|
| 1 | +// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license. |
| 2 | + |
| 3 | +import { describe, it, expect } from 'vitest'; |
| 4 | +import { foldWildcardSuperUser, clampManagedObjectWrites, type ManagedSchemaLike } from './hono-plugin.js'; |
| 5 | + |
| 6 | +/** |
| 7 | + * ADR-0057 D10 / ADR-0092 D5 — the `/me/permissions` per-object FLS map must |
| 8 | + * mirror the server's actual enforcement, which grants writes via a `'*'` |
| 9 | + * modifyAll super-user bypass regardless of another set's explicit per-object |
| 10 | + * deny (most-permissive merge, no deny-wins). |
| 11 | + */ |
| 12 | +describe('foldWildcardSuperUser', () => { |
| 13 | + it('lifts an explicit per-object deny when the wildcard is a modifyAll super-user grant', () => { |
| 14 | + const objects: Record<string, any> = { |
| 15 | + '*': { allowRead: true, allowEdit: true, viewAllRecords: true, modifyAllRecords: true }, |
| 16 | + // As produced when admin_full_access ('*') composes with organization_admin |
| 17 | + // (explicit sys_user deny) — the naive merge leaves allowEdit:false. |
| 18 | + sys_user: { allowRead: true, allowEdit: false, allowCreate: false, allowDelete: false }, |
| 19 | + }; |
| 20 | + foldWildcardSuperUser(objects); |
| 21 | + expect(objects.sys_user).toMatchObject({ allowRead: true, allowEdit: true, allowCreate: true, allowDelete: true }); |
| 22 | + // The wildcard entry itself is untouched. |
| 23 | + expect(objects['*'].modifyAllRecords).toBe(true); |
| 24 | + }); |
| 25 | + |
| 26 | + it('viewAll-only wildcard lifts read but NOT write', () => { |
| 27 | + const objects: Record<string, any> = { |
| 28 | + '*': { allowRead: true, viewAllRecords: true }, |
| 29 | + sys_session: { allowRead: false, allowEdit: false }, |
| 30 | + }; |
| 31 | + foldWildcardSuperUser(objects); |
| 32 | + expect(objects.sys_session.allowRead).toBe(true); |
| 33 | + expect(objects.sys_session.allowEdit).toBe(false); |
| 34 | + }); |
| 35 | + |
| 36 | + it('no-ops when the wildcard is not a super-user grant', () => { |
| 37 | + const objects: Record<string, any> = { |
| 38 | + '*': { allowRead: true, allowEdit: true }, // plain allow, no view/modifyAll |
| 39 | + sys_user: { allowRead: true, allowEdit: false }, |
| 40 | + }; |
| 41 | + foldWildcardSuperUser(objects); |
| 42 | + expect(objects.sys_user.allowEdit).toBe(false); // untouched — no super-user bypass |
| 43 | + }); |
| 44 | + |
| 45 | + it('no-ops when there is no wildcard entry', () => { |
| 46 | + const objects: Record<string, any> = { sys_user: { allowEdit: false } }; |
| 47 | + foldWildcardSuperUser(objects); |
| 48 | + expect(objects.sys_user.allowEdit).toBe(false); |
| 49 | + }); |
| 50 | +}); |
| 51 | + |
| 52 | +/** |
| 53 | + * ADR-0092 D2 — the identity write guard is a second enforcement layer the |
| 54 | + * permission sets don't model. The client hint must reflect permission ∩ guard: |
| 55 | + * managed (`better-auth`) objects are user-context-writable only where the |
| 56 | + * object opened the affordance; others (system/config/…) are untouched. |
| 57 | + */ |
| 58 | +describe('clampManagedObjectWrites', () => { |
| 59 | + const SCHEMAS: Record<string, ManagedSchemaLike> = { |
| 60 | + sys_user: { managedBy: 'better-auth', userActions: { edit: true } }, |
| 61 | + sys_member: { managedBy: 'better-auth' }, |
| 62 | + sys_session: { managedBy: 'better-auth' }, |
| 63 | + sys_automation_run: { managedBy: 'system' }, // NOT better-auth → not guarded |
| 64 | + crm_lead: { managedBy: 'platform' }, |
| 65 | + }; |
| 66 | + const schemaOf = (n: string) => SCHEMAS[n]; |
| 67 | + |
| 68 | + it('keeps write on a managed object that opened the edit affordance (sys_user)', () => { |
| 69 | + const objects: Record<string, any> = { sys_user: { allowRead: true, allowEdit: true, allowCreate: true, allowDelete: true } }; |
| 70 | + clampManagedObjectWrites(objects, schemaOf); |
| 71 | + // edit opted-in stays; create/delete were NOT opted in → clamped off. |
| 72 | + expect(objects.sys_user).toMatchObject({ allowRead: true, allowEdit: true, allowCreate: false, allowDelete: false }); |
| 73 | + }); |
| 74 | + |
| 75 | + it('clamps write to false on managed objects the guard blocks (sys_member, sys_session)', () => { |
| 76 | + const objects: Record<string, any> = { |
| 77 | + sys_member: { allowRead: true, allowEdit: true, allowCreate: true, allowDelete: true }, |
| 78 | + sys_session: { allowRead: true, allowEdit: true }, |
| 79 | + }; |
| 80 | + clampManagedObjectWrites(objects, schemaOf); |
| 81 | + expect(objects.sys_member).toMatchObject({ allowRead: true, allowEdit: false, allowCreate: false, allowDelete: false }); |
| 82 | + expect(objects.sys_session.allowEdit).toBe(false); |
| 83 | + expect(objects.sys_session.allowRead).toBe(true); // read never clamped |
| 84 | + }); |
| 85 | + |
| 86 | + it('leaves non-better-auth managed buckets untouched (system objects have no write guard)', () => { |
| 87 | + const objects: Record<string, any> = { sys_automation_run: { allowEdit: true }, crm_lead: { allowEdit: true } }; |
| 88 | + clampManagedObjectWrites(objects, schemaOf); |
| 89 | + expect(objects.sys_automation_run.allowEdit).toBe(true); |
| 90 | + expect(objects.crm_lead.allowEdit).toBe(true); |
| 91 | + }); |
| 92 | + |
| 93 | + it('fold + clamp compose to permission ∩ guard for a platform admin', () => { |
| 94 | + // As produced for a platform admin (admin_full_access '*' modifyAll) who |
| 95 | + // also holds organization_admin (explicit managed denies). |
| 96 | + const objects: Record<string, any> = { |
| 97 | + '*': { allowRead: true, allowEdit: true, viewAllRecords: true, modifyAllRecords: true }, |
| 98 | + sys_user: { allowRead: true, allowEdit: false, allowCreate: false, allowDelete: false }, |
| 99 | + sys_member: { allowRead: true, allowEdit: false, allowCreate: false, allowDelete: false }, |
| 100 | + }; |
| 101 | + foldWildcardSuperUser(objects); |
| 102 | + clampManagedObjectWrites(objects, schemaOf); |
| 103 | + expect(objects.sys_user.allowEdit).toBe(true); // opened + admin → editable |
| 104 | + expect(objects.sys_member.allowEdit).toBe(false); // guard blocks → not editable |
| 105 | + expect(objects.sys_member.allowRead).toBe(true); // read still granted by super-user |
| 106 | + }); |
| 107 | +}); |
0 commit comments