Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

apps/web/tests/rbac.test.ts

@@ -0,0 +1,63 @@
+import { describe, expect, it } from "vitest";
+import { can } from "../src/rbac";
+
+describe("can", () => {
+  it("allows every role to read the dashboard", () => {
+    expect(can(["viewer"], "dashboard.read")).toBe(true);
+    expect(can(["auditor"], "dashboard.read")).toBe(true);
+    expect(can(["operator"], "dashboard.read")).toBe(true);
+    expect(can(["admin"], "dashboard.read")).toBe(true);
+  });
+
+  it("denies audit.read to a viewer but allows it for auditor and above", () => {
+    expect(can(["viewer"], "audit.read")).toBe(false);
+    expect(can(["auditor"], "audit.read")).toBe(true);
+    expect(can(["operator"], "audit.read")).toBe(true);
+    expect(can(["admin"], "audit.read")).toBe(true);
+  });
+
+  it("restricts client.disable and client.revoke to operator and admin", () => {
+    expect(can(["viewer"], "client.disable")).toBe(false);
+    expect(can(["auditor"], "client.disable")).toBe(false);
+    expect(can(["operator"], "client.disable")).toBe(true);
+    expect(can(["admin"], "client.disable")).toBe(true);
+    expect(can(["operator"], "client.revoke")).toBe(true);
+    expect(can(["viewer"], "client.revoke")).toBe(false);
+  });
+
+  it("restricts live tool readiness checks to operator and admin", () => {
+    expect(can(["viewer"], "tool.test")).toBe(false);
+    expect(can(["auditor"], "tool.test")).toBe(false);
+    expect(can(["operator"], "tool.test")).toBe(true);
+    expect(can(["admin"], "tool.test")).toBe(true);
+  });
+
+  it("restricts actual tool invocation and operational probes to operator and admin", () => {
+    for (const action of ["tool.invoke", "operations.check"] as const) {
+      expect(can(["viewer"], action)).toBe(false);
+      expect(can(["auditor"], action)).toBe(false);
+      expect(can(["operator"], action)).toBe(true);
+      expect(can(["admin"], action)).toBe(true);
+    }
+  });
+
+  it("restricts client.create and catalog.apply to admin only", () => {
+    expect(can(["operator"], "client.create")).toBe(false);
+    expect(can(["admin"], "client.create")).toBe(true);
+    expect(can(["operator"], "catalog.apply")).toBe(false);
+    expect(can(["admin"], "catalog.apply")).toBe(true);
+  });
+
+  it("allows policy.simulate and catalog.preview for every role, side-effect-free reads", () => {
+    expect(can(["viewer"], "policy.simulate")).toBe(true);
+    expect(can(["viewer"], "catalog.preview")).toBe(true);
+  });
+
+  it("returns false for an empty role list, never throws", () => {
+    expect(can([], "dashboard.read")).toBe(false);
+  });
+
+  it("is permissive if the principal holds any one sufficient role among several", () => {
+    expect(can(["viewer", "admin"], "client.create")).toBe(true);
+  });
+});