Initial commit of Descrybe v2 without local scratch artifacts.

Drop one-shot tmp/axe scripts and agent i18n scratch so the Gitea tree is deployable.
2026-08-09 22:47:43 +02:00
commit 8580c996c3
1285 changed files with 325780 additions and 0 deletions
@@ -0,0 +1,83 @@
+package auth
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestResolveStaffAccess(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		name     string
+		admin    bool
+		role     string
+		wantRole string
+		wantFull bool
+		wantDesk bool
+		wantOnly bool
+	}{
+		{name: "legacy_platform_admin", admin: true, role: "", wantRole: StaffRoleAdmin, wantFull: true, wantDesk: true},
+		{name: "plain_user", admin: false, role: "", wantFull: false, wantDesk: false},
+		{name: "support_staff", admin: false, role: StaffRoleSupportStaff, wantRole: StaffRoleSupportStaff, wantFull: false, wantDesk: true, wantOnly: true},
+		{name: "support_staff_with_admin_flag", admin: true, role: StaffRoleSupportStaff, wantRole: StaffRoleSupportStaff, wantFull: false, wantDesk: true, wantOnly: true},
+		{name: "admin_role", admin: true, role: StaffRoleAdmin, wantRole: StaffRoleAdmin, wantFull: true, wantDesk: true},
+		{name: "developer_role", admin: false, role: StaffRoleDeveloper, wantRole: StaffRoleDeveloper, wantFull: true, wantDesk: true},
+		{name: "unknown_role_ignored", admin: false, role: "superuser", wantFull: false, wantDesk: false},
+	}
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			got := ResolveStaffAccess(tc.admin, tc.role)
+			if got.Role != tc.wantRole {
+				t.Fatalf("role = %q, want %q", got.Role, tc.wantRole)
+			}
+			if got.FullAdmin != tc.wantFull || got.SupportDesk != tc.wantDesk || got.IsSupportOnly != tc.wantOnly {
+				t.Fatalf("got full=%v desk=%v only=%v want full=%v desk=%v only=%v",
+					got.FullAdmin, got.SupportDesk, got.IsSupportOnly, tc.wantFull, tc.wantDesk, tc.wantOnly)
+			}
+		})
+	}
+}
+
+func TestStaffCapabilities(t *testing.T) {
+	t.Parallel()
+	adminCaps := StaffCapabilities(StaffRoleAdmin)
+	if len(adminCaps) < 10 {
+		t.Fatalf("admin caps too small: %v", adminCaps)
+	}
+	supportCaps := StaffCapabilities(StaffRoleSupportStaff)
+	if len(supportCaps) != 4 {
+		t.Fatalf("support caps = %v", supportCaps)
+	}
+	for _, c := range supportCaps {
+		if strings.Contains(c, "billing") || strings.Contains(c, "settings") {
+			t.Fatalf("support must not get %s", c)
+		}
+	}
+}
+
+func TestStaffRoleAllowsAdminRouteContract(t *testing.T) {
+	t.Parallel()
+	if !StaffRoleAllowsAdminRoute(StaffRoleSupportStaff, "/admin/support") {
+		t.Fatal("support_staff should access /admin/support")
+	}
+	if StaffRoleAllowsAdminRoute(StaffRoleSupportStaff, "/admin/billing") {
+		t.Fatal("support_staff must not access billing")
+	}
+	if !StaffRoleAllowsAdminRoute(StaffRoleDeveloper, "/admin/settings") {
+		t.Fatal("developer should access settings")
+	}
+}
+
+func TestNormalizeStaffRole(t *testing.T) {
+	t.Parallel()
+	if _, err := NormalizeStaffRole("nope"); err == nil {
+		t.Fatal("expected error for invalid role")
+	}
+	got, err := NormalizeStaffRole(" Support_Staff ")
+	if err != nil || got != StaffRoleSupportStaff {
+		t.Fatalf("got %q err=%v", got, err)
+	}
+}