48 lines
1.9 KiB
TypeScript
48 lines
1.9 KiB
TypeScript
import assert from "node:assert/strict";
|
|
import { IncomingMessage, ServerResponse } from "node:http";
|
|
import { Socket } from "node:net";
|
|
import { test } from "node:test";
|
|
import { buildContext, type RequestContext, type User } from "./context.ts";
|
|
import { can, check, GuardError, requireSession } from "./guards.ts";
|
|
import type { KetoClient, RelationTuple } from "./keto-client.ts";
|
|
|
|
function ctxFor(user: User | null): RequestContext {
|
|
const req = new IncomingMessage(new Socket());
|
|
req.url = "/";
|
|
return buildContext(req, new ServerResponse(req), { user });
|
|
}
|
|
|
|
const alice: User = { email: "a@b.c", id: "u1", roles: ["admin", "scheduling:read"] };
|
|
|
|
test("requireSession returns the user, or throws GuardError(401)→/login when anonymous", () => {
|
|
assert.equal(requireSession(ctxFor(alice)), alice);
|
|
|
|
assert.throws(() => requireSession(ctxFor(null)), (err: unknown) => {
|
|
assert.ok(err instanceof GuardError);
|
|
assert.equal(err.status, 401);
|
|
assert.equal(err.location, "/login"); // app.ts turns this into a 303 to sign in
|
|
return true;
|
|
});
|
|
});
|
|
|
|
test("can reads a coarse role from the JWT claims; anonymous has none", () => {
|
|
assert.equal(can(ctxFor(alice), "admin"), true);
|
|
assert.equal(can(ctxFor(alice), "billing:write"), false);
|
|
assert.equal(can(ctxFor(null), "admin"), false);
|
|
});
|
|
|
|
test("check asks Keto with the current user as subject; anonymous is denied without a call", async () => {
|
|
let asked: RelationTuple | undefined;
|
|
const keto = {
|
|
check: async (tuple: RelationTuple) => { asked = tuple; return true; },
|
|
} as unknown as KetoClient;
|
|
const tuple = { namespace: "Resource", object: "doc1", relation: "view" };
|
|
|
|
assert.equal(await check(keto, ctxFor(alice), tuple), true);
|
|
assert.deepEqual(asked, { ...tuple, subject_id: "user:u1" }); // subject is the signed-in user
|
|
|
|
asked = undefined;
|
|
assert.equal(await check(keto, ctxFor(null), tuple), false); // fail-closed, no Keto call
|
|
assert.equal(asked, undefined);
|
|
});
|