31 lines
1.0 KiB
TypeScript
31 lines
1.0 KiB
TypeScript
import { test } from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { actorFromHeaders } from '../src/common/auth-context.js';
|
|
|
|
test('auth context keeps local explicit roles for dev', () => {
|
|
const actor = actorFromHeaders({
|
|
'x-casan-actor': 'alice',
|
|
'x-casan-role': 'project-admin',
|
|
'x-casan-project': 'okr',
|
|
'x-casan-tenant': 'tenant-a',
|
|
});
|
|
assert.deepEqual(actor, { actor: 'alice', role: 'project-admin', project: 'okr', tenant: 'tenant-a' });
|
|
});
|
|
|
|
test('auth context maps IdP group claim to RBAC role', () => {
|
|
const actor = actorFromHeaders({
|
|
'x-auth-request-user': 'bob@example.com',
|
|
'x-auth-request-groups': 'engineering,casan-approver',
|
|
});
|
|
assert.equal(actor.actor, 'bob@example.com');
|
|
assert.equal(actor.role, 'approver');
|
|
});
|
|
|
|
test('auth context fails closed to viewer for unknown role claim', () => {
|
|
const actor = actorFromHeaders({
|
|
'x-auth-request-user': 'eve@example.com',
|
|
'x-auth-request-groups': 'unknown-admin',
|
|
});
|
|
assert.equal(actor.role, 'viewer');
|
|
});
|