@@ -406,6 +406,98 @@ func TestDontSendNilPrivileges(t *testing.T) {
406406 assert .NotNil (t , roles [0 ].Privileges )
407407}
408408
409+ func TestCheckEmptyStringsInPrivilegesEquivalentToNotPassingFields (t * testing.T ) {
410+ ctx := context .Background ()
411+
412+ roleWithEmptyStrings := mdbv1.MongoDBRole {
413+ Role : "withEmptyStrings" ,
414+ Db : "admin" ,
415+ Roles : []mdbv1.InheritedRole {{
416+ Db : "admin" ,
417+ Role : "read" ,
418+ }},
419+ Privileges : []mdbv1.Privilege {
420+ {
421+ Resource : mdbv1.Resource {
422+ Db : "config" ,
423+ Collection : "" , // Explicit empty string
424+ },
425+ Actions : []string {"find" , "update" , "insert" , "remove" },
426+ },
427+ {
428+ Resource : mdbv1.Resource {
429+ Db : "users" ,
430+ Collection : "usersCollection" ,
431+ },
432+ Actions : []string {"update" , "insert" , "remove" },
433+ },
434+ {
435+ Resource : mdbv1.Resource {
436+ Db : "" , // Explicit empty string
437+ Collection : "" , // Explicit empty string
438+ },
439+ Actions : []string {"find" },
440+ },
441+ },
442+ }
443+
444+ // Role without empty strings (fields omitted, which should result in empty strings for string types)
445+ roleWithoutEmptyStrings := mdbv1.MongoDBRole {
446+ Role : "withoutEmptyFields" ,
447+ Db : "admin" ,
448+ Roles : []mdbv1.InheritedRole {{
449+ Db : "admin" ,
450+ Role : "read" ,
451+ }},
452+ Privileges : []mdbv1.Privilege {
453+ {
454+ Resource : mdbv1.Resource {
455+ Db : "config" ,
456+ // field not set, should pass ""
457+ },
458+ Actions : []string {"find" , "update" , "insert" , "remove" },
459+ },
460+ {
461+ Resource : mdbv1.Resource {
462+ Db : "users" ,
463+ Collection : "usersCollection" ,
464+ },
465+ Actions : []string {"update" , "insert" , "remove" },
466+ },
467+ {
468+ Resource : mdbv1.Resource {
469+ // fields not set, should be passed as empty strings
470+ },
471+ Actions : []string {"find" },
472+ },
473+ },
474+ }
475+
476+ rs := DefaultReplicaSetBuilder ().SetRoles ([]mdbv1.MongoDBRole {roleWithEmptyStrings , roleWithoutEmptyStrings }).Build ()
477+ kubeClient , omConnectionFactory := mock .NewDefaultFakeClient ()
478+ controller := NewReconcileCommonController (ctx , kubeClient )
479+ mockOm , _ := prepareConnection (ctx , controller , omConnectionFactory .GetConnectionFunc , t )
480+
481+ controller .ensureRoles (ctx , rs .Spec .DbCommonSpec , true , mockOm , kube .ObjectKeyFromApiObject (rs ), zap .S ())
482+
483+ ac , err := mockOm .ReadAutomationConfig ()
484+ assert .NoError (t , err )
485+ roles , ok := ac .Deployment ["roles" ].([]mdbv1.MongoDBRole )
486+ assert .True (t , ok )
487+ require .Len (t , roles , 2 )
488+
489+ assert .Equal (t , "config" , roles [0 ].Privileges [0 ].Resource .Db )
490+ assert .Equal (t , "" , roles [0 ].Privileges [0 ].Resource .Collection )
491+
492+ assert .Equal (t , "users" , roles [0 ].Privileges [1 ].Resource .Db )
493+ assert .Equal (t , "usersCollection" , roles [0 ].Privileges [1 ].Resource .Collection )
494+
495+ assert .Equal (t , "" , roles [0 ].Privileges [2 ].Resource .Db )
496+ assert .Equal (t , "" , roles [0 ].Privileges [2 ].Resource .Collection )
497+
498+ assert .True (t , reflect .DeepEqual (roles [0 ].Privileges , roles [1 ].Privileges ))
499+ }
500+
409501func TestSecretWatcherWithAllResources (t * testing.T ) {
410502 ctx := context .Background ()
411503 caName := "custom-ca"
0 commit comments