Automated Test Framework for Security rule (acl) ?

[ashwanikumar]

Hi All,

How can I test the table & field level ACLs using ATF?

I tried to use field state validation but it doesn't work.

E.g. User do not have access to number field (tabled level access restricted. But ATF shows that user can read number field:

Thanks,

KUMAR

[ashwanikumar]

Any suggestions on this requirement?

[Jake Dodge]

I am also trying to do the same steps and I am getting the same result. Did you happen to find an answer here?

[Adam Stout]

I had a similar issue and got it to work by using a scripted step with a script like this:

(function(outputs, steps, stepResult, assertEqual) {
      var gr = new GlideRecord('x_snc_my_table_here');
      gr.get(steps('24f295e1db4510103bc0141b139619ff').record_id);
      // should be able to read
      if (gr.canRead()) {
            stepResult.setOutputMessage("Comment can be read by " + gs.getUserDisplayName());
            return true; // pass the step
      } else { 
            stepResult.setOutputMessage("Comment can NOT be read by " + gs.getUserDisplayName());
            return false; // fail the step
      }
})(outputs, steps, stepResult, assertEqual);

This retrieved the record then let me test it myself.

[krr]

We used a similar method to what @Adam Stout has done but used the assertEqual method to test read, write, create, and delete access in one test step. We had to test 100s of these, it so reduced the code a slight bit.

Obviously you'd only want to test one table per test step, else your testing results may get too non-specific

(function(outputs, steps, stepResult, assertEqual) {
    var gr = new GlideRecord("risk");
    gr.get(steps('421df333db8fd410366f53f2e2961953').record_id);
    assertEqual({name: "canCreate", shouldbe: false, value: gr.canCreate()});
    assertEqual({name: "canRead", shouldbe: true, value: gr.canRead()});
    assertEqual({name: "canWrite", shouldbe: false, value: gr.canWrite()});
    assertEqual({name: "canDelete", shouldbe: false, value: gr.canDelete()});

})(outputs, steps, stepResult, assertEqual);

This will output results such as these in case of a failure

16:32:47.630  Assertion failed: canCreate should have been false but was true

You also may want to make the name option more specific to what is being tested depending on your needs