s.esmaeiliandClaude Opus 5.5
d91dcf197b
- PERS-03: «تاریخ تولد» (Jalali DateInput) on the wholesale and retail forms, as legacy. The server accepts birth_date or birth_day, refuses impossible or future dates, clears on '', and returns both names. - SEC-07: setRoles stores only rids in ALL_RIDS or their tree parents. Anything else is dropped with a warning log, so a tick on a legacy-only tree leaf never fails the save. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
32 lines
1.1 KiB
TypeScript
32 lines
1.1 KiB
TypeScript
import { AdminUsersService } from './admin-users.service';
|
|
|
|
/** SEC-07: a role's saved permissions are limited to rids the server knows. */
|
|
describe('AdminUsersService.setRoles', () => {
|
|
let createMany: jest.Mock;
|
|
let service: AdminUsersService;
|
|
|
|
beforeEach(() => {
|
|
createMany = jest.fn();
|
|
const prisma = {
|
|
userType: { findUnique: jest.fn(async () => ({ id: 90, permissions: [] })) },
|
|
permission: { deleteMany: jest.fn(), createMany },
|
|
$transaction: jest.fn(async () => []),
|
|
};
|
|
service = new AdminUsersService(prisma as never, {} as never, {} as never);
|
|
});
|
|
|
|
it('keeps catalogue rids and their tree parents, drops anything else', async () => {
|
|
await service.setRoles(90, [
|
|
'order.list',
|
|
'order', // tree parent of order.list
|
|
'persons', // tree parent of persons.*
|
|
'notify.create.single.customer', // legacy tree leaf no route checks
|
|
'made.up.permission',
|
|
'order.list', // duplicate
|
|
'',
|
|
]);
|
|
const rows = createMany.mock.calls[0][0].data.map((d: { rid: string }) => d.rid);
|
|
expect(rows.sort()).toEqual(['order', 'order.list', 'persons']);
|
|
});
|
|
});
|