68 lines
1.8 KiB
TypeScript
68 lines
1.8 KiB
TypeScript
import { SystemRole } from "@capakraken/shared";
|
|
import { describe, expect, it, vi } from "vitest";
|
|
import { settingsRouter } from "../router/settings.js";
|
|
import { createCallerFactory } from "../trpc.js";
|
|
|
|
function createProtectedContext(
|
|
db: Record<string, unknown>,
|
|
systemRole: SystemRole,
|
|
) {
|
|
return {
|
|
session: {
|
|
user: { email: "user@example.com", name: "User", image: null },
|
|
expires: "2099-01-01T00:00:00.000Z",
|
|
},
|
|
db: db as never,
|
|
dbUser: {
|
|
id: "user_1",
|
|
systemRole,
|
|
permissionOverrides: null,
|
|
},
|
|
};
|
|
}
|
|
|
|
describe("settings router authorization", () => {
|
|
it("forbids non-admin users from reading AI configuration status", async () => {
|
|
const findUnique = vi.fn();
|
|
const caller = createCallerFactory(settingsRouter)(createProtectedContext({
|
|
systemSettings: {
|
|
findUnique,
|
|
},
|
|
}, SystemRole.USER));
|
|
|
|
await expect(caller.getAiConfigured()).rejects.toMatchObject({
|
|
code: "FORBIDDEN",
|
|
message: "Admin role required",
|
|
});
|
|
|
|
expect(findUnique).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it("allows admins to read AI configuration status", async () => {
|
|
const findUnique = vi.fn().mockResolvedValue({
|
|
aiProvider: "azure",
|
|
azureOpenAiEndpoint: "https://example.openai.azure.com",
|
|
azureOpenAiDeployment: "gpt-4o",
|
|
azureOpenAiApiKey: "secret",
|
|
});
|
|
const caller = createCallerFactory(settingsRouter)(createProtectedContext({
|
|
systemSettings: {
|
|
findUnique,
|
|
},
|
|
}, SystemRole.ADMIN));
|
|
|
|
const result = await caller.getAiConfigured();
|
|
|
|
expect(result).toEqual({ configured: true });
|
|
expect(findUnique).toHaveBeenCalledWith({
|
|
where: { id: "singleton" },
|
|
select: {
|
|
aiProvider: true,
|
|
azureOpenAiEndpoint: true,
|
|
azureOpenAiDeployment: true,
|
|
azureOpenAiApiKey: true,
|
|
},
|
|
});
|
|
});
|
|
});
|