fix

2026-08-14 00:06:43 +02:00
parent 841a05572e
commit a9395585f8
22 changed files with 326 additions and 22 deletions
@@ -150,6 +150,105 @@ func TestRequireSessionRejectsStaleSessionVersion(t *testing.T) {
 	}
 }

+func TestRequireCompanyAllowsFullStaffWithoutMembership(t *testing.T) {
+	t.Parallel()
+	sm := scs.New()
+	uid := uuid.New()
+	cid := uuid.New()
+	s := &Server{
+		Sessions: sm,
+		Config:   config.Config{},
+		Auth:     &auth.Service{},
+		testStaffAccess: func(ctx context.Context, userID uuid.UUID) (auth.StaffAccess, error) {
+			if userID != uid {
+				t.Fatalf("unexpected user %s", userID)
+			}
+			return auth.ResolveStaffAccess(true, auth.StaffRoleAdmin), nil
+		},
+	}
+
+	var capturedToken string
+	seed := LoadSession(sm)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		sm.Put(r.Context(), auth.SessionUserIDKey, uid.String())
+		sm.Put(r.Context(), auth.SessionCompanyIDKey, cid.String())
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	seedRec := httptest.NewRecorder()
+	seed.ServeHTTP(seedRec, httptest.NewRequest(http.MethodGet, "/seed", nil))
+	for _, c := range seedRec.Result().Cookies() {
+		if c.Name == sm.Cookie.Name {
+			capturedToken = c.Value
+		}
+	}
+	if capturedToken == "" {
+		t.Fatal("expected session cookie")
+	}
+
+	var gotCompany uuid.UUID
+	var gotRole string
+	h := LoadSession(sm)(s.RequireSession(s.RequireCompany(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotCompany, _ = CompanyIDFromContext(r.Context())
+		gotRole, _ = RoleFromContext(r.Context())
+		w.WriteHeader(http.StatusNoContent)
+	}))))
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/api/company", nil)
+	req.AddCookie(&http.Cookie{Name: sm.Cookie.Name, Value: capturedToken})
+	h.ServeHTTP(rec, req)
+	if rec.Code != http.StatusNoContent {
+		t.Fatalf("status = %d, want 204 staff override", rec.Code)
+	}
+	if gotCompany != cid {
+		t.Fatalf("company = %s, want %s", gotCompany, cid)
+	}
+	if gotRole != "admin" {
+		t.Fatalf("role = %q, want admin", gotRole)
+	}
+}
+
+func TestRequireCompanyDeniesDeveloperStaffWithoutMembership(t *testing.T) {
+	t.Parallel()
+	sm := scs.New()
+	uid := uuid.New()
+	cid := uuid.New()
+	s := &Server{
+		Sessions: sm,
+		Config:   config.Config{},
+		Auth:     &auth.Service{},
+		testStaffAccess: func(ctx context.Context, userID uuid.UUID) (auth.StaffAccess, error) {
+			return auth.ResolveStaffAccess(true, auth.StaffRoleDeveloper), nil
+		},
+	}
+
+	var capturedToken string
+	seed := LoadSession(sm)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		sm.Put(r.Context(), auth.SessionUserIDKey, uid.String())
+		sm.Put(r.Context(), auth.SessionCompanyIDKey, cid.String())
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	seedRec := httptest.NewRecorder()
+	seed.ServeHTTP(seedRec, httptest.NewRequest(http.MethodGet, "/seed", nil))
+	for _, c := range seedRec.Result().Cookies() {
+		if c.Name == sm.Cookie.Name {
+			capturedToken = c.Value
+		}
+	}
+	if capturedToken == "" {
+		t.Fatal("expected session cookie")
+	}
+
+	h := LoadSession(sm)(s.RequireSession(s.RequireCompany(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	}))))
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/api/company", nil)
+	req.AddCookie(&http.Cookie{Name: sm.Cookie.Name, Value: capturedToken})
+	h.ServeHTTP(rec, req)
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want 403 for developer without membership", rec.Code)
+	}
+}
+
 func TestRequireCompanyRequiresSelection(t *testing.T) {
 	t.Parallel()
 	sm := scs.New()