João Salavisa
41 lines
1.5 KiB
TypeScript
41 lines
1.5 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import { isAdminIdentity } from "./is-admin";
|
|
|
|
describe("isAdminIdentity", () => {
|
|
it("treats an admin role as admin while auth is enabled", () => {
|
|
expect(isAdminIdentity("enabled", "admin")).toBe(true);
|
|
});
|
|
|
|
it("treats a member role as not admin", () => {
|
|
expect(isAdminIdentity("enabled", "member")).toBe(false);
|
|
});
|
|
|
|
// Auth disabled: the boot payload carries no user, and the backend's
|
|
// synthetic single-user identity is an admin. This is the case that must
|
|
// keep every install-wide control available in single-user mode.
|
|
it("treats the auth-disabled single user as admin", () => {
|
|
expect(isAdminIdentity("disabled", undefined)).toBe(true);
|
|
});
|
|
|
|
// A backend old enough to send no auth block at all hydrates the slice
|
|
// defaults, which are mode "disabled".
|
|
it("treats a missing auth block as the disabled single user", () => {
|
|
expect(isAdminIdentity(undefined, undefined)).toBe(true);
|
|
});
|
|
|
|
// Session expiry calls clearAuthenticated(), which nulls the user but
|
|
// leaves mode "enabled" while the redirect to /login is in flight. Reading
|
|
// that as admin would flash install-wide controls at a signed-out caller.
|
|
it("does not treat a cleared session as admin", () => {
|
|
expect(isAdminIdentity("enabled", undefined)).toBe(false);
|
|
});
|
|
|
|
it("does not treat setup mode as admin", () => {
|
|
expect(isAdminIdentity("setup", undefined)).toBe(false);
|
|
});
|
|
|
|
it("treats an unknown role as not admin", () => {
|
|
expect(isAdminIdentity("enabled", "guest")).toBe(false);
|
|
});
|
|
});
|