@latte-macchiat-io/latte-payload 1.0.1

package/tests/unit/access/admins.spec.ts

@@ -0,0 +1,68 @@
+import { describe, expect, it } from 'vitest';
+import { admins, adminsFieldLevel } from '@/access/admins';
+
+describe('admins access control', () => {
+  describe('admins', () => {
+    it('should return true for users with admin role', () => {
+      const req = { user: { roles: ['admin'] } } as any;
+      expect(admins({ req })).toBe(true);
+    });
+
+    it('should return false for users without admin role', () => {
+      const req = { user: { roles: ['user'] } } as any;
+      expect(admins({ req })).toBe(false);
+    });
+
+    it('should return false for users with empty roles array', () => {
+      const req = { user: { roles: [] } } as any;
+      expect(admins({ req })).toBe(false);
+    });
+
+    it('should return false for unauthenticated users (null user)', () => {
+      const req = { user: null } as any;
+      expect(admins({ req })).toBe(false);
+    });
+
+    it('should return false for unauthenticated users (undefined user)', () => {
+      const req = { user: undefined } as any;
+      expect(admins({ req })).toBe(false);
+    });
+
+    it('should handle users with multiple roles including admin', () => {
+      const req = { user: { roles: ['user', 'admin', 'editor'] } } as any;
+      expect(admins({ req })).toBe(true);
+    });
+
+    it('should return false when user has no roles property', () => {
+      const req = { user: {} } as any;
+      expect(admins({ req })).toBe(false);
+    });
+
+    it('should return false when roles is null', () => {
+      const req = { user: { roles: null } } as any;
+      expect(admins({ req })).toBe(false);
+    });
+  });
+
+  describe('adminsFieldLevel', () => {
+    it('should return true for users with admin role', () => {
+      const params = { req: { user: { roles: ['admin'] } } } as any;
+      expect(adminsFieldLevel(params)).toBe(true);
+    });
+
+    it('should return false for users without admin role', () => {
+      const params = { req: { user: { roles: ['user'] } } } as any;
+      expect(adminsFieldLevel(params)).toBe(false);
+    });
+
+    it('should return false for unauthenticated users', () => {
+      const params = { req: { user: null } } as any;
+      expect(adminsFieldLevel(params)).toBe(false);
+    });
+
+    it('should handle users with multiple roles including admin', () => {
+      const params = { req: { user: { roles: ['user', 'admin'] } } } as any;
+      expect(adminsFieldLevel(params)).toBe(true);
+    });
+  });
+});

package/tests/unit/access/anyone.spec.ts

@@ -0,0 +1,28 @@
+import { describe, expect, it } from 'vitest';
+import { anyone } from '@/access/anyone';
+
+describe('anyone access control', () => {
+  it('should return true for authenticated users', () => {
+    const req = { user: { id: 1 } } as any;
+    expect(anyone({ req })).toBe(true);
+  });
+
+  it('should return true for unauthenticated users (null)', () => {
+    const req = { user: null } as any;
+    expect(anyone({ req })).toBe(true);
+  });
+
+  it('should return true for unauthenticated users (undefined)', () => {
+    const req = { user: undefined } as any;
+    expect(anyone({ req })).toBe(true);
+  });
+
+  it('should return true with no arguments', () => {
+    expect(anyone({} as any)).toBe(true);
+  });
+
+  it('should return true for admin users', () => {
+    const req = { user: { roles: ['admin'] } } as any;
+    expect(anyone({ req })).toBe(true);
+  });
+});

package/tests/unit/access/authenticated.spec.ts

@@ -0,0 +1,53 @@
+import { describe, expect, it } from 'vitest';
+import { authenticated, authenticatedFieldLevel } from '@/access/authenticated';
+
+describe('authenticated access control', () => {
+  describe('authenticated', () => {
+    it('should return true for authenticated users', () => {
+      const req = { user: { id: 1, email: 'test@example.com' } } as any;
+      expect(authenticated({ req })).toBe(true);
+    });
+
+    it('should return false for null user', () => {
+      const req = { user: null } as any;
+      expect(authenticated({ req })).toBe(false);
+    });
+
+    it('should return false for undefined user', () => {
+      const req = { user: undefined } as any;
+      expect(authenticated({ req })).toBe(false);
+    });
+
+    it('should return true for user with minimal properties', () => {
+      const req = { user: {} } as any;
+      expect(authenticated({ req })).toBe(true);
+    });
+
+    it('should return true for user with roles', () => {
+      const req = { user: { roles: ['admin'] } } as any;
+      expect(authenticated({ req })).toBe(true);
+    });
+  });
+
+  describe('authenticatedFieldLevel', () => {
+    it('should return true for authenticated users', () => {
+      const params = { req: { user: { id: 1 } } } as any;
+      expect(authenticatedFieldLevel(params)).toBe(true);
+    });
+
+    it('should return false for null user', () => {
+      const params = { req: { user: null } } as any;
+      expect(authenticatedFieldLevel(params)).toBe(false);
+    });
+
+    it('should return false for undefined user', () => {
+      const params = { req: { user: undefined } } as any;
+      expect(authenticatedFieldLevel(params)).toBe(false);
+    });
+
+    it('should return true for user object (even empty)', () => {
+      const params = { req: { user: {} } } as any;
+      expect(authenticatedFieldLevel(params)).toBe(true);
+    });
+  });
+});

package/tests/unit/access/authenticatedAccessOnly.spec.ts

@@ -0,0 +1,112 @@
+import { describe, expect, it } from 'vitest';
+import { authenticatedAccessOnly } from '@/access/authenticatedAccessOnly';
+
+describe('authenticatedAccessOnly access control', () => {
+  describe('admin property', () => {
+    it('should return true for authenticated users', () => {
+      const req = { user: { id: 1 } } as any;
+      expect(authenticatedAccessOnly.admin({ req })).toBe(true);
+    });
+
+    it('should return false for unauthenticated users (null)', () => {
+      const req = { user: null } as any;
+      expect(authenticatedAccessOnly.admin({ req })).toBe(false);
+    });
+
+    it('should return false for unauthenticated users (undefined)', () => {
+      const req = { user: undefined } as any;
+      expect(authenticatedAccessOnly.admin({ req })).toBe(false);
+    });
+
+    it('should return true for empty user object', () => {
+      const req = { user: {} } as any;
+      expect(authenticatedAccessOnly.admin({ req })).toBe(true);
+    });
+  });
+
+  describe('create property', () => {
+    it('should return true for authenticated users', () => {
+      const req = { user: { id: 1 } } as any;
+      expect(authenticatedAccessOnly.create({ req })).toBe(true);
+    });
+
+    it('should return false for unauthenticated users', () => {
+      const req = { user: null } as any;
+      expect(authenticatedAccessOnly.create({ req })).toBe(false);
+    });
+  });
+
+  describe('read property', () => {
+    it('should return true for authenticated users', () => {
+      const req = { user: { id: 1 } } as any;
+      expect(authenticatedAccessOnly.read({ req })).toBe(true);
+    });
+
+    it('should return false for unauthenticated users', () => {
+      const req = { user: null } as any;
+      expect(authenticatedAccessOnly.read({ req })).toBe(false);
+    });
+  });
+
+  describe('update property', () => {
+    it('should return true for authenticated users', () => {
+      const req = { user: { id: 1 } } as any;
+      expect(authenticatedAccessOnly.update({ req })).toBe(true);
+    });
+
+    it('should return false for unauthenticated users', () => {
+      const req = { user: null } as any;
+      expect(authenticatedAccessOnly.update({ req })).toBe(false);
+    });
+  });
+
+  describe('delete property', () => {
+    it('should return true for authenticated users', () => {
+      const req = { user: { id: 1 } } as any;
+      expect(authenticatedAccessOnly.delete({ req })).toBe(true);
+    });
+
+    it('should return false for unauthenticated users', () => {
+      const req = { user: null } as any;
+      expect(authenticatedAccessOnly.delete({ req })).toBe(false);
+    });
+  });
+
+  describe('readVersions property', () => {
+    it('should return true for authenticated users', () => {
+      const req = { user: { id: 1 } } as any;
+      expect(authenticatedAccessOnly.readVersions({ req })).toBe(true);
+    });
+
+    it('should return false for unauthenticated users', () => {
+      const req = { user: null } as any;
+      expect(authenticatedAccessOnly.readVersions({ req })).toBe(false);
+    });
+  });
+
+  describe('unlock property', () => {
+    it('should return true for authenticated users', () => {
+      const req = { user: { id: 1 } } as any;
+      expect(authenticatedAccessOnly.unlock({ req })).toBe(true);
+    });
+
+    it('should return false for unauthenticated users', () => {
+      const req = { user: null } as any;
+      expect(authenticatedAccessOnly.unlock({ req })).toBe(false);
+    });
+  });
+
+  describe('all properties work consistently', () => {
+    it('should allow all operations for authenticated users', () => {
+      const req = { user: { roles: ['user'] } } as any;
+
+      expect(authenticatedAccessOnly.admin({ req })).toBe(true);
+      expect(authenticatedAccessOnly.create({ req })).toBe(true);
+      expect(authenticatedAccessOnly.read({ req })).toBe(true);
+      expect(authenticatedAccessOnly.update({ req })).toBe(true);
+      expect(authenticatedAccessOnly.delete({ req })).toBe(true);
+      expect(authenticatedAccessOnly.readVersions({ req })).toBe(true);
+      expect(authenticatedAccessOnly.unlock({ req })).toBe(true);
+    });
+  });
+});

package/tests/unit/access/publicReadAuthenticatedAccess.spec.ts

@@ -0,0 +1,112 @@
+import { describe, expect, it } from 'vitest';
+import { publicReadAuthenticatedAccess } from '@/access/publicReadAuthenticatedAccess';
+
+describe('publicReadAuthenticatedAccess access control', () => {
+  describe('admin property', () => {
+    it('should return true for authenticated users', () => {
+      const req = { user: { id: 1 } } as any;
+      expect(publicReadAuthenticatedAccess.admin({ req })).toBe(true);
+    });
+
+    it('should return false for unauthenticated users', () => {
+      const req = { user: null } as any;
+      expect(publicReadAuthenticatedAccess.admin({ req })).toBe(false);
+    });
+  });
+
+  describe('read property (public access)', () => {
+    it('should return true for authenticated users', () => {
+      const req = { user: { id: 1 } } as any;
+      expect(publicReadAuthenticatedAccess.read({ req })).toBe(true);
+    });
+
+    it('should return true for unauthenticated users (public read)', () => {
+      const req = { user: null } as any;
+      expect(publicReadAuthenticatedAccess.read({ req })).toBe(true);
+    });
+
+    it('should return true with no user property', () => {
+      const req = {} as any;
+      expect(publicReadAuthenticatedAccess.read({ req })).toBe(true);
+    });
+  });
+
+  describe('create property (authenticated only)', () => {
+    it('should return true for authenticated users', () => {
+      const req = { user: { id: 1 } } as any;
+      expect(publicReadAuthenticatedAccess.create({ req })).toBe(true);
+    });
+
+    it('should return false for unauthenticated users', () => {
+      const req = { user: null } as any;
+      expect(publicReadAuthenticatedAccess.create({ req })).toBe(false);
+    });
+  });
+
+  describe('update property (authenticated only)', () => {
+    it('should return true for authenticated users', () => {
+      const req = { user: { id: 1 } } as any;
+      expect(publicReadAuthenticatedAccess.update({ req })).toBe(true);
+    });
+
+    it('should return false for unauthenticated users', () => {
+      const req = { user: null } as any;
+      expect(publicReadAuthenticatedAccess.update({ req })).toBe(false);
+    });
+  });
+
+  describe('delete property (authenticated only)', () => {
+    it('should return true for authenticated users', () => {
+      const req = { user: { id: 1 } } as any;
+      expect(publicReadAuthenticatedAccess.delete({ req })).toBe(true);
+    });
+
+    it('should return false for unauthenticated users', () => {
+      const req = { user: null } as any;
+      expect(publicReadAuthenticatedAccess.delete({ req })).toBe(false);
+    });
+  });
+
+  describe('readVersions property (authenticated only)', () => {
+    it('should return true for authenticated users', () => {
+      const req = { user: { id: 1 } } as any;
+      expect(publicReadAuthenticatedAccess.readVersions({ req })).toBe(true);
+    });
+
+    it('should return false for unauthenticated users', () => {
+      const req = { user: null } as any;
+      expect(publicReadAuthenticatedAccess.readVersions({ req })).toBe(false);
+    });
+  });
+
+  describe('unlock property (authenticated only)', () => {
+    it('should return true for authenticated users', () => {
+      const req = { user: { id: 1 } } as any;
+      expect(publicReadAuthenticatedAccess.unlock({ req })).toBe(true);
+    });
+
+    it('should return false for unauthenticated users', () => {
+      const req = { user: null } as any;
+      expect(publicReadAuthenticatedAccess.unlock({ req })).toBe(false);
+    });
+  });
+
+  describe('access pattern verification', () => {
+    it('should allow read to everyone and other operations to authenticated users only', () => {
+      const authenticatedReq = { user: { id: 1 } } as any;
+      const unauthenticatedReq = { user: null } as any;
+
+      // Authenticated user can do everything
+      expect(publicReadAuthenticatedAccess.read({ req: authenticatedReq })).toBe(true);
+      expect(publicReadAuthenticatedAccess.create({ req: authenticatedReq })).toBe(true);
+      expect(publicReadAuthenticatedAccess.update({ req: authenticatedReq })).toBe(true);
+      expect(publicReadAuthenticatedAccess.delete({ req: authenticatedReq })).toBe(true);
+
+      // Unauthenticated user can only read
+      expect(publicReadAuthenticatedAccess.read({ req: unauthenticatedReq })).toBe(true);
+      expect(publicReadAuthenticatedAccess.create({ req: unauthenticatedReq })).toBe(false);
+      expect(publicReadAuthenticatedAccess.update({ req: unauthenticatedReq })).toBe(false);
+      expect(publicReadAuthenticatedAccess.delete({ req: unauthenticatedReq })).toBe(false);
+    });
+  });
+});