		})
+
+		It("returns the evaluation error", func() {
+			sac, err := deliver.NewSessionAC(fakeChain, envelope, fakePolicyChecker, "chain-id", expiresAt)
+			Expect(err).NotTo(HaveOccurred())
 
-type oneTimeInvoke struct {
-	f       func(*common.Envelope, string) error
-	invoked bool
-}
+			err = sac.Evaluate()
+			Expect(err).To(MatchError("no-access-for-you"))
+		})
+	})
+
+	It("caches positive policy evaluation", func() {
+		sac, err := deliver.NewSessionAC(fakeChain, envelope, fakePolicyChecker, "chain-id", expiresAt)
+		Expect(err).NotTo(HaveOccurred())
 
-func (oti *oneTimeInvoke) invokeOnce() func(*common.Envelope, string) error {
-	return func(env *common.Envelope, s string) error {
-		if oti.invoked {
-			panic("already invoked!")
+		for i := 0; i < 5; i++ {
+			err = sac.Evaluate()
+			Expect(err).NotTo(HaveOccurred())
 		}
-		oti.invoked = true
-		return oti.f(env, s)
-	}
-}
-
-func oneTimeFunction(f func(*common.Envelope, string) error) func(*common.Envelope, string) error {
-	oti := &oneTimeInvoke{f: f}
-	return oti.invokeOnce()
-}
-
-func TestOneTimeFunction(t *testing.T) {
-	acceptPolicyChecker := func(envelope *common.Envelope, channelID string) error {
-		return nil
-	}
-	f := oneTimeFunction(acceptPolicyChecker)
-	// First time no panic
-	assert.NotPanics(t, func() {
-		f(nil, "")
+		Expect(fakePolicyChecker.CheckPolicyCallCount()).To(Equal(1))
 	})
 
-	// Second time we panic
-	assert.Panics(t, func() {
-		f(nil, "")
+	Context("when the config sequence changes", func() {
+		BeforeEach(func() {
+			fakePolicyChecker.CheckPolicyReturnsOnCall(2, errors.New("access-now-denied"))
+		})
+
+		It("re-evaluates the policy", func() {
+			sac, err := deliver.NewSessionAC(fakeChain, envelope, fakePolicyChecker, "chain-id", expiresAt)
+			Expect(err).NotTo(HaveOccurred())
+
+			Expect(sac.Evaluate()).To(Succeed())
+			Expect(fakePolicyChecker.CheckPolicyCallCount()).To(Equal(1))
+			Expect(sac.Evaluate()).To(Succeed())
+			Expect(fakePolicyChecker.CheckPolicyCallCount()).To(Equal(1))
+
+			fakeChain.SequenceReturns(2)
+			Expect(sac.Evaluate()).To(Succeed())
+			Expect(fakePolicyChecker.CheckPolicyCallCount()).To(Equal(2))
+			Expect(sac.Evaluate()).To(Succeed())
+			Expect(fakePolicyChecker.CheckPolicyCallCount()).To(Equal(2))
+
+			fakeChain.SequenceReturns(3)
+			Expect(sac.Evaluate()).To(MatchError("access-now-denied"))
+			Expect(fakePolicyChecker.CheckPolicyCallCount()).To(Equal(3))
+		})
 	})
-}
-
-func TestAC(t *testing.T) {
-	acceptPolicyChecker := func(envelope *common.Envelope, channelID string) error {
-		return nil
-	}
-
-	denyPolicyChecker := func(envelope *common.Envelope, channelID string) error {
-		return errors.New("forbidden")
-	}
-
-	sup := &mockACSupport{}
-	// Scenario I: create empty header
-	ac, err := newSessionAC(sup, &common.Envelope{}, nil, "mychannel", sup.ExpiresAt)
-	assert.Nil(t, ac)
-	assert.Contains(t, err.Error(), "Missing Header")
-
-	// Scenario II: Identity has expired.
-	sup = &mockACSupport{}
-	sup.On("ExpiresAt").Return(time.Now().Add(-1 * time.Second)).Once()
-	ac, err = newSessionAC(sup, createEnvelope(), oneTimeFunction(acceptPolicyChecker), "mychannel", sup.ExpiresAt)
-	assert.NotNil(t, ac)
-	assert.NoError(t, err)
-	err = ac.evaluate()
-	assert.Contains(t, err.Error(), "expired")
-
-	// Scenario III: Identity hasn't expired, but is forbidden
-	sup = &mockACSupport{}
-	sup.On("ExpiresAt").Return(time.Now().Add(time.Second)).Once()
-	sup.On("Sequence").Return(uint64(0)).Once()
-	ac, err = newSessionAC(sup, createEnvelope(), oneTimeFunction(denyPolicyChecker), "mychannel", sup.ExpiresAt)
-	assert.NoError(t, err)
-	err = ac.evaluate()
-	assert.Contains(t, err.Error(), "forbidden")
-
-	// Scenario IV: Identity hasn't expired, and is allowed
-	// We actually check 2 sub-cases, the first one is if the identity can expire,
-	// and the second one is if the identity can't expire (i.e an idemix identity currently can't expire)
-	for _, expirationTime := range []time.Time{time.Now().Add(time.Second), {}} {
-		sup = &mockACSupport{}
-		sup.On("ExpiresAt").Return(expirationTime).Once()
-		sup.On("Sequence").Return(uint64(0)).Once()
-		ac, err = newSessionAC(sup, createEnvelope(), oneTimeFunction(acceptPolicyChecker), "mychannel", sup.ExpiresAt)
-		assert.NoError(t, err)
-		err = ac.evaluate()
-		assert.NoError(t, err)
-		// Execute again. We should not evaluate the policy again.
-		// If we do, the test fails with panic because the function can be invoked only once
-		sup.On("Sequence").Return(uint64(0)).Once()
-		err = ac.evaluate()
-		assert.NoError(t, err)
-	}
-
-	// Scenario V: Identity hasn't expired, and is allowed at first, but afterwards there
-	// is a config change and afterwards it isn't allowed
-	sup = &mockACSupport{}
-	sup.On("ExpiresAt").Return(time.Now().Add(time.Second)).Once()
-	sup.On("Sequence").Return(uint64(0)).Once()
-	sup.On("Sequence").Return(uint64(1)).Once()
-
-	firstInvoke := true
-	policyChecker := func(envelope *common.Envelope, channelID string) error {
-		if firstInvoke {
-			firstInvoke = false
-			return nil
-		}
-		return errors.New("forbidden")
-	}
-
-	ac, err = newSessionAC(sup, createEnvelope(), policyChecker, "mychannel", sup.ExpiresAt)
-	assert.NoError(t, err)
-	err = ac.evaluate() // first time
-	assert.NoError(t, err)
-	err = ac.evaluate() // second time
-	assert.Contains(t, err.Error(), "forbidden")
-
-	// Scenario VI: Identity hasn't expired at first, but expires at a later time,
-	// and then it shouldn't be allowed to be serviced
-	sup = &mockACSupport{}
-	sup.On("ExpiresAt").Return(time.Now().Add(time.Millisecond * 500)).Once()
-	sup.On("Sequence").Return(uint64(0)).Times(3)
-	ac, err = newSessionAC(sup, createEnvelope(), oneTimeFunction(acceptPolicyChecker), "mychannel", sup.ExpiresAt)
-	assert.NoError(t, err)
-	err = ac.evaluate()
-	assert.NoError(t, err)
-	err = ac.evaluate()
-	assert.NoError(t, err)
-	time.Sleep(time.Second)
-	err = ac.evaluate()
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "expired")
-}
+
+	Context("when an identity expires", func() {
+		BeforeEach(func() {
+			expiresAt = func([]byte) time.Time {
+				return time.Now().Add(250 * time.Millisecond)
+			}
+		})
+
+		It("returns an identity expired error", func() {
+			sac, err := deliver.NewSessionAC(fakeChain, envelope, fakePolicyChecker, "chain-id", expiresAt)
+			Expect(err).NotTo(HaveOccurred())
+
+			err = sac.Evaluate()
+			Expect(err).NotTo(HaveOccurred())
+
+			Eventually(sac.Evaluate).Should(MatchError(ContainSubstring("client identity expired")))
+		})
+	})
+
+	Context("when the envelope cannot be represented as signed data", func() {
+		BeforeEach(func() {
+			envelope = &cb.Envelope{}
+		})
+
+		It("returns an error", func() {
+			_, expectedError := envelope.AsSignedData()
+			Expect(expectedError).To(HaveOccurred())
+
+			_, err := deliver.NewSessionAC(fakeChain, envelope, fakePolicyChecker, "chain-id", expiresAt)
+			Expect(err).To(Equal(expectedError))
+		})
+	})
+})