DEV Community: Matt Irby

SpiceDB HRBAC: A Practical Implementation

Matt Irby — Tue, 14 Oct 2025 03:53:27 +0000

This article has some code snippet examples hosted on GitHub. View here: (https://github.com/irby/spicedb-hrbac-example)

While working on an internal tool for managing virtual environments, a feature request added into the tool was the ability to share environments with other users. To implement this securely, we needed a way to determine what level of access a given subject (user) had to a particular object (environment or tenant). Given that we may need various roles for a given object (i.e. admin, editor, and viewer), we needed an authorization layer that could handle hierarchical role-based access control (HRBAC).

To minimize the amount of custom code to handle authorization, we decided to leverage Google Zanzibar for a number of reasons:

the Zanzibar design favors for quick writes while offering efficient, low-latency lookups
the graph-based model naturally handles nested roles, group membership, and resource hierarchies
Zanzibar has been proven to work at scale, lending to an efficient and reliable authorization system

A Zanzibar implementation I was particularly drawn to was AuthZed's SpiceDB. SpiceDB offers a mature, open-source, and actively maintained solution with comprehensive documentation, a flexible and extensible schema model, and Kubernetes support through its dedicated operator, making it straightforward to deploy and manage in production environments.

There are many great articles written on how to configure SpiceDB to handle complex role-based access control, for example this article goes into great depth to discuss relation-based access control (ReBAC). But, I do want to dive into how one can make a hierarchical role-based access control (HRBAC) possible via SpiceDB.

I've created a GitHub repository for this example: (https://github.com/irby/spicedb-hrbac-example)

Consider the following schema:

definition user {}

definition role {
    // A role belongs to a specific tenant
    relation tenant: tenant

    // Users can be assigned to this role
    relation assignee: user

    // Define the hierarchical permissions
    permission admin = assignee
    permission editor = assignee + admin
    permission viewer = assignee + editor
}

definition tenant {
    // Direct role assignments within this tenant
    relation admin_role: role
    relation editor_role: role  
    relation viewer_role: role

    // Computed permissions based on role assignments
    permission admin = admin_role->assignee
    permission editor = editor_role->assignee + admin
    permission viewer = viewer_role->assignee + editor
}

With this schema, we've defined the following relations:

A user can be assigned to a tenant via a role
A role can be one of the following:
- admin
- editor
- viewer
These roles have the following hierarchy
- an admin inherently has editor and viewer access
- an editor inherently has viewer access
- a viewer only has its own access.
These roles are tenant-scoped. A role relationship to tenant A is logically separate from a role relationship to tenant B.

While a relatively simple implementation, this gives us enough flexibility to configure the HRBAC we require for our internal tool. Combined with SpiceDB's robust SDKs and APIs, this proof of concept demonstrates that we can achieve scalable, maintainable authorization without the burden of building and maintaining custom logic from scratch.

Cryptography – A Gentle Overview (Part 2: Encryption)

Matt Irby — Sun, 05 Feb 2023 21:24:46 +0000

This post is part 2 of a series. Click here to read the first entry in this series.

Symmetric Encryption

In symmetric encryption, the same key is used to encrypt and decrypt. Plaintext is converted into ciphertext using a key and the ciphertext can be converted back to plaintext with the same key.

Symmetric encryption has been used for thousands of years. A famous example of symmetric encryption is a Caesar cipher. A Caesar cipher works by shifting characters in a text by a fixed number of positions. When the shift exceeds the bounds of the alphabet, it wraps back around to the start of the alphabet.

For example, this is an example of a Caesar cipher with a shift of 2.

For example, this is an example of a Caesar decipher with a shift of 2.

While this form of encryption is relatively simple, it is also quite easy to break. By mapping the frequency of commonly used letters (frequency analysis), it is possible to derive a shift value and keep updating the shift until the ciphertext converts into a readable plaintext.

Fortunately, other symmetric encryption schemes exist that are much more secure than the Caesar cipher. Some of the first modern symmetric encryption schemes were DES and 3DES, developed in the late 70s / early 80s (they have since been deprecated by NIST). As of this publishing, Advanced Encryption Scheme (AES) remains one of the most popular, widely-used symmetric encryption schemes still used today.

The challenge of utilizing symmetric encryption to securely communicate with other parties – especially over the internet – is how the key is shared. If Alice creates a key, how can she share the key with Bob without exposing it to a malicious actor, Eve? Another type of cryptographic algorithm is required: asymmetric encryption.

Asymmetric Encryption

In asymmetric encryption (also known as public key cryptography), different keys are required to encrypt and decrypt:

Public key - used to encrypt
Private key - used to decrypt

Therefore, if Alice wants to securely send a message to Bob:

Alice will use Bob's public key to encrypt a message and send it to Bob
Bob will use his private key to decrypt Alice's message

Since a message encrypted by a public key cannot be decrypted without the private key, it is extremely important that the private key is never shared with anyone.

Examples of asymmetric encryption algorithms in use today are RSA and Elliptic Curve Cryptography (ECC). While this blog will not dive into it, these schemes rely on mathematics to create difficult problems to solve, such as prime number factorization or difficulty finding a discrete logarithm for a curve, respectively.

While asymmetric encryption enables secure communication between two or more parties, it has its limitations. In terms of performance, asymmetric encryption is typically slower than symmetric encryption. This is largely due to the mathematics involved in their implementation as mentioned in the previous paragraph. Additionally, asymmetric encryption is bound on its input size; it cannot operate on large inputs.

In practical applications, a hybrid approach of using both symmetric and asymmetric encryption is utilized:

Encrypt a plaintext T with symmetric encryption to produce a ciphertext C1. Encrypt C1 with asymmetric encryption to produce ciphertext C2.
Decrypt ciphertext C2 with asymmetric encryption to produce ciphertext C1. Decrypt C1 with symmetric encryption to produce plaintext T.

A famous example of hybrid encryption is the Diffie-Hellman key exchange protocol, which describes how two parties can establish a shared symmetric key using their public and private keys. This video gives a good explanation of how the key exchange protocol works.

Encryption So Far

So far, we've established that symmetric and asymmetric encryption both offer confidentiality:

In symmetric encryption, only those with the shared secret key can read an encrypted message.
In asymmetric encryption, only the person with the private key can read a message encrypted by the public key.

In the previous post, I described a CIA triad cryptography can fulfill (confidentiality / integrity / authenticity). What about integrity and authenticity?

In the next couple of sections, I will describe how hashing could be used to fulfill these missing pillars.

Hashing

Hashing is the one-way conversion of a plaintext to a ciphertext (also known as a backdoor function):

A plaintext T1 can be converted to hash H1. H1 cannot be converted back to T1.
Given a constant plaintext T1, it will always produce hash H1.

A property of hashing is that it is one-to-one, which means:

Given two unique plaintexts T1 and T2, hash(T1) != hash(T2).

Some notable hashing algorithms include MD5, SHA (1/256/512) and Bcrypt.

You may have come across a scenario where you've downloaded a file from the internet and the site you've downloaded the file from provides an MD5 hash of the file. This is to ensure the integrity of the download: the file was downloaded completely and is the correct version of the file you're expecting.

Another application of hashing is to obscure sensitive information that shouldn't be recovered, such as a password. When a user's password is set, a hash of the password is stored in the database. Then, next time the user logs in, their supplied password is hashed and compared against the stored password hash. This is an example of using hashing to achieve confidentiality.

It is beyond the scope of this post, but hashes can utilize salting to achieve unique hashes given a constant input. This is primarily used to produce different password hashes given the same password.

Hashing + Encryption

Since anyone can send Bob a message by using his public key, how can Bob validate who sent him a message? If Bob receives a message saying "Send Eve 5 dollars", how can he ensure this message came from Alice and not Eve?

This is where HMAC (Hash-based Message Authenticator Code) can be used to validate the authenticity of the sender.

HMAC offers two main functions:

Signing - sign a hash using the private key of the sender to produce a signature
Verifying - verify the signature using the public key of the sender

For example, if Alice wants to send Bob the message "Send Eve 5 dollars":

Alice encrypts "Send Eve 5 dollars" with Bob's public key to produce ciphertext C1.
"Send Eve 5 dollars" is hashed by Alice to produce hash H1
Alice will then sign H1 with Alice's private key to produce signature S1.
Bob receives ciphertext C1 and signature S1.
Bob decrypts ciphertext C1 with his private key to produce plaintext "Send Eve 5 dollars".
Bob hashes "Send Eve 5 dollars" to produce hash H2.
Bob verifies hash H2 was used to produce signature S1 by using Alice's public key.

If validation passes, Bob can verify that the message he received from Alice was what was intended (integrity) and that Alice was the one who sent it (authenticity).

Conclusion

Although it is necessary for secure communication, cryptography has a lot of elements at play and can be a complex field. Through the course of this article, we explored the different encryption schemes and how, when combined with hashing, all of these components can be used to verify the confidentiality, integrity and authenticity of our communications.

As a final note, cryptography is not a perfect field. It relies on mathematics and computational complexity. As computer hardware becomes more efficient and can compute quicker, cryptographic functions that were once considered secure have since become insecure. When deciding on an encryption scheme to use in your application, verify it is appropriate for your scenario and whether the scheme is still considered secure.

Thank you for reading!

Good Literature

If you're interested in learning more about cryptography and want to learn more about the subject as a whole:

Foundations of Cryptography by George Kudrayvtsev (link )
Introduction to Modern Cryptography by M. Ballare, P. Rogaway

If you're interested in learning about the history behind cryptography and the historical figures behind our modern-day cryptographic landscape:

Crypto by Steven Levy

Cryptography – A Gentle Overview (Part 1: Intro)

Matt Irby — Wed, 30 Nov 2022 05:09:27 +0000

Introduction

I recently gave a lunch-and-learn discussing cryptography, and I figured I could convert the talk into a series of blog posts. While cryptography is a topic I enjoy learning, it is certainly not a field I am an expert in by any means. However, I feel that discussing it (verbally or written) helps me reinforce the knowledge.

At depth, cryptography can be a complicated subject matter because it can get into the weeds of mathematics and understanding abstract concepts. So, these posts will be a gentle introduction to the topic that will discuss some concepts in cryptography at a high-level.

This post will start off with a definition of cryptography, introduce some vocabulary, and wrap up with a little note about encryption. The next post will take what has been discussed here and flesh it out more.

Let's get started!

What is Cryptography, Anyway?

Cryptography is the process of protecting information and communication by obscuring its contents so it can only be read by an intended party. If the contents are to be read, there should be a guarantee about who originated the information. The mechanisms by which the information is obscured should use strong, mathematically intensive functions.

In the open internet, we can't blindly trust that our communication is safe. There is always the chance that our communication could be intercepted or forged by a malicious actor. When information is stored, it should be protected by an unwanted person from reading its contents. Cryptography can help ensure information is protected when sent between parties (in-transit) or stored (at rest).

Information security aims to address three pillars: confidentiality, integrity, and availability. These make up the CIA triad of security. In cryptography, while confidentiality and integrity are relevant, availability is not a concern. However, we do care about verifying where information came from.

Therefore, cryptography should address the following CIA triad:

Confidentiality: Information cannot be read by unauthorized parties.
Integrity: Data is not tampered with during transmission. It is complete.
Authenticity: Only the sender could have sent the message.

Introducing Some Vocabulary

Before diving in, let's introduce some vocabulary and provide some definitions.

Encrypt: Converting something readable into an unreadable form.
Decrypt: Converting something unreadable into a readable form
Plaintext: Ordinary, readable text before encryption and after decryption
Ciphertext: Unreadable text that is output of encryption and input to decryption
Hashing: One-way conversion of a plaintext to a ciphertext. This should not be able to convert back to plaintext.

Cryptographic Cast of Characters

If you come across literature concerning cryptography, sometimes example scenarios are provided to explain a concept. These examples probably involve characters named Alice, Bob, Eve, Mallory, etc. Alice and Bob are innocent actors while Eve and Mallory are typically malicious actors. For more information on these characters, feel free to check out this Wikipedia article on Alice and Bob.

Encryption

Encryption is the act of converting something readable into an unreadable form. Decryption is the act of converting something unreadable into a readable form. Information is encrypted using a key and decrypted using a key. The keys do not need to be the same.

The main types of encryption include:

Symmetric Encryption: The same key is used to encrypt and decrypt a message (secret key)
Asymmetric Encryption: A public key is used to encrypt a message and a private key is used to decrypt a message. Also known as public key encryption
Hybrid Encryption: A blend of symmetric and asymmetric encryption.

Initialization Vectors

So far, we've discussed a key and plaintext as input to encryption. If a plaintext is encrypted twice with the same key, is the resulting ciphertext the same? From what we have, the resulting ciphertext would be the same. This can be a bad thing. If an attacker knows the encryption of plaintext A produces ciphertext B, any time they see B they can infer that A was input. This would violate confidentiality.

Another component is needed to maintain confidentiality of encryption – an initialization vector (IV). The IV should be unpredictable / random and generated prior to any message encryption. Even if the plaintext and key are the same, a unique random IV will guarantee each resulting ciphertext will be different. The IV is usually appended at the start of the ciphertext and is used as input to decryption. It does not need to be secret.

Randomness is one of the most crucial parts of cryptography, especially for IVs. It is also near impossible to produce a truly random value – how do you produce a truly random number? I won't go into detail for this post about randomness (this post goes into good detail). IVs should be seeded using a secure random number generator.

Bits and Bytes

Nearly everything in cryptography is expressed in bits and bytes. Some encryption schemes (ciphers) work from fixed-length groups of bits called blocks. As you come across different algorithms, keys/blocks may require different bit sizes (256-bit / 512-bits).

While key length does not imply security, some encryption algorithms have been proven to be weak when key size is small (see here). A larger key size can decrease performance. When choosing an encryption algorithm, always research its implementation, what key sizes are recommended, and whether it's still considered secure. As computers get faster, encryption with smaller key sizes can be "broken" more quickly.

Summary & Up Next

A lot of material has been covered so far!

The next post in this series will take a look at symmetric and asymmetric encryption, understand what they are, how they could be applied, and what their limitations are. It will also dive into hashing and explain its usage. The post will conclude with how encryption and hashing could be used to fulfill the CIA triad of cryptography.

Thank you!

Part 2

Part 2 of this post is now available! Link to the next article: here

Making GDB Easier: The TUI Interface

Matt Irby — Sun, 30 Jan 2022 18:36:10 +0000

Background

I've recently started a new semester for my Master's program, and the first project for the semester involves using the GDB tool (GNU Debugger) to analyze a stack on a simple C program that contains a buffer overflow vulnerability. A couple of semesters ago, I had been given a VM pre-loaded with a more featured debugger tool called pwndbg. Pwndbg was excellent because it was easy to use and easily allowed accessed to information such as current assembly code being executed and a view of the program registers. So, going back to using GDB felt a little like stepping back into the stone age.

For this project, one of the TAs recommended watching a video called Give me 15 minutes & I'll change your view of GDB. In the video, the presenter, Greg Law, mentions that while GDB is easy to use, it is difficult to learn. He introduces a tool in GDB called TUI (Text User Interface). This tool allows the programmer to easily visualize the executing program, its assembly, and view the program registers (similar to what pwndbg offered). For reverse engineering and program forensics, these items are critical.

How to Access TUI

To access the TUI interface, first compile your C program with the gcc compiler and use the -g option. This option gives the GDB tool more information about your program. Then, run GDB on your compiled program and use start to hit a breakpoint once the program enters the main function.

Once the program has started, to enable TUI mode you can either use Ctrl+X+A or enter in tui enable into GDB to enter TUI mode.

Once inside TUI mode, you can see the program's current point of execution marked in the line that's highlighted. In this case, my program is currently at line 7. To see what assembly is currently being executed, type in layout asm

To enable split screen, press Ctrl+X then press 2.

With this split screen view enabled, I can use the next command in GDB to step through the program's steps, see what assembly and line of the program is currently being executed.

To see the program's registers, use the layout reg command.

Before TUI was enabled, pressing the up key would iterate through previous commands. However, with TUI enabled, pressing the up and down key scrolls through the assembly instructions. To iterate through previous instructions, use Ctrl+P. If you would like to switch back to using the arrow keys for the command line, enter focus cmd to switch focus to the command line.

To exit TUI and go back to the GDB console interpreter, either use Ctrl+X+A or type in tui disable.

Summary

As Greg Law mentions in Give me 15 minutes & I'll change your view of GDB, while GDB is easy to use, it has a bit of a learning curve. Before I saw this video, I was not aware of the TUI interface and assumed that viewing register values would be much more cumbersome than it actually is. I recommend checking out this list of TUI commands to get more familiar with the commands.

Happy hacking!

Mocking Your Interfaces with Moq

Matt Irby — Sat, 17 Jul 2021 05:45:49 +0000

Introduction

An important aspect of unit testing is being able to test how your code handles responses from services. While dependency injection allows you to inject your services into your classes, you don't want your unit tests directly calling those services, especially those making HTTP requests or database calls.

To circumvent this, you want to be able to mock your services so you can simulate them returning responses without actually calling them. Fortunately, the Moq framework allows you to be able to do such a thing, and it's extremely easy to setup. In this lesson, we shall cover the Moq framework and how you can use it to simulate your services while unit testing.

Installation and Sample Code

To install Moq, you can install it within your unit test project from the NuGet Package Manager or use the following command from the Package Manager Console:

> Install-Package Moq

Once installed, you are ready to start using Moq! Let's take an example of some code and how we can use Moq to our advantage:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;

namespace MyProject
{
    /// <summary>
    /// A class to denote students in a system
    /// </summary>
    public class Student
    {
        public int Id { get; set; }
        public string FirstName { get; set; }
        public string LastName { get; set; }
        public double GradeAverage { get; set; }
    }

    /// <summary>
    /// Enumeration to represent a grade a student may obtain
    /// </summary>
    public enum Grade
    {
        A,
        B,
        C,
        D,
        F
    }

    /// <summary>
    /// A repository containing all the students in a system
    /// </summary>
    public interface IStudentRepository
    {
        /// <summary>
        /// Returns a student by an ID value
        /// </summary>
        /// <param name="id">Numeric ID value of student to pull</param>
        /// <returns>If student with ID supplied exists in the repository, it return such a Student with Id. If no student in repository has such Id, it returns null.</returns>
        public Student GetStudentById(int id);

        /// <summary>
        /// Asynchronously returns all the students in the repository
        /// </summary>
        /// <returns>A list of students in the repository</returns>
        public Task<List<Student>> GetStudentsAsync();
    }

    public class StudentRepository : IStudentRepository
    {
        public Student GetStudentById(int id)
        {
            // Make a DB call to get a student by ID
            throw new System.NotImplementedException();
        }

        public Task<List<Student>> GetStudentsAsync()
        {
            // Make a DB call to get all student by ID
            throw new System.NotImplementedException();
        }
    }

    public class StudentService
    {
        private readonly IStudentRepository _repository;

        public StudentService(IStudentRepository repository)
        {
            _repository = repository;
        }

        /// <summary>
        /// Determines the grade value of a student based on their GradeAverage score.
        /// </summary>
        /// <param name="id">An Id value of a student in the system</param>
        /// <returns>Returns a Grade enumeration value of the student if student exists. If no student in the repository contains Id value provided, an Argument exception is thrown.</returns>
        public Grade GetStudentGrade(int id)
        {
            var student = _repository.GetStudentById(id);

            if (student == null)
                throw new ArgumentException("Could not find student with that ID.", nameof(id));

            if(student.GradeAverage >= 90)
            {
                return Grade.A;
            } else if (student.GradeAverage >= 80)
            {
                return Grade.B;
            } else if (student.GradeAverage >= 70)
            {
                return Grade.C;
            } else if (student.GradeAverage >= 60)
            {
                return Grade.D;
            } else
            {
                return Grade.F;
            }
        }

        /// <summary>
        /// Asynchronously returns a list of students in order by their last name.
        /// </summary>
        /// <returns>A list of students organized by their last name, ascending.</returns>
        public async Task<List<Student>> GetStudentsInAlphabeticalOrderAsync()
        {
            var students = await _repository.GetStudentsAsync();

            return students.OrderBy(p => p.LastName).ToList();
        }
    }

}

Testing the Synchronous Methods

To verify the code of our StudentService class, we want to be able to write a unit test against it, but we don't want to depend on the StudentRepository class doing any work. Of course, in this example, none of the StudentRepository methods have been implemented, but assuming they have, we don't want our unit tests making any actual database calls. Therefore, we must mock responses for the IStudentRepository classes in our unit tests. But, with Moq, this isn't a problem.

Consider the following code:

namespace MyProject.Tests
{
    public class Tests
    {
        private StudentService _service;

        [SetUp]
        public void Setup()
        {
        }

        [Test]
        public void ShouldCalculateStudentGradeCorrectly()
        {
            var student = new Student
            {
                Id = 1,
                FirstName = "John",
                LastName = "Doe",
                GradeAverage = 81.5
            };

            var mockStudentService = new Mock<IStudentRepository>();
            mockStudentService.Setup(p => p.GetStudentById(It.IsAny<int>())).Returns(student);

            _service = new StudentService(mockStudentService.Object);

            var grade = _service.GetStudentGrade(123);

            Assert.AreEqual(Grade.B, grade);
        }
}
}

Within the ShouldCalculateStudentGradeCorrectly method, we've created a Student object to simulate our repository returning, and then in the next line we instantiate a Mock version of the IStudentRepsitory interface called mockStudentService, and then on mockStudentService we setup the GetStudentById method, with any integer provided, to return our Student variable.

With the It.IsAny<T> declared within the variable, the Moq framework tells our method that any value of type T will return the Student value. Therefore, we could provide the value 123 to the GetStudentGrade method, and, no matter what, our IStudentRepository interface would return the Student value, whose Id is 1.

With this configuration, we know the code will always return Student with Id = 1 and GradeAverage = 81.5. Because 81.5 is less than 90.0, but greater than or equal to 80.0, we should expect our code to return a Grade enum of B. And, based on our unit test passing, this seems to be the case.

We can be more specific with our inputs that using the generic It.IsAny<int> with Moq. If we want to specify that, for only the integer 1, we want student with Id of 1 to come back from the service (as it would in an actual instance), we can do so. This will also allow our unit test to explore instances in which an Id that doesn't exist in our repository to be called, and we can therefore test edge cases.

Let's consider the following piece of code:

namespace MyProject.Tests
public class Tests
    {
        private StudentService _service;

        [Test]
        public void ShouldThrowExceptionIfStudentIdNotExist()
        {
            var student = new Student
            {
                Id = 1,
                FirstName = "John",
                LastName = "Doe",
                GradeAverage = 81.5
            };

            var mockStudentService = new Mock<IStudentRepository>();
            mockStudentService.Setup(p => p.GetStudentById(1)).Returns(student);

            _service = new StudentService(mockStudentService.Object);

            // Confirm that if we pass 1, we get our expected value
            var grade = _service.GetStudentGrade(1);
            Assert.AreEqual(Grade.B, grade);

            // If we pass in a value not defined to Moq, its result will be treated as null.
            Assert.Throws<ArgumentException>(() => _service.GetStudentGrade(123));
        }
}
}

In this scenario, we specify that if our GetStudentById method on the mockkStudentService service receives a parameter value of 1, it will return the Student object whose Id = 1. And, we confirm that when we do pass the value of 1 to that method that we still get our Grade.B result as expected.

So, what happens if we try to pass in the 123 value now as our parameter? Well, to our Moq framework, this value isn't yet defined. Therefore, when the GetStudentById method is called with this input, a value of null is returned. Thus, our unit test is able to explore the edge case scenario and hit the null-checking portion of the GetStudentGrade method in the StudentService class, and we can verify that an ArgumentException is thrown when no student with such Id exists.

Testing the Asynchronous Functions

So far, we've looked at how we can test the synchronous functions within the Moq testing framework, but what about testing the asynchronous functions? Fortunately, we are still able to do so.

Let's consider the following code in a unit test project:

namespace MyProject.Tests
{
    public class Tests
    {
        private StudentService _service;

        [Test]
        public async Task ShouldSortStudentsInAlphabeticalOrder()
        {
            var students = new List<Student>()
            {
                new Student()
                {
                    Id = 1,
                    FirstName = "Jacob",
                    LastName = "Jingleheimerschmidt"
                },
                new Student()
                {
                    Id = 2,
                    FirstName = "John",
                    LastName = "Appleseed"
                },
                new Student()
                {
                    Id = 3,
                    FirstName = "Zig",
                    LastName = "Zag"
                }
            };

            var mockStudentService = new Mock<IStudentRepository>();
            mockStudentService.Setup(p => p.GetStudentsAsync()).Returns(Task.FromResult(students));

            _service = new StudentService(mockStudentService.Object);

            var result = await _service.GetStudentsInAlphabeticalOrderAsync();

            // Verify all 3 Student values are turned from the function
            Assert.AreEqual(result.Count, 3);

            // Verify the order of the last names is as expected (item 0 = Appleseed (Id = 2), item 1 = Jingleheimerschmidt (Id = 1), item 2 = Zag (Id = 3))
            Assert.AreEqual(result[0].Id, 2);
            Assert.AreEqual(result[1].Id, 1);
            Assert.AreEqual(result[2].Id, 3);
        }
    }
}

If our asynchronous method GetStudentsAsync required any parameters, we could still use the It.IsAny<T> code and still supply it as generic parameters, but in this case no parameters are needed. Truly, the only important item to note is the Task.FromResult() within the Returns method of the GetStudentsAsync method. For asynchronous functions, you can declare that your mocked values are the result of a task and achieve the same result you would for mocking synchronous methods.

If we run our unit test code, we see that the GetStudentsInAlphabeticalOrderAsync does fetch all 3 Student values available in the repository and does order the results according by the Student last name, as we can tell by the ordering of the Id values.

Conclusion

In this lesson, we can see how easy it is to setup a mock interface for a unit test to work with using the Moq framework, and we have explored how to mock up responses for both synchronous and asynchronous functions. With Moq, we can easily be able to simulate how our code can handle responses from dependencies without actually needing to call upon their concrete implementations.

This lesson only provides a simple overview of Moq, but there's a lot more to Moq than just what we've covered. For example, it's good to take a look at the callback functionality of Moq or just the documentation from Moq's project page.

Thanks for reading!

Developing a Firebase Function Pt 2 - Environment Variables and HTTP Methods

Matt Irby — Mon, 12 Jul 2021 00:46:25 +0000

In my last article, I demonstrated how you can initialize a Firebase Functions project and how to deploy. In this lesson, I will explain how you can configure environment variables for your API and how to perform other HTTP methods such as PUT and POST.

Environment Variables

It is generally good practice to make use of environment variables when developing an API, especially when you want to source control your API code but not expose sensitive information such as database credentials. Fortunately, Firebase Functions allow for an easy way to get and set environment variables for your function.

To set an environment variable, run the following code from your command line:



$ firebase functions:config:set [scope].[value]="something"

For example, if you wanted to assign a value of hello to a variable called myvariable in the scope of test, run the following code:



$ firebase functions:config:set test.myvariable="hello"

To fetch the environment variables, run the following code



$ firebase functions:config:get

This will return a JSON object containing the environment variables for the project



{
  "test": {
    "myvariable": "hello"
  }
}

One thing to note is that setting the environment variable from the command line can introduce some quirks. For instance, if we try to set the variable to "hello, world!" we get a weird error:



$ firebase functions:config:set test.myvariable="hello, world!"
bash: !": event not found

The reason for this error is that an exclamation mark character is a special character to bash, so to get around this error we can substitute double quotes for single quotes



$ firebase functions:config:set test.myvariable='hello, world!'

Now let's use our environment variables within our code. Let's review our code we wrote in the previous lesson.



const functions = require('firebase-functions');

// Create and Deploy Your First Cloud Functions
// https://firebase.google.com/docs/functions/write-firebase-functions

exports.helloWorld = functions.https.onRequest((request, response) => {
  functions.logger.info("Hello logs!", {structuredData: true});
  response.send("Hello from Firebase!");
});

Within our response, let's return the myvariable environment variable we've setup. To retrieve all the environment variables in our project, we can write functions.config() within our code, and then we can access the environment variable by specifying the path to the variable. Since myvariable is part of the test scope, our code should look like this



const functions = require('firebase-functions');

// Create and Deploy Your First Cloud Functions
// https://firebase.google.com/docs/functions/write-firebase-functions

exports.helloWorld = functions.https.onRequest((request, response) => {
  functions.logger.info("Hello logs!", {structuredData: true});
  response.send(functions.config().test.myvariable);
});

Let's run the emulator and see if we can get this value when we view our function from the browser.



$ firebase emulators:start

However, when visiting the API endpoint for helloworld, the following error appears:

The reason for this error is that, although the environment variables are defined, the emulator is unable to retrieve the environment variables. In order for the emulator to retrieve the environment variables, a file containing a copy of the environment variables will need to be created. To do so, run the following script:



$ firebase functions:config:get > .runtimeconfig.json

This script will write the environment variables to a file called .runtimeconfig.json. This is a file that the emulator is able to read from. Let's restart the emulator and see if we can read our environment variable now:

Note that each time you add/update your environment variables, you will need to run the firebase functions:config:get > .runtimeconfig.json script. In addition, once the emulator is started it caches the values within the runtimeconfig file, so you'll need to restart the emulator to have the new environment variables picked up.

NOTE: Because the .runtimeconfig.json file contains environment variables (and potentially sensitive information), we will want to make sure we ignore this file from version control, i.e. adding it to .gitignore

This should cover the basics on getting environment variables configured and retrieved by the API. For some more information about environment variables, please consult Firebase's documentation. For now, let's move onto how the API can support more HTTP methods besides just GET.

More HTTP Methods

Currently, our application only supports a GET operation. How about support for more HTTP methods such as POST or PUT? Fortunately, Firebase Functions does allow support for this. To do so, you can use Express routers to specify the operations and have the functions.https.onRequest() method accept the Express router configuration.

Here is some sample code to illustrate this, borrowed from this StackOverflow post



const functions = require('firebase-functions');
const express = require('express');
const cors = require('cors');
const app = express();

// Automatically allow cross-origin requests
app.use(cors({origin: true}));

// Defines my GET method at the helloWorld endpoint
app.get('/', (request, response) => {
  response.end('Here is my GET request!');
});

// Defines my POST method at the helloWorld endpoint and prints out an environment variable
app.post('/', (request, response) => {
  response.end('Here is my POST request! ' + functions.config().test.myvariable);
});

// Defines my PUT method at the helloWorld endpoint
app.put('/', (request, response) => {
  response.end('Here is my PUT request!');
});

// Expose Express API as a single Cloud Function
exports.helloWorld = functions.https.onRequest(app);

With the emulators running, when we visit the API endpoint for helloWorld in the brower, we see the 'Here is my GET request!' message.

To test the POST endpoint, open up a command line tool and use CURL:



$ curl -X POST http://localhost:5001/irbytestproject/us-central1/helloWorld
Here is my POST request! hello, world!

Similarly, to test the PUT endpoint:



$ curl -X PUT http://localhost:5001/irbytestproject/us-central1/helloWorld
Here is my PUT request!

Deploying our API

Now that we have our environment variables configured and multiple HTTP methods supported, we are ready to deploy our function to Firebase. As a reminder from the first part of this lesson, the command to deploy our Firebase function:



$ firebase deploy

Once the deployment has completed, we can use CURL to test our POST endpoint to ensure it gets the environment variable correctly:



$ curl -X POST https://us-central1-irbytestproject.cloudfunctions.net/helloWorld 
Here is my POST request! hello, world!

Excellent! Our API seems to be working as expected.

Conclusion

For now, this should wrap up the basics on developing a Firebase function. If you are unfamiliar with Node.js or Express, I recommend checking out this course by Maximilian Schwarzmüller which goes over connecting a Node application to a MongoDB database, setting up API controllers, and more.

Hope you've enjoyed the article!

Developing a Firebase Function Pt 1 - Initialize and Deploy

Matt Irby — Sat, 10 Jul 2021 20:25:25 +0000

Recently, I've been dabbling in Google Firebase due to its minimal overhead in getting started and relatively simple deployment pipeline. In particular, its support for NodeJS code and HTTPS makes it an ideal candidate for folks who are new to API development and looking for a low-cost option. In this post, I wish to demonstrate from start to finish how to start a NodeJS API, be able to test it, and deploy it to production.

Installation and Initialization

To get started, check to ensure you have the Firebase CLI installed on your computer. To install the Firebase CLI, please follow these instructions. Once you are done, ensure you have installed Firebase version 8.6.0

$ firebase --version 
8.6.0

If you do not have version 8.6.0 installed, you can install this version globally using the following command with NPM:

$ npm install -g firebase@8.6.0
$ npm install -g firebase-tools@8.6.0

NOTE: If you receive an EACCESS: permission denied error running the npm install commands, use sudo npm install... instead.

Now, head over to Firebase and sign in. If you've never used Firebase before, all you need is to log into a Google account.

Using the Firebase CLI, log into your Firebase account using a command line application.

$ firebase login

? Allow Firebase to collect CLI usage and error reporting information (Y/n): N

This will open a page in your browser to login to Firebase and grant permissions for the CLI to access your account. Once you've signed in, the CLI will have the credentials stored and you're ready to initialize your project.

Create a new folder and visit this folder using your command line app. Then, use the script below to start the initialization:

$ firebase init

Once this command is entered, it will prompt you for which kind of project you want to create. For this tutorial, we will only be making a Functions project. Using the arrow keys, go down to Functions, hit space, and then hit enter. Next, you will be asked if you want to create a new project or use an existing project. Choose 'Create a new project', supply a unique project name (the initialization will fail if the name is already taken), and then choose a name to call your project (if left blank, it will default to the project name).

Then, You will then be asked if you want to use JavaScript or TypeScript. We will use JavaScript for this project. Then, when asked if you want to use ESLint to catch probable bugs or enforce style, choose No. When asked if you want to install dependencies with npm, choose Yes.

$ firebase init

You're about to initialize a Firebase project in this directory:

  /Users/matt/Documents/test

? Which Firebase CLI features do you want to set up for this folder? Press Space to select features, then Enter to confirm your choices. Functions
: Configure and deploy Cloud Functions

=== Project Setup

First, let's associate this project directory with a Firebase project.
You can create multiple project aliases by running firebase use --add, 
but for now we'll just set up a default project.

? Please select an option: Create a new project
i  If you want to create a project in a Google Cloud organization or folder, please use "firebase projects:create" instead, and return to this command when you've created the project.
? Please specify a unique project id (warning: cannot be modified afterwa
rd) [6-30 characters]:
 irbytestproject
? What would you like to call your project? (defaults to your project ID)

✔ Creating Google Cloud Platform project
✔ Adding Firebase resources to Google Cloud Platform project

🎉🎉🎉 Your Firebase project is ready! 🎉🎉🎉

Project information:
   - Project ID: irbytestproject
   - Project Name: irbytestproject

Firebase console is available at
https://console.firebase.google.com/project/irbytestproject/overview
i  Using project irbytestproject (irbytestproject)

=== Functions Setup

A functions directory will be created in your project with a Node.js
package pre-configured. Functions can be deployed with firebase deploy.

? What language would you like to use to write Cloud Functions? JavaScript
? Do you want to use ESLint to catch probable bugs and enforce style? No
✔  Wrote functions/package.json
✔  Wrote functions/index.js
✔  Wrote functions/.gitignore
? Do you want to install dependencies with npm now? Yes

added 255 packages, and audited 256 packages in 5s

i  Writing configuration info to firebase.json...
i  Writing project information to .firebaserc...
i  Writing gitignore file to .gitignore...

Inside of your project folder, you will now see a folder called functions. If you check the package.json file within this folder, you should see something very similar to this:

{
  "name": "functions",
  "description": "Cloud Functions for Firebase",
  "scripts": {
    "serve": "firebase emulators:start --only functions",
    "shell": "firebase functions:shell",
    "start": "npm run shell",
    "deploy": "firebase deploy --only functions",
    "logs": "firebase functions:log"
  },
  "engines": {
    "node": "10"
  },
  "dependencies": {
    "firebase-admin": "^8.10.0",
    "firebase-functions": "^3.6.1"
  },
  "devDependencies": {
    "firebase-functions-test": "^0.2.0"
  },
  "private": true
}

There are a couple of items to note. First, you will see commands such as firebase emulators:start and firebase deploy. Respectively, these commands will allow you to run your functions locally and deploy the functions. The --only functions flag at the end of these commands specifies that you only want the functions folder to be deployed to Firebase.

Running your API locally

Let's run our API and see it do some work. Run the following command to start your emulator:

$ firebase emulators:start

i  emulators: Starting emulators: functions
⚠  functions: The following emulators are not running, calls to these services from the Functions emulator will affect production: firestore, database, hosting, pubsub
⚠  Your requested "node" version "10" doesn't match your global version "12"
i  ui: Emulator UI logging to ui-debug.log
i  functions: Watching "/Users/matt/Documents/test/functions" for Cloud Functions...

┌───────────────────────────────────────────────────────────────────────┐
│ ✔  All emulators ready! View status and logs at http://localhost:4000 │
└───────────────────────────────────────────────────────────────────────┘

┌───────────┬────────────────┬─────────────────────────────────┐
│ Emulator  │ Host:Port      │ View in Emulator UI             │
├───────────┼────────────────┼─────────────────────────────────┤
│ Functions │ localhost:5001 │ http://localhost:4000/functions │
└───────────┴────────────────┴─────────────────────────────────┘
  Other reserved ports: 4400, 4500

Now, depending on how your emulator is configured, you may see a different value in your Host:Port box. In my instance, I have localhost:5001 set up as my function's host and port. When I visit http://localhost:5001 in my browser, however, I get the following message:

Cannot GET /

What this tells me is that my API is active, but the endpoint I'm trying to reach isn't available for GET. Let's look back at the project and see why this is the case.

Within the functions folder, in addition to the package.json file there's another file called index.js. The index.js file serves as the entry point of our API. When I open the index.js file, I see the following:

const functions = require('firebase-functions');

// // Create and Deploy Your First Cloud Functions
// // https://firebase.google.com/docs/functions/write-firebase-functions
//
// exports.helloWorld = functions.https.onRequest((request, response) => {
//   functions.logger.info("Hello logs!", {structuredData: true});
//   response.send("Hello from Firebase!");
// });

There are two things I notice. The first is, at the top, there's an import a firebase-functions package. The second thing I notice is that the code below it is commented out.

The firebase-functions package is an SDK that provides you with access to Cloud Functions for Firebase. It allows you to access things such as environment variables (which we will look further into in the next post) and defining HTTP routes.

In the commented out code, there's an command to export an endpoint called helloWorld, and it's pointing to a functions command to route an HTTP request to a function which will log Hello logs! and then send a response back saying Hello from Firebase!.

Let's un-comment this code and see what happens.

const functions = require('firebase-functions');

// Create and Deploy Your First Cloud Functions
// https://firebase.google.com/docs/functions/write-firebase-functions

exports.helloWorld = functions.https.onRequest((request, response) => {
  functions.logger.info("Hello logs!", {structuredData: true});
  response.send("Hello from Firebase!");
});

While the emulator is running, it will detect any saved changes made and will automatically reload the project. Checking my command line, I see the following message appear

functions[helloWorld]: http function initialized (http://localhost:5001/irbytestproject/us-central1/helloWorld).

When I visit the URL in my browser, I get a plain HTML page that says 'Hello from Firebase!'. Neat! My API is working!

Now let's check the Terminal to see if the log command is captured:

i  functions: Beginning execution of "helloWorld"
>  {"structuredData":true,"severity":"INFO","message":"Hello logs!"}
i  functions: Finished "helloWorld" in ~1s

Now that we can see our API is working and logs are being captured, let's move onto deploying our API.

Deploying the API

While it's not much (for now), we should be proud of the progress we've made. I think the world is ready to see our creation.

Let's stop our emulator (either by using Ctrl+C or Cmd+C) and use the firebase deploy command. Since we only have functions in our project, we don't need to worry about specifying the --only functions flag.

$ firebase deploy


=== Deploying to 'irbytestproject'...

i  deploying functions
i  functions: ensuring required API cloudfunctions.googleapis.com is enabled...
i  functions: ensuring required API cloudbuild.googleapis.com is enabled...
✔  functions: required API cloudfunctions.googleapis.com is enabled
⚠  functions: missing required API cloudbuild.googleapis.com. Enabling now...

Error: HTTP Error: 400, Billing account for project [removed] is not found. Billing must be enabled for activation of service(s) 'cloudbuild.googleapis.com,containerregistry.googleapis.com' to proceed.
Help Token: ...

Looks like we've run into an issue due to our project not being setup for billing yet. Not a problem. To fix this, let's go to our console by visiting https://console.firebase.google.com/, go into your project and click on Functions, and click on Upgrade project.

Select the Blaze - Pay as You Go option, enter in your billing information, and purchase.

Once this is done, we are ready to run our deploy code again. Note that it may take a couple of minutes for your project upgrade to take effect, and then deploying may take several minutes especially if it's the first time deploying.

$ firebase deploy

=== Deploying to 'irbytestproject'...

i  deploying functions
i  functions: ensuring required API cloudfunctions.googleapis.com is enabled...
i  functions: ensuring required API cloudbuild.googleapis.com is enabled...
⚠  functions: missing required API cloudbuild.googleapis.com. Enabling now...
✔  functions: required API cloudfunctions.googleapis.com is enabled
✔  functions: required API cloudbuild.googleapis.com is enabled
i  functions: preparing functions directory for uploading...
i  functions: packaged functions (54.5 KB) for uploading
✔  functions: functions folder uploaded successfully
i  functions: creating Node.js 10 function helloWorld(us-central1)...
✔  functions[helloWorld(us-central1)]: Successful create operation. 
Function URL (helloWorld): https://us-central1-irbytestproject.cloudfunctions.net/helloWorld

✔  Deploy complete!

Now, if we check out our Firebase Functions page again, we can now see a Functions entry for helloWorld:

Let's go test out our API! Copy the URL for your function and put it into your browser. You should see a plain HTML page that says Hello from Firebase!

Conclusion

We have walked through initializing our Firebase Functions project, running it locally, and deploying it to Firebase. In my next article, I will walk through some more concepts such as creating environment variables and handling different types of HTTP methods such as POST, PUT, etc.

Unit Testing with xUnit

Matt Irby — Tue, 22 Dec 2020 18:08:37 +0000

Before even writing a line of code, I always try to think of how I can unit test the classes and methods I'll write. Test-driven development at times may be tedious, but it is tremendously helpful in verifying your code works without running your program.

In Visual Studio, there are several testing frameworks that are offered out of the box, including MSTest, NUnit and xUnit. Of the three frameworks, my personal preference is xUnit. There are several reasons why I prefer this framework:

Test isolation is built into the design
It offers parallelization by default
Reduction of attributes cluttering your code

Test Isolation

When running tests, it's important that the context of each test be separate from each other. You wouldn't want to have the failure of one test to cause other tests to fail or to have the order in which tests are run play a role in a test's outcome.

With the xUnit framework, tests are designed to be isolated much like the JUnit framework for Java. Each test is run on its own instance. Of course, if there is a need to have an object that's only created once, such as a database connection, fixtures can be used to share contexts in xUnit. But, as mentioned by this post cited by the creators of xUnit, the idea is to make it difficult to design tests in a way that may be problematic.

Parallelization

One of the newer features xUnit has to offer is that it offers parallelization of unit tests by default. If xUnit detects multiple collections (classes) of unit tests within the same assembly, it will parallelize them to make best use of your computing capacity. For example, one project I've worked on can run around 100 unit tests in just 2.5 seconds.

While MSTest and NUnit do offer parallelization, it's not a default behavior like it is in xUnit. For MSTest and NUnit, attributes are required to specify that parallelization to take place. If you believe you do not require parallelization for your project, xUnit does allow you to disable this feature (see section Changing Default Behavior) through the use of attributes.

Reduction of Attributes

One of the more subtle differences between xUnit and the MSTest and NUnit frameworks is the fewer number of attributes required to establish a test class. Under the xUnit framework, really the only attribute needed to setup a unit test is [Fact] above the test method, and you're good to go. You can setup your tests from a constructor, there's no need for the [TestInitialize] or [SetUp] attributes to initialize a test as you would need in MSTest or NUnit. In addition, there's no need for an attribute to declare your test class is indeed a test class, xUnit infers test classes by the unit tests within.

I enjoy the clean nature of xUnit. When I'm trying to write multiple test classes with multiple unit tests per class, having less code to write is a big win. I don't have to worry about trying to add in attributes to ensure my test runner can identify the test classes and its corresponding tests.

Summary

While MSTest and NUnit are still great testing frameworks to work with, xUnit is my personal favorite among the bunch. It's incredibly performant, and the test isolation and clean nature of the framework gives me assurance that my unit tests are working as expected and easier to write and read.

DEV Community: Matt Irby

SpiceDB HRBAC: A Practical Implementation

Cryptography – A Gentle Overview (Part 2: Encryption)

Previous Entry

Symmetric Encryption

Asymmetric Encryption

Encryption So Far

Hashing

Hashing + Encryption

Conclusion

Good Literature

Cryptography – A Gentle Overview (Part 1: Intro)

Introduction

What is Cryptography, Anyway?

Introducing Some Vocabulary

Cryptographic Cast of Characters

Encryption

Initialization Vectors

Bits and Bytes

Summary & Up Next

Part 2

Making GDB Easier: The TUI Interface

Background

How to Access TUI

Summary

Mocking Your Interfaces with Moq

Introduction

Installation and Sample Code

Testing the Synchronous Methods

Testing the Asynchronous Functions

Conclusion

Developing a Firebase Function Pt 2 - Environment Variables and HTTP Methods

Environment Variables

More HTTP Methods

Deploying our API

Conclusion

Developing a Firebase Function Pt 1 - Initialize and Deploy

Installation and Initialization

Running your API locally

Deploying the API

Conclusion

Unit Testing with xUnit

Test Isolation

Parallelization

Reduction of Attributes

Summary

Related Reading

Credits