Moheeb Zara
9447b5ee80
Migration 023 (folded into schema.sql section 15). ADDITIVE and backward compatible: with no permission/ACL rows the app behaves exactly as before. Schema: - space_role_permissions (space_id, subject, permission); ops_acl (space_id, entity_type secret|kb|process|area_lead, entity_id, role). Full RLS, writes admin/board. - user_effective_roles(uid,sid): built-in role + custom-role slugs + area_lead:<id> for areas the member leads. SECURITY DEFINER. - user_has_permission(uid,sid,perm): admin implicit-all else a grant via an effective role. SECURITY DEFINER. - secrets/knowledge_base SELECT rewritten as `exact existing rule OR ops_acl match` (only widens; zero change with no ACL rows). Seed + backfill default role permissions. Area-lead roles reuse the existing area_leads table rather than duplicating the concept: a row is a role, lead_id NULL = Vacant, assigning sets lead_id, the member then holds area_lead:<id>. App: - lib/permissions-catalog.ts (codes + per-role defaults + guardrails), Zod schemas, lib/actions/permissions.ts (setRolePermissions, setOpsAcl, createAreaLeadRole, assign/unassign/delete). - Customize gains Permissions (role x permission matrix, admin shown implicit-all/locked) and Area leads (create/Vacant/assign) panels, modular under customize/panels/. Reusable components/ops/ops-acl-editor.tsx wired into the Secrets list. Audit-found latent fixes: - revealSecret errors on encrypted-but-no-ciphertext corruption instead of silently returning the stale plaintext column. - upsertAreaLead rejects null/empty area_code (NULLs are distinct in unique constraints; allowed duplicate rows). types/database.ts: added the two new tables. 271/271 tests pass, build clean. KB-modal ACL wiring + members-row shortcut deferred and tracked in HANDOFF.
41 lines
1.3 KiB
TypeScript
41 lines
1.3 KiB
TypeScript
import { describe, it, expect } from 'vitest'
|
|
import {
|
|
PERMISSIONS,
|
|
PERMISSION_CODES,
|
|
PERMISSION_GROUPS,
|
|
DEFAULT_ROLE_PERMISSIONS,
|
|
isValidPermission,
|
|
} from '@/lib/permissions-catalog'
|
|
|
|
describe('permissions catalog', () => {
|
|
it('has unique permission codes', () => {
|
|
expect(new Set(PERMISSION_CODES).size).toBe(PERMISSION_CODES.length)
|
|
})
|
|
|
|
it('every permission has a group present in PERMISSION_GROUPS', () => {
|
|
for (const p of PERMISSIONS) {
|
|
expect(PERMISSION_GROUPS).toContain(p.group)
|
|
}
|
|
})
|
|
|
|
it('isValidPermission accepts catalog codes and rejects others', () => {
|
|
expect(isValidPermission('ops.secrets.read')).toBe(true)
|
|
expect(isValidPermission('ops.kb.write')).toBe(true)
|
|
expect(isValidPermission('not.a.permission')).toBe(false)
|
|
expect(isValidPermission('')).toBe(false)
|
|
})
|
|
|
|
it('default role grants only reference real permissions', () => {
|
|
for (const [role, perms] of Object.entries(DEFAULT_ROLE_PERMISSIONS)) {
|
|
expect(role).not.toBe('admin') // admin is implicit-all, never seeded
|
|
for (const perm of perms) {
|
|
expect(isValidPermission(perm)).toBe(true)
|
|
}
|
|
}
|
|
})
|
|
|
|
it('does not grant admin defaults (admin is implicit and cannot be locked out)', () => {
|
|
expect(DEFAULT_ROLE_PERMISSIONS.admin).toBeUndefined()
|
|
})
|
|
})
|