RFC: Adds removePolicy to Iam Policy Builder (#480)

* Adds removePolicy to Iam Policy Builder * adds snippet test
googleapis · May 12, 2017 · e3c8005 · e3c8005
1 parent 7d17699
commit e3c8005
Show file tree

Hide file tree

Showing 3 changed files with 144 additions and 0 deletions.
diff --git a/src/Core/Iam/PolicyBuilder.php b/src/Core/Iam/PolicyBuilder.php
@@ -123,6 +123,53 @@ public function addBinding($role, array $members)
         return $this;
     }
 
+    /**
+     * Remove a binding from the policy.
+     *
+     * Example:
+     * ```
+     * $builder->setBindings([
+     *     [
+     *         'role' => 'roles/admin',
+     *         'members' => [
+     *             'user:[email protected]',
+     *             'user2:[email protected]'
+     *         ]
+     *     ]
+     * ]);
+     * $builder->removeBinding('roles/admin', [ 'user:[email protected]' ]);
+     * ```
+     *
+     * @param  string $role A valid role for the service
+     * @param  array  $members An array of members to remove from the role
+     * @return PolicyBuilder
+     * @throws InvalidArgumentException
+     */
+    public function removeBinding($role, array $members)
+    {
+        $bindings = $this->bindings;
+        foreach ((array) $bindings as $i => $binding) {
+            if ($binding['role'] == $role) {
+                $newMembers = array_diff($binding['members'], $members);
+                if (count($newMembers) != count($binding['members']) - count($members)) {
+                    throw new InvalidArgumentException('One or more role-members were not found.');
+                }
+                if (empty($newMembers)) {
+                    unset($bindings[$i]);
+                    $bindings = array_values($bindings);
+                } else {
+                    $binding['members'] = array_values($newMembers);
+                    $bindings[$i] = $binding;
+                }
+                $this->bindings = $bindings;
+
+                return $this;
+            }
+        }
+
+        throw new InvalidArgumentException('The role was not found.');
+    }
+
     /**
      * Update the etag on the policy.
      *

diff --git a/tests/snippets/Core/Iam/PolicyBuilderTest.php b/tests/snippets/Core/Iam/PolicyBuilderTest.php
@@ -62,6 +62,16 @@ public function testAddBindings()
         $this->assertEquals('user:[email protected]', $this->pb->result()['bindings'][0]['members'][0]);
     }
 
+    public function testRemoveBinding()
+    {
+        $snippet = $this->snippetFromMethod(PolicyBuilder::class, 'removeBinding');
+        $snippet->addLocal('builder', $this->pb);
+
+        $res = $snippet->invoke();
+        $this->assertEquals('roles/admin', $this->pb->result()['bindings'][0]['role']);
+        $this->assertEquals('user2:[email protected]', $this->pb->result()['bindings'][0]['members'][0]);
+    }
+
     public function testSetEtag()
     {
         $snippet = $this->snippetFromMethod(PolicyBuilder::class, 'setEtag');

diff --git a/tests/unit/Core/Iam/PolicyBuilderTest.php b/tests/unit/Core/Iam/PolicyBuilderTest.php
@@ -137,4 +137,91 @@ public function testConstructWithExistingPolicy()
 
         $this->assertEquals($policy, $result);
     }
+
+    public function testRemoveBinding()
+    {
+        $policy = [
+            'bindings' => [
+                [
+                    'role' => 'test',
+                    'members' => [
+                        'user:[email protected]',
+                        'user2:[email protected]'
+                    ]
+                ]
+            ]
+        ];
+
+        $builder = new PolicyBuilder($policy);
+        $builder->removeBinding('test', ['user:[email protected]']);
+
+        $this->assertEquals('user2:[email protected]', $builder->result()['bindings'][0]['members'][0]);
+    }
+
+    public function testRemoveBindingAndRole()
+    {
+        $policy = [
+            'bindings' => [
+                [
+                    'role' => 'test',
+                    'members' => [
+                        'user:[email protected]',
+                    ]
+                ],
+                [
+                    'role' => 'test2',
+                    'members' => [
+                        'user2:[email protected]'
+                    ]
+                ]
+            ]
+        ];
+
+        $builder = new PolicyBuilder($policy);
+        $builder->removeBinding('test', ['user:[email protected]']);
+
+        $this->assertEquals('user2:[email protected]', $builder->result()['bindings'][0]['members'][0]);
+    }
+
+    /**
+     * @expectedException InvalidArgumentException
+     * @expectedExceptionMessage One or more role-members were not found.
+     */
+    public function testRemoveBindingInvalidMemberThrowsException()
+    {
+        $policy = [
+            'bindings' => [
+                [
+                    'role' => 'test',
+                    'members' => [
+                        'user:[email protected]',
+                    ]
+                ],
+            ]
+        ];
+
+        $builder = new PolicyBuilder($policy);
+        $builder->removeBinding('test', ['user2:[email protected]']);
+    }
+
+    /**
+     * @expectedException InvalidArgumentException
+     * @expectedExceptionMessage The role was not found.
+     */
+    public function testRemoveBindingInvalidRoleThrowsException()
+    {
+        $policy = [
+            'bindings' => [
+                [
+                    'role' => 'test',
+                    'members' => [
+                        'user:[email protected]',
+                    ]
+                ],
+            ]
+        ];
+
+        $builder = new PolicyBuilder($policy);
+        $builder->removeBinding('test2', ['user:[email protected]']);
+    }
 }