forked from wangziqi/gongxue-base
59 lines
2.0 KiB
JavaScript
59 lines
2.0 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
|
|
const {
|
|
hasResolvedTenantPermission,
|
|
hasTenantPermission,
|
|
} = await import('../apps/api/src/features/tenant-admin/auth.ts');
|
|
|
|
function auth(role, permissions = {}, templatePermissions = {}) {
|
|
return { role, permissions, templatePermissions };
|
|
}
|
|
|
|
assert.equal(
|
|
hasTenantPermission(auth('teacher'), 'content:questions:write'),
|
|
true,
|
|
'teacher role defaults should grant content permissions',
|
|
);
|
|
assert.equal(
|
|
hasTenantPermission(auth('teacher', { 'content:*': false }), 'content:questions:write'),
|
|
false,
|
|
'member wildcard deny must override role defaults',
|
|
);
|
|
assert.equal(
|
|
hasTenantPermission(auth('tenant_operator', { 'content:questions:write': false }), 'content:questions:write'),
|
|
false,
|
|
'member exact deny must override role defaults',
|
|
);
|
|
assert.equal(
|
|
hasTenantPermission(auth('teacher', { 'content:questions:write': true, 'content:*': false }), 'content:questions:write'),
|
|
true,
|
|
'member exact allow must take precedence over a broader member deny',
|
|
);
|
|
assert.equal(
|
|
hasTenantPermission(auth('teacher', {}, { 'content:*': false }), 'content:questions:write'),
|
|
false,
|
|
'template wildcard deny must override role defaults',
|
|
);
|
|
assert.equal(
|
|
hasTenantPermission(auth('teacher', { 'content:*': false }, { 'content:questions:write': true }), 'content:questions:write'),
|
|
false,
|
|
'member decisions must take precedence over template decisions',
|
|
);
|
|
assert.equal(
|
|
hasResolvedTenantPermission(auth('teacher'), 'content:analytics:read', false),
|
|
false,
|
|
'a caller may narrow role defaults for sensitive content permissions',
|
|
);
|
|
assert.equal(
|
|
hasResolvedTenantPermission(auth('teacher', { 'content:analytics:read': true }), 'content:analytics:read', false),
|
|
true,
|
|
'an explicit member grant should work when the caller role default is denied',
|
|
);
|
|
assert.equal(
|
|
hasResolvedTenantPermission(auth('tenant_owner', { 'content:*': false }), 'content:write', true),
|
|
false,
|
|
'explicit deny must apply even to a role that is allowed by default',
|
|
);
|
|
|
|
console.log('[PASS] tenant permission resolution precedence');
|