45 lines
1.5 KiB
TypeScript
45 lines
1.5 KiB
TypeScript
import assert from 'node:assert/strict';
|
|
import test from 'node:test';
|
|
import { ForbiddenException } from '@nestjs/common';
|
|
import type { AuthPrincipal, AuthTransport } from '../../src/common/http/request-context';
|
|
import { assertMobileInspector } from '../../src/inspection-operations/mobile-inspector-policy';
|
|
|
|
function principal(transport: AuthTransport, roles: string[]): AuthPrincipal {
|
|
return {
|
|
userId: 'b6f6b10e-434a-4d72-9ec9-3520212dd290',
|
|
username: 'inspector',
|
|
sessionId: '1bab61ac-65d1-40e6-816b-63d90131a795',
|
|
firstName: 'Inspector',
|
|
lastName: 'DH',
|
|
email: null,
|
|
mustChangePassword: false,
|
|
roles,
|
|
permissions: [],
|
|
transport,
|
|
};
|
|
}
|
|
|
|
function forbiddenCode(error: unknown): string | undefined {
|
|
return error instanceof ForbiddenException
|
|
? (error.getResponse() as { code?: string }).code
|
|
: undefined;
|
|
}
|
|
|
|
test('operational inspection writes reject web cookie sessions', () => {
|
|
assert.throws(
|
|
() => assertMobileInspector(principal('cookie', ['inspector'])),
|
|
(error: unknown) => forbiddenCode(error) === 'INSPECTION_MOBILE_APP_REQUIRED',
|
|
);
|
|
});
|
|
|
|
test('operational inspection writes reject non-inspector bearer users', () => {
|
|
assert.throws(
|
|
() => assertMobileInspector(principal('bearer', ['admin'])),
|
|
(error: unknown) => forbiddenCode(error) === 'INSPECTION_INSPECTOR_ROLE_REQUIRED',
|
|
);
|
|
});
|
|
|
|
test('operational inspection writes accept inspector bearer users', () => {
|
|
assert.doesNotThrow(() => assertMobileInspector(principal('bearer', ['inspector'])));
|
|
});
|