64 lines
2.6 KiB
TypeScript
64 lines
2.6 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import { can } from "../src/rbac";
|
|
|
|
describe("can", () => {
|
|
it("allows every role to read the dashboard", () => {
|
|
expect(can(["viewer"], "dashboard.read")).toBe(true);
|
|
expect(can(["auditor"], "dashboard.read")).toBe(true);
|
|
expect(can(["operator"], "dashboard.read")).toBe(true);
|
|
expect(can(["admin"], "dashboard.read")).toBe(true);
|
|
});
|
|
|
|
it("denies audit.read to a viewer but allows it for auditor and above", () => {
|
|
expect(can(["viewer"], "audit.read")).toBe(false);
|
|
expect(can(["auditor"], "audit.read")).toBe(true);
|
|
expect(can(["operator"], "audit.read")).toBe(true);
|
|
expect(can(["admin"], "audit.read")).toBe(true);
|
|
});
|
|
|
|
it("restricts client.disable and client.revoke to operator and admin", () => {
|
|
expect(can(["viewer"], "client.disable")).toBe(false);
|
|
expect(can(["auditor"], "client.disable")).toBe(false);
|
|
expect(can(["operator"], "client.disable")).toBe(true);
|
|
expect(can(["admin"], "client.disable")).toBe(true);
|
|
expect(can(["operator"], "client.revoke")).toBe(true);
|
|
expect(can(["viewer"], "client.revoke")).toBe(false);
|
|
});
|
|
|
|
it("restricts live tool readiness checks to operator and admin", () => {
|
|
expect(can(["viewer"], "tool.test")).toBe(false);
|
|
expect(can(["auditor"], "tool.test")).toBe(false);
|
|
expect(can(["operator"], "tool.test")).toBe(true);
|
|
expect(can(["admin"], "tool.test")).toBe(true);
|
|
});
|
|
|
|
it("restricts actual tool invocation and operational probes to operator and admin", () => {
|
|
for (const action of ["tool.invoke", "operations.check"] as const) {
|
|
expect(can(["viewer"], action)).toBe(false);
|
|
expect(can(["auditor"], action)).toBe(false);
|
|
expect(can(["operator"], action)).toBe(true);
|
|
expect(can(["admin"], action)).toBe(true);
|
|
}
|
|
});
|
|
|
|
it("restricts client.create and catalog.apply to admin only", () => {
|
|
expect(can(["operator"], "client.create")).toBe(false);
|
|
expect(can(["admin"], "client.create")).toBe(true);
|
|
expect(can(["operator"], "catalog.apply")).toBe(false);
|
|
expect(can(["admin"], "catalog.apply")).toBe(true);
|
|
});
|
|
|
|
it("allows policy.simulate and catalog.preview for every role, side-effect-free reads", () => {
|
|
expect(can(["viewer"], "policy.simulate")).toBe(true);
|
|
expect(can(["viewer"], "catalog.preview")).toBe(true);
|
|
});
|
|
|
|
it("returns false for an empty role list, never throws", () => {
|
|
expect(can([], "dashboard.read")).toBe(false);
|
|
});
|
|
|
|
it("is permissive if the principal holds any one sufficient role among several", () => {
|
|
expect(can(["viewer", "admin"], "client.create")).toBe(true);
|
|
});
|
|
});
|