131 lines
4.3 KiB
JavaScript
131 lines
4.3 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import fs from 'node:fs/promises';
|
|
|
|
const base = 'http://127.0.0.1:8005';
|
|
function client() {
|
|
const cookies = new Map();
|
|
let csrf;
|
|
let version;
|
|
async function request(path, method = 'GET', data, inertia = true) {
|
|
const response = await fetch(base + path, {
|
|
method,
|
|
redirect: 'manual',
|
|
headers: {
|
|
Accept: inertia ? 'application/json' : 'text/html',
|
|
Cookie: [...cookies].map(([k, v]) => `${k}=${v}`).join('; '),
|
|
...(inertia
|
|
? {
|
|
'X-Inertia': 'true',
|
|
'X-Inertia-Version': version ?? '',
|
|
}
|
|
: {}),
|
|
...(data
|
|
? {
|
|
'Content-Type': 'application/json',
|
|
'X-CSRF-TOKEN': csrf,
|
|
}
|
|
: {}),
|
|
},
|
|
...(data ? { body: JSON.stringify(data) } : {}),
|
|
});
|
|
for (const cookie of response.headers.getSetCookie()) {
|
|
const pair = cookie.split(';', 1)[0],
|
|
i = pair.indexOf('=');
|
|
cookies.set(pair.slice(0, i), pair.slice(i + 1));
|
|
}
|
|
const text = await response.text();
|
|
return {
|
|
status: response.status,
|
|
location: response.headers.get('location'),
|
|
text,
|
|
page: response.headers
|
|
.get('content-type')
|
|
?.includes('application/json')
|
|
? JSON.parse(text)
|
|
: null,
|
|
};
|
|
}
|
|
return {
|
|
request,
|
|
async enter(role) {
|
|
let page = await request('/avaliar', 'GET', undefined, false);
|
|
assert.equal(page.status, 200);
|
|
csrf = page.text.match(/name="_token" value="([^"]+)"/)[1];
|
|
assert.equal(
|
|
(await request('/avaliar/entrar', 'POST', { role }, false))
|
|
.status,
|
|
302,
|
|
);
|
|
page = await request('/avaliar', 'GET', undefined, false);
|
|
csrf = page.text.match(/name="_token" value="([^"]+)"/)[1];
|
|
const dashboard = await request(
|
|
'/dashboard',
|
|
'GET',
|
|
undefined,
|
|
false,
|
|
);
|
|
const encoded = dashboard.text.match(
|
|
/<script data-page="app" type="application\/json">([\s\S]*?)<\/script>/,
|
|
);
|
|
assert.ok(encoded, 'Expected Inertia bootstrap data');
|
|
version = JSON.parse(encoded[1]).version;
|
|
},
|
|
};
|
|
}
|
|
|
|
const roles = [
|
|
'admin',
|
|
'requester',
|
|
'department_head',
|
|
'procurement',
|
|
'finance',
|
|
'warehouse',
|
|
];
|
|
let state;
|
|
for (const role of roles) {
|
|
const c = client();
|
|
await c.enter(role);
|
|
const response = await c.request('/administracao/parametrizacao');
|
|
if (role === 'admin') {
|
|
assert.equal(response.status, 200);
|
|
assert.equal(response.page.component, 'company/parameters');
|
|
assert.equal(response.page.props.ready, true);
|
|
assert.ok(response.page.props.permissions.admin);
|
|
assert.ok(
|
|
response.page.props.users.every(
|
|
(u) => !('password' in u) && !('remember_token' in u),
|
|
),
|
|
);
|
|
state = {
|
|
active: response.page.props.active,
|
|
version: response.page.props.version,
|
|
profiles: response.page.props.profiles.length,
|
|
};
|
|
} else assert.equal(response.status, 403, role);
|
|
assert.equal((await c.request('/logout', 'POST', {}, false)).status, 302);
|
|
}
|
|
await fs.writeFile(
|
|
'docs/proofs/organization-access-http.json',
|
|
JSON.stringify(
|
|
{
|
|
checked_at: new Date().toISOString(),
|
|
base,
|
|
path: '/administracao/parametrizacao',
|
|
roles,
|
|
owner_access: true,
|
|
other_legacy_profiles_refused: true,
|
|
passwords_not_returned: true,
|
|
configuration_state: state,
|
|
business_commands: 0,
|
|
accounts_created: 0,
|
|
permissions_changed: false,
|
|
visual_review: false,
|
|
},
|
|
null,
|
|
2,
|
|
) + '\n',
|
|
);
|
|
console.log(
|
|
'Administration parameters: owner access, six profiles, no exposed credentials or changed accounts.',
|
|
);
|