Initial commit of Descrybe v2 without local scratch artifacts.

Drop one-shot tmp/axe scripts and agent i18n scratch so the Gitea tree is deployable.
2026-08-09 22:47:43 +02:00
commit 8580c996c3
1285 changed files with 325780 additions and 0 deletions
@@ -0,0 +1,81 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { isFullPlatformAdmin, shouldUnlockAllFeatures } from "./staff-access.ts";
+
+describe("isFullPlatformAdmin", () => {
+	it("allows staff_access.full_admin", () => {
+		assert.equal(isFullPlatformAdmin({ staff_access: { full_admin: true } }), true);
+	});
+
+	it("denies support_staff even when legacy is_platform_admin is set", () => {
+		assert.equal(
+			isFullPlatformAdmin({
+				staff_access: { full_admin: false, support_desk: true, is_support_only: true },
+				user: { is_platform_admin: true }
+			}),
+			false
+		);
+	});
+
+	it("denies when staff_access is present without full_admin", () => {
+		assert.equal(isFullPlatformAdmin({ staff_access: {} }), false);
+	});
+
+	it("legacy: allows is_platform_admin when staff_access is absent", () => {
+		assert.equal(isFullPlatformAdmin({ user: { is_platform_admin: true } }), true);
+	});
+
+	it("legacy: denies when neither staff_access nor is_platform_admin", () => {
+		assert.equal(isFullPlatformAdmin({ user: { is_platform_admin: false } }), false);
+		assert.equal(isFullPlatformAdmin({}), false);
+		assert.equal(isFullPlatformAdmin(null), false);
+	});
+
+	it("treats null staff_access as legacy path", () => {
+		assert.equal(
+			isFullPlatformAdmin({ staff_access: null, user: { is_platform_admin: true } }),
+			true
+		);
+	});
+});
+
+describe("shouldUnlockAllFeatures", () => {
+	it("unlocks Demo / full admin", () => {
+		assert.equal(
+			shouldUnlockAllFeatures({
+				staff_access: { full_admin: true, support_desk: true },
+				user: { is_platform_admin: true }
+			}),
+			true
+		);
+	});
+
+	it("does not unlock normal A1 tenant (no staff)", () => {
+		assert.equal(
+			shouldUnlockAllFeatures({
+				user: { is_platform_admin: false }
+			}),
+			false
+		);
+	});
+
+	it("does not unlock via legacy is_platform_admin when staff_access denies full_admin", () => {
+		assert.equal(
+			shouldUnlockAllFeatures({
+				staff_access: { full_admin: false },
+				user: { is_platform_admin: true }
+			}),
+			false
+		);
+	});
+
+	it("does not unlock on || style leak (staff_access full_admin false)", () => {
+		// Regression: Boolean(full_admin || is_platform_admin) would be true here.
+		const me = {
+			staff_access: { full_admin: false, support_desk: true },
+			user: { is_platform_admin: true }
+		};
+		assert.equal(Boolean(me.staff_access?.full_admin || me.user?.is_platform_admin), true);
+		assert.equal(shouldUnlockAllFeatures(me), false);
+	});
+});