79 lines
3.8 KiB
JavaScript
79 lines
3.8 KiB
JavaScript
import { test } from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { authorize } from '../src/policy.js';
|
|
import { accessAddress, parseAddress, PLANES } from '../src/subjects.js';
|
|
|
|
test('five access planes', () => {
|
|
assert.deepEqual([...PLANES], ['zapier', 'web', 'api', 'leaf', 'staff']);
|
|
});
|
|
|
|
test('web may read statement and reload, not archive or jobs', () => {
|
|
assert.equal(authorize({ plane: 'web', subject: 'verae.billing.statement.get' }).allow, true);
|
|
assert.equal(
|
|
authorize({ plane: 'web', subject: 'verae.billing.balance.adjust', kind: 'reload' }).allow,
|
|
true,
|
|
);
|
|
assert.equal(
|
|
authorize({ plane: 'web', subject: 'verae.billing.balance.adjust', kind: 'credit' }).allow,
|
|
false,
|
|
);
|
|
assert.equal(authorize({ plane: 'web', subject: 'verae.archive.put' }).allow, false);
|
|
assert.equal(authorize({ plane: 'web', subject: 'verae.zapier.jobs.watch' }).allow, false);
|
|
});
|
|
|
|
test('leaf may archive and jobs, not billing adjust', () => {
|
|
assert.equal(authorize({ plane: 'leaf', subject: 'verae.archive.put' }).allow, true);
|
|
assert.equal(authorize({ plane: 'leaf', subject: 'verae.archive.reply.abc' }).allow, true);
|
|
assert.equal(authorize({ plane: 'leaf', subject: 'verae.zapier.jobs.watch' }).allow, true);
|
|
assert.equal(authorize({ plane: 'leaf', subject: 'verae.billing.balance.adjust' }).allow, false);
|
|
assert.equal(authorize({ plane: 'leaf', subject: 'verae.billing.statement.get' }).allow, false);
|
|
});
|
|
|
|
test('zapier may meter and jobs, not customer statement or credits', () => {
|
|
assert.equal(authorize({ plane: 'zapier', subject: 'verae.zapier.jobs.watch' }).allow, true);
|
|
assert.equal(authorize({ plane: 'zapier', subject: 'verae.billing.usage.recorded' }).allow, true);
|
|
assert.equal(authorize({ plane: 'zapier', subject: 'verae.billing.statement.get' }).allow, false);
|
|
assert.equal(authorize({ plane: 'zapier', subject: 'verae.billing.balance.adjust' }).allow, false);
|
|
assert.equal(authorize({ plane: 'zapier', subject: 'verae.archive.put' }).allow, false);
|
|
});
|
|
|
|
test('api may statement and usage, not credits or archive', () => {
|
|
assert.equal(authorize({ plane: 'api', subject: 'verae.billing.statement.get' }).allow, true);
|
|
assert.equal(authorize({ plane: 'api', subject: 'verae.billing.usage.recorded' }).allow, true);
|
|
assert.equal(authorize({ plane: 'api', subject: 'verae.billing.balance.adjust' }).allow, false);
|
|
assert.equal(authorize({ plane: 'api', subject: 'verae.archive.query' }).allow, false);
|
|
});
|
|
|
|
test('staff may credit and statement, not archive', () => {
|
|
assert.equal(authorize({ plane: 'staff', subject: 'verae.billing.balance.adjust', kind: 'credit' }).allow, true);
|
|
assert.equal(authorize({ plane: 'staff', subject: 'verae.billing.statement.get' }).allow, true);
|
|
assert.equal(authorize({ plane: 'staff', subject: 'verae.archive.put' }).allow, false);
|
|
});
|
|
|
|
test('access-prefixed address is mapped to internal', () => {
|
|
const addr = accessAddress('leaf', 'verae.archive.put');
|
|
assert.equal(addr, 'verae.access.leaf.archive.put');
|
|
const parsed = parseAddress(addr);
|
|
assert.equal(parsed.plane, 'leaf');
|
|
assert.equal(parsed.internal, 'verae.archive.put');
|
|
assert.equal(authorize({ plane: 'leaf', subject: addr }).allow, true);
|
|
assert.equal(authorize({ plane: 'web', subject: addr }).allow, false);
|
|
});
|
|
|
|
test('allow echoes veraeUserId for hop tracing', () => {
|
|
const out = authorize({
|
|
plane: 'web',
|
|
subject: 'verae.billing.statement.get',
|
|
principal: 'cust_1',
|
|
veraeUserId: 'vu_deadbeefdeadbeef',
|
|
traceId: 'tr-1',
|
|
});
|
|
assert.equal(out.allow, true);
|
|
assert.equal(out.veraeUserId, 'vu_deadbeefdeadbeef');
|
|
assert.equal(out.traceId, 'tr-1');
|
|
});
|
|
|
|
test('unknown plane and authz subjects denied', () => {
|
|
assert.equal(authorize({ plane: 'partner', subject: 'verae.archive.put' }).allow, false);
|
|
assert.equal(authorize({ plane: 'web', subject: 'verae.access.authz.check' }).allow, false);
|
|
});
|