85 lines
3.2 KiB
TypeScript
85 lines
3.2 KiB
TypeScript
import { describe, it, expect, vi } from 'vitest';
|
|
import { createLocals, createFormRequest, mockUser } from '$lib/test-utils';
|
|
|
|
vi.mock('$lib/db', () => ({
|
|
prisma: {
|
|
userRole: { create: vi.fn(), update: vi.fn(), delete: vi.fn() },
|
|
solfeggioFrequency: { create: vi.fn(), update: vi.fn(), delete: vi.fn() },
|
|
proclamationCategory: { findFirst: vi.fn(), create: vi.fn(), update: vi.fn(), delete: vi.fn() },
|
|
proclamationGroup: { findFirst: vi.fn(), create: vi.fn(), update: vi.fn(), delete: vi.fn() }
|
|
}
|
|
}));
|
|
|
|
import { prisma } from '$lib/db';
|
|
import { actions as userRoles } from './user-roles/+page.server';
|
|
import { actions as frequencies } from './solfeggio-frequencies/+page.server';
|
|
import { actions as categories } from './proclamation-categories/+page.server';
|
|
import { actions as groups } from './proclamation-groups/+page.server';
|
|
|
|
const staff = () => createLocals(mockUser({ roleId: 3 }) as any);
|
|
const admin = () => createLocals(mockUser({ roleId: 2 }) as any);
|
|
const user = () => createLocals(mockUser({ roleId: 4 }) as any);
|
|
const anonymous = () => createLocals();
|
|
|
|
type CrudActions = {
|
|
upsert: (event: unknown) => Promise<unknown>;
|
|
delete: (event: unknown) => Promise<unknown>;
|
|
};
|
|
|
|
const pages: Array<[string, CrudActions]> = [
|
|
['user-roles', userRoles as unknown as CrudActions],
|
|
['solfeggio-frequencies', frequencies as unknown as CrudActions],
|
|
['proclamation-categories', categories as unknown as CrudActions],
|
|
['proclamation-groups', groups as unknown as CrudActions]
|
|
];
|
|
|
|
describe('admin CRUD action role guards', () => {
|
|
for (const [name, actions] of pages) {
|
|
it(`${name}: upsert rejects an anonymous request`, async () => {
|
|
const result = await actions.upsert({
|
|
request: createFormRequest({ name: 'x' }),
|
|
locals: anonymous()
|
|
});
|
|
expect(result).toEqual({ success: false, action: 'upsert', error: 'Not authorized' });
|
|
});
|
|
|
|
it(`${name}: upsert rejects a regular user`, async () => {
|
|
const result = await actions.upsert({
|
|
request: createFormRequest({ name: 'x' }),
|
|
locals: user()
|
|
});
|
|
expect(result).toEqual({ success: false, action: 'upsert', error: 'Not authorized' });
|
|
});
|
|
|
|
it(`${name}: delete rejects a staff (non-admin) user`, async () => {
|
|
const result = await actions.delete({
|
|
request: createFormRequest({ id: '1' }),
|
|
locals: staff()
|
|
});
|
|
expect(result).toEqual({ success: false, error: 'Not authorized' });
|
|
});
|
|
}
|
|
});
|
|
|
|
describe('admin CRUD action role guards: authorized users still work', () => {
|
|
it('staff can create a user role', async () => {
|
|
(prisma.userRole.create as ReturnType<typeof vi.fn>).mockResolvedValue({ id: 5 });
|
|
const result = await userRoles.upsert({
|
|
request: createFormRequest({ name: 'New Role' }),
|
|
locals: staff()
|
|
} as any);
|
|
expect(result).toEqual({ success: true, action: 'upsert' });
|
|
expect(prisma.userRole.create).toHaveBeenCalledWith({ data: { name: 'New Role' } });
|
|
});
|
|
|
|
it('admin can delete a user role', async () => {
|
|
(prisma.userRole.delete as ReturnType<typeof vi.fn>).mockResolvedValue({});
|
|
const result = await userRoles.delete({
|
|
request: createFormRequest({ id: '5' }),
|
|
locals: admin()
|
|
} as any);
|
|
expect(result).toEqual({ success: true, action: 'delete' });
|
|
expect(prisma.userRole.delete).toHaveBeenCalledWith({ where: { id: 5 } });
|
|
});
|
|
});
|