API/test/integration/admin.readonly.test.ts

import {describe, it, expect, beforeAll, beforeEach, afterAll} from 'vitest';
import type {Application} from 'express';
import {createApp} from '../../src/app.factory.js';
import {READ_ROLE} from '../../src/models/admin/admin.schema.js';
import {closeDatabase, createAndAcceptInvitation, resetDatabase} from './helpers.js';

/**
 * The read-only role end to end: a real session cookie through the real
 * middleware into each app's routers. The writes are rejected before any
 * handler runs, which is why this suite needs no tickets/feedback/calendar
 * database - a 403 here proves the gate held, not that a query failed.
 */

let app: Application;

beforeAll(() => {
	app = createApp();
});

beforeEach(async () => {
	await resetDatabase();
});

afterAll(async () => {
	await closeDatabase();
});

const readOnlyEverywhere = async () => {
	return createAndAcceptInvitation(app, 'reader@nachklang.art', 'Reader', [
		{app: 'tickets', role: READ_ROLE},
		{app: 'feedback', role: READ_ROLE},
		{app: 'calendar', role: READ_ROLE}
	]);
};

describe('read-only access', () => {
	it('reports readOnly on each app\'s /me', async () => {
		const {agent} = await readOnlyEverywhere();

		const tickets = await agent.get('/tickets/admin/me');
		const feedback = await agent.get('/feedback/admin/me');

		expect(tickets.status).toBe(200);
		expect(tickets.body.readOnly).toBe(true);
		expect(feedback.status).toBe(200);
		expect(feedback.body.readOnly).toBe(true);
	});

	it('reports readOnly false for full access', async () => {
		const {agent} = await createAndAcceptInvitation(app, 'full@nachklang.art', 'Full', ['tickets']);

		const res = await agent.get('/tickets/admin/me');

		expect(res.status).toBe(200);
		expect(res.body.readOnly).toBe(false);
	});

	it.each([
		['post', '/tickets/admin/vouchers/wildcard'],
		['post', '/tickets/admin/redemptions/1/resend-confirmation'],
		['patch', '/tickets/admin/redemptions/1'],
		['put', '/tickets/admin/events/1/settings'],
		['delete', '/feedback/admin/submissions/1'],
		['post', '/feedback/admin/events'],
		['post', '/calendar/events'],
		['delete', '/calendar/events/1']
	] as const)('refuses %s %s', async (method, path) => {
		const {agent} = await readOnlyEverywhere();

		const res = await agent[method](path).send({});

		expect(res.status).toBe(403);
		expect(res.body.message).toBe('Du hast für diesen Bereich nur Lesezugriff.');
	});

	it('does not open user management', async () => {
		const {agent} = await readOnlyEverywhere();

		expect((await agent.get('/admin/users')).status).toBe(403);
	});
});

describe('granting read-only access', () => {
	const signedInAdmin = () => createAndAcceptInvitation(app, 'admin@nachklang.art', 'Admin', ['admin']);

	it('stores the read role per app', async () => {
		const {agent} = await signedInAdmin();
		const other = await createAndAcceptInvitation(app, 'user@nachklang.art', 'User', ['feedback']);

		const res = await agent
			.put(`/admin/users/${other.userId}/permissions`)
			.send({permissions: [{app: 'tickets', role: READ_ROLE}, {app: 'feedback', role: 'access'}]});

		expect(res.status).toBe(200);
		expect(res.body.permissions).toEqual(expect.arrayContaining([
			{app: 'tickets', role: READ_ROLE},
			{app: 'feedback', role: 'access'}
		]));
	});

	it('rejects full and read-only access to the same app', async () => {
		const {agent} = await signedInAdmin();
		const other = await createAndAcceptInvitation(app, 'user@nachklang.art', 'User', ['feedback']);

		const res = await agent
			.put(`/admin/users/${other.userId}/permissions`)
			.send({permissions: [{app: 'tickets', role: READ_ROLE}, {app: 'tickets', role: 'access'}]});

		expect(res.status).toBe(400);
	});

	it('rejects inviting someone with read-only user management', async () => {
		const {agent} = await signedInAdmin();

		const res = await agent
			.post('/admin/invitations')
			.send({email: 'new@nachklang.art', name: 'New', permissions: [{app: 'admin', role: READ_ROLE}]});

		expect(res.status).toBe(400);
	});
});