keb/lazysecrets
1
0 Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 6 Wiki Activity

refactor: no access list for Databricks scopes: it was the one request of its own

Browse Source 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
kebandClaude Opus 5.5 committed 2026-10-11 14:30:28 +02:00
1 parent 17054ad0ec
commit 1d8a7d2842
6 files changed
+4 -76
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/provider/databricks/databricks_test.go
-24
View File
@@ -140,15 +140,8 @@ func workspaceAPI(t *testing.T, status int) *httptest.Server {
map[string]any{"key": "storage-key", "last_updated_timestamp": 1767225600000},
map[string]any{"key": "client-secret"},
}})
case r.URL.Path == "/api/2.0/secrets/acls/list" && q.Get("scope") == "app":
write(w, 200, map[string]any{"items": []any{
map[string]any{"principal": "users", "permission": "READ"},
map[string]any{"principal": "admins", "permission": "MANAGE"},
}})
case r.URL.Path == "/api/2.0/secrets/list" && q.Get("scope") == "locked":
write(w, 403, map[string]any{"error_code": "PERMISSION_DENIED", "message": "User does not have READ permission on scope locked"})
case r.URL.Path == "/api/2.0/secrets/acls/list" && q.Get("scope") == "locked":
write(w, 403, map[string]any{"error_code": "PERMISSION_DENIED", "message": "User does not have MANAGE permission"})
case r.URL.Path == "/api/2.0/secrets/get" && q.Get("scope") == "app":
write(w, 200, map[string]any{"key": q.Get("key"),
"value": base64.StdEncoding.EncodeToString([]byte("value-of-" + q.Get("key")))})
@@ -301,23 +294,6 @@ func TestClassify(t *testing.T) {
}
}
func TestScopeDetails(t *testing.T) {
p := newTestProvider(t, workspaceAPI(t, 0), nil)
src := provider.Source{ID: "prod"}
attrs, err := p.Details(context.Background(), provider.Container{Source: src, Name: "app"})
if err != nil {
t.Fatal(err)
}
want := []provider.Attr{{Label: "access", Value: "admins · manage"}, {Value: "users · read"}}
if !reflect.DeepEqual(attrs, want) {
t.Errorf("app: %+v", attrs)
}
attrs, err = p.Details(context.Background(), provider.Container{Source: src, Name: "locked"})
if err != nil || len(attrs) != 1 || !strings.Contains(attrs[0].Value, "managers") {
t.Errorf("locked: %+v, %v", attrs, err)
}
}
func TestDeniedSaysWhatToCheck(t *testing.T) {
p := newTestProvider(t, workspaceAPI(t, 0), nil)
_, err := p.Objects(context.Background(), provider.Container{Source: provider.Source{ID: "prod"}, Name: "locked"}, provider.TypeSecret)