Build the agent-native compute CRM platform

apps/api/test/auth.test.ts

@@ -0,0 +1,36 @@
+import { strict as assert } from 'node:assert';
+import { describe, it } from 'node:test';
+import type { Principal } from '../src/lib/auth';
+import { AuthError, effectivePermissions, requireCapability } from '../src/lib/auth';
+
+function principal(overrides: Partial<Principal> = {}): Principal {
+  return {
+    userId: '00000000-0000-0000-0000-000000000001',
+    email: 'seller@example.com',
+    name: 'Seller',
+    isPlatformAdmin: false,
+    teams: [{ team: 'demand', role: 'member' }],
+    via: 'jwt',
+    scopes: ['read', 'write'],
+    ...overrides,
+  };
+}
+
+describe('capability enforcement', () => {
+  it('rejects a role grant from the wrong team', () => {
+    assert.throws(
+      () => requireCapability(principal(), 'deal:write', 'supply'),
+      (error: unknown) => error instanceof AuthError && error.code === 'insufficient_permission',
+    );
+  });
+
+  it('removes write grants from a read-only API key', () => {
+    const readOnly = principal({ via: 'api_key', scopes: ['read'] });
+
+    assert.deepEqual(effectivePermissions(readOnly), []);
+    assert.throws(
+      () => requireCapability(readOnly, 'deal:write', 'demand'),
+      (error: unknown) => error instanceof AuthError && error.code === 'insufficient_scope',
+    );
+  });
+});