91 lines
4.7 KiB
JavaScript
91 lines
4.7 KiB
JavaScript
import { describe, expect, it } from "vitest";
|
|
|
|
import { failureCount, gates, renderReport, reportPath } from "./verify-role-permission-baseline.mjs";
|
|
|
|
const requiredPrivilegeEscalationTargets = [
|
|
"apps/web/app/utils/services/workspaceRoles.server.test.ts",
|
|
"apps/web/app/routes/app.$tenant/settings/roles-and-permissions/roles.test.tsx",
|
|
"apps/web/app/utils/helpers/.server/PermissionsService.test.ts",
|
|
];
|
|
|
|
function rolePermissionBoundaryArgs(gateInventory = gates) {
|
|
const gate = gateInventory.find((candidate) => candidate.id === "vitest-role-permission-boundary");
|
|
return gate?.args ?? [];
|
|
}
|
|
|
|
describe("verify-role-permission-baseline", () => {
|
|
it("defines the Role Permission non-E2E baseline gates and report path", () => {
|
|
expect(reportPath).toMatch(/\.tc\/baselines\/role-permission\/baseline-health\.md$/);
|
|
expect(gates.map((gate) => gate.id)).toEqual([
|
|
"typecheck",
|
|
"lint",
|
|
"vitest-role-permission-boundary",
|
|
"role-permission-inventory",
|
|
]);
|
|
expect(rolePermissionBoundaryArgs().join(" ")).toBe(
|
|
"exec vitest run apps/api/src/permission-matrix.test.ts apps/api/src/auth/scope.test.ts apps/api/src/route-access-inventory.test.ts apps/web/app/utils/services/rolesAndPermissionsService.role-matrix.test.ts apps/web/app/utils/services/rolesAndPermissionsService.seed-diagnostics.test.ts apps/web/app/utils/services/workspaceRoles.server.test.ts apps/web/app/routes/app.$tenant/settings/roles-and-permissions/roles.test.tsx apps/web/app/utils/helpers/.server/PermissionsService.test.ts packages/db/src/seed.server.test.ts",
|
|
);
|
|
expect(rolePermissionBoundaryArgs()).toEqual(expect.arrayContaining(requiredPrivilegeEscalationTargets));
|
|
expect(gates.some((gate) => gate.args?.some((arg) => /playwright|cypress|browser|e2e/i.test(arg)))).toBe(false);
|
|
});
|
|
|
|
it("protects privilege-escalation tests from being dropped from the role permission boundary gate", () => {
|
|
for (const target of requiredPrivilegeEscalationTargets) {
|
|
const inventoryWithoutTarget = gates.map((gate) =>
|
|
gate.id === "vitest-role-permission-boundary" ? { ...gate, args: gate.args.filter((arg) => arg !== target) } : gate,
|
|
);
|
|
|
|
expect(rolePermissionBoundaryArgs(inventoryWithoutTarget)).not.toEqual(expect.arrayContaining([target]));
|
|
}
|
|
|
|
expect(rolePermissionBoundaryArgs()).toEqual(expect.arrayContaining(requiredPrivilegeEscalationTargets));
|
|
});
|
|
|
|
it("does not count successful gate output as failures", () => {
|
|
expect(failureCount("lint", "warning only", "", 0)).toBe(0);
|
|
expect(failureCount("vitest-role-permission-boundary", "Tests 30 passed", "", 0)).toBe(0);
|
|
expect(failureCount("role-permission-inventory", "total matches: 12", "", 0)).toBe(0);
|
|
});
|
|
|
|
it("counts failed typecheck diagnostics conservatively", () => {
|
|
const output = "src/a.ts(1,1): error TS2307: Cannot find module\nsrc/b.ts(2,2): error TS2322: Type mismatch";
|
|
|
|
expect(failureCount("typecheck", output, "", 1)).toBe(2);
|
|
expect(failureCount("typecheck", "Build failed", "", 1)).toBe(1);
|
|
});
|
|
|
|
it("counts failed ESLint diagnostics conservatively", () => {
|
|
expect(failureCount("lint", "✖ 4 problems (3 errors, 1 warning)", "", 1)).toBe(3);
|
|
expect(failureCount("lint", "2 errors and 0 warnings", "", 1)).toBe(2);
|
|
expect(failureCount("lint", "Lint crashed", "", 1)).toBe(1);
|
|
});
|
|
|
|
it("counts failed Vitest diagnostics conservatively", () => {
|
|
expect(failureCount("vitest-role-permission-boundary", "Tests 2 failed | 8 passed", "", 1)).toBe(2);
|
|
expect(failureCount("vitest-role-permission-boundary", "Test Files 1 failed | 2 passed", "", 1)).toBe(1);
|
|
expect(failureCount("vitest-role-permission-boundary", "Vitest crashed", "", 1)).toBe(1);
|
|
});
|
|
|
|
it("renders required Role Permission report sections", () => {
|
|
const report = renderReport([
|
|
{
|
|
id: "role-permission-inventory",
|
|
command: "read-only role/permission inventory",
|
|
exitCode: 0,
|
|
durationMs: 10,
|
|
failureCount: 0,
|
|
fingerprint: { hash: "abc123", excerpt: "Role/permission inventory scanned roots: apps/web/app, apps/api/src, packages, prisma" },
|
|
},
|
|
]);
|
|
|
|
expect(report).toContain("# Role Permission Baseline Health");
|
|
expect(report).toContain("non-E2E baseline gates for Role Permission baseline");
|
|
expect(report).toContain("default roles, permissions, role guards, auth scopes, and forbidden/unauthorized markers");
|
|
expect(report).toContain("## role-permission-inventory");
|
|
expect(report).toContain("Command: `read-only role/permission inventory`");
|
|
expect(report).toContain("Exitcode: 0");
|
|
expect(report).toContain("Failure Count: 0");
|
|
expect(report).toContain("Output Fingerprint: abc123");
|
|
});
|
|
});
|