17 lines
951 B
TypeScript
17 lines
951 B
TypeScript
import { readFile } from "node:fs/promises";
|
|
import { describe, expect, it } from "vitest";
|
|
|
|
describe("PostgreSQL application-role privilege contract", () => {
|
|
it("uses explicit current-object grants and no blanket future-object grants", async () => {
|
|
const source = await readFile(new URL("../scripts/migrate-postgres.mjs", import.meta.url), "utf8");
|
|
expect(source).toContain('["billing_wallets", "SELECT, INSERT, UPDATE"]');
|
|
expect(source).toContain('["billing_ledger", "SELECT, INSERT"]');
|
|
expect(source).toContain('["platform_runtime_settings", "SELECT, INSERT, UPDATE"]');
|
|
expect(source).toContain('["seedream_layer_compositions", "SELECT, INSERT, UPDATE, DELETE"]');
|
|
expect(source).toContain("applicationRoleTablePrivileges().map");
|
|
expect(source).toContain("REVOKE ALL ON TABLE");
|
|
expect(source).not.toContain("ALTER DEFAULT PRIVILEGES");
|
|
expect(source).not.toContain("ALL FUNCTIONS IN SCHEMA");
|
|
});
|
|
});
|