commit5

2026-10-30 10:55:18 +02:00
parent 0235c7609e
commit 48347e2d3a
161 changed files with 11814 additions and 265 deletions
@@ -0,0 +1,130 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+
+const base = 'http://127.0.0.1:8005';
+function client() {
+    const cookies = new Map();
+    let csrf;
+    let version;
+    async function request(path, method = 'GET', data, inertia = true) {
+        const response = await fetch(base + path, {
+            method,
+            redirect: 'manual',
+            headers: {
+                Accept: inertia ? 'application/json' : 'text/html',
+                Cookie: [...cookies].map(([k, v]) => `${k}=${v}`).join('; '),
+                ...(inertia
+                    ? {
+                          'X-Inertia': 'true',
+                          'X-Inertia-Version': version ?? '',
+                      }
+                    : {}),
+                ...(data
+                    ? {
+                          'Content-Type': 'application/json',
+                          'X-CSRF-TOKEN': csrf,
+                      }
+                    : {}),
+            },
+            ...(data ? { body: JSON.stringify(data) } : {}),
+        });
+        for (const cookie of response.headers.getSetCookie()) {
+            const pair = cookie.split(';', 1)[0],
+                i = pair.indexOf('=');
+            cookies.set(pair.slice(0, i), pair.slice(i + 1));
+        }
+        const text = await response.text();
+        return {
+            status: response.status,
+            location: response.headers.get('location'),
+            text,
+            page: response.headers
+                .get('content-type')
+                ?.includes('application/json')
+                ? JSON.parse(text)
+                : null,
+        };
+    }
+    return {
+        request,
+        async enter(role) {
+            let page = await request('/avaliar', 'GET', undefined, false);
+            assert.equal(page.status, 200);
+            csrf = page.text.match(/name="_token" value="([^"]+)"/)[1];
+            assert.equal(
+                (await request('/avaliar/entrar', 'POST', { role }, false))
+                    .status,
+                302,
+            );
+            page = await request('/avaliar', 'GET', undefined, false);
+            csrf = page.text.match(/name="_token" value="([^"]+)"/)[1];
+            const dashboard = await request(
+                '/dashboard',
+                'GET',
+                undefined,
+                false,
+            );
+            const encoded = dashboard.text.match(
+                /<script data-page="app" type="application\/json">([\s\S]*?)<\/script>/,
+            );
+            assert.ok(encoded, 'Expected Inertia bootstrap data');
+            version = JSON.parse(encoded[1]).version;
+        },
+    };
+}
+
+const roles = [
+    'admin',
+    'requester',
+    'department_head',
+    'procurement',
+    'finance',
+    'warehouse',
+];
+let state;
+for (const role of roles) {
+    const c = client();
+    await c.enter(role);
+    const response = await c.request('/administracao/parametrizacao');
+    if (role === 'admin') {
+        assert.equal(response.status, 200);
+        assert.equal(response.page.component, 'company/parameters');
+        assert.equal(response.page.props.ready, true);
+        assert.ok(response.page.props.permissions.admin);
+        assert.ok(
+            response.page.props.users.every(
+                (u) => !('password' in u) && !('remember_token' in u),
+            ),
+        );
+        state = {
+            active: response.page.props.active,
+            version: response.page.props.version,
+            profiles: response.page.props.profiles.length,
+        };
+    } else assert.equal(response.status, 403, role);
+    assert.equal((await c.request('/logout', 'POST', {}, false)).status, 302);
+}
+await fs.writeFile(
+    'docs/proofs/organization-access-http.json',
+    JSON.stringify(
+        {
+            checked_at: new Date().toISOString(),
+            base,
+            path: '/administracao/parametrizacao',
+            roles,
+            owner_access: true,
+            other_legacy_profiles_refused: true,
+            passwords_not_returned: true,
+            configuration_state: state,
+            business_commands: 0,
+            accounts_created: 0,
+            permissions_changed: false,
+            visual_review: false,
+        },
+        null,
+        2,
+    ) + '\n',
+);
+console.log(
+    'Administration parameters: owner access, six profiles, no exposed credentials or changed accounts.',
+);