56 lines
2.3 KiB
JavaScript
56 lines
2.3 KiB
JavaScript
import { test, beforeEach } from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { addPermissionHook, permittedScope } from '../dist/index.js';
|
|
|
|
const A = '00000000-0000-4000-8000-00000000000a';
|
|
const B = '00000000-0000-4000-8000-00000000000b';
|
|
|
|
function fakeDb(allowed) {
|
|
return {
|
|
async query(sql, params) {
|
|
if (sql.includes('unnest')) return { rows: params[1].filter((o) => allowed.has(o)).map((o) => ({ o })) };
|
|
if (sql.includes('morbac.is_allowed')) return { rows: [{ allowed: allowed.has(params[1]) }] };
|
|
throw new Error(`unexpected query ${sql}`);
|
|
},
|
|
};
|
|
}
|
|
|
|
function fakeReply() {
|
|
return { status: 200, code(c) { this.status = c; return this; }, send() { return this; } };
|
|
}
|
|
|
|
const req = { user: { id: 'u' } };
|
|
let removers = [];
|
|
beforeEach(() => { removers.forEach((r) => r()); removers = []; });
|
|
|
|
test('a pinned list keeps only the orgs the caller may read', async () => {
|
|
const reply = fakeReply();
|
|
assert.deepEqual(await permittedScope(fakeDb(new Set([B])), req, reply, [A, B], 'read', 'users'), [B]);
|
|
assert.equal(reply.status, 200);
|
|
});
|
|
|
|
test('a refused first org no longer fails the list', async () => {
|
|
removers.push(addPermissionHook('pre', (c) => c.orgId !== A));
|
|
assert.deepEqual(await permittedScope(fakeDb(new Set([A, B])), req, fakeReply(), [A, B], 'read', 'users'), [B]);
|
|
});
|
|
|
|
test('a list with no permitted org is refused', async () => {
|
|
const reply = fakeReply();
|
|
assert.equal(await permittedScope(fakeDb(new Set()), req, reply, [A, B], 'read', 'users'), null);
|
|
assert.equal(reply.status, 403);
|
|
});
|
|
|
|
test('an unpinned list is decided on the no-org perimeter', async () => {
|
|
assert.deepEqual(await permittedScope(fakeDb(new Set([null])), req, fakeReply(), [], 'read', 'users'), []);
|
|
const reply = fakeReply();
|
|
assert.equal(await permittedScope(fakeDb(new Set()), req, reply, [], 'read', 'users'), null);
|
|
assert.equal(reply.status, 403);
|
|
});
|
|
|
|
test('an API key outside its scope gets nothing', async () => {
|
|
const reply = fakeReply();
|
|
const keyed = { ...req, apiKeyScope: [{ activity: 'read', view: 'roles' }] };
|
|
assert.equal(await permittedScope(fakeDb(new Set([A])), keyed, reply, [A], 'read', 'users'), null);
|
|
assert.equal(reply.status, 403);
|
|
});
|