auth

Main authentication module for my projects
git clone git://git.finwo.net/app/auth
Log | Files | Refs

policy.test.js (4026B)

      1 import test from 'node:test';
      2 import assert from 'node:assert/strict';
      3 import { canManageUser, canUseClient, isRealmAdmin, isSystemAdmin } from '../src/lib/policy.js';
      4 
      5 const realm = { id: 'realm-a' };
      6 const user = { id: 'u1', status: 'active', home_realm_id: 'realm-a' };
      7 const guest = { id: 'u2', status: 'active', home_realm_id: 'realm-b' };
      8 const activeMembership = { status: 'active' };
      9 const suspendedMembership = { status: 'suspended' };
     10 
     11 function client(access_mode, required_roles = []) {
     12   return { access_mode, enabled: 1, required_roles };
     13 }
     14 
     15 test('internal clients accept only home-realm users', () => {
     16   const c = client('internal');
     17   assert.equal(canUseClient({ user, membership: activeMembership, roles: [], client: c, realm }), true);
     18   assert.equal(canUseClient({ user: guest, membership: activeMembership, roles: [], client: c, realm }), false);
     19 });
     20 
     21 test('members clients accept home and guest members', () => {
     22   const c = client('members');
     23   assert.equal(canUseClient({ user, membership: activeMembership, roles: [], client: c, realm }), true);
     24   assert.equal(canUseClient({ user: guest, membership: activeMembership, roles: [], client: c, realm }), true);
     25   assert.equal(canUseClient({ user: guest, membership: suspendedMembership, roles: [], client: c, realm }), false);
     26 });
     27 
     28 test('public clients accept non-members and ignore role requirements', () => {
     29   const c = client('public', ['realm-admin']);
     30   assert.equal(canUseClient({ user: guest, membership: null, roles: [], client: c, realm }), true);
     31 });
     32 
     33 test('required roles are any-of', () => {
     34   const c = client('members', ['realm-admin', 'auditor']);
     35   assert.equal(
     36     canUseClient({ user: guest, membership: activeMembership, roles: ['auditor'], client: c, realm }),
     37     true
     38   );
     39   assert.equal(
     40     canUseClient({ user: guest, membership: activeMembership, roles: ['member'], client: c, realm }),
     41     false
     42   );
     43 });
     44 
     45 test('disabled users and clients are denied', () => {
     46   const disabledUser = { ...user, status: 'disabled' };
     47   assert.equal(
     48     canUseClient({ user: disabledUser, membership: activeMembership, roles: [], client: client('public'), realm }),
     49     false
     50   );
     51   assert.equal(
     52     canUseClient({
     53       user,
     54       membership: activeMembership,
     55       roles: [],
     56       client: { ...client('members'), enabled: 0 },
     57       realm,
     58     }),
     59     false
     60   );
     61 });
     62 
     63 test('virtual admin clients accept system admins and realm admins', () => {
     64   const adminClient = { ...client('admin'), virtual: true, client_id: 'admin' };
     65   const systemAdmin = { ...guest, is_system_admin: 1 };
     66 
     67   assert.equal(
     68     canUseClient({ user: systemAdmin, membership: null, roles: [], client: adminClient, realm }),
     69     true
     70   );
     71   assert.equal(
     72     canUseClient({
     73       user: guest,
     74       membership: activeMembership,
     75       roles: ['realm-admin'],
     76       client: adminClient,
     77       realm,
     78     }),
     79     true
     80   );
     81   assert.equal(
     82     canUseClient({
     83       user: guest,
     84       membership: activeMembership,
     85       roles: [],
     86       client: adminClient,
     87       realm,
     88     }),
     89     false
     90   );
     91 });
     92 
     93 test('virtual account clients accept every active user', () => {
     94   const accountClient = { ...client('public'), virtual: true, client_id: 'account' };
     95   assert.equal(
     96     canUseClient({ user: guest, membership: null, roles: [], client: accountClient, realm }),
     97     true
     98   );
     99   assert.equal(isSystemAdmin({ is_system_admin: 1 }), true);
    100   assert.equal(isSystemAdmin({ is_system_admin: 0 }), false);
    101 });
    102 
    103 test('realm admins manage home users fully and guests by membership only', () => {
    104   assert.equal(isRealmAdmin(['realm-admin']), true);
    105   assert.equal(
    106     canManageUser({ actorRoles: ['realm-admin'], actorIsSystemAdmin: false, target: user, realmId: 'realm-a' }),
    107     'full'
    108   );
    109   assert.equal(
    110     canManageUser({ actorRoles: ['realm-admin'], actorIsSystemAdmin: false, target: guest, realmId: 'realm-a' }),
    111     'membership'
    112   );
    113   assert.equal(
    114     canManageUser({ actorRoles: [], actorIsSystemAdmin: false, target: guest, realmId: 'realm-a' }),
    115     null
    116   );
    117 });