33 lines
2.9 KiB
JavaScript
33 lines
2.9 KiB
JavaScript
// Directed HTTP checks; no business operations or credential output.
|
|
import fs from 'node:fs/promises';
|
|
import assert from 'node:assert/strict';
|
|
const fixture=JSON.parse(await fs.readFile('C:/laragon/data/sgf-tempo/secrets/browser-fixture.json','utf8'));
|
|
assert.equal(fixture.product_demo?.version,'SGF-PRODUCT-DEMO-v1');
|
|
const base='http://127.0.0.1:8002';
|
|
const results=[];
|
|
for(const [role,email,paths,forbidden] of [
|
|
['preparador','gestor@example.test',['workshop','workshop-billing','workshop-corrections','direct-costs','industrial-costs','industrial-budgets','service-invoices','service-receivables'],null],
|
|
['validador','consulta@example.test',['workshop','workshop-billing','workshop-corrections','direct-costs','industrial-costs','industrial-budgets','service-invoices','service-receivables'],null],
|
|
['tecnico','tecnico-oficina@example.test',['workshop'],'industrial-costs'],
|
|
['verificador','verificador-oficina@example.test',['workshop'],'service-receivables'],
|
|
]) {
|
|
const cookies=new Map();let csrf='',context='';
|
|
async function request(path,method='GET',body){
|
|
const response=await fetch(base+path,{method,headers:{Accept:'application/json','Content-Type':'application/json',Cookie:[...cookies].map(([k,v])=>`${k}=${v}`).join('; '),'X-CSRF-TOKEN':csrf,'X-SGF-Context':context},...(body===undefined?{}:{body:JSON.stringify(body)})});
|
|
for(const c of response.headers.getSetCookie()){const pair=c.split(';',1)[0],i=pair.indexOf('=');cookies.set(pair.slice(0,i),pair.slice(i+1));}
|
|
const data=await response.json().catch(()=>({}));if(data.csrf)csrf=data.csrf;if(data.context?.token)context=data.context.token;
|
|
return {status:response.status,data};
|
|
}
|
|
assert.equal((await request('/api/session')).status,200);
|
|
assert.equal((await request('/api/login','POST',{email,password:fixture.password})).status,200,role+' login');
|
|
assert.equal((await request('/api/context','POST',{tenant_id:fixture.tenant,company_id:fixture.company,unit_id:fixture.unit})).status,200);
|
|
for(const path of paths)assert.equal((await request('/api/'+path)).status,200,role+' '+path);
|
|
if(forbidden)assert.equal((await request('/api/'+forbidden)).status,403,role+' forbidden module');
|
|
assert.equal((await request('/api/context','POST',{tenant_id:fixture.tenant,company_id:fixture.company,unit_id:fixture.hidden})).status,403,role+' reserved unit');
|
|
assert.equal((await request('/api/logout','POST')).status,200);
|
|
results.push({role,modules:paths,unauthorised_unit_refused:true,...(forbidden?{unauthorised_module_refused:forbidden}:{})});
|
|
}
|
|
const report={demo:fixture.product_demo.version,checked_at:new Date().toISOString(),type:'HTTP integration, not visual acceptance',business_operations_changed:false,results};
|
|
await fs.writeFile('docs/proofs/product-demo-http.json',JSON.stringify(report,null,2)+'\n');
|
|
console.log('Integrated demo HTTP checks passed for four synthetic functions, module access and unit isolation. No business writes.');
|