{
  "version": 1,
  "cookieName": "zhinian_session",
  "cases": [
    {
      "name": "optional unconfigured application access uses the local administrator",
      "state": { "required": false, "configured": false },
      "requirement": "app",
      "resolverOutcome": "not_called",
      "expected": { "outcome": "authenticated", "status": 200, "role": "super_admin", "authMode": "admin" }
    },
    {
      "name": "required unconfigured authentication fails with service unavailable",
      "state": { "required": true, "configured": false },
      "requirement": "app",
      "resolverOutcome": "not_called",
      "expected": { "outcome": "configuration_error", "status": 503 }
    },
    {
      "name": "required configured request without a cookie is unauthenticated",
      "state": { "required": true, "configured": true },
      "requirement": "app",
      "resolverOutcome": "not_called",
      "expected": { "outcome": "unauthenticated", "status": 401 }
    },
    {
      "name": "an invalid session falls back locally only when authentication is optional",
      "state": { "required": false, "configured": true },
      "requirement": "super_admin",
      "resolverOutcome": "unauthenticated",
      "expected": { "outcome": "authenticated", "status": 200, "role": "super_admin", "authMode": "admin" }
    },
    {
      "name": "database refreshed user is allowed application access",
      "state": { "required": true, "configured": true },
      "requirement": "app",
      "resolverOutcome": "authenticated",
      "session": { "authMode": "user", "role": "user" },
      "expected": { "outcome": "authenticated", "status": 200, "role": "user", "authMode": "user" }
    },
    {
      "name": "ordinary user cannot access administration",
      "state": { "required": true, "configured": true },
      "requirement": "admin",
      "resolverOutcome": "authenticated",
      "session": { "authMode": "user", "role": "user" },
      "expected": { "outcome": "forbidden", "status": 403 }
    },
    {
      "name": "organization administrator in admin mode can access administration",
      "state": { "required": true, "configured": true },
      "requirement": "admin",
      "resolverOutcome": "authenticated",
      "session": { "authMode": "admin", "role": "organization_admin" },
      "expected": { "outcome": "authenticated", "status": 200, "role": "organization_admin", "authMode": "admin" }
    },
    {
      "name": "admin role without admin login mode cannot access administration",
      "state": { "required": true, "configured": true },
      "requirement": "admin",
      "resolverOutcome": "authenticated",
      "session": { "authMode": "user", "role": "organization_admin" },
      "expected": { "outcome": "forbidden", "status": 403 }
    },
    {
      "name": "organization administrator cannot access super administration",
      "state": { "required": true, "configured": true },
      "requirement": "super_admin",
      "resolverOutcome": "authenticated",
      "session": { "authMode": "admin", "role": "organization_admin" },
      "expected": { "outcome": "forbidden", "status": 403 }
    },
    {
      "name": "super administrator can access super administration",
      "state": { "required": true, "configured": true },
      "requirement": "super_admin",
      "resolverOutcome": "authenticated",
      "session": { "authMode": "admin", "role": "super_admin" },
      "expected": { "outcome": "authenticated", "status": 200, "role": "super_admin", "authMode": "admin" }
    },
    {
      "name": "resolver infrastructure failure is not disguised as authentication denial",
      "state": { "required": true, "configured": true },
      "requirement": "app",
      "resolverOutcome": "infrastructure_error",
      "expected": { "outcome": "infrastructure_error", "status": 500 }
    }
  ]
}