Handle nil in restricter (#103)

internal/datastore/cache.go

@@ -49,6 +49,8 @@ func newCache() *cache {
 // first call fetches the result, the other calles get blocked until it the
 // answer was fetched.
 //
+// A non existing value is returned as nil.
+//
 // All values get returned together. If only one key is missing, this function
 // blocks, until all values are retrieved.
 //

internal/datastore/datastore.go

@@ -45,6 +45,8 @@ func New(url string, closed <-chan struct{}, errHandler func(error), keychanger
 }
 
 // Get returns the value for one or many keys.
+//
+// If a key does not exist, the value nil is returned for that key.
 func (d *Datastore) Get(ctx context.Context, keys ...string) ([]json.RawMessage, error) {
 	values, err := d.cache.GetOrSet(ctx, keys, func(keys []string) (map[string]json.RawMessage, error) {
 		return d.requestKeys(keys)

internal/restrict/restrict.go

@@ -48,6 +48,10 @@ func (r *Restricter) Restrict(uid int, data map[string]json.RawMessage) error {
 	}
 
 	for k, v := range data {
+		if v == nil {
+			continue
+		}
+
 		if !allowed[k] {
 			data[k] = nil
 			continue

internal/restrict/restrict_test.go

@@ -35,8 +35,9 @@ func TestRestrict(t *testing.T) {
 func TestChecker(t *testing.T) {
 	perms := new(test.MockPermission)
 	perms.Data = map[string]bool{
-		"user/1/name":     true,
-		"user/1/password": false,
+		"user/1/name":       true,
+		"user/1/password":   false,
+		"user/1/first_name": true,
 	}
 
 	called := make(map[string]bool)
@@ -49,12 +50,17 @@ func TestChecker(t *testing.T) {
 			called[key] = true
 			return []byte("touched"), nil
 		}),
+		"user/first_name": restrict.CheckerFunc(func(uid int, key string, value json.RawMessage) (json.RawMessage, error) {
+			called[key] = true
+			return []byte("touched"), nil
+		}),
 	}
 
 	r := restrict.New(perms, checker)
 	data := map[string]json.RawMessage{
-		"user/1/name":     []byte("uwe"),
-		"user/1/password": []byte("easy"),
+		"user/1/name":       []byte("uwe"),
+		"user/1/password":   []byte("easy"),
+		"user/1/first_name": nil,
 	}
 	if err := r.Restrict(1, data); err != nil {
 		t.Errorf("Restrict returned unexpected error: %v", err)
@@ -75,4 +81,8 @@ func TestChecker(t *testing.T) {
 	if called["user/1/password"] {
 		t.Errorf("checker for key user/1/password was called")
 	}
+
+	if called["user/1/first_name"] {
+		t.Errorf("checker for key user/1/first_name was called")
+	}
 }