46 lines
1.6 KiB
TypeScript
46 lines
1.6 KiB
TypeScript
import { test } from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { actorFromHeaders } from '../src/common/auth-context.js';
|
|
|
|
test('auth context keeps local explicit roles for dev', () => {
|
|
const actor = actorFromHeaders({
|
|
'x-casan-actor': 'alice',
|
|
'x-casan-role': 'project-admin',
|
|
'x-casan-project': 'okr',
|
|
'x-casan-tenant': 'tenant-a',
|
|
});
|
|
assert.deepEqual(actor, { actor: 'alice', role: 'project-admin', project: 'okr', tenant: 'tenant-a' });
|
|
});
|
|
|
|
test('auth context maps IdP group claim to RBAC role', () => {
|
|
const actor = actorFromHeaders({
|
|
'x-auth-request-user': 'bob@example.com',
|
|
'x-auth-request-groups': 'engineering,casan-approver,casan-project:AINative_OKR_CASAN4',
|
|
});
|
|
assert.equal(actor.actor, 'bob@example.com');
|
|
assert.equal(actor.role, 'approver');
|
|
assert.equal(actor.project, 'AINative_OKR_CASAN4');
|
|
});
|
|
|
|
test('auth context fails closed to viewer for unknown role claim', () => {
|
|
const actor = actorFromHeaders({
|
|
'x-auth-request-user': 'eve@example.com',
|
|
'x-auth-request-groups': 'unknown-admin',
|
|
});
|
|
assert.equal(actor.role, 'viewer');
|
|
});
|
|
|
|
test('JWT mode rejects direct spoofed identity headers without middleware verification', () => {
|
|
const prior = process.env.CASAN_CP_AUTH_MODE;
|
|
process.env.CASAN_CP_AUTH_MODE = 'jwt';
|
|
try {
|
|
assert.throws(() => actorFromHeaders({
|
|
'x-casan-actor': 'attacker',
|
|
'x-casan-role': 'org-admin',
|
|
}), /AUTH_VERIFIED_IDENTITY_REQUIRED/);
|
|
} finally {
|
|
if (prior === undefined) delete process.env.CASAN_CP_AUTH_MODE;
|
|
else process.env.CASAN_CP_AUTH_MODE = prior;
|
|
}
|
|
});
|