64 lines
2.3 KiB
TypeScript
64 lines
2.3 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import type { User } from "../drizzle/schema";
|
|
import type { TrpcContext } from "./_core/context";
|
|
import { protectedProcedure, router, superAdminProcedure } from "./_core/trpc";
|
|
|
|
const testRouter = router({
|
|
read: protectedProcedure.query(() => "read-ok"),
|
|
write: protectedProcedure.mutation(() => "write-ok"),
|
|
manageUsers: superAdminProcedure.query(() => "users-ok"),
|
|
});
|
|
|
|
function user(role: User["role"], mustChangePassword = 0): User {
|
|
const now = new Date();
|
|
return {
|
|
id: 1,
|
|
username: `${role}-account`,
|
|
passwordHash: "unused",
|
|
name: role,
|
|
email: null,
|
|
role,
|
|
isActive: 1,
|
|
mustChangePassword,
|
|
sessionVersion: 0,
|
|
createdAt: now,
|
|
updatedAt: now,
|
|
lastLoginAt: null,
|
|
};
|
|
}
|
|
|
|
function context(currentUser: User | null): TrpcContext {
|
|
return { user: currentUser, req: {} as TrpcContext["req"], res: {} as TrpcContext["res"] };
|
|
}
|
|
|
|
describe("三角色权限矩阵", () => {
|
|
it("未登录不能读取", async () => {
|
|
await expect(testRouter.createCaller(context(null)).read()).rejects.toMatchObject({ code: "UNAUTHORIZED" });
|
|
});
|
|
|
|
it("首次改密前不能读取业务数据", async () => {
|
|
await expect(testRouter.createCaller(context(user("super_admin", 1))).read()).rejects.toMatchObject({ code: "FORBIDDEN" });
|
|
});
|
|
|
|
it("普通用户可读但不可写，也不可管理用户", async () => {
|
|
const caller = testRouter.createCaller(context(user("user")));
|
|
await expect(caller.read()).resolves.toBe("read-ok");
|
|
await expect(caller.write()).rejects.toMatchObject({ code: "FORBIDDEN" });
|
|
await expect(caller.manageUsers()).rejects.toMatchObject({ code: "FORBIDDEN" });
|
|
});
|
|
|
|
it("管理员可读写但不可管理用户", async () => {
|
|
const caller = testRouter.createCaller(context(user("admin")));
|
|
await expect(caller.read()).resolves.toBe("read-ok");
|
|
await expect(caller.write()).resolves.toBe("write-ok");
|
|
await expect(caller.manageUsers()).rejects.toMatchObject({ code: "FORBIDDEN" });
|
|
});
|
|
|
|
it("超级管理员拥有全部权限", async () => {
|
|
const caller = testRouter.createCaller(context(user("super_admin")));
|
|
await expect(caller.read()).resolves.toBe("read-ok");
|
|
await expect(caller.write()).resolves.toBe("write-ok");
|
|
await expect(caller.manageUsers()).resolves.toBe("users-ok");
|
|
});
|
|
});
|