mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
AshimandGitHub
5a45bcbc8f
* feat(rbac): add editor role, 3 new permissions, ownership helper * feat(rbac): add audit_log table, apiKeys.permissions column, editor role to schema * feat(rbac): wire requirePermission into all routes, add editor role support * refactor(rbac): replace ad-hoc role checks with permission-based ownership * feat(rbac): add audit log DB writes + query endpoint Dual-write audit events to stdout (existing) and SQLite audit_log table. Add GET /api/v1/audit-log with pagination, action filter, and date range filtering, gated behind audit:read permission. * feat(rbac): add API key permission scoping with ceiling enforcement * feat(rbac): add escalation prevention and last-admin protection * feat(rbac): add editor role to UI, API key permission scoping in settings * test(rbac): add full permission matrix integration test * test(rbac): add editor role E2E tests * feat(rbac): add custom roles with CRUD API and DB-backed permission lookup * feat(rbac): add API key expiration * feat(rbac): add roles management UI and API key expiration to settings * feat(rbac): add audit log UI to settings * fix: remove any cast in API key permission validation * test(rbac): add unit tests for username validation rules * test(rbac): add unit tests for effective permissions and ownership * test(rbac): add comprehensive route permission matrix (all routes × all roles) * test(rbac): add auth route edge case tests (login failures, session expiry, password side effects) * test(rbac): add escalation prevention tests (register, update, self-demote, last-admin) * test(rbac): add ownership enforcement tests (files, pipelines, editor access, cross-user isolation) * test(rbac): add API key edge cases (name validation, delete behavior, key revocation) * test(rbac): add audit log edge cases (all events, pagination clamping, structure) * test(rbac): add custom roles edge case tests (validation, CRUD, functional permissions) * test(rbac): add comprehensive E2E tests (roles UI, audit log, custom role, API key scoping)
88 lines
2.7 KiB
TypeScript
88 lines
2.7 KiB
TypeScript
/**
|
|
* Unit tests for username validation rules.
|
|
*
|
|
* The validateUsername function is not exported from auth.ts,
|
|
* so we reproduce its logic here to test the rules directly.
|
|
*/
|
|
|
|
import { describe, expect, it } from "vitest";
|
|
|
|
/**
|
|
* Reproduce the validateUsername logic from apps/api/src/plugins/auth.ts
|
|
* so we can unit-test the rules without importing the module (which
|
|
* transitively opens a SQLite connection).
|
|
*/
|
|
function validateUsername(username: string): string | null {
|
|
if (username.length < 3 || username.length > 50) {
|
|
return "Username must be between 3 and 50 characters";
|
|
}
|
|
if (!/^[a-zA-Z0-9_.-]+$/.test(username)) {
|
|
return "Username can only contain letters, numbers, dots, hyphens, and underscores";
|
|
}
|
|
return null;
|
|
}
|
|
|
|
describe("validateUsername", () => {
|
|
describe("valid usernames", () => {
|
|
it.each([
|
|
["alice", "lowercase letters"],
|
|
["bob123", "letters and digits"],
|
|
["user.name", "dots"],
|
|
["user-name", "hyphens"],
|
|
["user_name", "underscores"],
|
|
["abc", "minimum length (3)"],
|
|
["a".repeat(50), "maximum length (50)"],
|
|
["A.B-C_D", "mixed separators and uppercase"],
|
|
["123", "digits only"],
|
|
])("accepts %s (%s)", (username) => {
|
|
expect(validateUsername(username)).toBeNull();
|
|
});
|
|
});
|
|
|
|
describe("too short", () => {
|
|
it.each([
|
|
["ab", "2 characters"],
|
|
["a", "1 character"],
|
|
["", "empty string"],
|
|
])("rejects %s (%s)", (username) => {
|
|
expect(validateUsername(username)).toBe("Username must be between 3 and 50 characters");
|
|
});
|
|
});
|
|
|
|
describe("too long", () => {
|
|
it("rejects a 51-character username", () => {
|
|
expect(validateUsername("a".repeat(51))).toBe("Username must be between 3 and 50 characters");
|
|
});
|
|
});
|
|
|
|
describe("invalid characters", () => {
|
|
it.each([
|
|
["has space", "space"],
|
|
["user@name", "@ symbol"],
|
|
["user#name", "# symbol"],
|
|
["user/name", "forward slash"],
|
|
["<script>", "angle brackets"],
|
|
["user\nname", "newline"],
|
|
["user!name", "exclamation mark"],
|
|
["user name", "tab character"],
|
|
])("rejects '%s' (%s)", (username) => {
|
|
expect(validateUsername(username)).toBe(
|
|
"Username can only contain letters, numbers, dots, hyphens, and underscores",
|
|
);
|
|
});
|
|
});
|
|
|
|
describe("unicode characters", () => {
|
|
it.each([
|
|
["élève", "accented Latin letters"],
|
|
["用户名", "CJK characters"],
|
|
["пользователь", "Cyrillic characters"],
|
|
["üser", "umlaut"],
|
|
])("rejects '%s' (%s)", (username) => {
|
|
expect(validateUsername(username)).toBe(
|
|
"Username can only contain letters, numbers, dots, hyphens, and underscores",
|
|
);
|
|
});
|
|
});
|
|
});
|