36 lines
1.4 KiB
TypeScript
36 lines
1.4 KiB
TypeScript
import { describe, expect, it } from 'vitest'
|
|
import { hasAccess, rolesFromPayload } from './auth.js'
|
|
|
|
describe('FieldLens authorization isolation', () => {
|
|
it('extracts FieldLens client roles and ignores realm/platform roles', () => {
|
|
const roles = rolesFromPayload({
|
|
resource_access: {
|
|
'fieldlens-api': { roles: ['fieldlens-operator'] },
|
|
},
|
|
realm_access: { roles: ['operator', 'admin', 'owner', 'offline_access'] },
|
|
})
|
|
|
|
expect(roles).toEqual(['fieldlens-operator'])
|
|
})
|
|
|
|
it('does not grant FieldLens access from generic Arrowstack roles', () => {
|
|
const platformIdentity = {
|
|
roles: ['operator', 'admin', 'owner'],
|
|
clientId: 'some-arrowstack-client',
|
|
}
|
|
|
|
expect(hasAccess('operator', platformIdentity)).toBe(false)
|
|
expect(hasAccess('supervisor', platformIdentity)).toBe(false)
|
|
expect(hasAccess('admin', platformIdentity)).toBe(false)
|
|
expect(hasAccess('integration', platformIdentity)).toBe(false)
|
|
})
|
|
|
|
it('preserves the FieldLens role hierarchy', () => {
|
|
expect(hasAccess('operator', { roles: ['fieldlens-operator'] })).toBe(true)
|
|
expect(hasAccess('operator', { roles: ['fieldlens-supervisor'] })).toBe(true)
|
|
expect(hasAccess('supervisor', { roles: ['fieldlens-admin'] })).toBe(true)
|
|
expect(hasAccess('admin', { roles: ['fieldlens-admin'] })).toBe(true)
|
|
expect(hasAccess('admin', { roles: ['fieldlens-supervisor'] })).toBe(false)
|
|
})
|
|
})
|