31 lines
1.3 KiB
TypeScript
31 lines
1.3 KiB
TypeScript
import { describe, expect, it } from 'vitest';
|
|
import { canReadPlayAudit, canReadPlayAuditAccounts } from '../src/auth/playAudit.js';
|
|
|
|
describe('play audit capability scope', () => {
|
|
it.each([
|
|
'superuser',
|
|
'admin.superuser',
|
|
'admin.playAudit.read',
|
|
'admin.playAudit.read:*',
|
|
'admin.playAudit.read:che:default',
|
|
])('accepts explicit capability %s', (role) => expect(canReadPlayAudit([role], 'che:default')).toBe(true));
|
|
it.each([
|
|
'admin',
|
|
'user',
|
|
'admin.audit.read',
|
|
'admin.profiles.runtime:che:default',
|
|
'admin.playAudit.read:che',
|
|
'admin.playAudit.read:hwe:default',
|
|
'admin.playAudit.accounts',
|
|
])('rejects unrelated role %s', (role) => expect(canReadPlayAudit([role], 'che:default')).toBe(false));
|
|
it('requires both scoped game audit and global account audit', () => {
|
|
expect(canReadPlayAuditAccounts(['admin.playAudit.read:che:default'], 'che:default')).toBe(false);
|
|
expect(
|
|
canReadPlayAuditAccounts(['admin.playAudit.read:che:default', 'admin.playAudit.accounts'], 'che:default')
|
|
).toBe(true);
|
|
expect(
|
|
canReadPlayAuditAccounts(['admin.playAudit.read:che:default', 'admin.playAudit.accounts'], 'hwe:default')
|
|
).toBe(false);
|
|
});
|
|
});
|