forked from baron/baron-sso
77 lines
2.1 KiB
TypeScript
77 lines
2.1 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import {
|
|
canManageTenantScopedUsers,
|
|
canManageUserInTenantScope,
|
|
isSuperAdminRole,
|
|
normalizeAdminRole,
|
|
ROLE_SUPER_ADMIN,
|
|
ROLE_USER,
|
|
} from "./roles";
|
|
|
|
describe("admin role helpers", () => {
|
|
it.each([
|
|
["super_admin", ROLE_SUPER_ADMIN],
|
|
["superadmin", ROLE_SUPER_ADMIN],
|
|
["super-admin", ROLE_SUPER_ADMIN],
|
|
[" SUPER-ADMIN ", ROLE_SUPER_ADMIN],
|
|
["tenant_admin", ROLE_USER],
|
|
["tenantadmin", ROLE_USER],
|
|
["tenant-admin", ROLE_USER],
|
|
["admin", ROLE_USER],
|
|
["rp_admin", ROLE_USER],
|
|
["rpadmin", ROLE_USER],
|
|
["rp-admin", ROLE_USER],
|
|
["tenant_member", ROLE_USER],
|
|
["member", ROLE_USER],
|
|
["custom", ROLE_USER],
|
|
["", ROLE_USER],
|
|
])("normalizes %s to %s", (input, expected) => {
|
|
expect(normalizeAdminRole(input)).toBe(expected);
|
|
});
|
|
|
|
it("detects super admin aliases", () => {
|
|
expect(isSuperAdminRole("super-admin")).toBe(true);
|
|
expect(isSuperAdminRole("admin")).toBe(false);
|
|
expect(isSuperAdminRole(undefined)).toBe(false);
|
|
});
|
|
|
|
it("allows delegated tenant admins with manageable tenants to manage scoped users", () => {
|
|
const profile = {
|
|
id: "admin-user",
|
|
role: "user",
|
|
manageableTenants: [{ id: "tenant-1", slug: "tenant-a" }],
|
|
};
|
|
|
|
expect(canManageTenantScopedUsers(profile)).toBe(true);
|
|
expect(
|
|
canManageUserInTenantScope({
|
|
profile,
|
|
user: { id: "user-1", tenantSlug: "tenant-a" },
|
|
}),
|
|
).toBe(true);
|
|
expect(
|
|
canManageUserInTenantScope({
|
|
profile,
|
|
user: { id: "user-2", tenantSlug: "tenant-b" },
|
|
}),
|
|
).toBe(false);
|
|
});
|
|
|
|
it("does not treat ordinary tenant membership as delegated user management", () => {
|
|
const profile = {
|
|
id: "member-user",
|
|
role: "user",
|
|
tenantSlug: "tenant-a",
|
|
manageableTenants: [],
|
|
};
|
|
|
|
expect(canManageTenantScopedUsers(profile)).toBe(false);
|
|
expect(
|
|
canManageUserInTenantScope({
|
|
profile,
|
|
user: { id: "user-1", tenantSlug: "tenant-a" },
|
|
}),
|
|
).toBe(false);
|
|
});
|
|
});
|