89 lines
3.2 KiB
TypeScript
89 lines
3.2 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import {
|
|
AdminFallbackLoginRejected,
|
|
assertAdminFallbackLoginAllowed,
|
|
evaluateAdminFallbackLogin,
|
|
isAdminFallbackUiVisible,
|
|
readAdminFallbackPolicy,
|
|
} from "./admin-fallback.server";
|
|
|
|
describe("readAdminFallbackPolicy", () => {
|
|
it("returns disabled+empty by default", () => {
|
|
expect(readAdminFallbackPolicy({})).toEqual({ enabled: false, allowlist: [] });
|
|
});
|
|
|
|
it("parses ADMIN_FALLBACK_LOGIN_EMAILS comma-separated, lowercased", () => {
|
|
expect(
|
|
readAdminFallbackPolicy({
|
|
ADMIN_FALLBACK_LOGIN_ENABLED: "true",
|
|
ADMIN_FALLBACK_LOGIN_EMAILS: " Bootstrap@example.test , ops@example.test , ",
|
|
})
|
|
).toEqual({
|
|
enabled: true,
|
|
allowlist: ["bootstrap@example.test", "ops@example.test"],
|
|
});
|
|
});
|
|
|
|
it("accepts common truthy values", () => {
|
|
for (const value of ["1", "true", "yes", "on", "TRUE"]) {
|
|
expect(readAdminFallbackPolicy({ ADMIN_FALLBACK_LOGIN_ENABLED: value }).enabled).toBe(true);
|
|
}
|
|
});
|
|
|
|
it("rejects non-truthy values", () => {
|
|
for (const value of ["0", "false", "no", "", "off", "maybe"]) {
|
|
expect(readAdminFallbackPolicy({ ADMIN_FALLBACK_LOGIN_ENABLED: value }).enabled).toBe(false);
|
|
}
|
|
});
|
|
});
|
|
|
|
describe("evaluateAdminFallbackLogin", () => {
|
|
it("rejects when disabled even if allowlist matches", () => {
|
|
const result = evaluateAdminFallbackLogin("bootstrap@example.test", {
|
|
enabled: false,
|
|
allowlist: ["bootstrap@example.test"],
|
|
});
|
|
expect(result.ok).toBe(false);
|
|
if (!result.ok) expect(result.reason).toBe("disabled");
|
|
});
|
|
|
|
it("rejects when email not in allowlist", () => {
|
|
const result = evaluateAdminFallbackLogin("intruder@example.test", {
|
|
enabled: true,
|
|
allowlist: ["bootstrap@example.test"],
|
|
});
|
|
expect(result.ok).toBe(false);
|
|
if (!result.ok) expect(result.reason).toBe("email-not-allowlisted");
|
|
});
|
|
|
|
it("accepts when enabled AND email in allowlist (case-insensitive)", () => {
|
|
const result = evaluateAdminFallbackLogin("Bootstrap@Example.test", {
|
|
enabled: true,
|
|
allowlist: ["bootstrap@example.test"],
|
|
});
|
|
expect(result.ok).toBe(true);
|
|
});
|
|
});
|
|
|
|
describe("assertAdminFallbackLoginAllowed", () => {
|
|
it("throws AdminFallbackLoginRejected when disabled", () => {
|
|
expect(() => assertAdminFallbackLoginAllowed("anyone@example.test", { enabled: false, allowlist: [] })).toThrowError(AdminFallbackLoginRejected);
|
|
});
|
|
|
|
it("throws AdminFallbackLoginRejected when not in allowlist", () => {
|
|
expect(() => assertAdminFallbackLoginAllowed("nobody@example.test", { enabled: true, allowlist: ["other@example.test"] })).toThrowError(AdminFallbackLoginRejected);
|
|
});
|
|
|
|
it("passes silently when both conditions are met", () => {
|
|
expect(() => assertAdminFallbackLoginAllowed("ok@example.test", { enabled: true, allowlist: ["ok@example.test"] })).not.toThrow();
|
|
});
|
|
});
|
|
|
|
describe("isAdminFallbackUiVisible", () => {
|
|
it("reflects enabled flag only (allowlist intentionally ignored at UI layer)", () => {
|
|
expect(isAdminFallbackUiVisible({ ADMIN_FALLBACK_LOGIN_ENABLED: "true" })).toBe(true);
|
|
expect(isAdminFallbackUiVisible({ ADMIN_FALLBACK_LOGIN_ENABLED: "false" })).toBe(false);
|
|
expect(isAdminFallbackUiVisible({})).toBe(false);
|
|
});
|
|
});
|