Danijel Martinek
e50306cbf6
Generator-emitted scaffold (pnpm turbo gen core-package realtime) plus the story-00-precedent coverage repairs (coverage provider devDep, symbols.ts exclude + tested allowlist mirror) and three minimal tests covering generator-emitted realtime code the template suite misses. Squash of 31d85e0 + review-fix cf11b38. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016j8z4VHjedXDTjEDNg7qHK
74 lines
2.4 KiB
TypeScript
74 lines
2.4 KiB
TypeScript
import { describe, it, expect } from "vitest";
|
|
import { z } from "zod";
|
|
import { authorize } from "@/authorize";
|
|
import { defineRealtimeChannel } from "@/realtime-channel";
|
|
|
|
const schema = z.object({}).strict();
|
|
|
|
describe("authorize", () => {
|
|
describe("public", () => {
|
|
const ch = defineRealtimeChannel("a", schema, { scope: "public" });
|
|
it("allows anonymous", async () => {
|
|
expect(await authorize(ch, {}, null)).toBe(true);
|
|
});
|
|
it("allows authenticated", async () => {
|
|
expect(await authorize(ch, {}, { userId: "u1", roles: [] })).toBe(true);
|
|
});
|
|
});
|
|
|
|
describe("authenticated", () => {
|
|
const ch = defineRealtimeChannel("a", schema, { scope: "authenticated" });
|
|
it("rejects anonymous", async () => {
|
|
expect(await authorize(ch, {}, null)).toBe(false);
|
|
});
|
|
it("allows any user", async () => {
|
|
expect(await authorize(ch, {}, { userId: "u1", roles: [] })).toBe(true);
|
|
});
|
|
});
|
|
|
|
describe("{ role }", () => {
|
|
const ch = defineRealtimeChannel("a", schema, { scope: { role: "admin" } });
|
|
it("rejects anonymous", async () => {
|
|
expect(await authorize(ch, {}, null)).toBe(false);
|
|
});
|
|
it("rejects user without role", async () => {
|
|
expect(await authorize(ch, {}, { userId: "u1", roles: ["editor"] })).toBe(
|
|
false,
|
|
);
|
|
});
|
|
it("allows user with role", async () => {
|
|
expect(
|
|
await authorize(ch, {}, { userId: "u1", roles: ["admin", "editor"] }),
|
|
).toBe(true);
|
|
});
|
|
});
|
|
|
|
describe("{ userScoped }", () => {
|
|
const ch = defineRealtimeChannel("a", schema, {
|
|
scope: { userScoped: true, template: "notifications.user.{userId}" },
|
|
});
|
|
it("rejects anonymous", async () => {
|
|
expect(await authorize(ch, { userId: "u1" }, null)).toBe(false);
|
|
});
|
|
it("rejects user requesting someone else's channel", async () => {
|
|
expect(
|
|
await authorize(ch, { userId: "u_other" }, { userId: "u1", roles: [] }),
|
|
).toBe(false);
|
|
});
|
|
it("allows user requesting own channel", async () => {
|
|
expect(
|
|
await authorize(ch, { userId: "u1" }, { userId: "u1", roles: [] }),
|
|
).toBe(true);
|
|
});
|
|
});
|
|
|
|
describe("unknown scope shape", () => {
|
|
const ch = defineRealtimeChannel("a", schema, {
|
|
scope: {} as never,
|
|
});
|
|
it("falls through to deny", async () => {
|
|
expect(await authorize(ch, {}, { userId: "u1", roles: [] })).toBe(false);
|
|
});
|
|
});
|
|
});
|