75 lines
2.8 KiB
TypeScript
75 lines
2.8 KiB
TypeScript
import { beforeEach, describe, expect, test, vi } from "vitest";
|
|
import { RowPermissionsApi } from "./RowPermissionsApi";
|
|
import { getGroup } from "~/utils/db/permissions/groups.db.server";
|
|
import { getRole } from "~/utils/db/permissions/roles.db.server";
|
|
import { getTenant, getTenantUserByIds } from "~/utils/db/tenants.db.server";
|
|
|
|
vi.mock("~/utils/db/permissions/rowPermissions.db.server", () => ({
|
|
createRowPermission: vi.fn(),
|
|
deleteRowPermissionByIdForRow: vi.fn(),
|
|
getRowPermissions: vi.fn(async () => []),
|
|
updateRowPermissionForRow: vi.fn(),
|
|
}));
|
|
|
|
vi.mock("~/utils/db/permissions/groups.db.server", () => ({
|
|
getGroup: vi.fn(),
|
|
}));
|
|
|
|
vi.mock("~/utils/db/permissions/roles.db.server", () => ({
|
|
getRole: vi.fn(),
|
|
}));
|
|
|
|
vi.mock("~/utils/db/tenants.db.server", () => ({
|
|
getTenant: vi.fn(),
|
|
getTenantUserByIds: vi.fn(),
|
|
}));
|
|
|
|
describe("RowPermissionsApi.validateShareTarget", () => {
|
|
beforeEach(() => {
|
|
vi.mocked(getGroup).mockReset();
|
|
vi.mocked(getRole).mockReset();
|
|
vi.mocked(getTenant).mockReset();
|
|
vi.mocked(getTenantUserByIds).mockReset();
|
|
});
|
|
|
|
test("rejects tenant share targets outside the current tenant", async () => {
|
|
await expect(
|
|
RowPermissionsApi.validateShareTarget({ type: "tenant", id: "tenant_b", access: "view" }, { currentTenantId: "tenant_a" })
|
|
).rejects.toThrow("Invalid permission target");
|
|
});
|
|
|
|
test("rejects invalid access values", async () => {
|
|
await expect(
|
|
RowPermissionsApi.validateShareTarget({ type: "public", access: "owner" as never })
|
|
).rejects.toThrow("Invalid permission access");
|
|
});
|
|
|
|
test("rejects user share targets that are not members of the current tenant", async () => {
|
|
vi.mocked(getTenantUserByIds).mockResolvedValue(null);
|
|
|
|
await expect(
|
|
RowPermissionsApi.validateShareTarget({ type: "user", id: "user_b", access: "view" }, { currentTenantId: "tenant_a" })
|
|
).rejects.toThrow("Invalid permission target");
|
|
|
|
expect(getTenantUserByIds).toHaveBeenCalledWith("tenant_a", "user_b");
|
|
});
|
|
|
|
test("rejects group share targets outside the current tenant", async () => {
|
|
vi.mocked(getGroup).mockResolvedValue(null);
|
|
|
|
await expect(
|
|
RowPermissionsApi.validateShareTarget({ type: "group", id: "group_b", access: "view" }, { currentTenantId: "tenant_a" })
|
|
).rejects.toThrow("Invalid permission target");
|
|
|
|
expect(getGroup).toHaveBeenCalledWith("group_b", "tenant_a");
|
|
});
|
|
|
|
test("rejects admin roles as tenant share targets", async () => {
|
|
vi.mocked(getRole).mockResolvedValue({ id: "role_admin", type: "admin" } as Awaited<ReturnType<typeof getRole>>);
|
|
|
|
await expect(
|
|
RowPermissionsApi.validateShareTarget({ type: "role", id: "role_admin", access: "view" }, { currentTenantId: "tenant_a" })
|
|
).rejects.toThrow("Invalid permission target");
|
|
});
|
|
});
|