47 lines
2.9 KiB
JavaScript
47 lines
2.9 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import fs from 'node:fs/promises';
|
|
|
|
const base = 'http://127.0.0.1:8002';
|
|
const cookies = new Map();
|
|
let csrf = '', context = '';
|
|
async function request(path, method = 'GET', body) {
|
|
const response = await fetch(base + path, {method, redirect: 'manual', headers: {
|
|
Accept: 'application/json', Cookie: [...cookies].map(([k,v]) => `${k}=${v}`).join('; '),
|
|
'Content-Type': 'application/x-www-form-urlencoded', 'X-CSRF-TOKEN': csrf, 'X-SGF-Context': context,
|
|
}, ...(body ? {body: new URLSearchParams(body)} : {})});
|
|
for (const cookie of response.headers.getSetCookie()) {
|
|
const pair = cookie.split(';', 1)[0], index = pair.indexOf('=');
|
|
cookies.set(pair.slice(0, index), pair.slice(index + 1));
|
|
}
|
|
return {status: response.status, text: await response.text()};
|
|
}
|
|
async function enter() {
|
|
const page = await request('/avaliar');
|
|
assert.equal(page.status, 200);
|
|
csrf = page.text.match(/name="_token" value="([^"]+)"/)[1];
|
|
assert.equal((await request('/avaliar/entrar', 'POST', {role: 'proprietario', _token: csrf})).status, 302);
|
|
const session = JSON.parse((await request('/api/session')).text);
|
|
assert.equal(session.user.email, 'proprietario-avaliacao@example.test');
|
|
assert(session.context);
|
|
csrf = session.csrf; context = session.context.token;
|
|
return session;
|
|
}
|
|
const first = await enter();
|
|
const modules = ['a/clients','a/services','a/service_drafts','a/billing_drafts','workshop','workshop-billing',
|
|
'workshop-corrections','direct-costs','industrial-costs','industrial-budgets','service-invoices',
|
|
'service-receivables','service-fiscal','catalogue-accounting','document-preview/model','accesses'];
|
|
for (const module of modules) assert.equal((await request('/api/' + module)).status, 200, module);
|
|
for (const permission of ['workshop.record', 'workshop.verify', 'direct_costs.prepare', 'direct_costs.validate',
|
|
'industrial_costs.prepare', 'industrial_costs.validate', 'catalogue_accounting.propose', 'catalogue_accounting.approve']) {
|
|
assert(first.context.grants.some(g => g.permission === permission), permission);
|
|
}
|
|
assert.equal((await request('/avaliar/entrar', 'POST', {role: 'proprietario', user_id: '1', _token: csrf})).status, 422);
|
|
const second = await enter();
|
|
assert.equal(second.user.id, first.user.id);
|
|
assert.deepEqual(second.context.grants, first.context.grants, 'Re-entry must not duplicate grants');
|
|
await fs.writeFile('docs/proofs/local-owner-access.json', JSON.stringify({checked_at: new Date().toISOString(),
|
|
instance: base, synthetic_owner: true, consulted_modules: modules, grants: second.context.grants.length,
|
|
repeated_entry_stable: true, arbitrary_user_refused: true, business_commands: 0, real_accounts_changed: false,
|
|
process_separation_rules_removed: false, ssh_used: false, visual_review: false}, null, 2) + '\n');
|
|
console.log('Local owner entry, 16 module queries, combined permissions and repeat entry passed.');
|