85 lines
3.8 KiB
TypeScript
85 lines
3.8 KiB
TypeScript
import { afterEach, describe, expect, it, vi } from "vitest";
|
|
import {
|
|
configuredAdminAuthorities,
|
|
configuredAdminUsers,
|
|
hasAdminAccess,
|
|
hasAdminSessionAccess
|
|
} from "@/lib/auth/permissions";
|
|
import type { AuthSession, AuthUser } from "@/lib/auth/session";
|
|
|
|
const baseUser: AuthUser = {
|
|
id: "auth:app:1",
|
|
subject: "user-1",
|
|
username: "user-1",
|
|
displayName: "用户1",
|
|
clientId: "app",
|
|
authorities: [],
|
|
scope: ["server"]
|
|
};
|
|
|
|
describe("auth permission helpers", () => {
|
|
afterEach(() => {
|
|
vi.unstubAllEnvs();
|
|
});
|
|
|
|
it("treats ordinary users as non-admin", () => {
|
|
expect(hasAdminAccess({ ...baseUser, authorities: ["ROLE_USER"] })).toBe(false);
|
|
});
|
|
|
|
it("uses the platform role as the single source of browser permissions", () => {
|
|
expect(hasAdminAccess({ ...baseUser, role: "user", authorities: ["ROLE_SUPER_ADMIN"] })).toBe(false);
|
|
expect(hasAdminAccess({ ...baseUser, role: "organization_admin", authorities: [] })).toBe(true);
|
|
expect(hasAdminAccess({ ...baseUser, role: "super_admin", authorities: [] })).toBe(true);
|
|
});
|
|
|
|
it("treats ceshiop as the default administrator account", () => {
|
|
expect(configuredAdminUsers()).toEqual(["ceshiop"]);
|
|
expect(hasAdminAccess({ ...baseUser, username: "ceshiop", subject: "ceshiop", authorities: [] })).toBe(true);
|
|
});
|
|
|
|
it("allows configured admin usernames to override the default account", () => {
|
|
vi.stubEnv("ZHINIAN_ADMIN_USERS", "ops-admin");
|
|
expect(configuredAdminUsers()).toEqual(["ops-admin"]);
|
|
expect(hasAdminAccess({ ...baseUser, username: "ceshiop", subject: "ceshiop", authorities: [] })).toBe(false);
|
|
expect(hasAdminAccess({ ...baseUser, username: "ops-admin", subject: "ops-admin", authorities: [] })).toBe(true);
|
|
expect(hasAdminAccess({ ...baseUser, displayName: "ops-admin", authorities: [] })).toBe(false);
|
|
});
|
|
|
|
it("uses configured admin usernames without granting common platform permissions", () => {
|
|
vi.stubEnv("ZHINIAN_ADMIN_USERS", "admin");
|
|
expect(hasAdminAccess({ ...baseUser, username: "staff", subject: "staff", authorities: ["sys_user_view"] })).toBe(false);
|
|
expect(hasAdminAccess({ ...baseUser, username: "admin", subject: "admin", authorities: [] })).toBe(true);
|
|
});
|
|
|
|
it("accepts exact configured admin authorities and normalizes case", () => {
|
|
vi.stubEnv("ZHINIAN_ADMIN_AUTHORITIES", "custom-admin, role_ops_admin");
|
|
expect(configuredAdminAuthorities()).toEqual(["custom-admin", "role_ops_admin"]);
|
|
expect(hasAdminAccess({ ...baseUser, authorities: ["CUSTOM_ADMIN"] })).toBe(true);
|
|
expect(hasAdminAccess({ ...baseUser, authorities: ["CUSTOM_ADMIN_EXTRA"] })).toBe(false);
|
|
});
|
|
|
|
it("accepts dedicated admin roles but rejects generic roles and SYS permissions", () => {
|
|
expect(hasAdminAccess({ ...baseUser, authorities: ["ROLE_ADMIN"] })).toBe(true);
|
|
expect(hasAdminAccess({ ...baseUser, authorities: ["SUPER_ADMIN"] })).toBe(true);
|
|
expect(hasAdminAccess({ ...baseUser, authorities: ["ROLE_1"] })).toBe(false);
|
|
expect(hasAdminAccess({ ...baseUser, authorities: ["1"] })).toBe(false);
|
|
expect(hasAdminAccess({ ...baseUser, authorities: ["sys_user_view"] })).toBe(false);
|
|
expect(hasAdminAccess({ ...baseUser, authorities: ["admin:accounts"] })).toBe(false);
|
|
});
|
|
|
|
it("requires both admin login mode and an administrator identity", () => {
|
|
const adminUser = { ...baseUser, authorities: ["ROLE_ADMIN"] };
|
|
const session = (authMode: AuthSession["authMode"], user = adminUser): AuthSession => ({
|
|
version: 1,
|
|
authMode,
|
|
issuedAt: 100,
|
|
expiresAt: 200,
|
|
user
|
|
});
|
|
|
|
expect(hasAdminSessionAccess(session("user"))).toBe(false);
|
|
expect(hasAdminSessionAccess(session("admin"))).toBe(true);
|
|
expect(hasAdminSessionAccess(session("admin", { ...baseUser, authorities: ["ROLE_USER"] }))).toBe(false);
|
|
});
|
|
});
|