Preserva base local aceite de identidade e acessos

2026-10-25 21:29:22 +02:00
commit 26b80df545
112 changed files with 13259 additions and 0 deletions
@@ -0,0 +1,59 @@
+import fs from 'node:fs/promises';
+import assert from 'node:assert/strict';
+
+const base = 'http://127.0.0.1:8001';
+const fixture = JSON.parse(await fs.readFile('C:/laragon/data/sgf-tempo/secrets/browser-fixture.json', 'utf8'));
+const results = [];
+function client() {
+    const cookies = new Map();
+    let csrf = ''; let context = '';
+    return {
+        cookies,
+        async request(path, method = 'GET', body, {token = context, csrfHeader = true} = {}) {
+            const headers = {Accept:'application/json', 'Content-Type':'application/json', Cookie:[...cookies].map(([k,v]) => `${k}=${v}`).join('; '), 'X-SGF-Context':token};
+            if (csrfHeader) headers['X-CSRF-TOKEN'] = csrf;
+            const response = await fetch(base+path, {method, headers, ...(body === undefined ? {} : {body:JSON.stringify(body)})});
+            for (const cookie of response.headers.getSetCookie()) { const pair=cookie.split(';',1)[0]; const split=pair.indexOf('='); cookies.set(pair.slice(0,split),pair.slice(split+1)); }
+            const data = await response.json().catch(() => ({}));
+            if (data.csrf) csrf=data.csrf;
+            if (data.context?.token) context=data.context.token;
+            return {status:response.status,data};
+        },
+        async login(email) {
+            assert.equal((await this.request('/api/session')).status,200);
+            assert.equal((await this.request('/api/login','POST',{email,password:fixture.password})).status,200);
+        },
+        async select(company=fixture.company,unit=fixture.unit) {
+            const result=await this.request('/api/context','POST',{tenant_id:fixture.tenant,company_id:company,unit_id:unit});
+            assert.equal(result.status,200); return result.data.context.token;
+        }
+    };
+}
+const manager=client(); await manager.login('gestor@example.test'); const token=await manager.select();
+assert.equal((await manager.request(`/api/companies/${fixture.company}`,'PATCH',{name:'CSRF must refuse'},{csrfHeader:false})).status,419);
+results.push('CSRF: pedido de alteração sem token/origem válida recusado (419).');
+const reader=client(); await reader.login('consulta@example.test'); const readerToken=await reader.select();
+assert.equal((await reader.request(`/api/companies/${fixture.sibling}`)).status,403);
+assert.equal((await reader.request(`/api/units/${fixture.hidden}`)).status,403);
+assert.equal((await reader.request(`/api/companies/${fixture.company}`,'PATCH',{name:'Not allowed'})).status,403);
+results.push('URLs/API: empresa do mesmo tenant e unidade sem acesso recusadas; consulta não permite edição (403).');
+const grant={email:'consulta@example.test',permission:'company.edit',reason:'Prova HTTP sintética'};
+assert.equal((await manager.request('/api/accesses','POST',grant)).status,200);
+assert.equal((await reader.request(`/api/companies/${fixture.company}`,'PATCH',{name:'Empresa Horizonte — Prova HTTP'})).status,200);
+assert.equal((await manager.request('/api/accesses/revoke','POST',grant)).status,200);
+assert.equal((await reader.request(`/api/companies/${fixture.company}`,'PATCH',{name:'Revoked'})).status,403);
+results.push('Concessão e revogação: efeito no pedido seguinte em sessão independente (200 → 403).');
+await manager.select(fixture.sibling,null);
+assert.equal((await manager.request(`/api/companies/${fixture.company}`,'PATCH',{name:'Stale'},{token})).status,409);
+results.push('Formulário anterior à mudança de contexto recusado (409).');
+const limited=client(); await limited.login('limitado@example.test'); await limited.select();
+assert.equal((await limited.request('/api/accesses','POST',grant)).status,403);
+results.push('Gestor limitado não consegue conceder edição que não possui (403).');
+const oldCookies=new Map(reader.cookies);
+assert.equal((await reader.request('/api/logout','POST')).status,200);
+reader.cookies.clear(); for(const [key,value] of oldCookies) reader.cookies.set(key,value);
+assert.equal((await reader.request('/api/context')).status,401);
+results.push('Replay do cookie da sessão terminada recusado (401).');
+await manager.request('/api/logout','POST'); await limited.request('/api/logout','POST');
+await fs.writeFile(new URL('../docs/proofs/http-results.json',import.meta.url),JSON.stringify({environment:'sgf_tempo_test, browser-testing, localhost:8001',results},null,2));
+console.log(results.join('\n'));