@ftisindia/create-app 0.1.2 → 0.1.4

package/template/test/role-permission-policy.spec.ts

@@ -0,0 +1,94 @@
+import { ForbiddenException } from '@nestjs/common';
+import {
+  assertPermissionChangeWithinActor,
+  assertRoleWithinActorPermissions,
+} from '../src/modules/access-control/application/role-permission-policy';
+
+describe('assertRoleWithinActorPermissions', () => {
+  it('allows owners to assign any role', () => {
+    expect(() =>
+      assertRoleWithinActorPermissions({
+        actorIsOwner: true,
+        actorPermissionKeys: [],
+        rolePermissionKeys: ['billing.manage', 'roles.manage'],
+      }),
+    ).not.toThrow();
+  });
+
+  it('allows a role whose permissions are a subset of the actor', () => {
+    expect(() =>
+      assertRoleWithinActorPermissions({
+        actorIsOwner: false,
+        actorPermissionKeys: ['users.read', 'users.update', 'roles.manage'],
+        rolePermissionKeys: ['users.read', 'users.update'],
+      }),
+    ).not.toThrow();
+  });
+
+  it('rejects a role carrying a permission the actor does not hold', () => {
+    expect(() =>
+      assertRoleWithinActorPermissions({
+        actorIsOwner: false,
+        actorPermissionKeys: ['users.read'],
+        rolePermissionKeys: ['users.read', 'billing.manage'],
+      }),
+    ).toThrow(/billing\.manage/u);
+  });
+});
+
+describe('assertPermissionChangeWithinActor', () => {
+  it('allows owners to make any change', () => {
+    expect(() =>
+      assertPermissionChangeWithinActor({
+        actorIsOwner: true,
+        actorPermissionKeys: [],
+        previousPermissionKeys: ['users.read'],
+        nextPermissionKeys: ['users.read', 'billing.manage'],
+      }),
+    ).not.toThrow();
+  });
+
+  it('allows adding and removing permissions the actor holds', () => {
+    expect(() =>
+      assertPermissionChangeWithinActor({
+        actorIsOwner: false,
+        actorPermissionKeys: ['users.read', 'users.update'],
+        previousPermissionKeys: ['users.read'],
+        nextPermissionKeys: ['users.update'],
+      }),
+    ).not.toThrow();
+  });
+
+  it('rejects adding a permission the actor does not hold', () => {
+    expect(() =>
+      assertPermissionChangeWithinActor({
+        actorIsOwner: false,
+        actorPermissionKeys: ['users.read'],
+        previousPermissionKeys: ['users.read'],
+        nextPermissionKeys: ['users.read', 'billing.manage'],
+      }),
+    ).toThrow(/billing\.manage/u);
+  });
+
+  it('rejects revoking a permission the actor does not hold', () => {
+    expect(() =>
+      assertPermissionChangeWithinActor({
+        actorIsOwner: false,
+        actorPermissionKeys: ['users.read'],
+        previousPermissionKeys: ['users.read', 'billing.manage'],
+        nextPermissionKeys: ['users.read'],
+      }),
+    ).toThrow(ForbiddenException);
+  });
+
+  it('allows an unchanged set even when it contains permissions the actor lacks', () => {
+    expect(() =>
+      assertPermissionChangeWithinActor({
+        actorIsOwner: false,
+        actorPermissionKeys: [],
+        previousPermissionKeys: ['billing.manage'],
+        nextPermissionKeys: ['billing.manage'],
+      }),
+    ).not.toThrow();
+  });
+});