UniStore: test folders circular reference (#95496)

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>

pkg/tests/apis/folder/folders_test.go

@@ -347,6 +347,24 @@ func TestIntegrationFoldersApp(t *testing.T) {
 			},
 		}))
 	})
+
+	t.Run("with dual write (unified storage, mode 1, create circular reference folder)", func(t *testing.T) {
+		doCreateCircularReferenceFolderTest(t, apis.NewK8sTestHelper(t, testinfra.GrafanaOpts{
+			AppModeProduction:    true,
+			DisableAnonymous:     true,
+			APIServerStorageType: "unified",
+			UnifiedStorageConfig: map[string]setting.UnifiedStorageConfig{
+				folderv0alpha1.RESOURCEGROUP: {
+					DualWriterMode: grafanarest.Mode1,
+				},
+			},
+			EnableFeatureToggles: []string{
+				featuremgmt.FlagGrafanaAPIServerTestingWithExperimentalAPIs,
+				featuremgmt.FlagNestedFolders,
+				featuremgmt.FlagKubernetesFolders,
+			},
+		}))
+	})
 }
 
 func doFolderTests(t *testing.T, helper *apis.K8sTestHelper) *apis.K8sTestHelper {
@@ -589,6 +607,27 @@ func doCreateEnsureTitleIsTrimmedTest(t *testing.T, helper *apis.K8sTestHelper)
 	require.Equal(t, "my folder", create.Result.Title)
 }
 
+func doCreateCircularReferenceFolderTest(t *testing.T, helper *apis.K8sTestHelper) {
+	client := helper.GetResourceClient(apis.ResourceClientArgs{
+		User: helper.Org1.Admin,
+		GVR:  gvr,
+	})
+
+	payload := `{
+		"title": "Test",
+		"uid": "newFolder",
+		"parentUid: "newFolder",
+		}`
+	create := apis.DoRequest(helper, apis.RequestParams{
+		User:   client.Args.User,
+		Method: http.MethodPost,
+		Path:   "/api/folders",
+		Body:   []byte(payload),
+	}, &folder.Folder{})
+	require.NotEmpty(t, create.Response)
+	require.Equal(t, 400, create.Response.StatusCode)
+}
+
 func TestIntegrationFolderCreatePermissions(t *testing.T) {
 	if testing.Short() {
 		t.Skip("skipping integration test")
@@ -617,6 +656,32 @@ func TestIntegrationFolderCreatePermissions(t *testing.T) {
 				},
 			},
 		},
+		{
+			description:  "Should not be able to create a folder under the root with subfolder creation permissions",
+			input:        folderWithoutParentInput,
+			expectedCode: http.StatusForbidden,
+			permissions: []resourcepermissions.SetResourcePermissionCommand{
+				{
+					Actions:           []string{"folders:create"},
+					Resource:          "folders",
+					ResourceAttribute: "uid",
+					ResourceID:        "subfolder_uid",
+				},
+			},
+		},
+		{
+			description:  "Should not be able to create new folder under another folder without the right permissions",
+			input:        folderWithParentInput,
+			expectedCode: http.StatusForbidden,
+			permissions: []resourcepermissions.SetResourcePermissionCommand{
+				{
+					Actions:           []string{"folders:create"},
+					Resource:          "folders",
+					ResourceAttribute: "uid",
+					ResourceID:        "wrong_uid",
+				},
+			},
+		},
 		{
 			description:  "creation of folder without parent fails without permissions to create a folder",
 			input:        folderWithoutParentInput,