|
| 1 | +/** |
| 2 | + * ObjectUI |
| 3 | + * Copyright (c) 2024-present ObjectStack Inc. |
| 4 | + * |
| 5 | + * This source code is licensed under the MIT license found in the |
| 6 | + * LICENSE file in the root directory of this source tree. |
| 7 | + */ |
| 8 | + |
| 9 | +/** |
| 10 | + * `page:header` — ADR-0066 D4 `requiredPermissions` gate (framework#3923). |
| 11 | + * |
| 12 | + * `record_header` / `record_more` actions render through THIS component, which |
| 13 | + * filters its own action list rather than calling |
| 14 | + * `ActionEngine.getActionsForLocation`. So the engine's capability gate never |
| 15 | + * ran on the one surface those locations exist on: an action declaring a |
| 16 | + * capability nobody holds rendered as a live button, and the only thing behind |
| 17 | + * it was the server's 403 — which covers platform action routes only, never a |
| 18 | + * `type: 'api'` action pointed at a custom endpoint. |
| 19 | + * |
| 20 | + * The gate reads the ActionProvider's runner user (the same object the engine |
| 21 | + * reads), falls back to the ambient predicate scope, and fails OPEN when |
| 22 | + * neither knows — unknown is not denied. |
| 23 | + */ |
| 24 | + |
| 25 | +import { describe, it, expect } from 'vitest'; |
| 26 | +import { render, screen } from '@testing-library/react'; |
| 27 | +import { ComponentRegistry } from '@object-ui/core'; |
| 28 | +import { ActionProvider, PredicateScopeProvider } from '@object-ui/react'; |
| 29 | + |
| 30 | +function PageHeader({ schema }: { schema: any }) { |
| 31 | + const Component = ComponentRegistry.get('page:header'); |
| 32 | + if (!Component) throw new Error('page:header not registered'); |
| 33 | + // eslint-disable-next-line react-hooks/static-components -- registry component is stable |
| 34 | + return <Component schema={schema} />; |
| 35 | +} |
| 36 | + |
| 37 | +const schema = { |
| 38 | + type: 'page:header', |
| 39 | + title: 'Invoice', |
| 40 | + actions: [ |
| 41 | + { name: 'gated', label: 'Set Parallel Reviewers', type: 'api', requiredPermissions: ['ehr_probe_capability'] }, |
| 42 | + { name: 'plain', label: 'Print', type: 'api' }, |
| 43 | + ], |
| 44 | +}; |
| 45 | + |
| 46 | +const renderWithUser = (user: unknown, scope?: Record<string, any>) => { |
| 47 | + const tree = <ActionProvider context={{ user } as any}><PageHeader schema={schema} /></ActionProvider>; |
| 48 | + return render(scope ? <PredicateScopeProvider scope={scope}>{tree}</PredicateScopeProvider> : tree); |
| 49 | +}; |
| 50 | + |
| 51 | +const gatedShown = () => !!screen.queryByRole('button', { name: /Set Parallel Reviewers/i }); |
| 52 | + |
| 53 | +describe('page:header — ADR-0066 D4 capability gate (#3923)', () => { |
| 54 | + it('hides an action whose requiredPermissions the caller lacks', () => { |
| 55 | + renderWithUser({ id: 'u1', systemPermissions: ['setup.access'] }); |
| 56 | + expect(gatedShown()).toBe(false); |
| 57 | + // The ungated action is untouched — this filters, it does not blank the bar. |
| 58 | + expect(screen.getByRole('button', { name: /Print/i })).toBeTruthy(); |
| 59 | + }); |
| 60 | + |
| 61 | + it('shows the action when every declared capability is held', () => { |
| 62 | + renderWithUser({ id: 'u1', systemPermissions: ['ehr_probe_capability', 'setup.access'] }); |
| 63 | + expect(gatedShown()).toBe(true); |
| 64 | + }); |
| 65 | + |
| 66 | + it('requires ALL declared capabilities (AND, not OR)', () => { |
| 67 | + render( |
| 68 | + <ActionProvider context={{ user: { id: 'u1', systemPermissions: ['a'] } } as any}> |
| 69 | + <PageHeader |
| 70 | + schema={{ |
| 71 | + type: 'page:header', |
| 72 | + title: 'Invoice', |
| 73 | + actions: [{ name: 'both', label: 'Needs Both', type: 'api', requiredPermissions: ['a', 'b'] }], |
| 74 | + }} |
| 75 | + /> |
| 76 | + </ActionProvider>, |
| 77 | + ); |
| 78 | + expect(screen.queryByRole('button', { name: /Needs Both/i })).toBeNull(); |
| 79 | + }); |
| 80 | + |
| 81 | + it('gates on an EMPTY held set — "holds nothing" is known, not unknown', () => { |
| 82 | + renderWithUser({ id: 'u1', systemPermissions: [] }); |
| 83 | + expect(gatedShown()).toBe(false); |
| 84 | + }); |
| 85 | + |
| 86 | + it('fails OPEN when the host never resolved capabilities', () => { |
| 87 | + renderWithUser({ id: 'u1' }); |
| 88 | + expect(gatedShown()).toBe(true); |
| 89 | + }); |
| 90 | + |
| 91 | + it('falls back to the ambient predicate scope when there is no runner user', () => { |
| 92 | + renderWithUser(undefined, { user: { id: 'u1', systemPermissions: ['setup.access'] } }); |
| 93 | + expect(gatedShown()).toBe(false); |
| 94 | + }); |
| 95 | +}); |
0 commit comments