|
| 1 | +/** |
| 2 | + * Portal access matrix tests. |
| 3 | + * |
| 4 | + * Verifies which role combinations grant portal access, matching the |
| 5 | + * logic in apps/portal/src/utils/portal-access.ts. Tests the pure |
| 6 | + * built-in role resolution — custom roles require DB and are tested |
| 7 | + * separately in integration tests. |
| 8 | + */ |
| 9 | + |
| 10 | +jest.mock('better-auth', () => ({ betterAuth: jest.fn() })); |
| 11 | +jest.mock('better-auth/adapters/prisma', () => ({ prismaAdapter: jest.fn() })); |
| 12 | +jest.mock('better-auth/plugins', () => ({ |
| 13 | + bearer: jest.fn(), |
| 14 | + emailOTP: jest.fn(), |
| 15 | + jwt: jest.fn(), |
| 16 | + magicLink: jest.fn(), |
| 17 | + multiSession: jest.fn(), |
| 18 | + organization: jest.fn(), |
| 19 | +})); |
| 20 | +jest.mock('better-auth/plugins/access', () => ({ |
| 21 | + createAccessControl: (stmt: Record<string, readonly string[]>) => ({ |
| 22 | + newRole: (statements: Record<string, readonly string[]>) => ({ |
| 23 | + statements, |
| 24 | + }), |
| 25 | + }), |
| 26 | +})); |
| 27 | +jest.mock('better-auth/plugins/organization/access', () => ({ |
| 28 | + defaultStatements: { |
| 29 | + organization: ['update', 'delete'], |
| 30 | + member: ['create', 'update', 'delete'], |
| 31 | + invitation: ['create', 'delete'], |
| 32 | + team: ['create', 'update', 'delete'], |
| 33 | + }, |
| 34 | + ownerAc: { |
| 35 | + statements: { |
| 36 | + organization: ['update', 'delete'], |
| 37 | + member: ['create', 'update', 'delete'], |
| 38 | + invitation: ['create', 'delete'], |
| 39 | + team: ['create', 'update', 'delete'], |
| 40 | + }, |
| 41 | + }, |
| 42 | + adminAc: { |
| 43 | + statements: { |
| 44 | + organization: ['update'], |
| 45 | + member: ['create', 'update', 'delete'], |
| 46 | + invitation: ['create', 'delete'], |
| 47 | + team: ['create', 'update', 'delete'], |
| 48 | + }, |
| 49 | + }, |
| 50 | +})); |
| 51 | + |
| 52 | +import { |
| 53 | + BUILT_IN_ROLE_PERMISSIONS, |
| 54 | + BUILT_IN_ROLE_OBLIGATIONS, |
| 55 | +} from '@trycompai/auth'; |
| 56 | + |
| 57 | +function hasPortalAccessForBuiltInRoles(roleString: string): boolean { |
| 58 | + const roles = roleString |
| 59 | + .split(',') |
| 60 | + .map((r) => r.trim()) |
| 61 | + .filter(Boolean); |
| 62 | + const permissions: Record<string, string[]> = {}; |
| 63 | + let hasComplianceObligation = false; |
| 64 | + |
| 65 | + for (const role of roles) { |
| 66 | + const builtInPerms = BUILT_IN_ROLE_PERMISSIONS[role]; |
| 67 | + if (builtInPerms) { |
| 68 | + for (const [resource, actions] of Object.entries(builtInPerms)) { |
| 69 | + if (!permissions[resource]) { |
| 70 | + permissions[resource] = [...actions]; |
| 71 | + } else { |
| 72 | + for (const action of actions) { |
| 73 | + if (!permissions[resource].includes(action)) { |
| 74 | + permissions[resource].push(action); |
| 75 | + } |
| 76 | + } |
| 77 | + } |
| 78 | + } |
| 79 | + if (BUILT_IN_ROLE_OBLIGATIONS[role]?.compliance) { |
| 80 | + hasComplianceObligation = true; |
| 81 | + } |
| 82 | + } |
| 83 | + } |
| 84 | + |
| 85 | + if (permissions.portal?.length) return true; |
| 86 | + if (hasComplianceObligation) return true; |
| 87 | + return false; |
| 88 | +} |
| 89 | + |
| 90 | +describe('Portal access matrix', () => { |
| 91 | + describe('roles that SHOULD have portal access', () => { |
| 92 | + it.each([ |
| 93 | + ['employee'], |
| 94 | + ['contractor'], |
| 95 | + ['owner'], |
| 96 | + ['admin,employee'], |
| 97 | + ['owner,employee'], |
| 98 | + ['employee,contractor'], |
| 99 | + ])('%s → ALLOW', (roleString) => { |
| 100 | + expect(hasPortalAccessForBuiltInRoles(roleString)).toBe(true); |
| 101 | + }); |
| 102 | + }); |
| 103 | + |
| 104 | + describe('roles that should NOT have portal access', () => { |
| 105 | + it.each([ |
| 106 | + ['admin'], |
| 107 | + ['auditor'], |
| 108 | + ['member'], |
| 109 | + ['admin,member'], |
| 110 | + ['admin,auditor'], |
| 111 | + [''], |
| 112 | + ])('%s → DENY', (roleString) => { |
| 113 | + expect(hasPortalAccessForBuiltInRoles(roleString)).toBe(false); |
| 114 | + }); |
| 115 | + }); |
| 116 | + |
| 117 | + describe('portal access relies on RBAC, not role names', () => { |
| 118 | + it('admin gets portal access only through the employee role', () => { |
| 119 | + expect(BUILT_IN_ROLE_PERMISSIONS.admin?.portal).toBeUndefined(); |
| 120 | + expect(BUILT_IN_ROLE_PERMISSIONS.employee?.portal).toEqual( |
| 121 | + expect.arrayContaining(['read', 'update']), |
| 122 | + ); |
| 123 | + }); |
| 124 | + |
| 125 | + it('admin does not have compliance obligation', () => { |
| 126 | + expect(BUILT_IN_ROLE_OBLIGATIONS.admin?.compliance).toBeFalsy(); |
| 127 | + }); |
| 128 | + |
| 129 | + it('owner has portal access through its own permissions', () => { |
| 130 | + expect(BUILT_IN_ROLE_PERMISSIONS.owner?.portal).toEqual( |
| 131 | + expect.arrayContaining(['read', 'update']), |
| 132 | + ); |
| 133 | + }); |
| 134 | + |
| 135 | + it('unrecognized roles are silently skipped, not denied', () => { |
| 136 | + expect(hasPortalAccessForBuiltInRoles('employee,unknown_role')).toBe( |
| 137 | + true, |
| 138 | + ); |
| 139 | + }); |
| 140 | + }); |
| 141 | +}); |
0 commit comments