refactor: inject permission service into sparkle controller

2 files changed, 42 insertions, 38 deletions

diff --git a/app/controllers/sparkles/controller.go b/app/controllers/sparkles/controller.go
index 7e6975c..80e95cb 100644
--- a/app/controllers/sparkles/controller.go
+++ b/app/controllers/sparkles/controller.go
@@ -9,6 +9,7 @@ import (
 	"github.com/xlgmokha/x/pkg/x"
 	"gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/app/domain"
 	"gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/app/middleware"
+	"gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/pkg/authz"
 	"gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/pkg/pls"
 )
 
@@ -16,7 +17,7 @@ type Controller struct {
 	db domain.Repository[*domain.Sparkle]
 }
 
-func New(db domain.Repository[*domain.Sparkle]) *Controller {
+func New(db domain.Repository[*domain.Sparkle], check authz.PermissionService) *Controller {
 	return &Controller{db: db}
 }
 
diff --git a/app/controllers/sparkles/controller_test.go b/app/controllers/sparkles/controller_test.go
index 37e1a82..006c3fa 100644
--- a/app/controllers/sparkles/controller_test.go
+++ b/app/controllers/sparkles/controller_test.go
@@ -13,6 +13,7 @@ import (
 	"gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/app/cfg"
 	"gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/app/db"
 	"gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/app/domain"
+	"gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/internal/stub"
 )
 
 type FailingResponseWriter struct {
@@ -38,7 +39,7 @@ func TestSparkles(t *testing.T) {
 		store.Save(t.Context(), sparkle)
 
 		mux := http.NewServeMux()
-		controller := New(store)
+		controller := New(store, stub.AllowWith(t, "user:*", "read", "sparkle:*"))
 		controller.MountTo(mux)
 
 		t.Run("returns JSON", func(t *testing.T) {
@@ -64,47 +65,49 @@ func TestSparkles(t *testing.T) {
 		t.Run("when a user is logged in", func(t *testing.T) {
 			currentUser := domain.NewUser(domain.WithID[*domain.User](domain.ID("1")))
 
-			t.Run("saves a new sparkle", func(t *testing.T) {
-				repository := db.NewRepository[*domain.Sparkle]()
-				mux := http.NewServeMux()
-				controller := New(repository)
-				controller.MountTo(mux)
-
-				sparkle, _ := domain.NewSparkle("@tanuki for reviewing my code!")
-				request, response := test.RequestResponse(
-					"POST",
-					"/sparkles",
-					test.WithAcceptHeader(serde.JSON),
-					test.WithContentType(sparkle, serde.JSON),
-					test.WithContextKeyValue(t.Context(), cfg.CurrentUser, currentUser),
-				)
-
-				mux.ServeHTTP(response, request)
-
-				require.Equal(t, http.StatusCreated, response.Code)
-
-				t.Run("returns a JSON representation of the sparkle", func(t *testing.T) {
-					item, err := serde.FromJSON[*domain.Sparkle](response.Body)
-					require.NoError(t, err)
-
-					assert.NotEmpty(t, item.ID)
-					assert.Equal(t, "@tanuki", item.Sparklee)
-					assert.Equal(t, "for reviewing my code!", item.Reason)
-				})
-
-				t.Run("saves the sparkle to the db", func(t *testing.T) {
-					assert.Equal(t, 1, len(repository.All(t.Context())))
-					item := repository.All(t.Context())[0]
-
-					assert.Equal(t, "@tanuki", item.Sparklee)
-					assert.Equal(t, "for reviewing my code!", item.Reason)
-					assert.Equal(t, currentUser, item.Author)
+			t.Run("when the user is authorized to create sparkles", func(t *testing.T) {
+				t.Run("saves a new sparkle", func(t *testing.T) {
+					repository := db.NewRepository[*domain.Sparkle]()
+					mux := http.NewServeMux()
+					controller := New(repository, stub.AllowWith(t, "user:1", "create", "sparkle:*"))
+					controller.MountTo(mux)
+
+					sparkle, _ := domain.NewSparkle("@tanuki for reviewing my code!")
+					request, response := test.RequestResponse(
+						"POST",
+						"/sparkles",
+						test.WithAcceptHeader(serde.JSON),
+						test.WithContentType(sparkle, serde.JSON),
+						test.WithContextKeyValue(t.Context(), cfg.CurrentUser, currentUser),
+					)
+
+					mux.ServeHTTP(response, request)
+
+					require.Equal(t, http.StatusCreated, response.Code)
+
+					t.Run("returns a JSON representation of the sparkle", func(t *testing.T) {
+						item, err := serde.FromJSON[*domain.Sparkle](response.Body)
+						require.NoError(t, err)
+
+						assert.NotEmpty(t, item.ID)
+						assert.Equal(t, "@tanuki", item.Sparklee)
+						assert.Equal(t, "for reviewing my code!", item.Reason)
+					})
+
+					t.Run("saves the sparkle to the db", func(t *testing.T) {
+						assert.Equal(t, 1, len(repository.All(t.Context())))
+						item := repository.All(t.Context())[0]
+
+						assert.Equal(t, "@tanuki", item.Sparklee)
+						assert.Equal(t, "for reviewing my code!", item.Reason)
+						assert.Equal(t, currentUser, item.Author)
+					})
 				})
 			})
 
 			t.Run("prevents double WriteHeader when serialization fails", func(t *testing.T) {
 				repository := db.NewRepository[*domain.Sparkle]()
-				controller := New(repository)
+				controller := New(repository, stub.Allow())
 
 				currentUser := domain.NewUser(domain.WithID[*domain.User](domain.ID("1")))
 				sparkle, _ := domain.NewSparkle("@user for testing")