Publish curated ITWorx-Pulse source from 0e0633c8ac91cb71312a26837f791035a78d81b8

apps/web/tests/unit/sessionClient.test.ts

@@ -0,0 +1,38 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+import { readSessionCapabilities } from '../../src/sessionClient';
+
+afterEach(() => vi.unstubAllGlobals());
+
+function json(value: unknown, status = 200): Response {
+  return new Response(JSON.stringify(value), { status, headers: { 'Content-Type': 'application/json' } });
+}
+
+describe('session capability client', () => {
+  it('reads bounded identity, environment and effective permissions', async () => {
+    vi.stubGlobal('fetch', vi.fn(async () => json({
+      subject: 'operator-42', role: 'editor', environment: 'development',
+      permissions: { view: true, operate: true, edit: true, admin: false },
+    })));
+
+    await expect(readSessionCapabilities()).resolves.toEqual({
+      subject: 'operator-42', role: 'editor', environment: 'development',
+      permissions: { view: true, operate: true, edit: true, admin: false }, source: 'session',
+    });
+  });
+
+  it('falls back to the legacy capability probe when the endpoint is absent', async () => {
+    const fetch = vi.fn(async () => fetch.mock.calls.length === 1 ? json({}, 404) : json({}, 405));
+    vi.stubGlobal('fetch', fetch);
+
+    const result = await readSessionCapabilities();
+
+    expect(result).toMatchObject({ role: 'editor+', environment: '', permissions: { view: true, operate: true, edit: true, admin: false }, source: 'fallback' });
+    expect(fetch).toHaveBeenNthCalledWith(2, '/api/v1/widgets/preview', expect.objectContaining({ method: 'GET', cache: 'no-store' }));
+  });
+
+  it('preserves an explicit authentication failure', async () => {
+    vi.stubGlobal('fetch', vi.fn(async () => json({}, 401)));
+    await expect(readSessionCapabilities()).rejects.toMatchObject({ status: 401 });
+  });
+});