feat: production-grade RBAC with editor role, custom roles, API key scoping, and audit log (#89)

* feat(rbac): add editor role, 3 new permissions, ownership helper * feat(rbac): add audit_log table, apiKeys.permissions column, editor role to schema * feat(rbac): wire requirePermission into all routes, add editor role support * refactor(rbac): replace ad-hoc role checks with permission-based ownership * feat(rbac): add audit log DB writes + query endpoint Dual-write audit events to stdout (existing) and SQLite audit_log table. Add GET /api/v1/audit-log with pagination, action filter, and date range filtering, gated behind audit:read permission. * feat(rbac): add API key permission scoping with ceiling enforcement * feat(rbac): add escalation prevention and last-admin protection * feat(rbac): add editor role to UI, API key permission scoping in settings * test(rbac): add full permission matrix integration test * test(rbac): add editor role E2E tests * feat(rbac): add custom roles with CRUD API and DB-backed permission lookup * feat(rbac): add API key expiration * feat(rbac): add roles management UI and API key expiration to settings * feat(rbac): add audit log UI to settings * fix: remove any cast in API key permission validation * test(rbac): add unit tests for username validation rules * test(rbac): add unit tests for effective permissions and ownership * test(rbac): add comprehensive route permission matrix (all routes × all roles) * test(rbac): add auth route edge case tests (login failures, session expiry, password side effects) * test(rbac): add escalation prevention tests (register, update, self-demote, last-admin) * test(rbac): add ownership enforcement tests (files, pipelines, editor access, cross-user isolation) * test(rbac): add API key edge cases (name validation, delete behavior, key revocation) * test(rbac): add audit log edge cases (all events, pagination clamping, structure) * test(rbac): add custom roles edge case tests (validation, CRUD, functional permissions) * test(rbac): add comprehensive E2E tests (roles UI, audit log, custom role, API key scoping)
2026-08-03 07:46:42 +02:00 · 2026-04-22 18:10:04 +08:00
parent 2d7a61c18f
commit 5a45bcbc8f
40 changed files with 5054 additions and 87 deletions
@@ -0,0 +1,136 @@
+import { eq } from "drizzle-orm";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { db, schema } from "../../apps/api/src/db/index.js";
+import { buildTestApp, loginAsAdmin, type TestApp } from "./test-server.js";
+
+let testApp: TestApp;
+let adminToken: string;
+let editorToken: string;
+let userToken: string;
+
+beforeAll(async () => {
+  testApp = await buildTestApp();
+  adminToken = await loginAsAdmin(testApp.app);
+
+  // Create editor
+  await testApp.app.inject({
+    method: "POST",
+    url: "/api/auth/register",
+    headers: { authorization: `Bearer ${adminToken}` },
+    payload: { username: "matrix_editor", password: "EditorPass1", role: "editor" },
+  });
+  db.update(schema.users)
+    .set({ mustChangePassword: false })
+    .where(eq(schema.users.username, "matrix_editor"))
+    .run();
+  const editorLogin = await testApp.app.inject({
+    method: "POST",
+    url: "/api/auth/login",
+    payload: { username: "matrix_editor", password: "EditorPass1" },
+  });
+  editorToken = JSON.parse(editorLogin.body).token;
+
+  // Create user
+  await testApp.app.inject({
+    method: "POST",
+    url: "/api/auth/register",
+    headers: { authorization: `Bearer ${adminToken}` },
+    payload: { username: "matrix_user", password: "UserPass12", role: "user" },
+  });
+  db.update(schema.users)
+    .set({ mustChangePassword: false })
+    .where(eq(schema.users.username, "matrix_user"))
+    .run();
+  const userLogin = await testApp.app.inject({
+    method: "POST",
+    url: "/api/auth/login",
+    payload: { username: "matrix_user", password: "UserPass12" },
+  });
+  userToken = JSON.parse(userLogin.body).token;
+}, 30_000);
+
+afterAll(async () => {
+  await testApp.cleanup();
+}, 10_000);
+
+interface RouteTest {
+  method: "GET" | "POST" | "PUT" | "DELETE";
+  url: string;
+  payload?: unknown;
+  admin: number;
+  editor: number;
+  user: number;
+  unauth: number;
+}
+
+const routes: RouteTest[] = [
+  // Settings
+  { method: "GET", url: "/api/v1/settings", admin: 200, editor: 200, user: 200, unauth: 401 },
+  {
+    method: "PUT",
+    url: "/api/v1/settings",
+    payload: { _test: "v" },
+    admin: 200,
+    editor: 403,
+    user: 403,
+    unauth: 401,
+  },
+
+  // Users management
+  { method: "GET", url: "/api/auth/users", admin: 200, editor: 403, user: 403, unauth: 401 },
+
+  // Teams
+  { method: "GET", url: "/api/v1/teams", admin: 200, editor: 403, user: 403, unauth: 401 },
+
+  // Audit log
+  { method: "GET", url: "/api/v1/audit-log", admin: 200, editor: 403, user: 403, unauth: 401 },
+
+  // Admin health
+  { method: "GET", url: "/api/v1/admin/health", admin: 200, editor: 403, user: 403, unauth: 401 },
+
+  // Files
+  { method: "GET", url: "/api/v1/files", admin: 200, editor: 200, user: 200, unauth: 401 },
+
+  // Pipelines
+  { method: "GET", url: "/api/v1/pipeline/list", admin: 200, editor: 200, user: 200, unauth: 401 },
+
+  // API keys
+  { method: "GET", url: "/api/v1/api-keys", admin: 200, editor: 200, user: 200, unauth: 401 },
+
+  // Health (public)
+  { method: "GET", url: "/api/v1/health", admin: 200, editor: 200, user: 200, unauth: 200 },
+];
+
+describe("RBAC permission matrix", () => {
+  for (const route of routes) {
+    for (const [role, expectedStatus] of Object.entries({
+      admin: route.admin,
+      editor: route.editor,
+      user: route.user,
+      unauth: route.unauth,
+    })) {
+      it(`${route.method} ${route.url} → ${role} = ${expectedStatus}`, async () => {
+        const headers: Record<string, string> = {};
+        const token =
+          role === "admin"
+            ? adminToken
+            : role === "editor"
+              ? editorToken
+              : role === "user"
+                ? userToken
+                : undefined;
+        if (token) {
+          headers.authorization = `Bearer ${token}`;
+        }
+
+        const res = await testApp.app.inject({
+          method: route.method,
+          url: route.url,
+          headers,
+          ...(route.payload ? { payload: route.payload } : {}),
+        });
+        expect(res.statusCode).toBe(expectedStatus);
+      });
+    }
+  }
+});