fluxer/fluxer_api/src/api/admin/tests/AdminSetUserAclsValidation.test.ts

// SPDX-License-Identifier: AGPL-3.0-or-later

import {createTestAccount, setUserACLs} from '@app/api/auth/tests/AuthTestUtils';
import {type ApiTestHarness, createApiTestHarness} from '@app/api/test/ApiTestHarness';
import {HTTP_STATUS} from '@app/api/test/TestConstants';
import {createBuilder} from '@app/api/test/TestRequestBuilder';
import {AdminACLs} from '@fluxer/constants/src/AdminACLs';
import {afterAll, beforeAll, beforeEach, describe, expect, test} from 'vitest';

interface AdminUserMutationResponse {
	user: {
		id: string;
		acls: Array<string>;
	};
}

interface AdminUserLookupResponse {
	users: Array<{
		id: string;
		acls: Array<string>;
	}>;
}

const RETIRED_ACL = 'retired:acl';

describe('Admin set user ACLs validation', () => {
	let harness: ApiTestHarness;
	beforeAll(async () => {
		harness = await createApiTestHarness();
	});
	beforeEach(async () => {
		await harness.reset();
	});
	afterAll(async () => {
		await harness?.shutdown();
	});
	test('stores a value of the registry', async () => {
		const admin = await setUserACLs(harness, await createTestAccount(harness), [
			AdminACLs.AUTHENTICATE,
			AdminACLs.ACL_SET_USER,
			AdminACLs.USER_LOOKUP,
		]);
		const target = await createTestAccount(harness);
		const result = await createBuilder<AdminUserMutationResponse>(harness, `${admin.token}`)
			.put(`/admin/users/${target.userId}/acls`)
			.body({acls: [AdminACLs.USER_LOOKUP]})
			.expect(HTTP_STATUS.OK)
			.execute();
		expect(result.user.acls).toEqual([AdminACLs.USER_LOOKUP]);
	});
	test('rejects an ACL outside the registry with 400 and leaves the stored set unchanged', async () => {
		const admin = await setUserACLs(harness, await createTestAccount(harness), [
			AdminACLs.AUTHENTICATE,
			AdminACLs.ACL_SET_USER,
			AdminACLs.USER_LOOKUP,
		]);
		const target = await createTestAccount(harness);
		await createBuilder(harness, `${admin.token}`)
			.put(`/admin/users/${target.userId}/acls`)
			.body({acls: [AdminACLs.USER_LOOKUP]})
			.expect(HTTP_STATUS.OK)
			.execute();
		await createBuilder(harness, `${admin.token}`)
			.put(`/admin/users/${target.userId}/acls`)
			.body({acls: ['user:veiw']})
			.expect(HTTP_STATUS.BAD_REQUEST)
			.executeWithResponse();
		const lookup = await createBuilder<AdminUserLookupResponse>(harness, `${admin.token}`)
			.get(`/admin/users/${target.userId}`)
			.expect(HTTP_STATUS.OK)
			.execute();
		expect(lookup.users[0]!.acls).toEqual([AdminACLs.USER_LOOKUP]);
	});
	test('lists only registry values when a retired ACL is stored', async () => {
		const admin = await setUserACLs(harness, await createTestAccount(harness), [
			AdminACLs.AUTHENTICATE,
			AdminACLs.USER_LOOKUP,
		]);
		const target = await setUserACLs(harness, await createTestAccount(harness), [AdminACLs.USER_LOOKUP, RETIRED_ACL]);
		const lookup = await createBuilder<AdminUserLookupResponse>(harness, `${admin.token}`)
			.get(`/admin/users/${target.userId}`)
			.expect(HTTP_STATUS.OK)
			.execute();
		expect(lookup.users[0]!.acls).toEqual([AdminACLs.USER_LOOKUP]);
	});
	test('saves ACLs for an account that holds a retired ACL', async () => {
		const admin = await setUserACLs(harness, await createTestAccount(harness), [
			AdminACLs.AUTHENTICATE,
			AdminACLs.ACL_SET_USER,
			AdminACLs.USER_LOOKUP,
			AdminACLs.USER_VIEW_EMAIL,
		]);
		const target = await setUserACLs(harness, await createTestAccount(harness), [AdminACLs.USER_LOOKUP, RETIRED_ACL]);
		const result = await createBuilder<AdminUserMutationResponse>(harness, `${admin.token}`)
			.put(`/admin/users/${target.userId}/acls`)
			.body({acls: [AdminACLs.USER_LOOKUP, AdminACLs.USER_VIEW_EMAIL]})
			.expect(HTTP_STATUS.OK)
			.execute();
		expect(result.user.acls.sort()).toEqual([AdminACLs.USER_LOOKUP, AdminACLs.USER_VIEW_EMAIL].sort());
	});
	test('returns the current admin when every registry ACL and a retired ACL are stored', async () => {
		const admin = await setUserACLs(harness, await createTestAccount(harness), [
			...Object.values(AdminACLs),
			RETIRED_ACL,
		]);
		const me = await createBuilder<AdminUserMutationResponse>(harness, `${admin.token}`)
			.get('/admin/users/@me')
			.expect(HTTP_STATUS.OK)
			.execute();
		expect(me.user.acls).toHaveLength(Object.values(AdminACLs).length);
		expect(me.user.acls).not.toContain(RETIRED_ACL);
	});
});