37 lines
1.2 KiB
TypeScript
37 lines
1.2 KiB
TypeScript
import { strict as assert } from 'node:assert';
|
|
import { describe, it } from 'node:test';
|
|
import type { Principal } from '../src/lib/auth';
|
|
import { AuthError, effectivePermissions, requireCapability } from '../src/lib/auth';
|
|
|
|
function principal(overrides: Partial<Principal> = {}): Principal {
|
|
return {
|
|
userId: '00000000-0000-0000-0000-000000000001',
|
|
email: 'seller@example.com',
|
|
name: 'Seller',
|
|
isPlatformAdmin: false,
|
|
teams: [{ team: 'demand', role: 'member' }],
|
|
via: 'jwt',
|
|
scopes: ['read', 'write'],
|
|
...overrides,
|
|
};
|
|
}
|
|
|
|
describe('capability enforcement', () => {
|
|
it('rejects a role grant from the wrong team', () => {
|
|
assert.throws(
|
|
() => requireCapability(principal(), 'deal:write', 'supply'),
|
|
(error: unknown) => error instanceof AuthError && error.code === 'insufficient_permission',
|
|
);
|
|
});
|
|
|
|
it('removes write grants from a read-only API key', () => {
|
|
const readOnly = principal({ via: 'api_key', scopes: ['read'] });
|
|
|
|
assert.deepEqual(effectivePermissions(readOnly), []);
|
|
assert.throws(
|
|
() => requireCapability(readOnly, 'deal:write', 'demand'),
|
|
(error: unknown) => error instanceof AuthError && error.code === 'insufficient_scope',
|
|
);
|
|
});
|
|
});
|