36 lines
1.8 KiB
TypeScript
36 lines
1.8 KiB
TypeScript
import fs from "node:fs";
|
|
import path from "node:path";
|
|
import { describe, expect, it } from "vitest";
|
|
|
|
const source = fs.readFileSync(path.resolve("apps/web/app/modules/rows/routes/Rows_Overview.server.ts"), "utf8");
|
|
|
|
describe("Rows_Overview action permission gates", () => {
|
|
it("uses delete permission for row delete actions", () => {
|
|
expect(source).toContain('getEntityPermission(entity, "delete")');
|
|
expect(source).not.toContain('getEntityPermission(entity, "create"), tenantId), "verifyUserHasPermission"');
|
|
});
|
|
|
|
it("requires row comment permission before comment mutations", () => {
|
|
expect(source).toContain('action === "comment"');
|
|
expect(source).toContain("!rowData.rowPermissions.canComment");
|
|
expect(source).toContain('action === "comment-reaction"');
|
|
});
|
|
|
|
it("requires row update permission before task mutations", () => {
|
|
expect(source).toContain('action === "task-new"');
|
|
expect(source).toContain('action === "task-complete-toggle"');
|
|
expect(source).toContain('action === "task-delete"');
|
|
expect(source.match(/!rowData\.rowPermissions\.canUpdate/g)?.length ?? 0).toBeGreaterThanOrEqual(4);
|
|
});
|
|
|
|
it("scopes comment and task lookups to the current row before mutation", () => {
|
|
expect(source).toContain("getRowCommentInRow({ id: rowCommentId, rowId: item.id })");
|
|
expect(source).toContain("updateRowCommentInRow({ id: comment.id, rowId: item.id }");
|
|
expect(source).toContain("getRowTaskInRow({ id: taskId, rowId: item.id })");
|
|
expect(source).toMatch(/updateRowTaskInRow\(\s*\{\s*id: taskId,\s*rowId: item\.id\s*\}/);
|
|
expect(source).toContain("deleteRowTaskInRow({ id: taskId, rowId: item.id })");
|
|
expect(source).not.toContain("getRowComment(rowCommentId)");
|
|
expect(source).not.toContain("getRowTask(taskId)");
|
|
});
|
|
});
|