forked from EduCraft/curriculum-project-hub
72 lines
3.0 KiB
TypeScript
72 lines
3.0 KiB
TypeScript
import { describe, it, expect, beforeEach, afterAll } from "vitest";
|
|
import { prisma, resetDb } from "./helpers.js";
|
|
import { canTriggerRole } from "../../src/permission.js";
|
|
|
|
describe("canTriggerRole (integration, per-role gate)", () => {
|
|
beforeEach(async () => {
|
|
await resetDb();
|
|
});
|
|
|
|
afterAll(async () => {
|
|
await prisma.$disconnect();
|
|
});
|
|
|
|
it("allows when role is unconfigured on the project (back-compat: open)", async () => {
|
|
const project = await prisma.project.create({
|
|
data: { id: "p-role-1", name: "T", workspaceDir: "/tmp/x" },
|
|
});
|
|
const r = await canTriggerRole(prisma, project.id, "draft", "ou_a");
|
|
expect(r.allowed).toBe(true);
|
|
});
|
|
|
|
it("allows when principal holds an active grant for the role", async () => {
|
|
const project = await prisma.project.create({
|
|
data: { id: "p-role-2", name: "T", workspaceDir: "/tmp/x" },
|
|
});
|
|
await prisma.roleTriggerGrant.create({
|
|
data: { projectId: project.id, roleId: "review", principalType: "USER", principalId: "ou_a" },
|
|
});
|
|
const r = await canTriggerRole(prisma, project.id, "review", "ou_a");
|
|
expect(r.allowed).toBe(true);
|
|
});
|
|
|
|
it("denies when grants exist for the role but principal has none", async () => {
|
|
const project = await prisma.project.create({
|
|
data: { id: "p-role-3", name: "T", workspaceDir: "/tmp/x" },
|
|
});
|
|
// Someone else has the role; ou_b does not.
|
|
await prisma.roleTriggerGrant.create({
|
|
data: { projectId: project.id, roleId: "review", principalType: "USER", principalId: "ou_a" },
|
|
});
|
|
const r = await canTriggerRole(prisma, project.id, "review", "ou_b");
|
|
expect(r.allowed).toBe(false);
|
|
});
|
|
|
|
it("denies when the principal's grant was revoked", async () => {
|
|
const project = await prisma.project.create({
|
|
data: { id: "p-role-4", name: "T", workspaceDir: "/tmp/x" },
|
|
});
|
|
await prisma.roleTriggerGrant.create({
|
|
data: { projectId: project.id, roleId: "review", principalType: "USER", principalId: "ou_a", revokedAt: new Date() },
|
|
});
|
|
const r = await canTriggerRole(prisma, project.id, "review", "ou_a");
|
|
expect(r.allowed).toBe(false);
|
|
});
|
|
|
|
it("scopes grants per-project (grant on p1 does not allow on p2)", async () => {
|
|
const p1 = await prisma.project.create({ data: { id: "p-role-5a", name: "T", workspaceDir: "/tmp/x" } });
|
|
const p2 = await prisma.project.create({ data: { id: "p-role-5b", name: "T", workspaceDir: "/tmp/x" } });
|
|
await prisma.roleTriggerGrant.create({
|
|
data: { projectId: p1.id, roleId: "review", principalType: "USER", principalId: "ou_a" },
|
|
});
|
|
// p2 has the role configured for someone else; ou_a has no grant there.
|
|
await prisma.roleTriggerGrant.create({
|
|
data: { projectId: p2.id, roleId: "review", principalType: "USER", principalId: "ou_other" },
|
|
});
|
|
const onP1 = await canTriggerRole(prisma, p1.id, "review", "ou_a");
|
|
expect(onP1.allowed).toBe(true);
|
|
const onP2 = await canTriggerRole(prisma, p2.id, "review", "ou_a");
|
|
expect(onP2.allowed).toBe(false);
|
|
});
|
|
});
|