compras/scripts/evaluation-access-check.mjs

import assert from 'node:assert/strict';
import fs from 'node:fs/promises';

const base = 'http://127.0.0.1:8005';
const cookies = new Map();
async function request(
    path,
    method = 'GET',
    body,
    accept = 'application/json',
) {
    const response = await fetch(base + path, {
        method,
        redirect: 'manual',
        headers: {
            Accept: accept,
            Cookie: [...cookies].map(([k, v]) => `${k}=${v}`).join('; '),
            ...(body
                ? { 'Content-Type': 'application/x-www-form-urlencoded' }
                : {}),
        },
        ...(body ? { body: new URLSearchParams(body) } : {}),
    });
    for (const cookie of response.headers.getSetCookie()) {
        const pair = cookie.split(';', 1)[0],
            index = pair.indexOf('=');
        cookies.set(pair.slice(0, index), pair.slice(index + 1));
    }
    return {
        status: response.status,
        text: await response.text(),
        location: response.headers.get('location'),
    };
}
const token = (text) => text.match(/name="_token" value="([^"]+)"/)[1];
async function enter(role, destination = '/dashboard') {
    const page = await request('/avaliar');
    assert.equal(page.status, 200);
    const entered = await request('/avaliar/entrar', 'POST', {
        role,
        _token: token(page.text),
    });
    assert.equal(entered.status, 302, role);
    assert.equal(new URL(entered.location).pathname, destination);
    assert.equal((await request('/dashboard')).status, 200);
    return entered;
}
let page = await request('/avaliar');
const guestReport = await request(
    '/relatorios?status=approved',
    'GET',
    undefined,
    'text/html',
);
assert.equal(guestReport.status, 302);
assert.equal(new URL(guestReport.location).pathname, '/avaliar');
assert.equal(
    new URL((await request('/login', 'GET', undefined, 'text/html')).location)
        .pathname,
    '/avaliar',
);
assert.equal(
    (await request('/avaliar/entrar', 'POST', { role: 'admin' })).status,
    419,
);
assert.equal(
    (
        await request('/avaliar/entrar', 'POST', {
            role: 'root',
            _token: token(page.text),
        })
    ).status,
    422,
);
assert.equal(
    (
        await request('/avaliar/entrar', 'POST', {
            role: 'admin',
            user_id: '1',
            _token: token(page.text),
        })
    ).status,
    422,
);
const reportEntry = await enter('admin', '/relatorios');
assert.equal(
    new URL(reportEntry.location).searchParams.get('status'),
    'approved',
);
const modules = [
    '/dashboard',
    '/empresa',
    '/requisicoes',
    '/planeamento',
    '/fornecedores',
    '/cotacoes',
    '/ordens',
    '/recepcoes',
    '/stock',
    '/stock/operacoes',
    '/equipamentos',
    '/orcamentos',
    '/regras-investimento',
    '/facturas',
    '/pagamentos',
    '/obrigacoes-fornecedores',
    '/conflitos',
    '/revisao-compras',
    '/politica-admissao',
    '/politica-recomendacao',
    '/relatorios',
    '/relatorios/medidas-fornecedores',
    '/administracao/parametrizacao',
];
for (const path of modules)
    assert.equal((await request(path)).status, 200, path);
const roles = [
    'requester',
    'department_head',
    'procurement',
    'finance',
    'warehouse',
    'admin',
];
for (const role of roles) await enter(role);
page = await request('/avaliar');
assert.equal(
    (await request('/logout', 'POST', { _token: token(page.text) })).status,
    204,
);
assert.equal((await request('/empresa')).status, 401);
assert.equal((await request('/dashboard')).status, 200);
assert.equal((await request('/empresa')).status, 200);
assert.equal((await request('/administracao/parametrizacao')).status, 200);
page = await request('/avaliar');
assert.equal(
    (await request('/logout', 'POST', { _token: token(page.text) })).status,
    204,
);
assert.equal((await request('/empresa')).status, 401);
const operational = await fetch('http://127.0.0.1:8015/avaliar', {
    redirect: 'manual',
}).catch(() => null);
if (operational)
    assert.equal(
        operational.status,
        404,
        'Evaluation entry must not exist on the normal installation',
    );
await fs.mkdir('docs/proofs', { recursive: true });
await fs.writeFile(
    'docs/proofs/evaluation-access.json',
    JSON.stringify(
        {
            checked_at: new Date().toISOString(),
            base,
            owner_modules: modules,
            roles,
            csrf_enforced: true,
            arbitrary_role_refused: true,
            arbitrary_user_refused: true,
            logout: true,
            business_commands: 0,
            real_accounts_changed: false,
            operational_entry_status: operational?.status ?? 'not running',
            visual_review: false,
            dashboard_auto_entry: true,
            other_routes_require_session: true,
            guest_report_redirect: true,
            intended_report_and_filters_preserved: true,
        },
        null,
        2,
    ) + '\n',
);
console.log(
    'Owner entry, 23 module pages, six roles, report return, CSRF, rejected identifiers and logout passed.',
);