44 lines
2.0 KiB
TypeScript
44 lines
2.0 KiB
TypeScript
import { describe, expect, it } from 'vitest'
|
|
import { canApproveAccess, hasAccess, realmRolesFromPayload, rolesFromPayload } from './auth.js'
|
|
|
|
describe('FieldLens authorization isolation', () => {
|
|
it('extracts FieldLens client roles and ignores realm/platform roles for app access', () => {
|
|
const payload = {
|
|
resource_access: {
|
|
'fieldlens-api': { roles: ['fieldlens-operator'] },
|
|
},
|
|
realm_access: { roles: ['operator', 'admin', 'owner', 'offline_access'] },
|
|
}
|
|
expect(rolesFromPayload(payload)).toEqual(['fieldlens-operator'])
|
|
expect(realmRolesFromPayload(payload)).toEqual(['operator', 'admin', 'owner', 'offline_access'])
|
|
})
|
|
|
|
it('does not grant FieldLens operational access from generic Arrowstack roles', () => {
|
|
const platformIdentity = {
|
|
roles: ['operator', 'admin', 'owner'],
|
|
realmRoles: ['operator', 'admin', 'owner'],
|
|
clientId: 'some-arrowstack-client',
|
|
}
|
|
|
|
expect(hasAccess('operator', platformIdentity)).toBe(false)
|
|
expect(hasAccess('supervisor', platformIdentity)).toBe(false)
|
|
expect(hasAccess('admin', platformIdentity)).toBe(false)
|
|
expect(hasAccess('integration', platformIdentity)).toBe(false)
|
|
})
|
|
|
|
it('allows only admin/owner realm identities to approve access without granting app access', () => {
|
|
expect(canApproveAccess({ roles: [], realmRoles: ['admin'] })).toBe(true)
|
|
expect(canApproveAccess({ roles: [], realmRoles: ['owner'] })).toBe(true)
|
|
expect(canApproveAccess({ roles: [], realmRoles: ['operator'] })).toBe(false)
|
|
expect(hasAccess('operator', { roles: [], clientId: 'fieldlens' })).toBe(false)
|
|
})
|
|
|
|
it('preserves the FieldLens role hierarchy', () => {
|
|
expect(hasAccess('operator', { roles: ['fieldlens-operator'] })).toBe(true)
|
|
expect(hasAccess('operator', { roles: ['fieldlens-supervisor'] })).toBe(true)
|
|
expect(hasAccess('supervisor', { roles: ['fieldlens-admin'] })).toBe(true)
|
|
expect(hasAccess('admin', { roles: ['fieldlens-admin'] })).toBe(true)
|
|
expect(hasAccess('admin', { roles: ['fieldlens-supervisor'] })).toBe(false)
|
|
})
|
|
})
|