Validate check definitions and add tests

Author: aaguiarz

README.md

@@ -306,6 +306,7 @@ tests:
       # checks can also be defined for multiple users sharing the same expectation
       - object: group:employees
         users:
+      # either "user" or "users" may be provided, but not both
           - user:3
           - user:4
         assertions:
@@ -584,6 +585,7 @@ tests: # required
             - user:carl
           assertions:
             can_view: false
+        # either "user" or "users" may be provided, but not both
       list_objects: # a set of list objects to run
       - user: user:anne
         type: folder

cmd/store/import.go

@@ -121,6 +121,10 @@ func importStore(
 	maxTuplesPerWrite, maxParallelRequests int,
 	fileName string,
 ) (*CreateStoreAndModelResponse, error) {
+	if err := storeData.Validate(); err != nil {
+		return nil, err //nolint:wrapcheck
+	}
+
 	response, err := createOrUpdateStore(ctx, clientConfig, fgaClient, storeData, format, storeID, fileName)
 	if err != nil {
 		return nil, err

internal/storetest/read-from-input.go

@@ -54,5 +54,9 @@ func ReadFromFile(fileName string, basePath string) (authorizationmodel.ModelFor
 		return format, nil, err
 	}
 
+	if err = storeData.Validate(); err != nil {
+		return format, nil, err
+	}
+
 	return format, &storeData, nil
 }

internal/storetest/storedata.go

@@ -26,6 +26,7 @@ import (
 	"github.com/openfga/go-sdk/client"
 
 	"github.com/openfga/cli/internal/authorizationmodel"
+	"github.com/openfga/cli/internal/clierrors"
 	"github.com/openfga/cli/internal/tuplefile"
 )
 
@@ -138,3 +139,25 @@ func (storeData *StoreData) LoadTuples(basePath string) error {
 
 	return nil
 }
+
+func (storeData *StoreData) Validate() error {
+	var errs error
+
+	for _, test := range storeData.Tests {
+		for index, check := range test.Check {
+			if check.User != "" && len(check.Users) > 0 {
+				msg := fmt.Sprintf("test %s check %d cannot contain both 'user' and 'users'", test.Name, index)
+				errs = errors.Join(errs, fmt.Errorf("%w: %s", clierrors.ErrValidation, msg))
+			} else if check.User == "" && len(check.Users) == 0 {
+				msg := fmt.Sprintf("test %s check %d must specify 'user' or 'users'", test.Name, index)
+				errs = errors.Join(errs, fmt.Errorf("%w: %s", clierrors.ErrValidation, msg))
+			}
+		}
+	}
+
+	if errs != nil {
+		return clierrors.ValidationError("storetests", errs.Error()) //nolint:wrapcheck
+	}
+
+	return nil
+}

internal/storetest/storedata_test.go

@@ -0,0 +1,32 @@
+package storetest
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestStoreDataValidate(t *testing.T) {
+	t.Parallel()
+
+	validSingle := StoreData{Tests: []ModelTest{{Name: "t1", Check: []ModelTestCheck{{
+		User: "user:1", Object: "doc:1", Assertions: map[string]bool{"read": true},
+	}}}}}
+	assert.NoError(t, validSingle.Validate())
+
+	validUsers := StoreData{Tests: []ModelTest{{Name: "t1", Check: []ModelTestCheck{{
+		Users: []string{"user:1", "user:2"}, Object: "doc:1", Assertions: map[string]bool{"read": true},
+	}}}}}
+	assert.NoError(t, validUsers.Validate())
+
+	invalidBoth := StoreData{Tests: []ModelTest{{Name: "t1", Check: []ModelTestCheck{{
+		User: "user:1", Users: []string{"user:2"}, Object: "doc:1", Assertions: map[string]bool{"read": true},
+	}}}}}
+	require.Error(t, invalidBoth.Validate())
+
+	invalidNone := StoreData{Tests: []ModelTest{{Name: "t1", Check: []ModelTestCheck{{
+		Object: "doc:1", Assertions: map[string]bool{"read": true},
+	}}}}}
+	require.Error(t, invalidNone.Validate())
+}

internal/storetest/tests.go

@@ -36,6 +36,10 @@ func RunTests(
 ) (TestResults, error) {
 	testResults := TestResults{}
 
+	if err := storeData.Validate(); err != nil {
+		return testResults, err
+	}
+
 	fgaServer, authModel, stopServerFn, err := getLocalServerModelAndTuples(storeData, format)
 	if err != nil {
 		return testResults, err