Paddy
33489585a0
Two changes to the admin module, both made now because it is not deployed yet
and neither is free later.
Permissions were "an app", with a `role` column reserved for a future
fine-grained model. Reviewing whether that reservation was enough found three
problems:
- Every row was written with role = 'admin', hardcoded, and the column
defaulted to it. On a `tickets` row that reads as "tickets administrator"
when it only ever meant "has access", and once real roles existed there
would have been no way to tell an old plain grant from a deliberate one.
- The role never left the database. /admin/me, the user list, the user detail
and both write endpoints all spoke apps: AppName[]. Adding roles would have
been a breaking change to /admin/me - and after the cutover that endpoint
has two more consumers, turning a local edit into a coordinated deploy of
three apps.
- The key (user_id, app) allowed one role per app, i.e. a tier rather than a
set of capabilities. Choosing later means an ALTER on a live table.
So: the key is now (user_id, app, role), the role is `access`, and APP_ROLES
in admin.schema.ts is the contract - a role not listed there is rejected with
400 rather than written. permissions: [{app, role}] is on the wire alongside
the derived apps: AppName[], which is kept because the three frontends only
ever ask "may I show this app?". Both write endpoints accept either shape, and
the invitation column (now `permissions`) is parsed leniently: invitations live
seven days, so a deploy that changes the shape has in-flight rows in the old
one. requireAppAccess(app, role?) takes an optional role; nothing passes one
yet.
countActiveAdminsForUpdate now counts DISTINCT users rather than rows. With
several roles per app, counting rows would make a single admin holding two
roles look like two admins and defeat the last-admin guard at exactly the
moment it matters.
Separately, passkey registration now fills `name` from the authenticator's
AAGUID via registration.afterVerification and better-auth's own
getAuthenticatorName, yielding "1Password", "iCloud Keychain", "Windows Hello".
Without it the column stayed NULL and the account page could only label every
passkey "Passkey" - useless when someone has to remove the one on the device
they just lost. A client-supplied name still wins; an unknown AAGUID still
leaves it blank.
148 unit tests (up from 131, including the new admin.schema.test.ts) and 41
integration tests pass. The integration suite applies sql/admin/001_init.sql,
so the new key is exercised rather than trusted.
No production migration is needed - the module is not deployed. An existing dev
database needs three statements: set role = 'access', drop and re-add the
primary key, rename invitations.apps to permissions.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
78 lines
3.0 KiB
TypeScript
78 lines
3.0 KiB
TypeScript
import {expect} from 'vitest';
|
|
import type {Application} from 'express';
|
|
import request from 'supertest';
|
|
import {NachklangAdminDB} from '../../src/models/admin/Admin.db.js';
|
|
import * as InvitationsService from '../../src/models/admin/invitations/invitations.service.js';
|
|
import {ACCESS_ROLE, AppName, AppPermission, toPermissions} from '../../src/models/admin/admin.schema.js';
|
|
|
|
const db = NachklangAdminDB.db;
|
|
|
|
// Dev/test cookie name: advanced.cookiePrefix is 'nachklang', and the __Secure-
|
|
// prefix is only added over https.
|
|
export const SESSION_COOKIE = 'nachklang.session_token';
|
|
|
|
/**
|
|
* Wipes every table between test files. Child tables first - the FKs to `user`
|
|
* are ON DELETE CASCADE, but the rest are not.
|
|
*
|
|
* `rateLimit` matters more than it looks: the limiter is enabled during the
|
|
* suite, and better-auth caps /sign-in/* at 3 requests per 10 seconds. All
|
|
* tests resolve to the same client IP, so they share one bucket - without this
|
|
* reset the suite would start failing with 429s that look like auth bugs as
|
|
* soon as a third sign-in assertion is added.
|
|
*/
|
|
export const resetDatabase = async (): Promise<void> => {
|
|
await db.deleteFrom('session').execute();
|
|
await db.deleteFrom('user_app_permissions').execute();
|
|
await db.deleteFrom('passkey').execute();
|
|
await db.deleteFrom('invitations').execute();
|
|
await db.deleteFrom('verification').execute();
|
|
await db.deleteFrom('rateLimit').execute();
|
|
await db.deleteFrom('user').execute();
|
|
};
|
|
|
|
export const closeDatabase = async (): Promise<void> => {
|
|
await db.destroy();
|
|
};
|
|
|
|
/**
|
|
* Creates an invitation straight through the service (so the test gets the raw
|
|
* token, which the API deliberately never returns) and redeems it through the
|
|
* public endpoint. Returns an agent that carries the resulting session cookie.
|
|
*/
|
|
export const createAndAcceptInvitation = async (
|
|
app: Application,
|
|
email: string,
|
|
name: string,
|
|
// Takes the shorthand as well as the full form: most tests only care that
|
|
// someone can open an app, and `['tickets']` says that with less noise.
|
|
grants: (AppName | AppPermission)[],
|
|
password = 'devpassword123'
|
|
) => {
|
|
const permissions = toPermissions(grants) ?? [];
|
|
const invitation = await InvitationsService.createInvitation(email, name, permissions, null);
|
|
|
|
const agent = request.agent(app);
|
|
const res = await agent
|
|
.post('/admin/auth/invitations/accept')
|
|
.send({token: invitation.token, password});
|
|
|
|
expect(res.status).toBe(200);
|
|
return {agent, userId: res.body.user.id, token: invitation.token};
|
|
};
|
|
|
|
export const cookieHeader = (res: request.Response): string[] => {
|
|
const raw = res.headers['set-cookie'];
|
|
return Array.isArray(raw) ? raw : raw ? [raw] : [];
|
|
};
|
|
|
|
export const sessionCookieFrom = (res: request.Response): string | undefined => {
|
|
return cookieHeader(res).find(cookie => cookie.startsWith(SESSION_COOKIE));
|
|
};
|
|
|
|
/** `accessTo('feedback')` reads better than the (app, role) literal in tests
|
|
* that only care that someone can open an app. */
|
|
export const accessTo = (...apps: AppName[]): AppPermission[] => {
|
|
return apps.map(app => ({app, role: ACCESS_ROLE}));
|
|
};
|