fix

apps/api/internal/httpapi/company_member_role_test.go

@@ -152,7 +152,7 @@ func TestAllowCompanyAdminOrPlatform(t *testing.T) {
 		}
 	})
 
-	t.Run("dev_impersonator_retains_admin", func(t *testing.T) {
+	t.Run("impersonated_member_denied", func(t *testing.T) {
 		t.Parallel()
 		actor := uuid.MustParse("bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb")
 		sm := scs.New()
@@ -185,28 +185,16 @@ func TestAllowCompanyAdminOrPlatform(t *testing.T) {
 		LoadSession(sm)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			ctx := context.WithValue(r.Context(), ctxUserID, uid)
 			ctx = context.WithValue(ctx, ctxRole, "member")
-			req := r.WithContext(ctx)
-			if !s.allowCompanyAdminOrPlatform(w, req) {
-				t.Fatal("impersonating privileged actor must retain company-admin powers")
+			if s.allowCompanyAdminOrPlatform(w, r.WithContext(ctx)) {
+				t.Fatal("impersonated member must not retain company-admin powers")
 			}
-			w.WriteHeader(http.StatusNoContent)
 		})).ServeHTTP(rec, func() *http.Request {
 			req := httptest.NewRequest(http.MethodGet, "/", nil)
 			req.AddCookie(&http.Cookie{Name: sm.Cookie.Name, Value: token})
 			return req
 		}())
-		if rec.Code != http.StatusNoContent {
-			t.Fatalf("status=%d body=%s", rec.Code, rec.Body.String())
-		}
-	})
-
-	t.Run("dev_impersonator_helper_empty_session", func(t *testing.T) {
-		t.Parallel()
-		s := &Server{Config: config.Config{AppEnv: "development"}}
-		req := httptest.NewRequest(http.MethodGet, "/", nil)
-		req = req.WithContext(context.WithValue(req.Context(), ctxUserID, uid))
-		if s.devImpersonatorRetainsCompanyAdmin(req) {
-			t.Fatal("nil Sessions must not retain admin")
+		if rec.Code != http.StatusForbidden {
+			t.Fatalf("status=%d body=%s, want 403", rec.Code, rec.Body.String())
 		}
 	})
 }