Jarupatj/wildcardissue

[jarupatj]

close #572

Issue

#544 change caused a regression in wildcard handling. Entity with actions that contains wildcard will cause the hawaii engine failure to start.

 "entities": {
    "Region": {
      "source": "region",
	  "rest": true,
      "graphql": true,
      "permissions": [
        {
          "role": "anonymous",
          "actions": ["*"]
        }
      ]
    }
  }

Why are we not catching this issue earlier? Why did the existing test not catch this issue?

We have 2 tests related to wildcard action
TestWildcardResolvesAsAllActions
TestWildcardPolicyResolvesToEmpty

However, these 2 tests generate an actions configuration that looks like this

"actions": [
        "action": "*",
            "policy": {},
            "fields: {
                "include": null,
                "exclude": null
            }
]

This actions configuration is an array of JSON object.
However, the issue happen when we have a wildcard that is an array of string

"actions": ["*"]

We are handling array of object and array of string differently. That's why the test did not catch this issue.

Fix

The fix for this issue is to expand the wildcard action to actual explicit action in Authorization internal data structure.
We look up if the action is permitted using actual action name not wildcard.

For example, does this role have a permission to UPDATE an entity or not. We are not asking if this role have a WILDCARD permission to this entity or not. During runtime, we know exactly what action we would like to use.

As a result, I think it is better to remove wildcard action from Authorization internal data structure and replace it with actual action. It will also remove special wildcard checks that we have around authZ.

Minor fixes included in this change are

• Replace "*" with AuthorizationResolver.WILDCARD
• Replace some action string with ActionType const string.

Test

I modified these 2 test - TestWildcardResolvesAsAllActions, TestWildcardPolicyResolvesToEmpty
to address wildcard input correctly.

I also add tests in Authorization Unittest to verify that we expand wildcard to explicit action correctly.

[jarupatj]

This change will be merged with #577