karti
13dec6b4b8
Seven parallel agents and an adversarial verification pass. The three things worth knowing before reading the diff: RBAC WAS ALREADY BUILT. docs/build-plan.md marks F2 and F3 outstanding and is stale — packages/core/src/permissions.ts and lib/mutation.ts shipped long ago. So this does not rebuild them; it closes the gaps an audit found. The big one is that reads were entirely ungoverned: every GET was "any authenticated member", so a junior demand rep and a research contractor could both pull per-block supplier cost and break-even prices from /api/capacity/margin, and every contract's negotiated terms. For a company whose margin is the business, that was the hole that mattered. Adds book:read / economics:read / team:read, a readGuard middleware, and a `viewer` role below member. THE BUTTON AND THE 403 DISAGREED — the exact thing F3 said must never happen. Contracts.tsx never called can() at all, so its save button was always enabled against a server requiring contract:sign; Capacity.tsx gated commitment creation on deal:write/demand while the server wanted commitment:write/supply. POST /api/activities was the one write bypassing executeMutation: no capability check, and any member could mutate accounts.lastActivityAt as a side effect. It is now a proper mutation() behind activity:write. The shell becomes three panes — a collapsible shadcn sidebar with an account switcher on the Piggy accent, a header with real search, and Piggy docked to the right, page-aware and persistent across navigation. The phone keeps its bottom tab bar, which is the thing this product already beat trycompai/crm on, and gains the sidebar as a sheet. Calendar is a projection over thirteen dated sources rather than a new table, because a table would duplicate dates that already live on contracts, deals and commitments and would drift — and one ledger answering the question is the whole argument. It surfaces export_authorizations and compliance_artifacts, which had indexed expires_at columns, schema comments saying they must be alerted on, and no read endpoint or UI anywhere. Learn carries two tracks. Concepts are members-only; the platform track can be opened with a share code by someone with no account. The code mints a scoped learn-only token and never a Principal — every route here resolves a principal and then checks capabilities, so a principal-minting code would be one missing check away from leaking the book. "Only platform-track rows may be code-visible" is a database CHECK constraint as well as a write-path rule, and a test asserts a valid learn token still gets 401 on /api/dashboard, /api/accounts and /api/contracts — the same invariant scripts/deploy.sh refuses to ship without. CD becomes tag-to-ship. CI publishes an image to the Gitea registry on a release-* tag and cloud-2 pulls it, so no credential on the shared runner can execute anything on production — by construction rather than by policy. Both halves of deploy.sh's original rule survive: nothing on the runner reaches the host, and a human still decides when it ships. deploy.sh gains a rollback and a public-origin check, and PIG_IMAGE now reaches compose through `sudo env`, without which sudo's env_reset silently resolved every release to pig:local. Tests 141 -> 261. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
106 lines
3.3 KiB
TypeScript
106 lines
3.3 KiB
TypeScript
/**
|
|
* Shared test fixtures for authorisation.
|
|
*
|
|
* Before this, `Principal` was re-declared as a literal in auth.test.ts,
|
|
* records.test.ts, mutation.test.ts and half a dozen others — ten copies of the
|
|
* same nine fields. Adding a field to `Principal` meant editing every one of
|
|
* them, and the copies had already drifted on `scopes`, which is precisely the
|
|
* field the read/write split now turns on. One factory, overridden per case.
|
|
*/
|
|
import type { Team, TeamRole } from '@pig/core';
|
|
import type { Database } from '@pig/db';
|
|
import type { Principal } from '../../src/lib/auth';
|
|
|
|
/**
|
|
* A demand-team member with a full-scope session: the ordinary user, chosen as
|
|
* the default because it is the case most tests want to vary *away* from.
|
|
*/
|
|
export function principal(overrides: Partial<Principal> = {}): Principal {
|
|
return {
|
|
userId: '00000000-0000-4000-8000-000000000001',
|
|
email: 'seller@example.com',
|
|
name: 'Seller',
|
|
isPlatformAdmin: false,
|
|
teams: [{ team: 'demand', role: 'member' }],
|
|
via: 'jwt',
|
|
scopes: ['read', 'write'],
|
|
...overrides,
|
|
};
|
|
}
|
|
|
|
/** One membership, spelled out — the common override, and easy to get wrong. */
|
|
export function onTeam(team: Team, role: TeamRole): Partial<Principal> {
|
|
return { teams: [{ team, role }] };
|
|
}
|
|
|
|
export interface FakeDatabaseOptions {
|
|
/** Appended to in call order, so a test can assert what ran and in what order. */
|
|
events?: string[];
|
|
/** Rows handed to `insert().values()`, chiefly the audit activity. */
|
|
inserted?: unknown[];
|
|
/** Rows a `select()` chain resolves to. Defaults to empty. */
|
|
selected?: unknown[];
|
|
}
|
|
|
|
/**
|
|
* The minimum Drizzle surface `executeMutation` touches: a transaction, an
|
|
* insert that records its row, and a select chain that resolves to fixed rows.
|
|
* Deliberately not a database — a test that needs real SQL semantics needs a
|
|
* real Postgres, and pretending otherwise is how a fake starts asserting that
|
|
* broken queries work.
|
|
*/
|
|
export function fakeDatabase(options: FakeDatabaseOptions = {}): Database {
|
|
const events = options.events ?? [];
|
|
const inserted = options.inserted ?? [];
|
|
const selected = options.selected ?? [];
|
|
|
|
const selectChain = {
|
|
from: () => selectChain,
|
|
leftJoin: () => selectChain,
|
|
innerJoin: () => selectChain,
|
|
where: () => selectChain,
|
|
orderBy: () => selectChain,
|
|
limit: async () => selected,
|
|
then: (resolve: (rows: unknown[]) => unknown) => resolve(selected),
|
|
};
|
|
|
|
const insertChain = {
|
|
values: (row: unknown) => {
|
|
events.push('insert');
|
|
inserted.push(row);
|
|
return {
|
|
onConflictDoNothing: () => ({ returning: async () => [row] }),
|
|
returning: async () => [row],
|
|
then: (resolve: (value: unknown) => unknown) => resolve(undefined),
|
|
};
|
|
},
|
|
};
|
|
|
|
const updateChain = {
|
|
set: () => ({
|
|
where: async () => {
|
|
events.push('update');
|
|
},
|
|
}),
|
|
};
|
|
|
|
const tx = {
|
|
select: () => {
|
|
events.push('select');
|
|
return selectChain;
|
|
},
|
|
insert: () => insertChain,
|
|
update: () => updateChain,
|
|
};
|
|
|
|
return {
|
|
transaction: async (work: (transaction: unknown) => Promise<unknown>) => {
|
|
events.push('transaction');
|
|
return work(tx);
|
|
},
|
|
select: tx.select,
|
|
insert: tx.insert,
|
|
update: tx.update,
|
|
} as unknown as Database;
|
|
}
|