API/test/admin/admin.middleware.test.ts

import {vi, describe, it, expect, beforeEach, type Mock} from 'vitest';
import {Request, Response} from 'express';

vi.mock('../../src/models/admin/admin.auth.js', () => ({
	auth: {api: {getSession: vi.fn()}}
}));
vi.mock('../../src/models/admin/users/users.admin.service.js', () => ({
	loadAccess: vi.fn()
}));

import {auth} from '../../src/models/admin/admin.auth.js';
import * as UsersService from '../../src/models/admin/users/users.admin.service.js';
import {requireAppAccess, requireSignedIn, resolveAccess} from '../../src/models/admin/admin.middleware.js';

const mockGetSession = auth.api.getSession as unknown as Mock;
const mockLoadAccess = UsersService.loadAccess as Mock;

const makeReq = (method = 'GET'): Request => ({method, headers: {cookie: 'nachklang.session_token=abc'}} as unknown as Request);

const makeRes = (): Response => {
	const res: any = {};
	res.status = vi.fn().mockReturnValue(res);
	res.send = vi.fn().mockReturnValue(res);
	res.locals = {};
	return res as Response;
};

const activeUser = {
	id: 'u1',
	email: 'a@nachklang.art',
	displayName: 'A',
	disabled: false,
	permissions: [
		{app: 'feedback', role: 'access'},
		{app: 'admin', role: 'access'}
	],
	apps: ['feedback', 'admin']
};

describe('resolveAccess', () => {
	beforeEach(() => {
		mockGetSession.mockReset();
		mockLoadAccess.mockReset();
	});

	it('returns null without a valid session', async () => {
		mockGetSession.mockResolvedValue(null);
		expect(await resolveAccess(makeReq())).toBeNull();
		expect(mockLoadAccess).not.toHaveBeenCalled();
	});

	it('returns null when the session points at a user row that is gone', async () => {
		mockGetSession.mockResolvedValue({user: {id: 'u1'}});
		mockLoadAccess.mockResolvedValue(null);
		expect(await resolveAccess(makeReq())).toBeNull();
	});

	it('resolves identity and permissions in a single permission query', async () => {
		mockGetSession.mockResolvedValue({user: {id: 'u1'}});
		mockLoadAccess.mockResolvedValue(activeUser);

		expect(await resolveAccess(makeReq())).toEqual({
			id: 'u1',
			email: 'a@nachklang.art',
			displayName: 'A',
			disabled: false,
			permissions: [
				{app: 'feedback', role: 'access'},
				{app: 'admin', role: 'access'}
			],
			apps: ['feedback', 'admin']
		});
		// No cookieCache: exactly one lookup per request, never zero.
		expect(mockLoadAccess).toHaveBeenCalledTimes(1);
	});
});

describe('requireSignedIn', () => {
	beforeEach(() => {
		mockGetSession.mockReset();
		mockLoadAccess.mockReset();
	});

	it('401s without a session', async () => {
		mockGetSession.mockResolvedValue(null);
		const res = makeRes();
		const next = vi.fn();

		await requireSignedIn(makeReq(), res, next);

		expect(res.status).toHaveBeenCalledWith(401);
		expect(next).not.toHaveBeenCalled();
	});

	it('403s a disabled user that still holds a valid cookie', async () => {
		mockGetSession.mockResolvedValue({user: {id: 'u1'}});
		mockLoadAccess.mockResolvedValue({...activeUser, disabled: true});
		const res = makeRes();
		const next = vi.fn();

		await requireSignedIn(makeReq(), res, next);

		expect(res.status).toHaveBeenCalledWith(403);
		expect(next).not.toHaveBeenCalled();
	});

	it('admits a signed-in user with no app permissions at all', async () => {
		mockGetSession.mockResolvedValue({user: {id: 'u1'}});
		mockLoadAccess.mockResolvedValue({...activeUser, apps: []});
		const res = makeRes();
		const next = vi.fn();

		await requireSignedIn(makeReq(), res, next);

		expect(next).toHaveBeenCalled();
		expect(res.locals.admin.apps).toEqual([]);
	});
});

describe('requireAppAccess', () => {
	beforeEach(() => {
		mockGetSession.mockReset();
		mockLoadAccess.mockReset();
	});

	it('401s without a session', async () => {
		mockGetSession.mockResolvedValue(null);
		const res = makeRes();
		const next = vi.fn();

		await requireAppAccess('feedback')(makeReq(), res, next);

		expect(res.status).toHaveBeenCalledWith(401);
	});

	it('403s a signed-in user without that app permission', async () => {
		mockGetSession.mockResolvedValue({user: {id: 'u1'}});
		mockLoadAccess.mockResolvedValue({
			...activeUser,
			permissions: [{app: 'feedback', role: 'access'}],
			apps: ['feedback']
		});
		const res = makeRes();
		const next = vi.fn();

		await requireAppAccess('tickets')(makeReq(), res, next);

		expect(res.status).toHaveBeenCalledWith(403);
		expect(next).not.toHaveBeenCalled();
	});

	it('403s a disabled user even when they hold the permission', async () => {
		mockGetSession.mockResolvedValue({user: {id: 'u1'}});
		mockLoadAccess.mockResolvedValue({...activeUser, disabled: true});
		const res = makeRes();
		const next = vi.fn();

		await requireAppAccess('feedback')(makeReq(), res, next);

		expect(res.status).toHaveBeenCalledWith(403);
	});

	it('passes through and exposes the identity the feedback/tickets services expect', async () => {
		mockGetSession.mockResolvedValue({user: {id: 'u1'}});
		mockLoadAccess.mockResolvedValue(activeUser);
		const res = makeRes();
		const next = vi.fn();

		await requireAppAccess('feedback')(makeReq(), res, next);

		expect(next).toHaveBeenCalled();
		expect(res.locals.admin).toMatchObject({id: 'u1', email: 'a@nachklang.art', displayName: 'A'});
	});

	it('500s (never allows through) when the permission query throws', async () => {
		mockGetSession.mockResolvedValue({user: {id: 'u1'}});
		mockLoadAccess.mockRejectedValue(new Error('db down'));
		const res = makeRes();
		const next = vi.fn();

		await requireAppAccess('feedback')(makeReq(), res, next);

		expect(res.status).toHaveBeenCalledWith(500);
		expect(next).not.toHaveBeenCalled();
	});

	// The seam a finer per-app permission arrives through. Nothing passes a role
	// today, so these two pin the behaviour before there is anything to break.
	it('403s when a specific role is required and the user only holds another', async () => {
		mockGetSession.mockResolvedValue({user: {id: 'u1'}});
		mockLoadAccess.mockResolvedValue({
			...activeUser,
			permissions: [{app: 'tickets', role: 'access'}],
			apps: ['tickets']
		});
		const res = makeRes();
		const next = vi.fn();

		await requireAppAccess('tickets', 'refund')(makeReq(), res, next);

		expect(res.status).toHaveBeenCalledWith(403);
		expect(next).not.toHaveBeenCalled();
	});

	it('passes when the user holds exactly the required role', async () => {
		mockGetSession.mockResolvedValue({user: {id: 'u1'}});
		mockLoadAccess.mockResolvedValue({
			...activeUser,
			permissions: [
				{app: 'tickets', role: 'access'},
				{app: 'tickets', role: 'refund'}
			],
			apps: ['tickets']
		});
		const res = makeRes();
		const next = vi.fn();

		await requireAppAccess('tickets', 'refund')(makeReq(), res, next);

		expect(next).toHaveBeenCalled();
	});

	describe('read-only grant', () => {
		const readOnlyUser = {
			...activeUser,
			permissions: [{app: 'tickets', role: 'read'}],
			apps: ['tickets']
		};

		it.each(['GET', 'HEAD', 'OPTIONS'])('lets %s through', async method => {
			mockGetSession.mockResolvedValue({user: {id: 'u1'}});
			mockLoadAccess.mockResolvedValue(readOnlyUser);
			const res = makeRes();
			const next = vi.fn();

			await requireAppAccess('tickets')(makeReq(method), res, next);

			expect(next).toHaveBeenCalled();
		});

		it.each(['POST', 'PUT', 'PATCH', 'DELETE'])('403s %s', async method => {
			mockGetSession.mockResolvedValue({user: {id: 'u1'}});
			mockLoadAccess.mockResolvedValue(readOnlyUser);
			const res = makeRes();
			const next = vi.fn();

			await requireAppAccess('tickets')(makeReq(method), res, next);

			expect(res.status).toHaveBeenCalledWith(403);
			expect(res.send).toHaveBeenCalledWith(expect.objectContaining({message: 'Du hast für diesen Bereich nur Lesezugriff.'}));
			expect(next).not.toHaveBeenCalled();
		});

		it('does not let full access to another app write here', async () => {
			mockGetSession.mockResolvedValue({user: {id: 'u1'}});
			mockLoadAccess.mockResolvedValue({
				...activeUser,
				permissions: [{app: 'tickets', role: 'read'}, {app: 'feedback', role: 'access'}],
				apps: ['feedback', 'tickets']
			});
			const res = makeRes();
			const next = vi.fn();

			await requireAppAccess('tickets')(makeReq('POST'), res, next);

			expect(res.status).toHaveBeenCalledWith(403);
		});

		it('lets full access write', async () => {
			mockGetSession.mockResolvedValue({user: {id: 'u1'}});
			mockLoadAccess.mockResolvedValue(activeUser);
			const res = makeRes();
			const next = vi.fn();

			await requireAppAccess('feedback')(makeReq('DELETE'), res, next);

			expect(next).toHaveBeenCalled();
		});
	});
});