0pt/tests/document-workbench/project-access.test.ts

import { describe, expect, it } from 'vitest';
import {
  createProjectAuthorizer,
  parseProjectGrants,
  projectAuthorizationConfigured,
} from '../../src/document-workbench/project-access';

const scope = { tenantId: 't_0pt', projectId: 'prj_alpha', actorId: 'user_1' };

describe('project authorization', () => {
  it('fails closed when neither OpenFGA nor explicit grants are configured', async () => {
    const env = {} as unknown as NodeJS.ProcessEnv;
    expect(projectAuthorizationConfigured(env)).toBe(false);
    await expect(createProjectAuthorizer(env)(scope)).resolves.toBe(false);
  });

  it('honours an exact actor grant and rejects a different actor or project', async () => {
    const env = {
      OPT_PROJECT_GRANTS: JSON.stringify([{ tenantId: 't_0pt', projectId: 'prj_alpha', actorId: 'user_1' }]),
    } as unknown as NodeJS.ProcessEnv;
    const authorize = createProjectAuthorizer(env);
    await expect(authorize(scope)).resolves.toBe(true);
    await expect(authorize({ ...scope, actorId: 'user_2' })).resolves.toBe(false);
    await expect(authorize({ ...scope, projectId: 'prj_beta' })).resolves.toBe(false);
    await expect(authorize({ ...scope, tenantId: 't_other' })).resolves.toBe(false);
  });

  it('supports a tenant-wide wildcard actor', async () => {
    const env = {
      OPT_PROJECT_GRANTS: JSON.stringify([{ tenantId: 't_0pt', projectId: 'prj_alpha', actorId: '*' }]),
    } as unknown as NodeJS.ProcessEnv;
    await expect(createProjectAuthorizer(env)({ ...scope, actorId: 'anyone' })).resolves.toBe(true);
  });

  it('treats an invalid grant document as unconfigured', () => {
    expect(parseProjectGrants('{not json')).toBeUndefined();
    expect(parseProjectGrants(JSON.stringify([]))).toBeUndefined();
    expect(parseProjectGrants(JSON.stringify([{ tenantId: 't', projectId: 'p' }]))).toBeUndefined();
    expect(
      projectAuthorizationConfigured({
        OPT_PROJECT_GRANTS: 'not-json',
      } as unknown as NodeJS.ProcessEnv),
    ).toBe(false);
  });
});