42 lines
2.0 KiB
TypeScript
42 lines
2.0 KiB
TypeScript
// The manifest's own invariants. A route gating on a permission the manifest doesn't declare is
|
|
// silent: bootstrap seeds only declared names, so the demo admin would simply 403 on that screen
|
|
// with nothing in the logs to explain it. Pin the two halves against each other here.
|
|
import assert from "node:assert/strict";
|
|
import { test } from "node:test";
|
|
import { isValidPermissionName } from "#plugin-api";
|
|
import manifest from "./plugin.ts";
|
|
|
|
const routes = manifest.routes ?? [];
|
|
const declared = (manifest.permissions ?? []).map((p) => p.name);
|
|
|
|
test("every route is gated, and gates on a permission the manifest declares", () => {
|
|
assert.ok(routes.length > 0);
|
|
for (const route of routes) {
|
|
assert.equal(route.public, undefined, `${route.method} ${route.path} must not be public`);
|
|
assert.ok(route.permission, `${route.method} ${route.path} has no permission`);
|
|
assert.ok(declared.includes(route.permission!), `${route.method} ${route.path} gates on undeclared ${route.permission}`);
|
|
}
|
|
});
|
|
|
|
test("the manifest declares no permission it never gates on", () => {
|
|
const gated = new Set(routes.map((r) => r.permission));
|
|
for (const name of declared) assert.ok(gated.has(name), `declared but unused: ${name}`);
|
|
});
|
|
|
|
test("every declared permission is <resource>:<action>, and reads and writes are split per resource", () => {
|
|
for (const name of declared) assert.ok(isValidPermissionName(name), name); // the host's rule, not a copy of it
|
|
assert.deepEqual([...declared].sort(), [
|
|
"groups:read", "groups:write",
|
|
"oauth2-clients:read", "oauth2-clients:write",
|
|
"permissions:read", "permissions:write",
|
|
"users:read", "users:write",
|
|
]);
|
|
});
|
|
|
|
test("GET routes gate on read and mutations on write, so a reader can open a screen but not change it", () => {
|
|
for (const route of routes) {
|
|
const action = route.method === "GET" ? "read" : "write";
|
|
assert.ok(route.permission?.endsWith(`:${action}`), `${route.method} ${route.path} → ${route.permission}`);
|
|
}
|
|
});
|