@uipath/data-fabric-tool 1.198.0 → 1.199.0-preview.104

package/tests/access-management.e2e.test.ts

@@ -0,0 +1,347 @@
+import { beforeAll, describe, expect, it } from "vitest";
+import {
+    type E2EManifest,
+    MANIFEST_PATH,
+} from "../../../tests/e2e-shared/global-setup";
+import {
+    EXEC_TIMEOUT,
+    extractJson,
+    localCli,
+    localCliRawWithArgs,
+    readManifest,
+    SETUP_TIMEOUT,
+} from "../../../tests/e2e-shared/helpers";
+
+const manifest = readManifest<E2EManifest>(MANIFEST_PATH);
+const { tempDir } = manifest.sharedInstall;
+
+// Owning e2e suite for scenarios/data-fabric-tool/access-management.md.
+//
+// Every S<n> in that scenario file maps one-to-one to an it()/it.skip() here
+// (see scenarios/README.md — "Scenario ↔ e2e mapping"). Guard scenarios
+// (S4, S7, S8, S10) fail before connectOrFail and run against the shared
+// install without tenant permissions. Read-only live scenarios (S1, S2, S3)
+// use a beforeAll probe + ctx.skip() when the token lacks DF manage-access.
+// Mutating scenarios (S5, S6, S9) stay as it.skip — the CLI can't provision
+// a scratch principal (identity-side, no OAuth from a test), and mutating a
+// real user's role set isn't safe.
+
+const PRINCIPAL_ID = "00000000-0000-0000-0000-000000000001";
+
+interface FailureOutput {
+    Result: string;
+    Message: string;
+    Instructions?: string;
+}
+
+// noExplicitAny is off for test files; e2e parses dynamic CLI JSON.
+// biome-ignore lint/suspicious/noExplicitAny: dynamic CLI JSON
+type Json = any;
+
+const AUTH_MARKERS = [
+    "forbidden",
+    "403",
+    "401",
+    "unauthorized",
+    "not logged in",
+    "auth_token",
+    "authentication",
+    "insufficient_scope",
+];
+
+function tryParse(stdout: string): Json {
+    try {
+        return extractJson(stdout) as Json;
+    } catch {
+        return {};
+    }
+}
+
+function isAuthDenial(res: { stdout: string; exitCode: number }): boolean {
+    if (res.exitCode === 0) return false;
+    const parsed = tryParse(res.stdout);
+    const hay =
+        `${parsed.Message ?? ""} ${parsed.Instructions ?? ""}`.toLowerCase();
+    return AUTH_MARKERS.some((m) => hay.includes(m));
+}
+
+let dfAccessDenied = false;
+
+describe("df access management scenario", () => {
+    beforeAll(() => {
+        const probe = localCliRawWithArgs(tempDir, [
+            "df",
+            "roles",
+            "list",
+            "--output",
+            "json",
+        ]);
+        if (probe.exitCode !== 0) {
+            dfAccessDenied = isAuthDenial(probe);
+            if (!dfAccessDenied) {
+                console.warn(
+                    `[df access-management e2e] Probe failed for a non-auth reason; live scenarios will run and assert.\n${probe.stdout}`,
+                );
+            }
+        }
+    }, SETUP_TIMEOUT);
+
+    // ── S1 ──────────────────────────────────────────────────────────────────
+    it(
+        "S1: list access roles with statistics",
+        (ctx) => {
+            if (dfAccessDenied) return ctx.skip();
+            const { stdout, exitCode } = localCliRawWithArgs(tempDir, [
+                "df",
+                "roles",
+                "list",
+                "--output",
+                "json",
+            ]);
+            expect(exitCode).toBe(0);
+            const out = extractJson(stdout) as Json;
+            expect(out.Result).toBe("Success");
+            expect(out.Code).toBe("RoleList");
+            expect(Array.isArray(out.Data)).toBe(true);
+            for (const role of out.Data as Json[]) {
+                expect(role).toHaveProperty("Id");
+                expect(role).toHaveProperty("Name");
+                expect(role).toHaveProperty("Type");
+                // Stats-on response carries the count.
+                expect(role).toHaveProperty("DirectoryEntityCount");
+            }
+        },
+        EXEC_TIMEOUT,
+    );
+
+    // ── S2 ──────────────────────────────────────────────────────────────────
+    it(
+        "S2: list access roles without statistics",
+        (ctx) => {
+            if (dfAccessDenied) return ctx.skip();
+            const { stdout, exitCode } = localCliRawWithArgs(tempDir, [
+                "df",
+                "roles",
+                "list",
+                "--no-stats",
+                "--output",
+                "json",
+            ]);
+            expect(exitCode).toBe(0);
+            const out = extractJson(stdout) as Json;
+            expect(out.Result).toBe("Success");
+            expect(out.Code).toBe("RoleList");
+            expect(Array.isArray(out.Data)).toBe(true);
+            for (const role of out.Data as Json[]) {
+                expect(role.DirectoryEntityCount).toBeUndefined();
+            }
+        },
+        EXEC_TIMEOUT,
+    );
+
+    // ── S3 ──────────────────────────────────────────────────────────────────
+    it(
+        "S3: list directory principals with their roles",
+        (ctx) => {
+            if (dfAccessDenied) return ctx.skip();
+            const { stdout, exitCode } = localCliRawWithArgs(tempDir, [
+                "df",
+                "directory",
+                "list",
+                "--limit",
+                "50",
+                "--offset",
+                "0",
+                "--output",
+                "json",
+            ]);
+            expect(exitCode).toBe(0);
+            const out = extractJson(stdout) as Json;
+            expect(out.Result).toBe("Success");
+            expect(out.Code).toBe("DirectoryList");
+            expect(typeof out.Data.TotalCount).toBe("number");
+            expect(Array.isArray(out.Data.Results)).toBe(true);
+            for (const p of out.Data.Results as Json[]) {
+                expect(p).toHaveProperty("ExternalId");
+                expect(p).toHaveProperty("Name");
+                expect(p).toHaveProperty("Type");
+                expect(Array.isArray(p.Roles)).toBe(true);
+                expect(typeof p.IsUIEnabled).toBe("boolean");
+            }
+        },
+        EXEC_TIMEOUT,
+    );
+
+    // ── S4 ──────────────────────────────────────────────────────────────────
+    it(
+        "S4: invalid paging values fail before any network call",
+        () => {
+            const rows: Array<{
+                limit: string;
+                offset: string;
+                message: string;
+            }> = [
+                {
+                    limit: "0",
+                    offset: "0",
+                    message: "Invalid --limit value '0'",
+                },
+                {
+                    limit: "abc",
+                    offset: "0",
+                    message: "Invalid --limit value 'abc'",
+                },
+                {
+                    limit: "50",
+                    offset: "-5",
+                    message: "Invalid --offset value '-5'",
+                },
+            ];
+            for (const { limit, offset, message } of rows) {
+                const { stdout, exitCode } = localCliRawWithArgs(tempDir, [
+                    "df",
+                    "directory",
+                    "list",
+                    "--limit",
+                    limit,
+                    `--offset=${offset}`,
+                    "--output",
+                    "json",
+                ]);
+                expect(exitCode, `--limit ${limit} --offset ${offset}`).toBe(1);
+                const result = extractJson(stdout) as FailureOutput;
+                expect(result.Result).toBe("Failure");
+                expect(result.Message).toBe(message);
+            }
+        },
+        EXEC_TIMEOUT,
+    );
+
+    // ── S5 ──────────────────────────────────────────────────────────────────
+    it.skip("S5: assign a role to a principal preserving existing roles", () => {});
+
+    // ── S6 ──────────────────────────────────────────────────────────────────
+    it.skip("S6: replace a principal's role set", () => {});
+
+    // ── S7 ──────────────────────────────────────────────────────────────────
+    it(
+        "S7: assign with invalid input fails before any network call",
+        () => {
+            const rows: Array<{ type: string; ids: string; message: string }> =
+                [
+                    {
+                        type: "Robot",
+                        ids: "r-1",
+                        message: "Invalid --type value 'Robot'",
+                    },
+                    {
+                        type: "User",
+                        ids: " , ",
+                        message: "No role IDs provided",
+                    },
+                ];
+            for (const { type, ids, message } of rows) {
+                const { stdout, exitCode } = localCliRawWithArgs(tempDir, [
+                    "df",
+                    "directory",
+                    "assign-roles",
+                    PRINCIPAL_ID,
+                    "--type",
+                    type,
+                    "--role-ids",
+                    ids,
+                    "--output",
+                    "json",
+                ]);
+                expect(exitCode, `--type ${type}`).toBe(1);
+                const result = extractJson(stdout) as FailureOutput;
+                expect(result.Result).toBe("Failure");
+                expect(result.Message).toBe(message);
+            }
+        },
+        EXEC_TIMEOUT,
+    );
+
+    // ── S8 ──────────────────────────────────────────────────────────────────
+    it(
+        "S8: revoke requires confirmation and a reason",
+        () => {
+            // --reason without --yes → confirmation required
+            const withoutYes = localCliRawWithArgs(tempDir, [
+                "df",
+                "directory",
+                "revoke-roles",
+                PRINCIPAL_ID,
+                "--reason",
+                "x",
+                "--output",
+                "json",
+            ]);
+            expect(withoutYes.exitCode).toBe(1);
+            const withoutYesResult = extractJson(
+                withoutYes.stdout,
+            ) as FailureOutput;
+            expect(withoutYesResult.Result).toBe("Failure");
+            expect(withoutYesResult.Message).toContain("Confirmation required");
+
+            // --yes without --reason → reason required
+            const withoutReason = localCliRawWithArgs(tempDir, [
+                "df",
+                "directory",
+                "revoke-roles",
+                PRINCIPAL_ID,
+                "--yes",
+                "--output",
+                "json",
+            ]);
+            expect(withoutReason.exitCode).toBe(1);
+            const withoutReasonResult = extractJson(
+                withoutReason.stdout,
+            ) as FailureOutput;
+            expect(withoutReasonResult.Result).toBe("Failure");
+            expect(withoutReasonResult.Message).toBe(
+                "Reason required for destructive operation",
+            );
+        },
+        EXEC_TIMEOUT,
+    );
+
+    // ── S9 ──────────────────────────────────────────────────────────────────
+    it.skip("S9: revoke all direct roles from a principal", () => {});
+
+    // ── S10 ─────────────────────────────────────────────────────────────────
+    it(
+        "S10: roles and directory groups are hidden from help",
+        () => {
+            const help = localCli(tempDir, "df --help");
+            // Command rows render as "│ <name>   <description>…" in the boxed
+            // help, so anchoring on "│ <name>" matches only the command column
+            // (continuation lines have extra spaces after the border).
+            // Documented command groups are listed…
+            expect(help).toMatch(/^│ entities\s/m);
+            expect(help).toMatch(/^│ records\s/m);
+            expect(help).toMatch(/^│ files\s/m);
+            expect(help).toMatch(/^│ choice-sets\s/m);
+            // …the internal manage-access groups are not.
+            expect(help).not.toMatch(/^│ roles\s/m);
+            expect(help).not.toMatch(/^│ directory\s/m);
+
+            // Hidden groups still execute when invoked directly: an invalid
+            // flag reaches the command's own validation, proving the command
+            // is registered and runs (full happy paths are S1/S3).
+            const { stdout, exitCode } = localCliRawWithArgs(tempDir, [
+                "df",
+                "directory",
+                "list",
+                "--limit",
+                "0",
+                "--output",
+                "json",
+            ]);
+            expect(exitCode).toBe(1);
+            const result = extractJson(stdout) as FailureOutput;
+            expect(result.Message).toBe("Invalid --limit value '0'");
+        },
+        EXEC_TIMEOUT,
+    );
+});