diff --git a/api/types/accesslist/accesslist.go b/api/types/accesslist/accesslist.go index 4acc0d24fe4..3ec386ab336 100644 --- a/api/types/accesslist/accesslist.go +++ b/api/types/accesslist/accesslist.go @@ -190,8 +190,7 @@ const ( // Static Access Lists are supposed to be managed with the IaC tools like Terraform. Audit // reviews are not supported for them and the ownership is optional. Static Type = "static" - // SCIM Access Lists are created with the SCIM integration. Audit reviews are not supported - // for them and the ownership is optional. + // SCIM Access Lists are created with the SCIM integration. Ownership is optional. SCIM Type = "scim" ) @@ -201,7 +200,7 @@ var AllTypes = []Type{DeprecatedDynamic, Default, Static, SCIM} // IsReviewable returns true if the AccessList type supports the audit reviews in the web UI. func (t Type) IsReviewable() bool { switch t { - case DeprecatedDynamic, Default: + case DeprecatedDynamic, Default, SCIM: return true default: return false diff --git a/api/types/accesslist/accesslist_test.go b/api/types/accesslist/accesslist_test.go index b5091cefb2b..23ce70cbeae 100644 --- a/api/types/accesslist/accesslist_test.go +++ b/api/types/accesslist/accesslist_test.go @@ -262,7 +262,7 @@ func TestSelectNextReviewDate(t *testing.T) { }{ { name: "one month, first day", - accessListTypes: []Type{Default, DeprecatedDynamic}, + accessListTypes: []Type{Default, DeprecatedDynamic, SCIM}, frequency: OneMonth, dayOfMonth: FirstDayOfMonth, currentReviewDate: time.Date(2023, 1, 1, 0, 0, 0, 0, time.UTC), @@ -271,7 +271,7 @@ func TestSelectNextReviewDate(t *testing.T) { }, { name: "one month, fifteenth day", - accessListTypes: []Type{Default, DeprecatedDynamic}, + accessListTypes: []Type{Default, DeprecatedDynamic, SCIM}, frequency: OneMonth, dayOfMonth: FifteenthDayOfMonth, currentReviewDate: time.Date(2023, 1, 1, 0, 0, 0, 0, time.UTC), @@ -280,7 +280,7 @@ func TestSelectNextReviewDate(t *testing.T) { }, { name: "one month, last day", - accessListTypes: []Type{Default, DeprecatedDynamic}, + accessListTypes: []Type{Default, DeprecatedDynamic, SCIM}, frequency: OneMonth, dayOfMonth: LastDayOfMonth, currentReviewDate: time.Date(2023, 1, 1, 0, 0, 0, 0, time.UTC), @@ -289,7 +289,7 @@ func TestSelectNextReviewDate(t *testing.T) { }, { name: "six months, last day", - accessListTypes: []Type{Default, DeprecatedDynamic}, + accessListTypes: []Type{Default, DeprecatedDynamic, SCIM}, frequency: SixMonths, dayOfMonth: LastDayOfMonth, currentReviewDate: time.Date(2023, 1, 1, 0, 0, 0, 0, time.UTC), @@ -298,7 +298,7 @@ func TestSelectNextReviewDate(t *testing.T) { }, { name: "six months, last day", - accessListTypes: []Type{Static, SCIM, "__test_unknown__"}, + accessListTypes: []Type{Static, "__test_unknown__"}, frequency: SixMonths, dayOfMonth: LastDayOfMonth, currentReviewDate: time.Time{}, @@ -307,7 +307,7 @@ func TestSelectNextReviewDate(t *testing.T) { }, { name: "six months, last day", - accessListTypes: []Type{Static, SCIM, "__test_unknown__"}, + accessListTypes: []Type{Static, "__test_unknown__"}, frequency: SixMonths, dayOfMonth: LastDayOfMonth, currentReviewDate: time.Date(2023, 1, 1, 0, 0, 0, 0, time.UTC), diff --git a/api/types/accesslist/convert/v1/accesslist_test.go b/api/types/accesslist/convert/v1/accesslist_test.go index cb0b124d8bd..7216696e3ec 100644 --- a/api/types/accesslist/convert/v1/accesslist_test.go +++ b/api/types/accesslist/convert/v1/accesslist_test.go @@ -395,7 +395,7 @@ func TestConvAccessList(t *testing.T) { { name: "audit with only Recurrence.DayOfMonth set", input: newAccessList(func(al *accesslistv1.AccessList) { - al.Spec.Type = string(accesslist.SCIM) + al.Spec.Type = string(accesslist.Static) al.Spec.Audit = &accesslistv1.AccessListAudit{ Recurrence: &accesslistv1.Recurrence{ DayOfMonth: accesslistv1.ReviewDayOfMonth_REVIEW_DAY_OF_MONTH_LAST, @@ -411,7 +411,7 @@ func TestConvAccessList(t *testing.T) { { name: "audit with only Recurrence.Frequency and Notifications.Start set", input: newAccessList(func(al *accesslistv1.AccessList) { - al.Spec.Type = string(accesslist.SCIM) + al.Spec.Type = string(accesslist.Static) al.Spec.Audit = &accesslistv1.AccessListAudit{ Recurrence: &accesslistv1.Recurrence{ Frequency: accesslistv1.ReviewFrequency_REVIEW_FREQUENCY_ONE_YEAR, @@ -431,13 +431,13 @@ func TestConvAccessList(t *testing.T) { { name: "static-type", input: newAccessList(func(al *accesslistv1.AccessList) { - al.Spec.Type = string(accesslist.SCIM) + al.Spec.Type = string(accesslist.Static) }), }, { - name: "scim-type and zero audit", + name: "static-type and zero audit", input: newAccessList(func(al *accesslistv1.AccessList) { - al.Spec.Type = string(accesslist.SCIM) + al.Spec.Type = string(accesslist.Static) al.Spec.Audit = &accesslistv1.AccessListAudit{ NextAuditDate: ×tamppb.Timestamp{}, Recurrence: &accesslistv1.Recurrence{ diff --git a/lib/accesslists/validate_test.go b/lib/accesslists/validate_test.go index 259f0c223a1..b907f2462bc 100644 --- a/lib/accesslists/validate_test.go +++ b/lib/accesslists/validate_test.go @@ -387,7 +387,7 @@ func Test_ValidateAccessListWithMembers_audit(t *testing.T) { t.Run("audit frequency", func(t *testing.T) { accessList = newAccessList(t, accessListName, clockwork.NewFakeClockAt(time.Now())) t.Run("must be non-zero for reviewable access lists", func(t *testing.T) { - for _, typ := range []accesslist.Type{accesslist.Default} { + for _, typ := range []accesslist.Type{accesslist.Default, accesslist.SCIM} { t.Run(string(typ), func(t *testing.T) { accessList.Spec.Type = typ accessList.Spec.Audit.Recurrence.Frequency = 0 @@ -397,7 +397,7 @@ func Test_ValidateAccessListWithMembers_audit(t *testing.T) { } }) t.Run("can be zero for non-reviewable access lists", func(t *testing.T) { - for _, typ := range []accesslist.Type{accesslist.SCIM, accesslist.Static} { + for _, typ := range []accesslist.Type{accesslist.Static} { t.Run(string(typ), func(t *testing.T) { accessList.Spec.Type = typ accessList.Spec.Audit.Recurrence.Frequency = 0 @@ -425,7 +425,7 @@ func Test_ValidateAccessListWithMembers_audit(t *testing.T) { t.Run("audit day_of_month", func(t *testing.T) { accessList = newAccessList(t, accessListName, clockwork.NewFakeClockAt(time.Now())) t.Run("must be non-zero for reviewable access lists", func(t *testing.T) { - for _, typ := range []accesslist.Type{accesslist.Default} { + for _, typ := range []accesslist.Type{accesslist.Default, accesslist.SCIM} { t.Run(string(typ), func(t *testing.T) { accessList.Spec.Type = typ accessList.Spec.Audit.Recurrence.DayOfMonth = 0 @@ -435,7 +435,7 @@ func Test_ValidateAccessListWithMembers_audit(t *testing.T) { } }) t.Run("can be zero for non-reviewable access lists", func(t *testing.T) { - for _, typ := range []accesslist.Type{accesslist.SCIM, accesslist.Static} { + for _, typ := range []accesslist.Type{accesslist.Static} { t.Run(string(typ), func(t *testing.T) { accessList.Spec.Type = typ accessList.Spec.Audit.Recurrence.DayOfMonth = 0 diff --git a/lib/services/local/access_list_test.go b/lib/services/local/access_list_test.go index a62868cd811..91614eb4bc2 100644 --- a/lib/services/local/access_list_test.go +++ b/lib/services/local/access_list_test.go @@ -1544,28 +1544,20 @@ func Test_CreateAccessListReview_FailForNonReviewable(t *testing.T) { require.NoError(t, err) service := newAccessListService(t, mem, modulestest.EnterpriseModules()) - // Create a couple access lists. + // Create an access lists. accessList1 := newAccessList(t, "accessList1", clock, withType(accesslist.Static)) - accessList2 := newAccessList(t, "accessList2", clock, withType(accesslist.SCIM)) - // Create both access lists. _, err = service.UpsertAccessList(ctx, accessList1) require.NoError(t, err) - _, err = service.UpsertAccessList(ctx, accessList2) - require.NoError(t, err) accessList1Review := newAccessListReview(t, accessList1.GetName(), "al1-review") - accessList2Review := newAccessListReview(t, accessList2.GetName(), "al2-review") // Add access list review. _, _, err = service.CreateAccessListReview(ctx, accessList1Review) require.Error(t, err) require.ErrorContains(t, err, "is not reviewable") require.True(t, trace.IsBadParameter(err)) - _, _, err = service.CreateAccessListReview(ctx, accessList2Review) - require.Error(t, err) - require.ErrorContains(t, err, "is not reviewable") - require.True(t, trace.IsBadParameter(err)) + } func TestAccessListRequiresEqual(t *testing.T) {