mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
feat: production-grade RBAC with editor role, custom roles, API key scoping, and audit log (#89)
* feat(rbac): add editor role, 3 new permissions, ownership helper * feat(rbac): add audit_log table, apiKeys.permissions column, editor role to schema * feat(rbac): wire requirePermission into all routes, add editor role support * refactor(rbac): replace ad-hoc role checks with permission-based ownership * feat(rbac): add audit log DB writes + query endpoint Dual-write audit events to stdout (existing) and SQLite audit_log table. Add GET /api/v1/audit-log with pagination, action filter, and date range filtering, gated behind audit:read permission. * feat(rbac): add API key permission scoping with ceiling enforcement * feat(rbac): add escalation prevention and last-admin protection * feat(rbac): add editor role to UI, API key permission scoping in settings * test(rbac): add full permission matrix integration test * test(rbac): add editor role E2E tests * feat(rbac): add custom roles with CRUD API and DB-backed permission lookup * feat(rbac): add API key expiration * feat(rbac): add roles management UI and API key expiration to settings * feat(rbac): add audit log UI to settings * fix: remove any cast in API key permission validation * test(rbac): add unit tests for username validation rules * test(rbac): add unit tests for effective permissions and ownership * test(rbac): add comprehensive route permission matrix (all routes × all roles) * test(rbac): add auth route edge case tests (login failures, session expiry, password side effects) * test(rbac): add escalation prevention tests (register, update, self-demote, last-admin) * test(rbac): add ownership enforcement tests (files, pipelines, editor access, cross-user isolation) * test(rbac): add API key edge cases (name validation, delete behavior, key revocation) * test(rbac): add audit log edge cases (all events, pagination clamping, structure) * test(rbac): add custom roles edge case tests (validation, CRUD, functional permissions) * test(rbac): add comprehensive E2E tests (roles UI, audit log, custom role, API key scoping)
This commit is contained in:
Ashim
@@ -0,0 +1,398 @@
|
||||
/**
|
||||
* Comprehensive RBAC route permission matrix.
|
||||
*
|
||||
* Tests every route × every role (admin, editor, user, unauthenticated)
|
||||
* to verify the correct HTTP status code is returned. Also validates
|
||||
* cross-role session isolation and token edge cases.
|
||||
*/
|
||||
import { eq } from "drizzle-orm";
|
||||
import { afterAll, beforeAll, describe, expect, it } from "vitest";
|
||||
import { db, schema } from "../../apps/api/src/db/index.js";
|
||||
import { buildTestApp, loginAsAdmin, type TestApp } from "./test-server.js";
|
||||
|
||||
let testApp: TestApp;
|
||||
let adminToken: string;
|
||||
let editorToken: string;
|
||||
let userToken: string;
|
||||
|
||||
const runId = Date.now().toString(36) + Math.random().toString(36).slice(2, 6);
|
||||
|
||||
beforeAll(async () => {
|
||||
testApp = await buildTestApp();
|
||||
adminToken = await loginAsAdmin(testApp.app);
|
||||
|
||||
// Create editor
|
||||
const editorUsername = `full_editor_${runId}`;
|
||||
await testApp.app.inject({
|
||||
method: "POST",
|
||||
url: "/api/auth/register",
|
||||
headers: { authorization: `Bearer ${adminToken}` },
|
||||
payload: { username: editorUsername, password: "EditorPass1", role: "editor" },
|
||||
});
|
||||
db.update(schema.users)
|
||||
.set({ mustChangePassword: false })
|
||||
.where(eq(schema.users.username, editorUsername))
|
||||
.run();
|
||||
const editorLogin = await testApp.app.inject({
|
||||
method: "POST",
|
||||
url: "/api/auth/login",
|
||||
payload: { username: editorUsername, password: "EditorPass1" },
|
||||
});
|
||||
editorToken = JSON.parse(editorLogin.body).token;
|
||||
|
||||
// Create user
|
||||
const userUsername = `full_user_${runId}`;
|
||||
await testApp.app.inject({
|
||||
method: "POST",
|
||||
url: "/api/auth/register",
|
||||
headers: { authorization: `Bearer ${adminToken}` },
|
||||
payload: { username: userUsername, password: "UserPass12", role: "user" },
|
||||
});
|
||||
db.update(schema.users)
|
||||
.set({ mustChangePassword: false })
|
||||
.where(eq(schema.users.username, userUsername))
|
||||
.run();
|
||||
const userLogin = await testApp.app.inject({
|
||||
method: "POST",
|
||||
url: "/api/auth/login",
|
||||
payload: { username: userUsername, password: "UserPass12" },
|
||||
});
|
||||
userToken = JSON.parse(userLogin.body).token;
|
||||
}, 30_000);
|
||||
|
||||
afterAll(async () => {
|
||||
await testApp.cleanup();
|
||||
}, 10_000);
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Route permission matrix
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
interface RouteTest {
|
||||
method: "GET" | "POST" | "PUT" | "DELETE";
|
||||
url: string;
|
||||
payload?: unknown | (() => unknown);
|
||||
admin: number;
|
||||
editor: number;
|
||||
user: number;
|
||||
unauth: number;
|
||||
label?: string;
|
||||
}
|
||||
|
||||
const routes: RouteTest[] = [
|
||||
// --- Public routes (no auth required) ---
|
||||
{
|
||||
method: "GET",
|
||||
url: "/api/v1/health",
|
||||
admin: 200,
|
||||
editor: 200,
|
||||
user: 200,
|
||||
unauth: 200,
|
||||
label: "public health check",
|
||||
},
|
||||
{
|
||||
method: "GET",
|
||||
url: "/api/v1/config/auth",
|
||||
admin: 200,
|
||||
editor: 200,
|
||||
user: 200,
|
||||
unauth: 200,
|
||||
label: "public auth config",
|
||||
},
|
||||
|
||||
// --- Auth-only routes (any authenticated user) ---
|
||||
{
|
||||
method: "GET",
|
||||
url: "/api/v1/settings",
|
||||
admin: 200,
|
||||
editor: 200,
|
||||
user: 200,
|
||||
unauth: 401,
|
||||
label: "settings:read",
|
||||
},
|
||||
{
|
||||
method: "GET",
|
||||
url: "/api/v1/files",
|
||||
admin: 200,
|
||||
editor: 200,
|
||||
user: 200,
|
||||
unauth: 401,
|
||||
label: "requireAuth",
|
||||
},
|
||||
{
|
||||
method: "GET",
|
||||
url: "/api/v1/pipeline/list",
|
||||
admin: 200,
|
||||
editor: 200,
|
||||
user: 200,
|
||||
unauth: 401,
|
||||
label: "requireAuth",
|
||||
},
|
||||
{
|
||||
method: "GET",
|
||||
url: "/api/v1/api-keys",
|
||||
admin: 200,
|
||||
editor: 200,
|
||||
user: 200,
|
||||
unauth: 401,
|
||||
label: "requireAuth",
|
||||
},
|
||||
{
|
||||
method: "POST",
|
||||
url: "/api/v1/api-keys",
|
||||
payload: { name: `test-key-${runId}` },
|
||||
admin: 201,
|
||||
editor: 201,
|
||||
user: 201,
|
||||
unauth: 401,
|
||||
label: "requireAuth (create api key)",
|
||||
},
|
||||
|
||||
// --- Admin-only routes ---
|
||||
{
|
||||
method: "PUT",
|
||||
url: "/api/v1/settings",
|
||||
payload: { _test: "v" },
|
||||
admin: 200,
|
||||
editor: 403,
|
||||
user: 403,
|
||||
unauth: 401,
|
||||
label: "settings:write",
|
||||
},
|
||||
{
|
||||
method: "GET",
|
||||
url: "/api/auth/users",
|
||||
admin: 200,
|
||||
editor: 403,
|
||||
user: 403,
|
||||
unauth: 401,
|
||||
label: "users:manage",
|
||||
},
|
||||
{
|
||||
method: "POST",
|
||||
url: "/api/auth/register",
|
||||
payload: () => ({
|
||||
username: `reg_${Date.now().toString(36)}${Math.random().toString(36).slice(2, 6)}`,
|
||||
password: "TempPass1",
|
||||
role: "user",
|
||||
}),
|
||||
admin: 201,
|
||||
editor: 403,
|
||||
user: 403,
|
||||
unauth: 401,
|
||||
label: "users:manage (register)",
|
||||
},
|
||||
{
|
||||
method: "GET",
|
||||
url: "/api/v1/teams",
|
||||
admin: 200,
|
||||
editor: 403,
|
||||
user: 403,
|
||||
unauth: 401,
|
||||
label: "teams:manage",
|
||||
},
|
||||
{
|
||||
method: "POST",
|
||||
url: "/api/v1/teams",
|
||||
payload: () => ({
|
||||
name: `team_${Date.now().toString(36)}${Math.random().toString(36).slice(2, 6)}`,
|
||||
}),
|
||||
admin: 201,
|
||||
editor: 403,
|
||||
user: 403,
|
||||
unauth: 401,
|
||||
label: "teams:manage (create)",
|
||||
},
|
||||
{
|
||||
method: "GET",
|
||||
url: "/api/v1/roles",
|
||||
admin: 200,
|
||||
editor: 403,
|
||||
user: 403,
|
||||
unauth: 401,
|
||||
label: "audit:read (roles list)",
|
||||
},
|
||||
{
|
||||
method: "POST",
|
||||
url: "/api/v1/roles",
|
||||
payload: () => ({
|
||||
name: `role_${Date.now().toString(36)}${Math.random().toString(36).slice(2, 6)}`,
|
||||
permissions: ["tools:use", "files:own"],
|
||||
}),
|
||||
admin: 201,
|
||||
editor: 403,
|
||||
user: 403,
|
||||
unauth: 401,
|
||||
label: "users:manage (create role)",
|
||||
},
|
||||
{
|
||||
method: "GET",
|
||||
url: "/api/v1/audit-log",
|
||||
admin: 200,
|
||||
editor: 403,
|
||||
user: 403,
|
||||
unauth: 401,
|
||||
label: "audit:read",
|
||||
},
|
||||
{
|
||||
method: "GET",
|
||||
url: "/api/v1/admin/health",
|
||||
admin: 200,
|
||||
editor: 403,
|
||||
user: 403,
|
||||
unauth: 401,
|
||||
label: "system:health",
|
||||
},
|
||||
{
|
||||
method: "DELETE",
|
||||
url: "/api/v1/settings/logo",
|
||||
admin: 200,
|
||||
editor: 403,
|
||||
user: 403,
|
||||
unauth: 401,
|
||||
label: "branding:manage (delete logo)",
|
||||
},
|
||||
];
|
||||
|
||||
describe("RBAC route permission matrix (full)", () => {
|
||||
for (const route of routes) {
|
||||
for (const [role, expectedStatus] of Object.entries({
|
||||
admin: route.admin,
|
||||
editor: route.editor,
|
||||
user: route.user,
|
||||
unauth: route.unauth,
|
||||
})) {
|
||||
const suffix = route.label ? ` [${route.label}]` : "";
|
||||
it(`${route.method} ${route.url} -> ${role} = ${expectedStatus}${suffix}`, async () => {
|
||||
const headers: Record<string, string> = {};
|
||||
const token =
|
||||
role === "admin"
|
||||
? adminToken
|
||||
: role === "editor"
|
||||
? editorToken
|
||||
: role === "user"
|
||||
? userToken
|
||||
: undefined;
|
||||
if (token) {
|
||||
headers.authorization = `Bearer ${token}`;
|
||||
}
|
||||
|
||||
const payload = typeof route.payload === "function" ? route.payload() : route.payload;
|
||||
|
||||
const res = await testApp.app.inject({
|
||||
method: route.method,
|
||||
url: route.url,
|
||||
headers,
|
||||
...(payload ? { payload } : {}),
|
||||
});
|
||||
expect(res.statusCode).toBe(expectedStatus);
|
||||
});
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Cross-role isolation
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
describe("Cross-role isolation", () => {
|
||||
it("editor session returns correct role and permissions", async () => {
|
||||
const res = await testApp.app.inject({
|
||||
method: "GET",
|
||||
url: "/api/auth/session",
|
||||
headers: { authorization: `Bearer ${editorToken}` },
|
||||
});
|
||||
expect(res.statusCode).toBe(200);
|
||||
const body = JSON.parse(res.body);
|
||||
expect(body.user.role).toBe("editor");
|
||||
expect(body.user.permissions).toEqual(
|
||||
expect.arrayContaining([
|
||||
"tools:use",
|
||||
"files:own",
|
||||
"files:all",
|
||||
"apikeys:own",
|
||||
"pipelines:own",
|
||||
"pipelines:all",
|
||||
"settings:read",
|
||||
]),
|
||||
);
|
||||
// Must NOT have admin-only permissions
|
||||
expect(body.user.permissions).not.toContain("settings:write");
|
||||
expect(body.user.permissions).not.toContain("users:manage");
|
||||
expect(body.user.permissions).not.toContain("teams:manage");
|
||||
expect(body.user.permissions).not.toContain("branding:manage");
|
||||
expect(body.user.permissions).not.toContain("features:manage");
|
||||
expect(body.user.permissions).not.toContain("system:health");
|
||||
expect(body.user.permissions).not.toContain("audit:read");
|
||||
});
|
||||
|
||||
it("user session returns correct role and permissions", async () => {
|
||||
const res = await testApp.app.inject({
|
||||
method: "GET",
|
||||
url: "/api/auth/session",
|
||||
headers: { authorization: `Bearer ${userToken}` },
|
||||
});
|
||||
expect(res.statusCode).toBe(200);
|
||||
const body = JSON.parse(res.body);
|
||||
expect(body.user.role).toBe("user");
|
||||
expect(body.user.permissions).toEqual(
|
||||
expect.arrayContaining([
|
||||
"tools:use",
|
||||
"files:own",
|
||||
"apikeys:own",
|
||||
"pipelines:own",
|
||||
"settings:read",
|
||||
]),
|
||||
);
|
||||
// Must NOT have editor or admin permissions
|
||||
expect(body.user.permissions).not.toContain("files:all");
|
||||
expect(body.user.permissions).not.toContain("pipelines:all");
|
||||
expect(body.user.permissions).not.toContain("settings:write");
|
||||
expect(body.user.permissions).not.toContain("users:manage");
|
||||
expect(body.user.permissions).not.toContain("teams:manage");
|
||||
});
|
||||
|
||||
it("invalid token returns 401", async () => {
|
||||
const res = await testApp.app.inject({
|
||||
method: "GET",
|
||||
url: "/api/auth/session",
|
||||
headers: { authorization: "Bearer totally-bogus-token-value" },
|
||||
});
|
||||
expect(res.statusCode).toBe(401);
|
||||
});
|
||||
|
||||
it("expired session returns 401", async () => {
|
||||
// Create a session, then manually expire it in the DB
|
||||
const expiredUsername = `expired_${runId}`;
|
||||
await testApp.app.inject({
|
||||
method: "POST",
|
||||
url: "/api/auth/register",
|
||||
headers: { authorization: `Bearer ${adminToken}` },
|
||||
payload: { username: expiredUsername, password: "ExpiredPass1", role: "user" },
|
||||
});
|
||||
db.update(schema.users)
|
||||
.set({ mustChangePassword: false })
|
||||
.where(eq(schema.users.username, expiredUsername))
|
||||
.run();
|
||||
|
||||
const loginRes = await testApp.app.inject({
|
||||
method: "POST",
|
||||
url: "/api/auth/login",
|
||||
payload: { username: expiredUsername, password: "ExpiredPass1" },
|
||||
});
|
||||
const expiredToken = JSON.parse(loginRes.body).token;
|
||||
|
||||
// Manually expire the session
|
||||
db.update(schema.sessions)
|
||||
.set({ expiresAt: new Date(Date.now() - 60_000) })
|
||||
.where(eq(schema.sessions.id, expiredToken))
|
||||
.run();
|
||||
|
||||
const res = await testApp.app.inject({
|
||||
method: "GET",
|
||||
url: "/api/auth/session",
|
||||
headers: { authorization: `Bearer ${expiredToken}` },
|
||||
});
|
||||
expect(res.statusCode).toBe(401);
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user