68 lines
2.7 KiB
TypeScript
68 lines
2.7 KiB
TypeScript
import { PRESET_ROLES } from './rbac.service';
|
|
|
|
function permissionsFor(roleCode: string): { groups: string[]; extras: string[] } {
|
|
const role = PRESET_ROLES.find((item) => item.code === roleCode);
|
|
if (!role) throw new Error(`missing role ${roleCode}`);
|
|
return { groups: role.permissionGroups, extras: role.extraPermissions ?? [] };
|
|
}
|
|
|
|
describe('preset role permissions', () => {
|
|
it('keeps teachers read-only in scheduling while preserving class attendance access', () => {
|
|
const teacher = permissionsFor('teacher');
|
|
|
|
expect(teacher.groups).toEqual(['notification', 'profile']);
|
|
expect(teacher.extras).toEqual(
|
|
expect.arrayContaining([
|
|
'teacher-workspace:view',
|
|
'schedule:view',
|
|
'attendance:view',
|
|
'attendance:create',
|
|
'attendance:self-edit',
|
|
]),
|
|
);
|
|
expect(teacher.extras).not.toContain('schedule:create');
|
|
expect(teacher.extras).not.toContain('schedule:edit');
|
|
expect(teacher.extras).not.toContain('schedule:delete');
|
|
expect(teacher.extras).not.toContain('student:view');
|
|
expect(teacher.extras).not.toContain('class:view');
|
|
expect(teacher.extras).not.toContain('attendance:export');
|
|
});
|
|
|
|
|
|
it('gives academic administrators the complete teaching administration workflow', () => {
|
|
const academic = permissionsFor('academic');
|
|
expect(academic.groups).toEqual(
|
|
expect.arrayContaining(['student', 'class', 'schedule', 'attendance', 'classroom']),
|
|
);
|
|
expect(academic.extras).toEqual(expect.arrayContaining(['sync:read', 'sync:trigger']));
|
|
});
|
|
|
|
it('combines accommodation, expenses, bills and deposits in one operations role', () => {
|
|
const accommodation = permissionsFor('accommodation_operations');
|
|
expect(accommodation.groups).toEqual(
|
|
expect.arrayContaining(['room', 'occupancy', 'expense', 'bill', 'deposit']),
|
|
);
|
|
expect(accommodation.extras).toEqual(
|
|
expect.arrayContaining(['student:basic-view', 'organization:view']),
|
|
);
|
|
});
|
|
|
|
it('keeps classroom rental operations separate from accommodation operations', () => {
|
|
const classroomOperations = permissionsFor('classroom_operations');
|
|
expect(classroomOperations.groups).toEqual(
|
|
expect.arrayContaining(['classroom', 'rental', 'organization']),
|
|
);
|
|
expect(classroomOperations.groups).not.toEqual(expect.arrayContaining(['room', 'deposit']));
|
|
});
|
|
|
|
it('limits system administrators to accounts, permissions, logs and integrations', () => {
|
|
const systemAdmin = permissionsFor('system_admin');
|
|
expect(systemAdmin.groups).toEqual(
|
|
expect.arrayContaining(['user', 'role', 'log', 'integration', 'sync', 'ai']),
|
|
);
|
|
expect(systemAdmin.groups).not.toEqual(
|
|
expect.arrayContaining(['student', 'schedule', 'attendance', 'expense']),
|
|
);
|
|
});
|
|
});
|