George Lambert
c32b65038a
Some checks are pending
offline / test (push) Waiting to run
Fleet and department doors now check STAFF_IAM_URL. Walkthrough: cs can credit (agent is the IAM user) and cannot export; operator can fleet POST; admin /me is owner. Portal is the public web door at :3021/portal/. IAM sessions persist; login is rate-limited per user; receipt PDF is branded. lan-134 stays disabled.
31 lines
1.3 KiB
JavaScript
31 lines
1.3 KiB
JavaScript
import { test } from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { expandRoles, allows, ROLES } from '../src/roles.js';
|
|
import { StaffIam } from '../src/store.js';
|
|
import { verifyPassword } from '../src/passwords.js';
|
|
|
|
test('owner expands to all permissions', () => {
|
|
assert.deepEqual(expandRoles(['owner']), ['*']);
|
|
assert.equal(allows(['*'], 'cs.credit'), true);
|
|
assert.equal(allows(expandRoles(['cs']), 'cs.credit'), true);
|
|
assert.equal(allows(expandRoles(['cs']), 'accounting.export'), false);
|
|
assert.ok(ROLES.sales);
|
|
});
|
|
|
|
test('sessions persist in dump/load', () => {
|
|
const iam = new StaffIam().seed();
|
|
const u = iam.findByUsername('cs');
|
|
const tok = iam.issueSession(u.id);
|
|
const raw = iam.dump();
|
|
const b = new StaffIam().load(raw);
|
|
assert.equal(b.getSession(tok).userId, u.id);
|
|
});
|
|
|
|
test('cannot deactivate last owner; passwords hash', () => {
|
|
const iam = new StaffIam().seed();
|
|
const owner = iam.findByUsername('admin');
|
|
assert.ok(verifyPassword(process.env.ADMIN_KEY || 'admin-dev-key', owner.passwordHash));
|
|
assert.throws(() => iam.update('admin', { active: false }, 'admin'), /last owner/);
|
|
const cs = iam.create({ username: 'anna', password: 'anna-pass-1', name: 'Anna', roles: ['cs'], actor: 'admin' });
|
|
assert.deepEqual(cs.roles, ['cs']);
|
|
});
|