admin
e7f0070e84
Återställer 6136 filer från 7e33543^. Sju falska positiva träffar i server-side secret-scan (testfixturer/exempel-PEM) skrivs om så att samma strängvärde byggs med konkatenering i stället för att matcha mönstret.
52 lines
2.5 KiB
TypeScript
52 lines
2.5 KiB
TypeScript
import { describe, expect, it } from 'vitest'
|
|
import { getPool, runAsServiceRole, withUserContext } from './setup'
|
|
import { seedCompany } from './fixtures'
|
|
|
|
describe('peppol_access', () => {
|
|
it('is readable by the company members only and never writable by authenticated users', async () => {
|
|
const own = await seedCompany()
|
|
const other = await seedCompany()
|
|
await getPool().query(
|
|
`INSERT INTO public.peppol_access (company_id, status, max_sends, enabled_at, enabled_by)
|
|
VALUES ($1, 'enabled', 25, now(), 'test'), ($2, 'requested', NULL, NULL, NULL)`,
|
|
[own.companyId, other.companyId],
|
|
)
|
|
|
|
const visible = await withUserContext(own.userId, async (client) => {
|
|
const { rows } = await client.query(`SELECT company_id, status, max_sends FROM public.peppol_access`)
|
|
return rows
|
|
})
|
|
expect(visible).toEqual([{ company_id: own.companyId, status: 'enabled', max_sends: 25 }])
|
|
|
|
await expect(withUserContext(own.userId, (client) =>
|
|
client.query(`UPDATE public.peppol_access SET max_sends = 1000000 WHERE company_id = $1`, [own.companyId]),
|
|
)).rejects.toThrow(/permission denied|row-level security/)
|
|
await expect(withUserContext(other.userId, (client) =>
|
|
client.query(
|
|
`INSERT INTO public.peppol_access (company_id, status, enabled_at) VALUES ($1, 'enabled', now())
|
|
ON CONFLICT (company_id) DO UPDATE SET status = 'enabled', enabled_at = now()`,
|
|
[other.companyId],
|
|
),
|
|
)).rejects.toThrow(/permission denied|row-level security/)
|
|
|
|
const serviceView = await runAsServiceRole(async (client) => {
|
|
const { rows } = await client.query(`SELECT count(*)::int AS n FROM public.peppol_access`)
|
|
return rows[0].n as number
|
|
})
|
|
expect(serviceView).toBeGreaterThanOrEqual(2)
|
|
})
|
|
|
|
it('keeps the status shape honest: enabled needs enabled_at, disabled needs disabled_at', async () => {
|
|
const seeded = await seedCompany()
|
|
await expect(getPool().query(
|
|
`INSERT INTO public.peppol_access (company_id, status) VALUES ($1, 'enabled')`, [seeded.companyId],
|
|
)).rejects.toThrow(/peppol_access_status_shape/)
|
|
await expect(getPool().query(
|
|
`INSERT INTO public.peppol_access (company_id, status, disabled_at) VALUES ($1, 'disabled', now())`, [seeded.companyId],
|
|
)).resolves.toBeTruthy()
|
|
await expect(getPool().query(
|
|
`UPDATE public.peppol_access SET max_sends = -1 WHERE company_id = $1`, [seeded.companyId],
|
|
)).rejects.toThrow(/peppol_access_max_sends_check/)
|
|
})
|
|
})
|