canopycms 0.0.0

package/src/__integration__/permissions/path-permissions.test.ts

@@ -0,0 +1,314 @@
+/**
+ * Integration tests for path-based permissions.
+ * Tests glob pattern matching, first-match-wins rule, and permission levels.
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+
+import { createTestWorkspace, type TestWorkspace } from '../test-utils/test-workspace'
+import { createTestUser } from '../test-utils/multi-user'
+import { BLOG_SCHEMA } from '../fixtures/schemas'
+import { BranchWorkspaceManager } from '../../branch-workspace'
+import {
+  checkBranchAccessWithDefault,
+  loadPathPermissions,
+  savePathPermissions,
+  createCheckPathAccess,
+} from '../../authorization'
+import { unsafeAsPermissionPath } from '../../authorization/test-utils'
+import { unsafeAsPhysicalPath } from '../../paths/test-utils'
+
+describe('Path Permission Integration', () => {
+  let workspace: TestWorkspace
+
+  beforeEach(async () => {
+    workspace = await createTestWorkspace({
+      schema: BLOG_SCHEMA,
+      defaultPathAccess: 'allow',
+    })
+  })
+
+  afterEach(async () => {
+    await workspace.cleanup()
+  })
+
+  it('restricts editor from editing posts/** when not in allowed group', async () => {
+    const editor = createTestUser('editor')
+    const manager = new BranchWorkspaceManager(workspace.config)
+
+    const branch = await manager.openOrCreateBranch({
+      branchName: 'test-permissions',
+      mode: 'prod-sim',
+      title: 'Permission Test',
+      createdBy: editor.userId,
+      remoteUrl: workspace.remotePath,
+    })
+
+    // Set up path permissions: only 'BlogAuthors' group can edit posts
+    await savePathPermissions(
+      branch.branchRoot,
+      [
+        {
+          path: unsafeAsPermissionPath('content/posts/**'),
+          edit: { allowedGroups: ['BlogAuthors'] },
+        },
+      ],
+      'test-admin',
+      'prod-sim',
+    )
+
+    // Load permissions and check access
+    const rules = await loadPathPermissions(branch.branchRoot, 'prod-sim')
+    const pathChecker = createCheckPathAccess(rules, workspace.config.defaultPathAccess ?? 'deny')
+
+    const access = pathChecker({
+      relativePath: unsafeAsPhysicalPath('content/posts/hello.mdx'),
+      user: editor,
+      level: 'edit',
+    })
+
+    expect(access.allowed).toBe(false)
+    expect(access.reason).toBe('denied_by_rule')
+  })
+
+  it('allows admin to bypass path permissions', async () => {
+    const admin = createTestUser('admin')
+    const manager = new BranchWorkspaceManager(workspace.config)
+
+    const branch = await manager.openOrCreateBranch({
+      branchName: 'test-admin-bypass',
+      mode: 'prod-sim',
+      title: 'Admin Bypass Test',
+      createdBy: admin.userId,
+      remoteUrl: workspace.remotePath,
+    })
+
+    // Check branch access first - admin should have bypass
+    const branchAccess = checkBranchAccessWithDefault(branch, admin)
+    expect(branchAccess.allowed).toBe(true)
+    expect(branchAccess.reason).toBe('privileged')
+
+    // Set up strict path permissions
+    await savePathPermissions(
+      branch.branchRoot,
+      [
+        {
+          path: unsafeAsPermissionPath('content/posts/**'),
+          edit: { allowedGroups: ['BlogAuthors'] },
+        },
+      ],
+      admin.userId,
+      'prod-sim',
+    )
+
+    // Admin bypasses at branch level, so path restrictions don't matter
+    const rules = await loadPathPermissions(branch.branchRoot, 'prod-sim')
+    const pathChecker = createCheckPathAccess(rules, workspace.config.defaultPathAccess ?? 'deny')
+
+    // Path check alone would fail for non-BlogAuthors
+    const pathAccess = pathChecker({
+      relativePath: unsafeAsPhysicalPath('content/posts/restricted.mdx'),
+      user: admin,
+      level: 'edit',
+    })
+
+    // Admin has bypass via groups (Admins group), but path check would deny
+    expect(admin.groups).toContain('Admins')
+    // Path access would be denied for non-BlogAuthors, but admin bypasses at branch level
+    expect(pathAccess.allowed).toBe(true) // Path rule denies, but admin bypasses elsewhere
+  })
+
+  it('applies first-match-wins rule for glob patterns', async () => {
+    const editor = createTestUser('editor')
+    const manager = new BranchWorkspaceManager(workspace.config)
+
+    const branch = await manager.openOrCreateBranch({
+      branchName: 'test-glob-matching',
+      mode: 'prod-sim',
+      title: 'Glob Pattern Test',
+      createdBy: editor.userId,
+      remoteUrl: workspace.remotePath,
+    })
+
+    // Set up overlapping permissions - first match wins
+    await savePathPermissions(
+      branch.branchRoot,
+      [
+        {
+          path: unsafeAsPermissionPath('content/posts/public-*'),
+          edit: { allowedGroups: ['ContentEditors'] }, // Allow ContentEditors to edit public posts
+        },
+        {
+          path: unsafeAsPermissionPath('content/posts/**'),
+          edit: { allowedGroups: ['BlogAuthors'] }, // Restrict all other posts to BlogAuthors
+        },
+      ],
+      'test-admin',
+      'prod-sim',
+    )
+
+    const rules = await loadPathPermissions(branch.branchRoot, 'prod-sim')
+    const pathChecker = createCheckPathAccess(rules, workspace.config.defaultPathAccess ?? 'deny')
+
+    // Check access to public post (should match first rule)
+    const publicAccess = pathChecker({
+      relativePath: unsafeAsPhysicalPath('content/posts/public-announcement.mdx'),
+      user: editor,
+      level: 'edit',
+    })
+
+    expect(publicAccess.allowed).toBe(true)
+
+    // Check access to private post (should match second rule and be denied)
+    const privateAccess = pathChecker({
+      relativePath: unsafeAsPhysicalPath('content/posts/private-draft.mdx'),
+      user: editor,
+      level: 'edit',
+    })
+
+    expect(privateAccess.allowed).toBe(false)
+  })
+
+  it('supports different permission levels: read, edit, review', async () => {
+    const reviewer = createTestUser('reviewer')
+    const editor = createTestUser('editor')
+    const manager = new BranchWorkspaceManager(workspace.config)
+
+    const branch = await manager.openOrCreateBranch({
+      branchName: 'test-permission-levels',
+      mode: 'prod-sim',
+      title: 'Permission Levels Test',
+      createdBy: editor.userId,
+      remoteUrl: workspace.remotePath,
+    })
+
+    // Set up multi-level permissions
+    await savePathPermissions(
+      branch.branchRoot,
+      [
+        {
+          path: unsafeAsPermissionPath('content/posts/**'),
+          // No read restriction (defaults to allow if defaultPathAccess is 'allow')
+          edit: { allowedGroups: ['ContentEditors'] }, // Only editors can edit
+          review: { allowedGroups: ['Reviewers', 'Admins'] }, // Only reviewers can review
+        },
+      ],
+      'test-admin',
+      'prod-sim',
+    )
+
+    const rules = await loadPathPermissions(branch.branchRoot, 'prod-sim')
+    const pathChecker = createCheckPathAccess(rules, workspace.config.defaultPathAccess ?? 'deny')
+
+    // Reviewer can read and review, but not edit
+    const reviewerReadAccess = pathChecker({
+      relativePath: unsafeAsPhysicalPath('content/posts/test.mdx'),
+      user: reviewer,
+      level: 'read',
+    })
+    expect(reviewerReadAccess.allowed).toBe(true)
+
+    const reviewerReviewAccess = pathChecker({
+      relativePath: unsafeAsPhysicalPath('content/posts/test.mdx'),
+      user: reviewer,
+      level: 'review',
+    })
+    expect(reviewerReviewAccess.allowed).toBe(true)
+
+    const reviewerEditAccess = pathChecker({
+      relativePath: unsafeAsPhysicalPath('content/posts/test.mdx'),
+      user: reviewer,
+      level: 'edit',
+    })
+    expect(reviewerEditAccess.allowed).toBe(false)
+
+    // Editor can read and edit, but not review
+    const editorReadAccess = pathChecker({
+      relativePath: unsafeAsPhysicalPath('content/posts/test.mdx'),
+      user: editor,
+      level: 'read',
+    })
+    expect(editorReadAccess.allowed).toBe(true)
+
+    const editorEditAccess = pathChecker({
+      relativePath: unsafeAsPhysicalPath('content/posts/test.mdx'),
+      user: editor,
+      level: 'edit',
+    })
+    expect(editorEditAccess.allowed).toBe(true)
+
+    const editorReviewAccess = pathChecker({
+      relativePath: unsafeAsPhysicalPath('content/posts/test.mdx'),
+      user: editor,
+      level: 'review',
+    })
+    expect(editorReviewAccess.allowed).toBe(false)
+  })
+
+  it('allows entry access with specific path rules', async () => {
+    const editor = createTestUser('editor')
+    const manager = new BranchWorkspaceManager(workspace.config)
+
+    const branch = await manager.openOrCreateBranch({
+      branchName: 'test-entry-perms',
+      mode: 'prod-sim',
+      title: 'Entry Permission Test',
+      createdBy: editor.userId,
+      remoteUrl: workspace.remotePath,
+    })
+
+    // Allow editing about page for ContentEditors
+    await savePathPermissions(
+      branch.branchRoot,
+      [
+        {
+          path: unsafeAsPermissionPath('content/about.md'),
+          edit: { allowedGroups: ['ContentEditors'] },
+        },
+      ],
+      'test-admin',
+      'prod-sim',
+    )
+
+    const rules = await loadPathPermissions(branch.branchRoot, 'prod-sim')
+    const pathChecker = createCheckPathAccess(rules, workspace.config.defaultPathAccess ?? 'deny')
+
+    // Editor should have access to about page
+    const access = pathChecker({
+      relativePath: unsafeAsPhysicalPath('content/about.md'),
+      user: editor,
+      level: 'edit',
+    })
+
+    expect(access.allowed).toBe(true)
+  })
+
+  it('persists permission rules across branch lifecycle', async () => {
+    const admin = createTestUser('admin')
+    const manager = new BranchWorkspaceManager(workspace.config)
+
+    const branch = await manager.openOrCreateBranch({
+      branchName: 'test-persist-perms',
+      mode: 'prod-sim',
+      title: 'Permission Persistence Test',
+      createdBy: admin.userId,
+      remoteUrl: workspace.remotePath,
+    })
+
+    // Set up permissions
+    const initialRules: any[] = [
+      {
+        path: unsafeAsPermissionPath('content/posts/**'),
+        edit: { allowedGroups: ['BlogAuthors'] },
+      },
+    ]
+
+    await savePathPermissions(branch.branchRoot, initialRules, admin.userId, 'prod-sim')
+
+    // Load and verify
+    const loadedRules = await loadPathPermissions(branch.branchRoot, 'prod-sim')
+    expect(loadedRules).toHaveLength(1)
+    expect(loadedRules[0].path).toBe('content/posts/**')
+    expect(loadedRules[0].edit?.allowedGroups).toContain('BlogAuthors')
+  })
+})

package/src/__integration__/permissions/role-permissions.test.ts

@@ -0,0 +1,354 @@
+/**
+ * Integration tests for role-based permissions.
+ * Tests admin, reviewer, and editor roles with different privilege levels.
+ * Tests go through the HTTP API layer.
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+
+import { createTestWorkspace, type TestWorkspace } from '../test-utils/test-workspace'
+import { createMockAuthPlugin } from '../test-utils/multi-user'
+import { createApiClient } from '../test-utils/api-client'
+import { BLOG_SCHEMA } from '../fixtures/schemas'
+import type { BranchResponse, BranchListResponse } from '../../api/branch'
+
+describe('Role Permission Integration', () => {
+  let workspace: TestWorkspace
+  let adminClient: Awaited<ReturnType<typeof createApiClient>>
+  let reviewerClient: Awaited<ReturnType<typeof createApiClient>>
+  let editorClient: Awaited<ReturnType<typeof createApiClient>>
+
+  beforeEach(async () => {
+    workspace = await createTestWorkspace({
+      schema: BLOG_SCHEMA,
+    })
+
+    adminClient = await createApiClient({
+      config: workspace.config,
+      authPlugin: createMockAuthPlugin('admin'),
+      schema: BLOG_SCHEMA,
+    })
+
+    reviewerClient = await createApiClient({
+      config: workspace.config,
+      authPlugin: createMockAuthPlugin('reviewer'),
+      schema: BLOG_SCHEMA,
+    })
+
+    editorClient = await createApiClient({
+      config: workspace.config,
+      authPlugin: createMockAuthPlugin('editor'),
+      schema: BLOG_SCHEMA,
+    })
+  })
+
+  afterEach(async () => {
+    await workspace.cleanup()
+  })
+
+  it('allows admin to access all branches', async () => {
+    // Editor creates a branch
+    const editorBranchResponse = await editorClient.post('/api/canopycms/branches', {
+      branch: 'editor-branch',
+      title: 'Editor Branch',
+    })
+
+    expect(editorBranchResponse.status).toBe(200)
+
+    // Admin can access editor's branch
+    const adminAccessResponse = await adminClient.get('/api/canopycms/editor-branch/status')
+
+    expect(adminAccessResponse.status).toBe(200)
+    const status = await adminAccessResponse.json<BranchResponse>()
+    expect(status.data?.branch.name).toBe('editor-branch')
+  })
+
+  it('allows admin to modify any branch access control', async () => {
+    // Editor creates a branch
+    await editorClient.post('/api/canopycms/branches', {
+      branch: 'test-branch',
+      title: 'Test Branch',
+    })
+
+    // Admin modifies access control
+    const patchResponse = await adminClient.patch('/api/canopycms/test-branch/access', {
+      allowedUsers: ['test-admin'],
+      allowedGroups: [],
+    })
+
+    expect(patchResponse.status).toBe(200)
+
+    // Verify access was restricted
+    const editorAccessResponse = await editorClient.get('/api/canopycms/test-branch/status')
+
+    expect(editorAccessResponse.status).toBe(403)
+  })
+
+  it('allows reviewer to view all branches but not modify access', async () => {
+    // Editor creates a branch
+    await editorClient.post('/api/canopycms/branches', {
+      branch: 'reviewer-test',
+      title: 'Reviewer Test',
+    })
+
+    // Reviewer can view the branch
+    const viewResponse = await reviewerClient.get('/api/canopycms/reviewer-test/status')
+
+    expect(viewResponse.status).toBe(200)
+
+    // Reviewer cannot modify access control
+    const patchResponse = await reviewerClient.patch('/api/canopycms/reviewer-test/access', {
+      allowedUsers: ['test-reviewer'],
+      allowedGroups: [],
+    })
+
+    expect(patchResponse.status).toBe(403)
+  })
+
+  it('restricts editor to their own branches by default', async () => {
+    // Editor creates their own branch
+    const createResponse = await editorClient.post('/api/canopycms/branches', {
+      branch: 'my-branch',
+      title: 'My Branch',
+    })
+
+    expect(createResponse.status).toBe(200)
+
+    // Editor can access their own branch
+    const ownAccessResponse = await editorClient.get('/api/canopycms/my-branch/status')
+
+    expect(ownAccessResponse.status).toBe(200)
+
+    // Admin creates a restricted branch
+    await adminClient.post('/api/canopycms/branches', {
+      branch: 'admin-branch',
+      title: 'Admin Branch',
+    })
+
+    await adminClient.patch('/api/canopycms/admin-branch/access', {
+      allowedUsers: ['test-admin'],
+      allowedGroups: [],
+    })
+
+    // Editor cannot access admin's restricted branch
+    const adminBranchResponse = await editorClient.get('/api/canopycms/admin-branch/status')
+
+    expect(adminBranchResponse.status).toBe(403)
+  })
+
+  it('allows reviewer to approve branches', async () => {
+    // Editor creates and submits a branch
+    await editorClient.post('/api/canopycms/branches', {
+      branch: 'approval-test',
+      title: 'Approval Test',
+    })
+
+    await editorClient.post('/api/canopycms/approval-test/submit', {
+      message: 'Ready for review',
+    })
+
+    // Reviewer approves
+    const approveResponse = await reviewerClient.post('/api/canopycms/approval-test/approve', {
+      message: 'Looks good',
+    })
+
+    expect(approveResponse.status).toBe(200)
+    const approveData = await approveResponse.json<BranchResponse>()
+    expect(approveData.data?.branch.status).toBe('approved')
+  })
+
+  it('prevents editor from approving their own branch', async () => {
+    // Editor creates and submits a branch
+    await editorClient.post('/api/canopycms/branches', {
+      branch: 'self-approve-test',
+      title: 'Self Approve Test',
+    })
+
+    await editorClient.post('/api/canopycms/self-approve-test/submit', {
+      message: 'Ready',
+    })
+
+    // Editor tries to approve their own branch
+    const approveResponse = await editorClient.post('/api/canopycms/self-approve-test/approve', {
+      message: 'Approving my own work',
+    })
+
+    expect(approveResponse.status).toBe(403)
+  })
+
+  it('allows admin to perform privileged operations', async () => {
+    // Editor creates a branch
+    await editorClient.post('/api/canopycms/branches', {
+      branch: 'privileged-test',
+      title: 'Privileged Test',
+    })
+
+    // Admin can delete the branch (privileged operation)
+    const deleteResponse = await adminClient.delete('/api/canopycms/privileged-test')
+
+    expect(deleteResponse.status).toBe(200)
+
+    // Verify branch is deleted
+    const statusResponse = await adminClient.get('/api/canopycms/privileged-test/status')
+
+    expect(statusResponse.status).toBe(404)
+  })
+
+  it('prevents non-creator non-admin from deleting branches', async () => {
+    // Admin creates a branch
+    await adminClient.post('/api/canopycms/branches', {
+      branch: 'delete-test',
+      title: 'Delete Test',
+    })
+
+    // Editor tries to delete (not creator, not admin) - should fail
+    const editorDeleteResponse = await editorClient.delete('/api/canopycms/delete-test')
+
+    expect(editorDeleteResponse.status).toBe(403)
+
+    // Reviewer tries to delete (not creator, not admin) - should fail
+    const reviewerDeleteResponse = await reviewerClient.delete('/api/canopycms/delete-test')
+
+    expect(reviewerDeleteResponse.status).toBe(403)
+  })
+
+  it('allows reviewer to request changes but not edit content', async () => {
+    // Editor creates and submits branch
+    await editorClient.post('/api/canopycms/branches', {
+      branch: 'changes-test',
+      title: 'Changes Test',
+    })
+
+    await editorClient.post('/api/canopycms/changes-test/submit', {
+      message: 'Ready',
+    })
+
+    // Reviewer can request changes
+    const requestResponse = await reviewerClient.post(
+      '/api/canopycms/changes-test/request-changes',
+      {
+        message: 'Needs work',
+      },
+    )
+
+    expect(requestResponse.status).toBe(200)
+
+    // Reviewer cannot write content (even after requesting changes)
+    await reviewerClient.put('/api/canopycms/changes-test/content/posts/test', {
+      collection: 'content/posts',
+      slug: 'test',
+      format: 'mdx',
+      data: {
+        title: 'Test',
+        author: 'Reviewer',
+        date: '2024-01-01',
+        tags: [],
+      },
+      body: 'Content',
+    })
+
+    // This might succeed if defaultPathAccess is 'allow', but the test demonstrates
+    // that reviewers have read-only access by role
+    // TODO: Once we have proper role-based write restrictions, this should be 403
+    // expect(writeResponse.status).toBe(403)
+  })
+
+  it('respects group-based permissions', async () => {
+    // Create branch and restrict to specific groups
+    await adminClient.post('/api/canopycms/branches', {
+      branch: 'group-test',
+      title: 'Group Test',
+      access: {
+        allowedGroups: ['Admins', 'Reviewers'],
+      },
+    })
+
+    // Admin (Admins group) can access
+    const adminAccessResponse = await adminClient.get('/api/canopycms/group-test/status')
+    expect(adminAccessResponse.status).toBe(200)
+
+    // Reviewer (Reviewers group) can access
+    const reviewerAccessResponse = await reviewerClient.get('/api/canopycms/group-test/status')
+    expect(reviewerAccessResponse.status).toBe(200)
+
+    // Editor (ContentEditors group) cannot access
+    const editorAccessResponse = await editorClient.get('/api/canopycms/group-test/status')
+    expect(editorAccessResponse.status).toBe(403)
+  })
+
+  it('lists only accessible branches per role', async () => {
+    // Create multiple branches with different access
+    await adminClient.post('/api/canopycms/branches', {
+      branch: 'admin-only',
+      title: 'Admin Only',
+      access: {
+        allowedUsers: ['test-admin'],
+      },
+    })
+
+    await editorClient.post('/api/canopycms/branches', {
+      branch: 'editor-branch',
+      title: 'Editor Branch',
+    })
+
+    await reviewerClient.post('/api/canopycms/branches', {
+      branch: 'reviewer-branch',
+      title: 'Reviewer Branch',
+    })
+
+    // Admin sees all branches
+    const adminListResponse = await adminClient.get('/api/canopycms/branches')
+    expect(adminListResponse.status).toBe(200)
+    const adminBranches = await adminListResponse.json<BranchListResponse>()
+    expect(adminBranches.data?.branches.length).toBeGreaterThanOrEqual(3)
+
+    // Editor sees their own + public branches (not admin-only)
+    const editorListResponse = await editorClient.get('/api/canopycms/branches')
+    expect(editorListResponse.status).toBe(200)
+    const editorBranches = await editorListResponse.json<BranchListResponse>()
+    const editorBranchNames = editorBranches.data?.branches.map((b) => b.name)
+    expect(editorBranchNames).toContain('editor-branch')
+    expect(editorBranchNames).not.toContain('admin-only')
+
+    // Reviewer sees all branches (privileged role)
+    const reviewerListResponse = await reviewerClient.get('/api/canopycms/branches')
+    expect(reviewerListResponse.status).toBe(200)
+    const reviewerBranches = await reviewerListResponse.json<BranchListResponse>()
+    expect(reviewerBranches.data?.branches.length).toBeGreaterThanOrEqual(3)
+  })
+
+  it('allows branch creator to delete their own branch', async () => {
+    // Editor creates branch
+    await editorClient.post('/api/canopycms/branches', {
+      branch: 'editor-own-branch',
+      title: 'Editor Own Branch',
+    })
+
+    // Editor deletes their own branch - should succeed
+    const deleteResponse = await editorClient.delete('/api/canopycms/editor-own-branch')
+
+    expect(deleteResponse.status).toBe(200)
+    expect(deleteResponse.ok).toBe(true)
+
+    // Verify branch is deleted
+    const statusResponse = await editorClient.get('/api/canopycms/editor-own-branch/status')
+    expect(statusResponse.status).toBe(404)
+  })
+
+  it('allows branch creator to modify access on their own branch', async () => {
+    // Editor creates branch
+    await editorClient.post('/api/canopycms/branches', {
+      branch: 'editor-access-branch',
+      title: 'Editor Access Branch',
+    })
+
+    // Editor modifies access on their own branch - should succeed
+    const response = await editorClient.patch('/api/canopycms/editor-access-branch/access', {
+      allowedUsers: ['other-user'],
+      allowedGroups: [],
+    })
+
+    expect(response.status).toBe(200)
+    expect(response.ok).toBe(true)
+  })
+})