RadiantWaveTech/portal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enforce roleId checks on all admin page actions

Browse Source
This commit is contained in:
NeilClack
2026-09-10 14:59:32 -05:00
parent 0cb4b2148a
commit 7596937f30
14 changed files with 217 additions and 112 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/routes/(protected)/admin/users/page.server.spec.ts
+4 -8
View File
@@ -25,7 +25,6 @@ vi.mock('$lib/server/registration-invite', () => ({
import { prisma } from '$lib/db';
import { actions } from './+page.server';
const userFindUnique = prisma.user.findUnique as ReturnType<typeof vi.fn>;
const userCreate = prisma.user.create as ReturnType<typeof vi.fn>;
const userUpdate = prisma.user.update as ReturnType<typeof vi.fn>;
@@ -44,14 +43,13 @@ function upsertRequest(overrides: Record<string, string> = {}) {
describe('users admin page server upsert', () => {
beforeEach(() => {
vi.clearAllMocks();
userFindUnique.mockResolvedValue({ roleId: 1 });
userCreate.mockResolvedValue({ id: 'new-user' });
userUpdate.mockResolvedValue({ id: 'user-1' });
sendRegistrationInvite.mockResolvedValue(undefined);
});
it('marks a created user verified and emails a set-password link', async () => {
const locals = createLocals(mockUser() as any);
const locals = createLocals(mockUser({ roleId: 1 }) as any);
const result = await invokeUpsert(upsertRequest(), locals);
expect(result).toEqual({ success: true, action: 'upsert' });
@@ -66,7 +64,7 @@ describe('users admin page server upsert', () => {
});
it('does not email a registration link when updating an existing user', async () => {
const locals = createLocals(mockUser() as any);
const locals = createLocals(mockUser({ roleId: 1 }) as any);
const result = await invokeUpsert(upsertRequest({ id: 'user-9' }), locals);
expect(result).toEqual({ success: true, action: 'upsert' });
@@ -78,7 +76,7 @@ describe('users admin page server upsert', () => {
it('still succeeds when the registration email fails to send', async () => {
sendRegistrationInvite.mockRejectedValue(new Error('resend down'));
const locals = createLocals(mockUser() as any);
const locals = createLocals(mockUser({ roleId: 1 }) as any);
const result = await invokeUpsert(upsertRequest(), locals);
expect(result).toEqual({ success: true, action: 'upsert' });
@@ -86,9 +84,7 @@ describe('users admin page server upsert', () => {
});
it('blocks assigning a role with more privileges than the actor', async () => {
userFindUnique.mockResolvedValue({ roleId: 2 });
const locals = createLocals(mockUser() as any);
const locals = createLocals(mockUser({ roleId: 2 }) as any);
const result = await invokeUpsert(upsertRequest({ roleId: '1' }), locals);
expect(result).toEqual({