129 lines
3.7 KiB
Rust
129 lines
3.7 KiB
Rust
//! Publish gate is Owner-only. The role check must fire before any DB
|
|
//! work, so we probe it with a bogus approval id: Members see 403 (role
|
|
//! guard), Owners see 404 (row missing) — proving ordering + coverage on
|
|
//! both approve and reject.
|
|
|
|
use std::sync::Arc;
|
|
|
|
use cm_api::AppState;
|
|
use cm_auth::AuthService;
|
|
use cm_domain::{Role, User, UserId, Workspace, WorkspaceId};
|
|
use cm_llm::ScriptedProvider;
|
|
use cm_runtime::{Runtime, RuntimeConfig};
|
|
use reqwest::StatusCode;
|
|
use serde_json::{json, Value};
|
|
use uuid::Uuid;
|
|
|
|
struct Server {
|
|
base: String,
|
|
client: reqwest::Client,
|
|
}
|
|
|
|
async fn serve(pool: sqlx::PgPool) -> Server {
|
|
let runtime = Runtime::new(
|
|
pool.clone(),
|
|
Arc::new(ScriptedProvider::from_toml("").unwrap()),
|
|
RuntimeConfig::basic("scripted", 1024),
|
|
);
|
|
let app = cm_api::router(AppState::new(pool, runtime));
|
|
let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
|
|
let addr = listener.local_addr().unwrap();
|
|
tokio::spawn(async move {
|
|
axum::serve(listener, app).await.unwrap();
|
|
});
|
|
Server {
|
|
base: format!("http://{addr}"),
|
|
client: reqwest::Client::new(),
|
|
}
|
|
}
|
|
|
|
async fn seed_user(pool: &sqlx::PgPool, ws: WorkspaceId, role: Role, email: &str) -> UserId {
|
|
let user = User {
|
|
id: UserId::new(),
|
|
workspace_id: ws,
|
|
email: email.into(),
|
|
role,
|
|
display_name: format!("{role:?}"),
|
|
created_at: time::OffsetDateTime::UNIX_EPOCH,
|
|
};
|
|
cm_db::repo::users::insert(pool, &user).await.unwrap();
|
|
AuthService::new(pool.clone())
|
|
.set_password(user.id, "pw")
|
|
.await
|
|
.unwrap();
|
|
user.id
|
|
}
|
|
|
|
async fn login(server: &Server, email: &str) -> String {
|
|
server
|
|
.client
|
|
.post(format!("{}/api/auth/login", server.base))
|
|
.json(&json!({"email": email, "password": "pw"}))
|
|
.send()
|
|
.await
|
|
.unwrap()
|
|
.json::<Value>()
|
|
.await
|
|
.unwrap()["token"]
|
|
.as_str()
|
|
.unwrap()
|
|
.to_owned()
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn publish_decide_is_owner_only() {
|
|
let pool = cm_testkit::test_pool().await;
|
|
let server = serve(pool.clone()).await;
|
|
|
|
let ws = Workspace {
|
|
id: WorkspaceId::new(),
|
|
name: "Acme".into(),
|
|
plan: "team".into(),
|
|
};
|
|
cm_db::repo::workspaces::insert(&pool, &ws).await.unwrap();
|
|
|
|
let owner_email = format!("owner-{}@acme.test", UserId::new());
|
|
let member_email = format!("member-{}@acme.test", UserId::new());
|
|
seed_user(&pool, ws.id, Role::Owner, &owner_email).await;
|
|
seed_user(&pool, ws.id, Role::Member, &member_email).await;
|
|
|
|
let owner_tok = login(&server, &owner_email).await;
|
|
let member_tok = login(&server, &member_email).await;
|
|
|
|
// Bogus id: role guard should fire before the DB lookup.
|
|
let bogus = Uuid::now_v7();
|
|
|
|
for path in [
|
|
format!("/api/research/publish-approvals/{bogus}/approve"),
|
|
format!("/api/research/publish-approvals/{bogus}/reject"),
|
|
] {
|
|
let member_resp = server
|
|
.client
|
|
.post(format!("{}{path}", server.base))
|
|
.bearer_auth(&member_tok)
|
|
.json(&json!({}))
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
assert_eq!(
|
|
member_resp.status(),
|
|
StatusCode::FORBIDDEN,
|
|
"member should be forbidden on {path}"
|
|
);
|
|
|
|
let owner_resp = server
|
|
.client
|
|
.post(format!("{}{path}", server.base))
|
|
.bearer_auth(&owner_tok)
|
|
.json(&json!({}))
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
assert_eq!(
|
|
owner_resp.status(),
|
|
StatusCode::NOT_FOUND,
|
|
"owner should reach DB lookup + get 404 on {path}"
|
|
);
|
|
}
|
|
}
|