146 lines
4.2 KiB
TypeScript
146 lines
4.2 KiB
TypeScript
import { describe, expect, it } from "@suaveplan/testing/runner";
|
|
import { PermissionPolicy } from "../../policy/policy.js";
|
|
import { checkCapability } from "./capability.js";
|
|
|
|
const policy = new PermissionPolicy({
|
|
database: {
|
|
required: true,
|
|
schemaVersion: 1,
|
|
tablePrefix: "billing_",
|
|
},
|
|
secrets: [{ name: "STRIPE_SECRET_KEY", required: true }],
|
|
events: {
|
|
publishes: ["billing.invoice.created"],
|
|
subscribes: ["users.profile.updated"],
|
|
},
|
|
});
|
|
|
|
describe("checkCapability — db", () => {
|
|
it("allows query inside declared tablePrefix", {
|
|
timeout: 5000,
|
|
}, () => {
|
|
expect(
|
|
checkCapability(policy, {
|
|
capability: "db",
|
|
table: "billing_invoices",
|
|
})
|
|
).toEqual({ outcome: "allow" });
|
|
});
|
|
|
|
it("db denies queries outside declared tablePrefix", {
|
|
timeout: 5000,
|
|
}, () => {
|
|
expect(
|
|
checkCapability(policy, {
|
|
capability: "db",
|
|
table: "users_account",
|
|
})
|
|
).toEqual({ outcome: "deny", reason: "table-out-of-scope" });
|
|
});
|
|
|
|
it("db denies queries when database manifest absent", {
|
|
timeout: 5000,
|
|
}, () => {
|
|
const empty = new PermissionPolicy({});
|
|
expect(
|
|
checkCapability(empty, { capability: "db", table: "any_table" })
|
|
).toEqual({ outcome: "deny", reason: "db-not-declared" });
|
|
});
|
|
});
|
|
|
|
describe("checkCapability — secrets", () => {
|
|
it("allows declared name", { timeout: 5000 }, () => {
|
|
expect(
|
|
checkCapability(policy, {
|
|
capability: "secrets",
|
|
name: "STRIPE_SECRET_KEY",
|
|
}).outcome
|
|
).toBe("allow");
|
|
});
|
|
|
|
it("secrets denies undeclared name", { timeout: 5000 }, () => {
|
|
expect(
|
|
checkCapability(policy, {
|
|
capability: "secrets",
|
|
name: "AWS_KEY",
|
|
})
|
|
).toEqual({ outcome: "deny", reason: "secret-not-declared" });
|
|
});
|
|
|
|
it("secrets denies when manifest has no secrets array", {
|
|
timeout: 5000,
|
|
}, () => {
|
|
const empty = new PermissionPolicy({});
|
|
expect(
|
|
checkCapability(empty, {
|
|
capability: "secrets",
|
|
name: "FOO",
|
|
}).outcome
|
|
).toBe("deny");
|
|
});
|
|
});
|
|
|
|
describe("checkCapability — events", () => {
|
|
it("allows publish of declared topic", { timeout: 5000 }, () => {
|
|
expect(
|
|
checkCapability(policy, {
|
|
capability: "events",
|
|
mode: "publish",
|
|
topic: "billing.invoice.created",
|
|
}).outcome
|
|
).toBe("allow");
|
|
});
|
|
|
|
it("allows subscribe of declared topic", { timeout: 5000 }, () => {
|
|
expect(
|
|
checkCapability(policy, {
|
|
capability: "events",
|
|
mode: "subscribe",
|
|
topic: "users.profile.updated",
|
|
}).outcome
|
|
).toBe("allow");
|
|
});
|
|
|
|
it("events denies publish outside manifest", { timeout: 5000 }, () => {
|
|
expect(
|
|
checkCapability(policy, {
|
|
capability: "events",
|
|
mode: "publish",
|
|
topic: "other.topic",
|
|
})
|
|
).toEqual({ outcome: "deny", reason: "publish-not-declared" });
|
|
});
|
|
|
|
it("events denies subscribe outside manifest", {
|
|
timeout: 5000,
|
|
}, () => {
|
|
expect(
|
|
checkCapability(policy, {
|
|
capability: "events",
|
|
mode: "subscribe",
|
|
topic: "other.topic",
|
|
})
|
|
).toEqual({ outcome: "deny", reason: "subscribe-not-declared" });
|
|
});
|
|
|
|
it("events denies when no events block in manifest", {
|
|
timeout: 5000,
|
|
}, () => {
|
|
const empty = new PermissionPolicy({});
|
|
expect(
|
|
checkCapability(empty, {
|
|
capability: "events",
|
|
mode: "publish",
|
|
topic: "anything",
|
|
}).outcome
|
|
).toBe("deny");
|
|
expect(
|
|
checkCapability(empty, {
|
|
capability: "events",
|
|
mode: "subscribe",
|
|
topic: "anything",
|
|
}).outcome
|
|
).toBe("deny");
|
|
});
|
|
});
|