|
| 1 | +/** @vitest-environment node */ |
| 2 | +import { createMockRequest } from '@sim/testing' |
| 3 | +import { beforeEach, describe, expect, it, vi } from 'vitest' |
| 4 | + |
| 5 | +const mocks = vi.hoisted(() => ({ |
| 6 | + session: vi.fn(), |
| 7 | + context: vi.fn(), |
| 8 | + role: vi.fn(), |
| 9 | + admin: vi.fn(), |
| 10 | + enterprise: vi.fn(), |
| 11 | + group: vi.fn(), |
| 12 | +})) |
| 13 | +vi.mock('@/lib/auth', () => ({ getSession: mocks.session })) |
| 14 | +vi.mock('@/lib/workspaces/application/workspace-context', () => ({ |
| 15 | + resolveActiveWorkspaceApplicationContext: mocks.context, |
| 16 | +})) |
| 17 | +vi.mock('@sim/platform-authz/workspace', async (importOriginal) => ({ |
| 18 | + ...(await importOriginal<typeof import('@sim/platform-authz/workspace')>()), |
| 19 | + resolveEffectiveWorkspacePermission: mocks.role, |
| 20 | +})) |
| 21 | +vi.mock('@/lib/workspaces/permissions/utils', () => ({ isOrganizationAdminOrOwner: mocks.admin })) |
| 22 | +vi.mock('@/lib/billing/core/subscription', () => ({ |
| 23 | + isOrganizationOnEnterprisePlan: mocks.enterprise, |
| 24 | +})) |
| 25 | +vi.mock('@/lib/permission-groups/resolve.server', () => ({ resolveWorkspaceGroup: mocks.group })) |
| 26 | + |
| 27 | +import { userPermissionConfigSchema } from '@/lib/api/contracts/permission-groups' |
| 28 | +import { OrchestrationError } from '@/lib/core/orchestration/types' |
| 29 | +import { readUserPermissionConfig } from '@/lib/permission-groups/application/read-user-config' |
| 30 | +import { DEFAULT_PERMISSION_GROUP_CONFIG } from '@/lib/permission-groups/fields' |
| 31 | +import { GET } from '@/app/api/permission-groups/user/route' |
| 32 | + |
| 33 | +const principal = { kind: 'session', userId: 'viewer', sessionId: 'session' } as const |
| 34 | +const context = { |
| 35 | + workspaceId: 'workspace', |
| 36 | + workspaceOrganizationId: 'owning-org', |
| 37 | + allowPersonalApiKeys: true, |
| 38 | + billedAccountUserId: 'owner', |
| 39 | +} |
| 40 | +const unrestricted = { |
| 41 | + permissionGroupId: null, |
| 42 | + groupName: null, |
| 43 | + config: null, |
| 44 | + entitled: false, |
| 45 | + organizationId: 'owning-org', |
| 46 | + isOrgAdmin: false, |
| 47 | +} |
| 48 | +function get(query = '?workspaceId=workspace') { |
| 49 | + return GET( |
| 50 | + createMockRequest('GET', undefined, {}, `http://localhost/api/permission-groups/user${query}`) |
| 51 | + ) |
| 52 | +} |
| 53 | + |
| 54 | +beforeEach(() => { |
| 55 | + vi.clearAllMocks() |
| 56 | + mocks.session.mockResolvedValue({ |
| 57 | + user: { id: 'viewer' }, |
| 58 | + session: { id: 'session', activeOrganizationId: 'unrelated-org' }, |
| 59 | + }) |
| 60 | + mocks.context.mockResolvedValue(context) |
| 61 | + mocks.role.mockResolvedValue('read') |
| 62 | + mocks.admin.mockResolvedValue(false) |
| 63 | + mocks.enterprise.mockResolvedValue(true) |
| 64 | + mocks.group.mockResolvedValue(null) |
| 65 | +}) |
| 66 | + |
| 67 | +describe('user permission policy shared read', () => { |
| 68 | + it('authenticates before parsing or protected lookups', async () => { |
| 69 | + mocks.session.mockResolvedValue(null) |
| 70 | + expect((await get('')).status).toBe(401) |
| 71 | + expect(mocks.context).not.toHaveBeenCalled() |
| 72 | + }) |
| 73 | + it.each(['', '?workspaceId='])('preserves missing workspace validation for %s', async (query) => { |
| 74 | + const response = await get(query) |
| 75 | + expect(response.status).toBe(400) |
| 76 | + expect(await response.json()).toMatchObject({ error: 'workspaceId is required' }) |
| 77 | + expect(mocks.context).not.toHaveBeenCalled() |
| 78 | + }) |
| 79 | + it('preserves missing or archived workspace responses', async () => { |
| 80 | + mocks.context.mockRejectedValue(new OrchestrationError('not_found', 'Workspace not found')) |
| 81 | + const response = await get() |
| 82 | + expect(response.status).toBe(404) |
| 83 | + expect(await response.json()).toMatchObject({ error: 'Workspace not found' }) |
| 84 | + expect(mocks.group).not.toHaveBeenCalled() |
| 85 | + }) |
| 86 | + it('refuses current nonmembers before loading their policy', async () => { |
| 87 | + mocks.role.mockResolvedValue(null) |
| 88 | + const response = await get() |
| 89 | + expect(response.status).toBe(403) |
| 90 | + expect(await response.json()).toMatchObject({ error: 'Not a member of this workspace' }) |
| 91 | + expect(mocks.admin).not.toHaveBeenCalled() |
| 92 | + expect(mocks.enterprise).not.toHaveBeenCalled() |
| 93 | + expect(mocks.group).not.toHaveBeenCalled() |
| 94 | + }) |
| 95 | + it('leaves personal workspaces unrestricted without organization reads', async () => { |
| 96 | + mocks.context.mockResolvedValue({ ...context, workspaceOrganizationId: null }) |
| 97 | + const response = await get() |
| 98 | + expect(response.status).toBe(200) |
| 99 | + expect(await response.json()).toEqual({ ...unrestricted, organizationId: null }) |
| 100 | + expect(mocks.admin).not.toHaveBeenCalled() |
| 101 | + expect(mocks.enterprise).not.toHaveBeenCalled() |
| 102 | + expect(mocks.group).not.toHaveBeenCalled() |
| 103 | + }) |
| 104 | + it('retains organization admin status without enterprise entitlement', async () => { |
| 105 | + mocks.enterprise.mockResolvedValue(false) |
| 106 | + mocks.admin.mockResolvedValue(true) |
| 107 | + expect(await (await get()).json()).toEqual({ ...unrestricted, isOrgAdmin: true }) |
| 108 | + expect(mocks.group).not.toHaveBeenCalled() |
| 109 | + }) |
| 110 | + it('reads the acting member in the workspace owning organization and matches the server result', async () => { |
| 111 | + const group = { |
| 112 | + permissionGroupId: 'group', |
| 113 | + groupName: 'Restricted', |
| 114 | + config: { ...DEFAULT_PERMISSION_GROUP_CONFIG, hideCopilot: true }, |
| 115 | + } |
| 116 | + mocks.group.mockResolvedValue(group) |
| 117 | + const response = await get() |
| 118 | + expect(response.status).toBe(200) |
| 119 | + const body = await response.json() |
| 120 | + expect(body).toEqual({ ...unrestricted, ...group, entitled: true }) |
| 121 | + expect(mocks.group).toHaveBeenCalledWith('viewer', 'owning-org', 'workspace') |
| 122 | + expect(mocks.admin).toHaveBeenCalledWith('viewer', 'owning-org') |
| 123 | + const serverResult = await readUserPermissionConfig.execute({ |
| 124 | + principal, |
| 125 | + input: { workspaceId: 'workspace' }, |
| 126 | + }) |
| 127 | + expect(userPermissionConfigSchema.parse(serverResult)).toEqual(body) |
| 128 | + }) |
| 129 | + it('retains enterprise entitlement when no group applies', async () => { |
| 130 | + expect(await (await get()).json()).toEqual({ ...unrestricted, entitled: true }) |
| 131 | + }) |
| 132 | + it('does not turn policy infrastructure failures into unrestricted access', async () => { |
| 133 | + mocks.enterprise.mockImplementation(async (_organizationId, onError) => { |
| 134 | + if (onError === 'throw') throw new Error('unavailable') |
| 135 | + return false |
| 136 | + }) |
| 137 | + expect((await get()).status).toBe(500) |
| 138 | + await expect( |
| 139 | + readUserPermissionConfig.execute({ principal, input: { workspaceId: 'workspace' } }) |
| 140 | + ).rejects.toThrow('unavailable') |
| 141 | + }) |
| 142 | + it('rejects API keys before canonical lookup on the shared server entry point', async () => { |
| 143 | + await expect( |
| 144 | + readUserPermissionConfig.execute({ |
| 145 | + principal: { kind: 'personal_api_key', userId: 'viewer', keyId: 'key' }, |
| 146 | + input: { workspaceId: 'workspace' }, |
| 147 | + }) |
| 148 | + ).rejects.toThrow('cannot perform operation') |
| 149 | + expect(mocks.context).not.toHaveBeenCalled() |
| 150 | + }) |
| 151 | +}) |
0 commit comments