46 lines
2.0 KiB
TypeScript
46 lines
2.0 KiB
TypeScript
import { describe, expect, it } from 'vitest';
|
|
import {
|
|
createProjectAuthorizer,
|
|
parseProjectGrants,
|
|
projectAuthorizationConfigured,
|
|
} from '../../src/document-workbench/project-access';
|
|
|
|
const scope = { tenantId: 't_0pt', projectId: 'prj_alpha', actorId: 'user_1' };
|
|
|
|
describe('project authorization', () => {
|
|
it('fails closed when neither OpenFGA nor explicit grants are configured', async () => {
|
|
const env = {} as unknown as NodeJS.ProcessEnv;
|
|
expect(projectAuthorizationConfigured(env)).toBe(false);
|
|
await expect(createProjectAuthorizer(env)(scope)).resolves.toBe(false);
|
|
});
|
|
|
|
it('honours an exact actor grant and rejects a different actor or project', async () => {
|
|
const env = {
|
|
OPT_PROJECT_GRANTS: JSON.stringify([{ tenantId: 't_0pt', projectId: 'prj_alpha', actorId: 'user_1' }]),
|
|
} as unknown as NodeJS.ProcessEnv;
|
|
const authorize = createProjectAuthorizer(env);
|
|
await expect(authorize(scope)).resolves.toBe(true);
|
|
await expect(authorize({ ...scope, actorId: 'user_2' })).resolves.toBe(false);
|
|
await expect(authorize({ ...scope, projectId: 'prj_beta' })).resolves.toBe(false);
|
|
await expect(authorize({ ...scope, tenantId: 't_other' })).resolves.toBe(false);
|
|
});
|
|
|
|
it('supports a tenant-wide wildcard actor', async () => {
|
|
const env = {
|
|
OPT_PROJECT_GRANTS: JSON.stringify([{ tenantId: 't_0pt', projectId: 'prj_alpha', actorId: '*' }]),
|
|
} as unknown as NodeJS.ProcessEnv;
|
|
await expect(createProjectAuthorizer(env)({ ...scope, actorId: 'anyone' })).resolves.toBe(true);
|
|
});
|
|
|
|
it('treats an invalid grant document as unconfigured', () => {
|
|
expect(parseProjectGrants('{not json')).toBeUndefined();
|
|
expect(parseProjectGrants(JSON.stringify([]))).toBeUndefined();
|
|
expect(parseProjectGrants(JSON.stringify([{ tenantId: 't', projectId: 'p' }]))).toBeUndefined();
|
|
expect(
|
|
projectAuthorizationConfigured({
|
|
OPT_PROJECT_GRANTS: 'not-json',
|
|
} as unknown as NodeJS.ProcessEnv),
|
|
).toBe(false);
|
|
});
|
|
});
|