func TestGetAuthorizedResources(t *testing.T) {
	testcases := map[string]struct {
		requestInfo RequestInfo
		resourceUrn string
		action string
		resourcesToAuthorize []Resource
		resourcesAuthorized []Resource
		wantError error
		getUserByExternalIDResult *User
		getUserByExternalIDError  error
		getGroupsByUserIDResult []TestUserGroupRelation
		getGroupsByUserIDError  error
		getAttachedPoliciesResult []TestPolicyGroupRelation
		getAttachedPoliciesError  error
	}{
		"OKtestCaseAdmin": {
			requestInfo: RequestInfo{
				Identifier: "123456",
				Admin:      true,
			},
			resourceUrn: CreateUrn("example", RESOURCE_GROUP, "/path/", "group1"),
			action:      GROUP_ACTION_GET_GROUP,
			resourcesToAuthorize: []Resource{
				Group{
					ID:  "654321",
					Urn: CreateUrn("example", RESOURCE_GROUP, "/path/", "group1"),
				},
			},
			resourcesAuthorized: []Resource{
				Group{
					ID:  "654321",
					Urn: CreateUrn("example", RESOURCE_GROUP, "/path/", "group1"),
				},
			},
		},
		"ErrortestCaseGetRestrictions": {
			requestInfo: RequestInfo{
				Identifier: "123456",
				Admin:      false,
			},
			resourceUrn: CreateUrn("example", RESOURCE_GROUP, "/path/", "group1"),
			action:      GROUP_ACTION_GET_GROUP,
			resourcesToAuthorize: []Resource{
				Group{
					ID:  "654321",
					Urn: CreateUrn("example", RESOURCE_GROUP, "/path/", "group1"),
				},
			},
			resourcesAuthorized: []Resource{
				Group{
					ID:  "654321",
					Urn: CreateUrn("example", RESOURCE_GROUP, "/path/", "group1"),
				},
			},
			getUserByExternalIDError: &database.Error{
				Code:    database.USER_NOT_FOUND,
				Message: "User not found",
			},
			wantError: &Error{
				Code:    UNAUTHORIZED_RESOURCES_ERROR,
				Message: "Authenticated user with externalId 123456 not found. Unable to retrieve permissions.",
			},
		},
		"ErrortestCaseNotAllowedResources": {
			requestInfo: RequestInfo{
				Identifier: "123456",
				Admin:      false,
			},
			resourceUrn: CreateUrn("example", RESOURCE_GROUP, "/path/", "group1"),
			action:      GROUP_ACTION_GET_GROUP,
			resourcesToAuthorize: []Resource{
				Group{
					ID:  "654321",
					Urn: CreateUrn("example", RESOURCE_GROUP, "/path/", "group1"),
				},
			},
			resourcesAuthorized: []Resource{
				Group{
					ID:  "654321",
					Urn: CreateUrn("example", RESOURCE_GROUP, "/path/", "group1"),
				},
			},
			getUserByExternalIDResult: &User{
				ID:  "123456",
				Urn: CreateUrn("", RESOURCE_USER, "/path/", "user1"),
			},
			wantError: &Error{
				Code:    UNAUTHORIZED_RESOURCES_ERROR,
				Message: "User with externalId 123456 is not allowed to access to resource urn:iws:iam:example:group/path/group1",
			},
		},
		"OKtestCaseResourcesFiltered": {
			requestInfo: RequestInfo{
				Identifier: "123456",
				Admin:      false,
			},
			resourceUrn: GetUrnPrefix("example", RESOURCE_GROUP, "/path"),
			action:      GROUP_ACTION_GET_GROUP,
			resourcesToAuthorize: []Resource{
				Group{
					ID:  "654321",
					Urn: CreateUrn("example", RESOURCE_GROUP, "/path/", "group1"),
				},
				Group{
					ID:  "UNAUTHORIZED-GROUP-ID",
					Urn: CreateUrn("example", RESOURCE_GROUP, "/path/", "groupUnauthorized"),
				},
			},
			resourcesAuthorized: []Resource{
				Group{
					ID:  "654321",
					Urn: CreateUrn("example", RESOURCE_GROUP, "/path/", "group1"),
				},
			},
			getUserByExternalIDResult: &User{
				ID:  "123456",
				Urn: CreateUrn("", RESOURCE_USER, "/path/", "user1"),
			},
			getGroupsByUserIDResult: []TestUserGroupRelation{
				{
					Group: &Group{
						ID:  "GROUP-USER-ID",
						Urn: CreateUrn("example", RESOURCE_GROUP, "/path/", "groupUser"),
					},
				},
			},
			getAttachedPoliciesResult: []TestPolicyGroupRelation{
				{
					Policy: &Policy{
						ID:  "POLICY-USER-ID",
						Urn: CreateUrn("example", RESOURCE_POLICY, "/path/", "policyUser"),
						Statements: &[]Statement{
							{
								Effect: "allow",
								Actions: []string{
									GROUP_ACTION_GET_GROUP,
								},
								Resources: []string{
									CreateUrn("example", RESOURCE_GROUP, "/path/", "group1"),
								},
							},
						},
					},
				},
			},
		},
		"OKtestCaseResourcesFilteredReturnEmpty": {
			requestInfo: RequestInfo{
				Identifier: "123456",
				Admin:      false,
			},
			resourceUrn: GetUrnPrefix("example", RESOURCE_GROUP, "/path"),
			action:      GROUP_ACTION_GET_GROUP,
			resourcesToAuthorize: []Resource{
				Group{
					ID:  "654321",
					Urn: CreateUrn("example", RESOURCE_GROUP, "/path/", "group1"),
				},
				Group{
					ID:  "654322",
					Urn: CreateUrn("example", RESOURCE_GROUP, "/path/", "group2"),
				},
			},
			resourcesAuthorized: []Resource{},
			getUserByExternalIDResult: &User{
				ID:  "123456",
				Urn: CreateUrn("", RESOURCE_USER, "/path/", "user1"),
			},
			getGroupsByUserIDResult: []TestUserGroupRelation{
				{
					Group: &Group{
						ID:  "GROUP-USER-ID",
						Urn: CreateUrn("example", RESOURCE_GROUP, "/path/", "groupUser"),
					},
				},
			},
			getAttachedPoliciesResult: []TestPolicyGroupRelation{
				{
					Policy: &Policy{
						ID:  "POLICY-USER-ID",
						Urn: CreateUrn("example", RESOURCE_POLICY, "/path/", "policyUser"),
						Statements: &[]Statement{
							{
								Effect: "allow",
								Actions: []string{
									GROUP_ACTION_GET_GROUP,
								},
								Resources: []string{
									GetUrnPrefix("example", RESOURCE_GROUP, "/path2/"),
								},
							},
						},
					},
				},
			},
		},
	}
	for n, test := range testcases {
		testRepo := makeTestRepo()
		testAPI := makeTestAPI(testRepo)
		testRepo.ArgsOut[GetUserByExternalIDMethod][0] = test.getUserByExternalIDResult
		testRepo.ArgsOut[GetUserByExternalIDMethod][1] = test.getUserByExternalIDError
		testRepo.ArgsOut[GetGroupsByUserIDMethod][0] = test.getGroupsByUserIDResult
		testRepo.ArgsOut[GetGroupsByUserIDMethod][1] = test.getGroupsByUserIDError
		testRepo.ArgsOut[GetAttachedPoliciesMethod][0] = test.getAttachedPoliciesResult
		testRepo.ArgsOut[GetAttachedPoliciesMethod][1] = test.getAttachedPoliciesError
		authorizedResources, err := testAPI.getAuthorizedResources(test.requestInfo, test.resourceUrn, test.action, test.resourcesToAuthorize)
		checkMethodResponse(t, n, test.wantError, err, test.resourcesAuthorized, authorizedResources)
		if !test.requestInfo.Admin {
			assert.Equal(t, test.requestInfo.Identifier, testRepo.ArgsIn[GetUserByExternalIDMethod][0], "Error in test case %v", n)
		}
	}
}
Test for aux methods of Foulkon
package api
import (
	"testing"
	"fmt"
	"github.com/Tecsisa/foulkon/database"
	"github.com/stretchr/testify/assert"
)
func TestGetAuthorizedUsers(t *testing.T) {
	testcases := map[string]struct {
		requestInfo RequestInfo
		resourceUrn string
		action string
		usersToAuthorize []User
		usersAuthorized []User
		wantError error
		getUserByExternalIDResult *User
		getUserByExternalIDError  error
	}{
		"OKtestCaseAdmin": {
			requestInfo: RequestInfo{
				Identifier: "123456",
				Admin:      true,
			},
			resourceUrn: CreateUrn("", RESOURCE_USER, "/path/", "user1"),
			action:      USER_ACTION_GET_USER,
			usersToAuthorize: []User{
				{
					ID:  "654321",
					Urn: CreateUrn("", RESOURCE_USER, "/path/", "user1"),
				},
			},
			usersAuthorized: []User{
				{
					ID:  "654321",
					Urn: CreateUrn("", RESOURCE_USER, "/path/", "user1"),
				},
			},
		},
		"OKtestCaseAdminWithEmptyResources": {
			requestInfo: RequestInfo{
				Identifier: "123456",
				Admin:      true,
			},
			resourceUrn:      CreateUrn("", RESOURCE_USER, "/path/", "user1"),
			action:           USER_ACTION_GET_USER,
			usersToAuthorize: []User{},
			usersAuthorized:  []User{},
		},
		"ErrortestCaseAuthenticatedUserNotExist": {
			requestInfo: RequestInfo{
				Identifier: "notAdminUser",
				Admin:      false,
			},
			resourceUrn: CreateUrn("", RESOURCE_USER, "/path/", "user1"),
			action:      USER_ACTION_GET_USER,
			wantError: &Error{
				Code:    UNAUTHORIZED_RESOURCES_ERROR,
				Message: "Authenticated user with externalId notAdminUser not found. Unable to retrieve permissions.",
			},
			getUserByExternalIDResult: nil,
			getUserByExternalIDError: &database.Error{
				Code:    database.USER_NOT_FOUND,
				Message: "Error",
			},
		},
	}
	for n, test := range testcases {
		testRepo := makeTestRepo()
		testAPI := makeTestAPI(testRepo)
		testRepo.ArgsOut[GetUserByExternalIDMethod][0] = test.getUserByExternalIDResult
		testRepo.ArgsOut[GetUserByExternalIDMethod][1] = test.getUserByExternalIDError
		authorizedUsers, err := testAPI.GetAuthorizedUsers(test.requestInfo, test.resourceUrn, test.action, test.usersToAuthorize)
		checkMethodResponse(t, n, test.wantError, err, test.usersAuthorized, authorizedUsers)
		if !test.requestInfo.Admin {
			assert.Equal(t, test.requestInfo.Identifier, testRepo.ArgsIn[GetUserByExternalIDMethod][0], "Error in test case %v", n)
		}
	}
}
func TestGetAuthorizedGroups(t *testing.T) {
	testcases := map[string]struct {
		requestInfo RequestInfo
		resourceUrn string
		action string
		groupsToAuthorize []Group
		groupsAuthorized []Group
		wantError error
		getUserByExternalIDResult *User
		getUserByExternalIDError  error
	}{
		"OKtestCaseAdmin": {
			requestInfo: RequestInfo{
				Identifier: "123456",
				Admin:      true,
			},
			resourceUrn: CreateUrn("example", RESOURCE_GROUP, "/path/", "group1"),
			action:      GROUP_ACTION_GET_GROUP,
			groupsToAuthorize: []Group{
				{
					ID:  "654321",
					Urn: CreateUrn("example", RESOURCE_GROUP, "/path/", "group1"),
				},
			},
			groupsAuthorized: []Group{
				{
					ID:  "654321",
					Urn: CreateUrn("example", RESOURCE_GROUP, "/path/", "group1"),
				},
			},
		},
		"OKtestCaseAdminWithEmptyResources": {
			requestInfo: RequestInfo{
				Identifier: "123456",
				Admin:      true,
			},
			resourceUrn:       CreateUrn("example", RESOURCE_GROUP, "/path/", "group1"),
			action:            GROUP_ACTION_GET_GROUP,
			groupsToAuthorize: []Group{},
			groupsAuthorized:  []Group{},
		},
		"ErrortestCaseAuthenticatedUserNotExist": {
			requestInfo: RequestInfo{
				Identifier: "notAdminUser",
				Admin:      false,
			},
			resourceUrn: CreateUrn("example", RESOURCE_GROUP, "/path/", "group1"),
			action:      GROUP_ACTION_GET_GROUP,
			wantError: &Error{
				Code:    UNKNOWN_API_ERROR,
				Message: "Error",
			},
			getUserByExternalIDResult: nil,
			getUserByExternalIDError: &database.Error{
				Code:    database.INTERNAL_ERROR,
				Message: "Error",
			},
		},
	}
	for n, test := range testcases {
		testRepo := makeTestRepo()
		testAPI := makeTestAPI(testRepo)
		testRepo.ArgsOut[GetUserByExternalIDMethod][0] = test.getUserByExternalIDResult
		testRepo.ArgsOut[GetUserByExternalIDMethod][1] = test.getUserByExternalIDError
		authorizedGroups, err := testAPI.GetAuthorizedGroups(test.requestInfo, test.resourceUrn, test.action, test.groupsToAuthorize)
		checkMethodResponse(t, n, test.wantError, err, test.groupsAuthorized, authorizedGroups)
		if !test.requestInfo.Admin {
			assert.Equal(t, test.requestInfo.Identifier, testRepo.ArgsIn[GetUserByExternalIDMethod][0], "Error in test case %v", n)
		}
	}
}
func TestGetAuthorizedPolicies(t *testing.T) {
	testcases := map[string]struct {
		requestInfo RequestInfo
		resourceUrn string
		action string
		policiesToAuthorize []Policy
		policiesAuthorized []Policy
		wantError error
		getUserByExternalIDResult *User
		getUserByExternalIDError  error
	}{
		"OKtestCaseAdmin": {
			requestInfo: RequestInfo{
				Identifier: "123456",
				Admin:      true,
			},
			resourceUrn: CreateUrn("example", RESOURCE_POLICY, "/path/", "policy1"),
			action:      POLICY_ACTION_GET_POLICY,
			policiesToAuthorize: []Policy{
				{
					ID:  "654321",
					Urn: CreateUrn("example", RESOURCE_POLICY, "/path/", "policy1"),
				},
			},
			policiesAuthorized: []Policy{
				{
					ID:  "654321",
					Urn: CreateUrn("example", RESOURCE_POLICY, "/path/", "policy1"),
				},
			},
		},
		"OKtestCaseAdminWithEmptyResources": {
			requestInfo: RequestInfo{
				Identifier: "123456",
				Admin:      true,
			},
			resourceUrn:         CreateUrn("example", RESOURCE_POLICY, "/path/", "policy1"),
			action:              POLICY_ACTION_GET_POLICY,
			policiesToAuthorize: []Policy{},
			policiesAuthorized:  []Policy{},
		},
		"ErrortestCaseDatabaseError": {
			requestInfo: RequestInfo{
				Identifier: "USER-AUTHENTICATED",
				Admin:      false,
			},
			resourceUrn: CreateUrn("example", RESOURCE_POLICY, "/path/", "policy1"),
			action:      POLICY_ACTION_GET_POLICY,
			wantError: &Error{
				Code:    UNKNOWN_API_ERROR,
				Message: "Error",
			},
			getUserByExternalIDResult: nil,
			getUserByExternalIDError: &database.Error{
				Code:    database.INTERNAL_ERROR,
				Message: "Error",
			},
		},
	}
	for n, test := range testcases {
		testRepo := makeTestRepo()
		testAPI := makeTestAPI(testRepo)
		testRepo.ArgsOut[GetUserByExternalIDMethod][0] = test.getUserByExternalIDResult
		testRepo.ArgsOut[GetUserByExternalIDMethod][1] = test.getUserByExternalIDError
		authorizedPolicies, err := testAPI.GetAuthorizedPolicies(test.requestInfo, test.resourceUrn, test.action, test.policiesToAuthorize)
		checkMethodResponse(t, n, test.wantError, err, test.policiesAuthorized, authorizedPolicies)
		if !test.requestInfo.Admin {
			assert.Equal(t, test.requestInfo.Identifier, testRepo.ArgsIn[GetUserByExternalIDMethod][0], "Error in test case %v", n)
		}
	}
}
func TestWorkerAPI_GetAuthorizedOidcProviders(t *testing.T) {
	testcases := map[string]struct {
		requestInfo RequestInfo
		resourceUrn string
		action string
		oidcProvidersToAuthorize []OidcProvider
		oidcProvidersAuthorized []OidcProvider
		wantError error
		getUserByExternalIDResult *User
		getUserByExternalIDError  error
	}{
		"OKtestCaseAdmin": {
			requestInfo: RequestInfo{
				Identifier: "123456",
				Admin:      true,
			},
			resourceUrn: CreateUrn("", RESOURCE_AUTH_OIDC_PROVIDER, "/path/", "keycloak"),
			action:      AUTH_OIDC_ACTION_GET_PROVIDER,
			oidcProvidersToAuthorize: []OidcProvider{
				{
					ID:  "654321",
					Urn: CreateUrn("", RESOURCE_AUTH_OIDC_PROVIDER, "/path/", "keycloak"),
				},
			},
			oidcProvidersAuthorized: []OidcProvider{
				{
					ID:  "654321",
					Urn: CreateUrn("", RESOURCE_AUTH_OIDC_PROVIDER, "/path/", "keycloak"),
				},
			},
		},
		"OKtestCaseAdminWithEmptyResources": {
			requestInfo: RequestInfo{
				Identifier: "123456",
				Admin:      true,
			},
			resourceUrn: CreateUrn("", RESOURCE_AUTH_OIDC_PROVIDER, "/path/", "keycloak"),
			action:      AUTH_OIDC_ACTION_GET_PROVIDER,
			oidcProvidersToAuthorize: []OidcProvider{},
			oidcProvidersAuthorized:  []OidcProvider{},
		},
		"ErrortestCaseDatabaseError": {
			requestInfo: RequestInfo{
				Identifier: "USER-AUTHENTICATED",
				Admin:      false,
			},
			resourceUrn: CreateUrn("", RESOURCE_AUTH_OIDC_PROVIDER, "/path/", "keycloak"),
			action:      AUTH_OIDC_ACTION_GET_PROVIDER,
			wantError: &Error{
				Code:    UNKNOWN_API_ERROR,
				Message: "Error",
			},
			getUserByExternalIDResult: nil,
			getUserByExternalIDError: &database.Error{
				Code:    database.INTERNAL_ERROR,
				Message: "Error",
			},
		},
	}
	for n, test := range testcases {
		testRepo := makeTestRepo()
		testAPI := makeTestAPI(testRepo)
		testRepo.ArgsOut[GetUserByExternalIDMethod][0] = test.getUserByExternalIDResult
		testRepo.ArgsOut[GetUserByExternalIDMethod][1] = test.getUserByExternalIDError
		authorizedOidcProviders, err := testAPI.GetAuthorizedOidcProviders(test.requestInfo, test.resourceUrn, test.action, test.oidcProvidersToAuthorize)
		checkMethodResponse(t, n, test.wantError, err, test.oidcProvidersAuthorized, authorizedOidcProviders)
		if !test.requestInfo.Admin {
			assert.Equal(t, test.requestInfo.Identifier, testRepo.ArgsIn[GetUserByExternalIDMethod][0], "Error in test case %v", n)
		}
	}
}
func TestGetAuthorizedExternalResources(t *testing.T) {
	testcases := map[string]struct {
		requestInfo RequestInfo
		resourceUrns []string
		action string
		expectedResources []string
		wantError error
		getUserByExternalIDResult *User
		getUserByExternalIDError  error
		getGroupsByUserIDResult []TestUserGroupRelation
		getGroupsByUserIDError  error
		getAttachedPoliciesResult []TestPolicyGroupRelation
		getAttachedPoliciesError  error
	}{
		"ErrortestCaseInvalidAction": {
			requestInfo: RequestInfo{
				Admin: true,
			},
			action: "valid::Action",
			wantError: &Error{
				Code:    INVALID_PARAMETER_ERROR,
				Message: "Invalid parameter action, value: valid::Action",
			},
		},
		"ErrortestCaseInvalidResource": {
			requestInfo: RequestInfo{
				Admin: true,
			},
			action: "product:DoSomething",
			resourceUrns: []string{
				"urn:invalid/resource:resource",
			},
			wantError: &Error{
				Code:    INVALID_PARAMETER_ERROR,
				Message: "Invalid parameter urn, value: urn:invalid/resource:resource",
			},
		},
		"ErrortestCaseInvalidResourceWithPrefix": {
			requestInfo: RequestInfo{
				Admin: true,
			},
			action: "product:DoSomething",
			resourceUrns: []string{
				"urn:*",
			},
			wantError: &Error{
				Code:    INVALID_PARAMETER_ERROR,
				Message: "Invalid parameter resource urn:*. Urn prefixes are not allowed here",
			},
		},
		"ErrortestCaseEmptyResources": {
			requestInfo: RequestInfo{
				Identifier: "123456",
				Admin:      true,
			},
			action: "product:DoSomething",
			wantError: &Error{
				Code:    INVALID_PARAMETER_ERROR,
				Message: fmt.Sprintf("Invalid parameter Resources. Resources can't be empty or bigger than %v elements", MAX_RESOURCE_NUMBER),
			},
		},
		"ErrortestCaseMaxResourcesExceed": {
			requestInfo: RequestInfo{
				Identifier: "123456",
				Admin:      true,
			},
			action:       "product:DoSomething",
			resourceUrns: getResources(MAX_RESOURCE_NUMBER+1, "urn:iws:iam:org:genericresource/pathname"),
			wantError: &Error{
				Code:    INVALID_PARAMETER_ERROR,
				Message: fmt.Sprintf("Invalid parameter Resources. Resources can't be empty or bigger than %v elements", MAX_RESOURCE_NUMBER),
			},
		},
		"ErrortestCaseGetRestrictions": {
			action: "product:DoSomething",
			resourceUrns: []string{
				CreateUrn("example", RESOURCE_POLICY, "/path/", "policy1"),
			},
			wantError: &Error{
				Code:    UNAUTHORIZED_RESOURCES_ERROR,
				Message: "Authenticated user with externalId  not found. Unable to retrieve permissions.",
			},
			getUserByExternalIDError: &database.Error{
				Code: database.USER_NOT_FOUND,
			},
		},
		"ErrortestCaseActionPrefix": {
			requestInfo: RequestInfo{
				Identifier: "123456",
				Admin:      true,
			},
			action: "product:DoPrefix*",
			resourceUrns: []string{
				CreateUrn("example", RESOURCE_POLICY, "/path/", "policy1"),
			},
			wantError: &Error{
				Code:    INVALID_PARAMETER_ERROR,
				Message: "Invalid parameter action product:DoPrefix*. Action parameter can't be a prefix",
			},
		},
		"ErrortestCaseNoAllowedUrns": {
			requestInfo: RequestInfo{
				Identifier: "123456",
				Admin:      false,
			},
			action: POLICY_ACTION_GET_POLICY,
			resourceUrns: []string{
				CreateUrn("example", RESOURCE_POLICY, "/path/", "policy1"),
				CreateUrn("example", RESOURCE_POLICY, "/path/", "policy2"),
				CreateUrn("example1", RESOURCE_POLICY, "/path/", "policy3"),
			},
			wantError: &Error{
				Code:    UNAUTHORIZED_RESOURCES_ERROR,
				Message: "User with externalId 123456 is not allowed to access to any resource",
			},
			getUserByExternalIDResult: &User{
				ID:  "123456",
				Urn: CreateUrn("", RESOURCE_USER, "/path/", "user1"),
			},
			getGroupsByUserIDResult: []TestUserGroupRelation{
				{
					Group: &Group{
						ID:  "GROUP-USER-ID",
						Urn: CreateUrn("example", RESOURCE_GROUP, "/path/", "groupUser"),
					},
				},
			},
			getAttachedPoliciesResult: []TestPolicyGroupRelation{
				{
					Policy: &Policy{
						ID:  "POLICY-USER-ID",
						Urn: CreateUrn("example", RESOURCE_POLICY, "/path/", "policyUser"),
						Statements: &[]Statement{
							{
								Effect: "deny",
								Actions: []string{
									POLICY_ACTION_GET_POLICY,
								},
								Resources: []string{
									GetUrnPrefix("example", RESOURCE_POLICY, "/path/"),
								},
							},
							{
								Effect: "allow",
								Actions: []string{
									POLICY_ACTION_GET_POLICY,
								},
								Resources: []string{
									GetUrnPrefix("example", RESOURCE_POLICY, "/path/path2"),
									GetUrnPrefix("example2", RESOURCE_POLICY, "/path/path2"),
								},
							},
						},
					},
				},
			},
		},
		"OktestCaseFullUrnAllow": {
			requestInfo: RequestInfo{
				Identifier: "123456",
				Admin:      false,
			},
			resourceUrns: []string{
				CreateUrn("example", RESOURCE_POLICY, "/path/", "policy1"),
				CreateUrn("example", RESOURCE_POLICY, "/path/", "policy2"),
				CreateUrn("example1", RESOURCE_POLICY, "/path/", "policy3"),
			},
			action: POLICY_ACTION_GET_POLICY,
			expectedResources: []string{
				CreateUrn("example", RESOURCE_POLICY, "/path/", "policy1"),
				CreateUrn("example", RESOURCE_POLICY, "/path/", "policy2"),
			},
			getUserByExternalIDResult: &User{
				ID:  "123456",
				Urn: CreateUrn("", RESOURCE_USER, "/path/", "user1"),
			},
			getGroupsByUserIDResult: []TestUserGroupRelation{
				{
					Group: &Group{
						ID:  "GROUP-USER-ID",
						Urn: CreateUrn("example", RESOURCE_GROUP, "/path/", "groupUser"),
					},
				},
			},
			getAttachedPoliciesResult: []TestPolicyGroupRelation{
				{
					Policy: &Policy{
						ID:  "POLICY-USER-ID",
						Urn: CreateUrn("example", RESOURCE_POLICY, "/path/", "policyUser"),
						Statements: &[]Statement{
							{
								Effect: "allow",
								Actions: []string{
									POLICY_ACTION_GET_POLICY,
								},
								Resources: []string{
									GetUrnPrefix("example", RESOURCE_POLICY, "/path/"),
								},
							},
						},
					},
				},
			},
		},
		"OktestCaseFullUrnDeny": {
			requestInfo: RequestInfo{
				Identifier: "123456",
				Admin:      false,
			},
			action: POLICY_ACTION_GET_POLICY,
			resourceUrns: []string{
				CreateUrn("example", RESOURCE_POLICY, "/path/", "policy1"),
				CreateUrn("example", RESOURCE_POLICY, "/path/", "policy2"),
				CreateUrn("example1", RESOURCE_POLICY, "/path/", "policy3"),
				CreateUrn("example2", RESOURCE_POLICY, "/path/path2/", "policy3"),
			},
			expectedResources: []string{CreateUrn("example2", RESOURCE_POLICY, "/path/path2/", "policy3")},
			getUserByExternalIDResult: &User{
				ID:  "123456",
				Urn: CreateUrn("", RESOURCE_USER, "/path/", "user1"),
			},
			getGroupsByUserIDResult: []TestUserGroupRelation{
				{
					Group: &Group{
						ID:  "GROUP-USER-ID",
						Urn: CreateUrn("example", RESOURCE_GROUP, "/path/", "groupUser"),
					},
				},
			},
			getAttachedPoliciesResult: []TestPolicyGroupRelation{
				{
					Policy: &Policy{
						ID:  "POLICY-USER-ID",
						Urn: CreateUrn("example", RESOURCE_POLICY, "/path/", "policyUser"),
						Statements: &[]Statement{
							{
								Effect: "deny",
								Actions: []string{
									POLICY_ACTION_GET_POLICY,
								},
								Resources: []string{
									GetUrnPrefix("example", RESOURCE_POLICY, "/path/"),
								},
							},
							{
								Effect: "allow",
								Actions: []string{
									POLICY_ACTION_GET_POLICY,
								},
								Resources: []string{
									GetUrnPrefix("example", RESOURCE_POLICY, "/path/path2"),
									GetUrnPrefix("example2", RESOURCE_POLICY, "/path/path2"),
								},
							},
						},
					},
				},
			},
		},
		"OktestCaseWithRestrictions": {
			requestInfo: RequestInfo{
				Identifier: "123456",
				Admin:      false,
			},
			resourceUrns: []string{
				"urn:ews:product:instance:resource/path1/resourceAllow",
				"urn:ews:product:instance:resource/path2/resourceAllow",
				"urn:ews:product:instance:resource/path1/resourceDeny",
				"urn:ews:product:instance:resource/path2/resourceDeny",
			},
			action: "product:DoAction",
			expectedResources: []string{
				"urn:ews:product:instance:resource/path1/resourceAllow",
				"urn:ews:product:instance:resource/path2/resourceAllow",
			},
			getUserByExternalIDResult: &User{
				ID:  "123456",
				Urn: CreateUrn("", RESOURCE_USER, "/path/", "user1"),
			},
			getGroupsByUserIDResult: []TestUserGroupRelation{
				{
					Group: &Group{
						ID:  "GROUP-USER-ID",
						Urn: CreateUrn("example", RESOURCE_GROUP, "/path/", "groupUser"),
					},
				},
			},
			getAttachedPoliciesResult: []TestPolicyGroupRelation{
				{
					Policy: &Policy{
						ID:  "POLICY-USER-ID",
						Urn: CreateUrn("example", RESOURCE_POLICY, "/path/", "policyUser"),
						Statements: &[]Statement{
							{
								Effect: "allow",
								Actions: []string{
									"product:DoAction",
								},
								Resources: []string{
									"urn:ews:product:instance:resource/path1/resourceAllow",
									"urn:ews:product:instance:resource/path2/resourceAllow",
									"urn:ews:product:instance:resource/path1*",
									"urn:ews:product:instance:resource/path2*",
								},
							},
							{
								Effect: "deny",
								Actions: []string{
									"product:DoAction",
								},
								Resources: []string{
									"urn:ews:product:instance:resource/path1/resourceDeny",
									"urn:ews:product:instance:resource/path2/resourceDeny",
									"urn:ews:product:instance:resource/path3*",
									"urn:ews:product:instance:resource/path4*",
								},
							},
						},
					},
				},
			},
		},
	}
	for n, test := range testcases {
		testRepo := makeTestRepo()
		testAPI := makeTestAPI(testRepo)
		testRepo.ArgsOut[GetUserByExternalIDMethod][0] = test.getUserByExternalIDResult
		testRepo.ArgsOut[GetUserByExternalIDMethod][1] = test.getUserByExternalIDError
		testRepo.ArgsOut[GetGroupsByUserIDMethod][0] = test.getGroupsByUserIDResult
		testRepo.ArgsOut[GetGroupsByUserIDMethod][1] = test.getGroupsByUserIDError
		testRepo.ArgsOut[GetAttachedPoliciesMethod][0] = test.getAttachedPoliciesResult
		testRepo.ArgsOut[GetAttachedPoliciesMethod][1] = test.getAttachedPoliciesError
		resources, err := testAPI.GetAuthorizedExternalResources(test.requestInfo, test.action, test.resourceUrns)
		checkMethodResponse(t, n, test.wantError, err, test.expectedResources, resources)
		if !test.requestInfo.Admin {
			assert.Equal(t, test.requestInfo.Identifier, testRepo.ArgsIn[GetUserByExternalIDMethod][0], "Error in test case %v", n)
		}
	}
}