mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
AshimandGitHub
5a45bcbc8f
* feat(rbac): add editor role, 3 new permissions, ownership helper * feat(rbac): add audit_log table, apiKeys.permissions column, editor role to schema * feat(rbac): wire requirePermission into all routes, add editor role support * refactor(rbac): replace ad-hoc role checks with permission-based ownership * feat(rbac): add audit log DB writes + query endpoint Dual-write audit events to stdout (existing) and SQLite audit_log table. Add GET /api/v1/audit-log with pagination, action filter, and date range filtering, gated behind audit:read permission. * feat(rbac): add API key permission scoping with ceiling enforcement * feat(rbac): add escalation prevention and last-admin protection * feat(rbac): add editor role to UI, API key permission scoping in settings * test(rbac): add full permission matrix integration test * test(rbac): add editor role E2E tests * feat(rbac): add custom roles with CRUD API and DB-backed permission lookup * feat(rbac): add API key expiration * feat(rbac): add roles management UI and API key expiration to settings * feat(rbac): add audit log UI to settings * fix: remove any cast in API key permission validation * test(rbac): add unit tests for username validation rules * test(rbac): add unit tests for effective permissions and ownership * test(rbac): add comprehensive route permission matrix (all routes × all roles) * test(rbac): add auth route edge case tests (login failures, session expiry, password side effects) * test(rbac): add escalation prevention tests (register, update, self-demote, last-admin) * test(rbac): add ownership enforcement tests (files, pipelines, editor access, cross-user isolation) * test(rbac): add API key edge cases (name validation, delete behavior, key revocation) * test(rbac): add audit log edge cases (all events, pagination clamping, structure) * test(rbac): add custom roles edge case tests (validation, CRUD, functional permissions) * test(rbac): add comprehensive E2E tests (roles UI, audit log, custom role, API key scoping)
88 lines
3.0 KiB
TypeScript
88 lines
3.0 KiB
TypeScript
/**
|
|
* Unit tests for the permission map and helper functions.
|
|
*
|
|
* Verifies that each role gets the correct set of permissions
|
|
* and that the hasPermission check works as expected.
|
|
*/
|
|
|
|
import type { Role } from "@ashim/shared";
|
|
import { describe, expect, it, vi } from "vitest";
|
|
|
|
// Mock the auth plugin to avoid transitively opening a SQLite connection
|
|
// (permissions.ts -> auth.ts -> db/index.ts), which causes lock contention
|
|
// when running in parallel with other DB-using test files like cleanup.test.ts.
|
|
vi.mock("../../../apps/api/src/plugins/auth.js", () => ({
|
|
getAuthUser: () => null,
|
|
}));
|
|
|
|
import { getPermissions, hasPermission } from "../../../apps/api/src/permissions.js";
|
|
|
|
describe("permissions", () => {
|
|
describe("getPermissions", () => {
|
|
it("returns all 15 permissions for admin", () => {
|
|
const perms = getPermissions("admin");
|
|
expect(perms).toHaveLength(15);
|
|
expect(perms).toContain("tools:use");
|
|
expect(perms).toContain("files:own");
|
|
expect(perms).toContain("files:all");
|
|
expect(perms).toContain("apikeys:own");
|
|
expect(perms).toContain("apikeys:all");
|
|
expect(perms).toContain("pipelines:own");
|
|
expect(perms).toContain("pipelines:all");
|
|
expect(perms).toContain("settings:read");
|
|
expect(perms).toContain("settings:write");
|
|
expect(perms).toContain("users:manage");
|
|
expect(perms).toContain("teams:manage");
|
|
expect(perms).toContain("branding:manage");
|
|
expect(perms).toContain("features:manage");
|
|
expect(perms).toContain("system:health");
|
|
expect(perms).toContain("audit:read");
|
|
});
|
|
|
|
it("returns only basic permissions for user role", () => {
|
|
const perms = getPermissions("user");
|
|
expect(perms).toEqual([
|
|
"tools:use",
|
|
"files:own",
|
|
"apikeys:own",
|
|
"pipelines:own",
|
|
"settings:read",
|
|
]);
|
|
});
|
|
|
|
it("does NOT contain admin-only permissions for user role", () => {
|
|
const perms = getPermissions("user");
|
|
expect(perms).not.toContain("files:all");
|
|
expect(perms).not.toContain("apikeys:all");
|
|
expect(perms).not.toContain("pipelines:all");
|
|
expect(perms).not.toContain("settings:write");
|
|
expect(perms).not.toContain("users:manage");
|
|
expect(perms).not.toContain("teams:manage");
|
|
expect(perms).not.toContain("branding:manage");
|
|
});
|
|
|
|
it("returns empty array for unknown role", () => {
|
|
const perms = getPermissions("unknown" as Role);
|
|
expect(perms).toEqual([]);
|
|
});
|
|
});
|
|
|
|
describe("hasPermission", () => {
|
|
it("returns true for admin with users:manage", () => {
|
|
expect(hasPermission("admin", "users:manage")).toBe(true);
|
|
});
|
|
|
|
it("returns true for user with tools:use", () => {
|
|
expect(hasPermission("user", "tools:use")).toBe(true);
|
|
});
|
|
|
|
it("returns false for user with users:manage", () => {
|
|
expect(hasPermission("user", "users:manage")).toBe(false);
|
|
});
|
|
|
|
it("returns false for user with settings:write", () => {
|
|
expect(hasPermission("user", "settings:write")).toBe(false);
|
|
});
|
|
});
|
|
});
|