32 lines
1.1 KiB
TypeScript
32 lines
1.1 KiB
TypeScript
|
import { AdminUsersService } from './admin-users.service';
|
||
|
|
|
||
|
|
/** SEC-07: a role's saved permissions are limited to rids the server knows. */
|
||
|
|
describe('AdminUsersService.setRoles', () => {
|
||
|
|
let createMany: jest.Mock;
|
||
|
|
let service: AdminUsersService;
|
||
|
|
|
||
|
|
beforeEach(() => {
|
||
|
|
createMany = jest.fn();
|
||
|
|
const prisma = {
|
||
|
|
userType: { findUnique: jest.fn(async () => ({ id: 90, permissions: [] })) },
|
||
|
|
permission: { deleteMany: jest.fn(), createMany },
|
||
|
|
$transaction: jest.fn(async () => []),
|
||
|
|
};
|
||
|
|
service = new AdminUsersService(prisma as never, {} as never, {} as never);
|
||
|
|
});
|
||
|
|
|
||
|
|
it('keeps catalogue rids and their tree parents, drops anything else', async () => {
|
||
|
|
await service.setRoles(90, [
|
||
|
|
'order.list',
|
||
|
|
'order', // tree parent of order.list
|
||
|
|
'persons', // tree parent of persons.*
|
||
|
|
'notify.create.single.customer', // legacy tree leaf no route checks
|
||
|
|
'made.up.permission',
|
||
|
|
'order.list', // duplicate
|
||
|
|
'',
|
||
|
|
]);
|
||
|
|
const rows = createMany.mock.calls[0][0].data.map((d: { rid: string }) => d.rid);
|
||
|
|
expect(rows.sort()).toEqual(['order', 'order.list', 'persons']);
|
||
|
|
});
|
||
|
|
});
|