commit5

scripts/evaluation-access-check.mjs

@@ -0,0 +1,48 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+
+const base = 'http://127.0.0.1:8005';
+const cookies = new Map();
+async function request(path, method = 'GET', body) {
+    const response = await fetch(base + path, {method, redirect: 'manual', headers: {
+        Accept: 'application/json', Cookie: [...cookies].map(([k,v]) => `${k}=${v}`).join('; '),
+        ...(body ? {'Content-Type': 'application/x-www-form-urlencoded'} : {}),
+    }, ...(body ? {body: new URLSearchParams(body)} : {})});
+    for (const cookie of response.headers.getSetCookie()) {
+        const pair = cookie.split(';', 1)[0], index = pair.indexOf('=');
+        cookies.set(pair.slice(0,index),pair.slice(index+1));
+    }
+    return {status: response.status, text: await response.text(), location: response.headers.get('location')};
+}
+const token = text => text.match(/name="_token" value="([^"]+)"/)[1];
+async function enter(role) {
+    const page = await request('/avaliar');
+    assert.equal(page.status, 200);
+    const entered = await request('/avaliar/entrar', 'POST', {role, _token: token(page.text)});
+    assert.equal(entered.status, 302, role);
+    assert.equal(new URL(entered.location).pathname, '/dashboard');
+    assert.equal((await request('/dashboard')).status, 200);
+}
+let page = await request('/avaliar');
+assert.equal((await request('/avaliar/entrar','POST',{role:'admin'})).status,419);
+assert.equal((await request('/avaliar/entrar','POST',{role:'root',_token:token(page.text)})).status,422);
+assert.equal((await request('/avaliar/entrar','POST',{role:'admin',user_id:'1',_token:token(page.text)})).status,422);
+await enter('admin');
+const modules = ['/dashboard','/empresa','/requisicoes','/planeamento','/fornecedores','/cotacoes','/ordens',
+    '/recepcoes','/stock','/stock/operacoes','/equipamentos','/orcamentos','/regras-investimento','/facturas',
+    '/pagamentos','/obrigacoes-fornecedores','/conflitos','/revisao-compras','/politica-admissao','/politica-recomendacao'];
+for (const path of modules) assert.equal((await request(path)).status,200,path);
+const roles = ['requester','department_head','procurement','finance','warehouse','admin'];
+for (const role of roles) await enter(role);
+page = await request('/avaliar');
+assert.equal((await request('/logout','POST',{_token:token(page.text)})).status,204);
+assert.equal((await request('/dashboard')).status,401);
+assert.equal((await request('/empresa')).status,401);
+const operational = await fetch('http://127.0.0.1:8015/avaliar', {redirect:'manual'}).catch(() => null);
+if (operational) assert.equal(operational.status,404,'Evaluation entry must not exist on the normal installation');
+await fs.mkdir('docs/proofs',{recursive:true});
+await fs.writeFile('docs/proofs/evaluation-access.json',JSON.stringify({checked_at:new Date().toISOString(),base,
+    owner_modules:modules,roles,csrf_enforced:true,arbitrary_role_refused:true,arbitrary_user_refused:true,logout:true,
+    business_commands:0,real_accounts_changed:false,operational_entry_status:operational?.status??'not running',
+    visual_review:false},null,2)+'\n');
+console.log('Owner entry, 20 module pages, six roles, CSRF, rejected identifiers and logout passed.');