greeneclipse
8580c996c3
Drop one-shot tmp/axe scripts and agent i18n scratch so the Gitea tree is deployable.
84 lines
2.8 KiB
Go
84 lines
2.8 KiB
Go
package auth
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestResolveStaffAccess(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
cases := []struct {
|
|
name string
|
|
admin bool
|
|
role string
|
|
wantRole string
|
|
wantFull bool
|
|
wantDesk bool
|
|
wantOnly bool
|
|
}{
|
|
{name: "legacy_platform_admin", admin: true, role: "", wantRole: StaffRoleAdmin, wantFull: true, wantDesk: true},
|
|
{name: "plain_user", admin: false, role: "", wantFull: false, wantDesk: false},
|
|
{name: "support_staff", admin: false, role: StaffRoleSupportStaff, wantRole: StaffRoleSupportStaff, wantFull: false, wantDesk: true, wantOnly: true},
|
|
{name: "support_staff_with_admin_flag", admin: true, role: StaffRoleSupportStaff, wantRole: StaffRoleSupportStaff, wantFull: false, wantDesk: true, wantOnly: true},
|
|
{name: "admin_role", admin: true, role: StaffRoleAdmin, wantRole: StaffRoleAdmin, wantFull: true, wantDesk: true},
|
|
{name: "developer_role", admin: false, role: StaffRoleDeveloper, wantRole: StaffRoleDeveloper, wantFull: true, wantDesk: true},
|
|
{name: "unknown_role_ignored", admin: false, role: "superuser", wantFull: false, wantDesk: false},
|
|
}
|
|
for _, tc := range cases {
|
|
tc := tc
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
t.Parallel()
|
|
got := ResolveStaffAccess(tc.admin, tc.role)
|
|
if got.Role != tc.wantRole {
|
|
t.Fatalf("role = %q, want %q", got.Role, tc.wantRole)
|
|
}
|
|
if got.FullAdmin != tc.wantFull || got.SupportDesk != tc.wantDesk || got.IsSupportOnly != tc.wantOnly {
|
|
t.Fatalf("got full=%v desk=%v only=%v want full=%v desk=%v only=%v",
|
|
got.FullAdmin, got.SupportDesk, got.IsSupportOnly, tc.wantFull, tc.wantDesk, tc.wantOnly)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestStaffCapabilities(t *testing.T) {
|
|
t.Parallel()
|
|
adminCaps := StaffCapabilities(StaffRoleAdmin)
|
|
if len(adminCaps) < 10 {
|
|
t.Fatalf("admin caps too small: %v", adminCaps)
|
|
}
|
|
supportCaps := StaffCapabilities(StaffRoleSupportStaff)
|
|
if len(supportCaps) != 4 {
|
|
t.Fatalf("support caps = %v", supportCaps)
|
|
}
|
|
for _, c := range supportCaps {
|
|
if strings.Contains(c, "billing") || strings.Contains(c, "settings") {
|
|
t.Fatalf("support must not get %s", c)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestStaffRoleAllowsAdminRouteContract(t *testing.T) {
|
|
t.Parallel()
|
|
if !StaffRoleAllowsAdminRoute(StaffRoleSupportStaff, "/admin/support") {
|
|
t.Fatal("support_staff should access /admin/support")
|
|
}
|
|
if StaffRoleAllowsAdminRoute(StaffRoleSupportStaff, "/admin/billing") {
|
|
t.Fatal("support_staff must not access billing")
|
|
}
|
|
if !StaffRoleAllowsAdminRoute(StaffRoleDeveloper, "/admin/settings") {
|
|
t.Fatal("developer should access settings")
|
|
}
|
|
}
|
|
|
|
func TestNormalizeStaffRole(t *testing.T) {
|
|
t.Parallel()
|
|
if _, err := NormalizeStaffRole("nope"); err == nil {
|
|
t.Fatal("expected error for invalid role")
|
|
}
|
|
got, err := NormalizeStaffRole(" Support_Staff ")
|
|
if err != nil || got != StaffRoleSupportStaff {
|
|
t.Fatalf("got %q err=%v", got, err)
|
|
}
|
|
}
|