Nick.Rosenloecher/ApiCore
1
0 Fork 0
Code Issues 22 Pull Requests Actions 2 Packages Projects Releases Wiki Activity

feat: RBAC Phase 3 - LegacyRole-Enum, RolesGuard und @Roles vollstaendig entfernt

Browse Source 
Letzte Phase des RBAC-Umbaus: die transitionale Rollen-Infrastruktur,
die seit Phase 1 parallel zum neuen Role/Permission-System mitlief,
ist jetzt komplett weg.

- Prisma-Migration: User.legacyRole-Spalte und LegacyRole-Enum
  gedroppt (nichts liest die Spalte mehr, seit Phase 2 jeder Controller
  auf @RequirePermission laeuft).
- roles.guard.ts, roles.guard.spec.ts, roles.decorator.ts geloescht;
  RolesGuard aus den APP_GUARD-Providern entfernt.
- AuthenticatedUser/JWT-Payload verlieren das role-Feld (permissions
  werden ohnehin frisch pro Request aus der DB aufgeloest, nicht aus
  dem Claim).
- Users-API: CreateUserDto/UpdateUserDto akzeptieren jetzt roleId
  (eine echte Role.id) statt der alten role-Enum-Werte; UsersService
  validiert, dass die Rolle existiert und aktiv ist, bevor sie
  zugewiesen wird.
- Alle 34 e2e-Fixtures und der Seed-Script folgen dem neuen Schema.

Verifiziert: tsc, lint, build, unit (220/220), volle e2e-Suite
159/159 gruen - keine uebersprungenen Tests.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
This commit is contained in:
Nick SzaunigandClaude Sonnet 5 committed 2026-08-26 09:01:13 +02:00
1 parent 0284077d3b
commit ae53f7889e
51 files changed
+125 -224
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

ApiCore-Backend/test/apiaries.e2e-spec.ts
-2
View File
@@ -34,7 +34,6 @@ describe('Apiaries (e2e)', () => {
email: beekeeperEmail,
passwordHash,
name: 'Beekeeper',
legacyRole: 'BEEKEEPER',
role: { connect: { key: 'BEEKEEPER' } },
},
});
@@ -44,7 +43,6 @@ describe('Apiaries (e2e)', () => {
email: readonlyEmail,
passwordHash,
name: 'Readonly',
legacyRole: 'READONLY',
role: { connect: { key: 'READONLY' } },
},
});
ApiCore-Backend/test/audit-log.e2e-spec.ts
-2
View File
@@ -34,7 +34,6 @@ describe('Audit log (e2e)', () => {
email: adminEmail,
passwordHash,
name: 'Admin',
legacyRole: 'ADMIN',
role: { connect: { key: 'ADMIN' } },
},
});
@@ -44,7 +43,6 @@ describe('Audit log (e2e)', () => {
email: beekeeperEmail,
passwordHash,
name: 'Beekeeper',
legacyRole: 'BEEKEEPER',
role: { connect: { key: 'BEEKEEPER' } },
},
});
ApiCore-Backend/test/auth-throttle.e2e-spec.ts
-1
View File
@@ -24,7 +24,6 @@ describe('Auth login throttling (e2e)', () => {
email,
passwordHash,
name: 'Throttle E2E User',
legacyRole: 'STAFF',
role: { connect: { key: 'STAFF' } },
},
});
ApiCore-Backend/test/auth.e2e-spec.ts
-1
View File
@@ -23,7 +23,6 @@ describe('Auth (e2e)', () => {
email,
passwordHash,
name: 'Auth E2E User',
legacyRole: 'ADMIN',
role: { connect: { key: 'ADMIN' } },
},
});
ApiCore-Backend/test/authorization-coverage.e2e-spec.ts
+2 -8
View File
@@ -8,7 +8,6 @@ import {
import { PATH_METADATA } from '@nestjs/common/constants';
import { AppModule } from '../src/app.module';
import { IS_PUBLIC_KEY } from '../src/auth/decorators/public.decorator';
import { ROLES_KEY } from '../src/auth/decorators/roles.decorator';
import { REQUIRE_PERMISSION_KEY } from '../src/auth/decorators/require-permission.decorator';
import { PERMISSION_CATALOG } from '../src/auth/permissions/permission-catalog';
@@ -22,7 +21,7 @@ const ALLOWLIST = new Set([
]);
describe('Authorization coverage (e2e)', () => {
it('every non-public route requires a role or a catalog-valid permission', async () => {
it('every non-public route requires a catalog-valid permission', async () => {
const moduleRef = await Test.createTestingModule({
imports: [AppModule, DiscoveryModule],
}).compile();
@@ -64,19 +63,14 @@ describe('Authorization coverage (e2e)', () => {
continue;
}
const roles = reflector.getAllAndOverride<unknown[]>(ROLES_KEY, [
handler,
constructor,
]);
const permissions = reflector.getAllAndOverride<string[]>(
REQUIRE_PERMISSION_KEY,
[handler, constructor],
);
const hasRoles = Array.isArray(roles) && roles.length > 0;
const hasPermissions =
Array.isArray(permissions) && permissions.length > 0;
if (!hasRoles && !hasPermissions) {
if (!hasPermissions) {
uncoveredRoutes.push(routeKey);
}
if (hasPermissions) {
ApiCore-Backend/test/automation.e2e-spec.ts
-2
View File
@@ -38,7 +38,6 @@ describe('Automation rules (e2e)', () => {
email: adminEmail,
passwordHash,
name: 'Automation E2E Admin',
legacyRole: 'ADMIN',
role: { connect: { key: 'ADMIN' } },
},
});
@@ -48,7 +47,6 @@ describe('Automation rules (e2e)', () => {
email: staffEmail,
passwordHash,
name: 'Automation E2E Staff',
legacyRole: 'STAFF',
role: { connect: { key: 'STAFF' } },
},
});
ApiCore-Backend/test/bottling.e2e-spec.ts
-1
View File
@@ -41,7 +41,6 @@ describe('Bottling (e2e)', () => {
email: beekeeperEmail,
passwordHash,
name: 'Beekeeper',
legacyRole: 'BEEKEEPER',
role: { connect: { key: 'BEEKEEPER' } },
},
});
ApiCore-Backend/test/calendar.e2e-spec.ts
-1
View File
@@ -32,7 +32,6 @@ describe('Calendar (e2e)', () => {
email: beekeeperEmail,
passwordHash,
name: 'Beekeeper',
legacyRole: 'BEEKEEPER',
role: { connect: { key: 'BEEKEEPER' } },
},
});
ApiCore-Backend/test/colonies.e2e-spec.ts
-2
View File
@@ -46,7 +46,6 @@ describe('Colonies (e2e)', () => {
email: beekeeperEmail,
passwordHash,
name: 'Beekeeper',
legacyRole: 'BEEKEEPER',
role: { connect: { key: 'BEEKEEPER' } },
},
});
@@ -56,7 +55,6 @@ describe('Colonies (e2e)', () => {
email: staffEmail,
passwordHash,
name: 'Staff',
legacyRole: 'STAFF',
role: { connect: { key: 'STAFF' } },
},
});
ApiCore-Backend/test/dashboard.e2e-spec.ts
-1
View File
@@ -37,7 +37,6 @@ describe('Dashboard (e2e)', () => {
email: readonlyEmail,
passwordHash,
name: 'Readonly',
legacyRole: 'READONLY',
role: { connect: { key: 'READONLY' } },
},
});
ApiCore-Backend/test/documents.e2e-spec.ts
-2
View File
@@ -41,7 +41,6 @@ describe('Documents (e2e)', () => {
email: beekeeperEmail,
passwordHash,
name: 'Documents E2E Beekeeper',
legacyRole: 'BEEKEEPER',
role: { connect: { key: 'BEEKEEPER' } },
},
});
@@ -51,7 +50,6 @@ describe('Documents (e2e)', () => {
email: readonlyEmail,
passwordHash,
name: 'Documents E2E Readonly',
legacyRole: 'READONLY',
role: { connect: { key: 'READONLY' } },
},
});
ApiCore-Backend/test/equipment.e2e-spec.ts
-2
View File
@@ -34,7 +34,6 @@ describe('Equipment (e2e)', () => {
email: beekeeperEmail,
passwordHash,
name: 'Beekeeper',
legacyRole: 'BEEKEEPER',
role: { connect: { key: 'BEEKEEPER' } },
},
});
@@ -44,7 +43,6 @@ describe('Equipment (e2e)', () => {
email: staffEmail,
passwordHash,
name: 'Staff',
legacyRole: 'STAFF',
role: { connect: { key: 'STAFF' } },
},
});
ApiCore-Backend/test/export.e2e-spec.ts
-1
View File
@@ -29,7 +29,6 @@ describe('Export (e2e)', () => {
email: beekeeperEmail,
passwordHash,
name: 'Beekeeper',
legacyRole: 'BEEKEEPER',
role: { connect: { key: 'BEEKEEPER' } },
},
});
ApiCore-Backend/test/extractions.e2e-spec.ts
-2
View File
@@ -36,7 +36,6 @@ describe('Extractions (e2e)', () => {
email: beekeeperEmail,
passwordHash,
name: 'Beekeeper',
legacyRole: 'BEEKEEPER',
role: { connect: { key: 'BEEKEEPER' } },
},
});
@@ -46,7 +45,6 @@ describe('Extractions (e2e)', () => {
email: staffEmail,
passwordHash,
name: 'Staff',
legacyRole: 'STAFF',
role: { connect: { key: 'STAFF' } },
},
});
ApiCore-Backend/test/feedings.e2e-spec.ts
-2
View File
@@ -40,7 +40,6 @@ describe('Feedings (e2e)', () => {
email: staffEmail,
passwordHash,
name: 'Staff',
legacyRole: 'STAFF',
role: { connect: { key: 'STAFF' } },
},
});
@@ -50,7 +49,6 @@ describe('Feedings (e2e)', () => {
email: readonlyEmail,
passwordHash,
name: 'Readonly',
legacyRole: 'READONLY',
role: { connect: { key: 'READONLY' } },
},
});
ApiCore-Backend/test/harvests.e2e-spec.ts
-2
View File
@@ -37,7 +37,6 @@ describe('Harvests (e2e)', () => {
email: staffEmail,
passwordHash,
name: 'Staff',
legacyRole: 'STAFF',
role: { connect: { key: 'STAFF' } },
},
});
@@ -47,7 +46,6 @@ describe('Harvests (e2e)', () => {
email: readonlyEmail,
passwordHash,
name: 'Readonly',
legacyRole: 'READONLY',
role: { connect: { key: 'READONLY' } },
},
});
ApiCore-Backend/test/honey-batches.e2e-spec.ts
-2
View File
@@ -53,7 +53,6 @@ describe('Honey batches (e2e)', () => {
email: beekeeperEmail,
passwordHash,
name: 'Beekeeper',
legacyRole: 'BEEKEEPER',
role: { connect: { key: 'BEEKEEPER' } },
},
});
@@ -63,7 +62,6 @@ describe('Honey batches (e2e)', () => {
email: staffEmail,
passwordHash,
name: 'Staff',
legacyRole: 'STAFF',
role: { connect: { key: 'STAFF' } },
},
});
ApiCore-Backend/test/import.e2e-spec.ts
-2
View File
@@ -49,7 +49,6 @@ describe('Import (e2e)', () => {
email: adminEmail,
passwordHash,
name: 'Import E2E Admin',
legacyRole: 'ADMIN',
role: { connect: { key: 'ADMIN' } },
},
});
@@ -59,7 +58,6 @@ describe('Import (e2e)', () => {
email: staffEmail,
passwordHash,
name: 'Import E2E Staff',
legacyRole: 'STAFF',
role: { connect: { key: 'STAFF' } },
},
});
ApiCore-Backend/test/inspections.e2e-spec.ts
-2
View File
@@ -41,7 +41,6 @@ describe('Inspections (e2e)', () => {
email: staffEmail,
passwordHash,
name: 'Staff',
legacyRole: 'STAFF',
role: { connect: { key: 'STAFF' } },
},
});
@@ -51,7 +50,6 @@ describe('Inspections (e2e)', () => {
email: readonlyEmail,
passwordHash,
name: 'Readonly',
legacyRole: 'READONLY',
role: { connect: { key: 'READONLY' } },
},
});
ApiCore-Backend/test/notifications.e2e-spec.ts
-2
View File
@@ -34,7 +34,6 @@ describe('Notifications (e2e)', () => {
email: beekeeperEmail,
passwordHash,
name: 'Beekeeper',
legacyRole: 'BEEKEEPER',
role: { connect: { key: 'BEEKEEPER' } },
},
});
@@ -44,7 +43,6 @@ describe('Notifications (e2e)', () => {
email: staffEmail,
passwordHash,
name: 'Staff',
legacyRole: 'STAFF',
role: { connect: { key: 'STAFF' } },
},
});
ApiCore-Backend/test/products.e2e-spec.ts
-2
View File
@@ -34,7 +34,6 @@ describe('Products (e2e)', () => {
email: beekeeperEmail,
passwordHash,
name: 'Beekeeper',
legacyRole: 'BEEKEEPER',
role: { connect: { key: 'BEEKEEPER' } },
},
});
@@ -44,7 +43,6 @@ describe('Products (e2e)', () => {
email: staffEmail,
passwordHash,
name: 'Staff',
legacyRole: 'STAFF',
role: { connect: { key: 'STAFF' } },
},
});
ApiCore-Backend/test/public.e2e-spec.ts
-1
View File
@@ -42,7 +42,6 @@ describe('Public batch origin page (e2e)', () => {
email: beekeeperEmail,
passwordHash,
name: 'Beekeeper',
legacyRole: 'BEEKEEPER',
role: { connect: { key: 'BEEKEEPER' } },
},
});
ApiCore-Backend/test/qr.e2e-spec.ts
-1
View File
@@ -26,7 +26,6 @@ describe('QR codes (e2e)', () => {
email: beekeeperEmail,
passwordHash,
name: 'Beekeeper',
legacyRole: 'BEEKEEPER',
role: { connect: { key: 'BEEKEEPER' } },
},
});
ApiCore-Backend/test/queens.e2e-spec.ts
-1
View File
@@ -33,7 +33,6 @@ describe('Queens (e2e)', () => {
email: beekeeperEmail,
passwordHash,
name: 'Beekeeper',
legacyRole: 'BEEKEEPER',
role: { connect: { key: 'BEEKEEPER' } },
},
});
ApiCore-Backend/test/roles.e2e-spec.ts
-3
View File
@@ -19,7 +19,6 @@ interface RoleBody {
interface MeBody {
id: string;
email: string;
role: string;
roleKey: string;
permissions: string[];
}
@@ -57,7 +56,6 @@ describe('Roles (e2e)', () => {
email: adminEmail,
passwordHash,
name: 'Roles E2E Admin',
legacyRole: 'ADMIN',
role: { connect: { key: 'ADMIN' } },
},
});
@@ -67,7 +65,6 @@ describe('Roles (e2e)', () => {
email: staffEmail,
passwordHash,
name: 'Roles E2E Staff',
legacyRole: 'STAFF',
role: { connect: { key: 'STAFF' } },
},
});
ApiCore-Backend/test/search.e2e-spec.ts
-1
View File
@@ -39,7 +39,6 @@ describe('Search and filters (e2e)', () => {
email: readonlyEmail,
passwordHash,
name: 'Readonly',
legacyRole: 'READONLY',
role: { connect: { key: 'READONLY' } },
},
});
ApiCore-Backend/test/statistics.e2e-spec.ts
-1
View File
@@ -60,7 +60,6 @@ describe('Statistics (e2e)', () => {
email: beekeeperEmail,
passwordHash,
name: 'Beekeeper',
legacyRole: 'BEEKEEPER',
role: { connect: { key: 'BEEKEEPER' } },
},
});
ApiCore-Backend/test/storage.e2e-spec.ts
-2
View File
@@ -33,7 +33,6 @@ describe('Storage (e2e)', () => {
email: beekeeperEmail,
passwordHash,
name: 'Beekeeper',
legacyRole: 'BEEKEEPER',
role: { connect: { key: 'BEEKEEPER' } },
},
});
@@ -43,7 +42,6 @@ describe('Storage (e2e)', () => {
email: staffEmail,
passwordHash,
name: 'Staff',
legacyRole: 'STAFF',
role: { connect: { key: 'STAFF' } },
},
});
ApiCore-Backend/test/swarm-control.e2e-spec.ts
-2
View File
@@ -36,7 +36,6 @@ describe('Swarm control checks (e2e)', () => {
email: beekeeperEmail,
passwordHash,
name: 'Beekeeper',
legacyRole: 'BEEKEEPER',
role: { connect: { key: 'BEEKEEPER' } },
},
});
@@ -46,7 +45,6 @@ describe('Swarm control checks (e2e)', () => {
email: staffEmail,
passwordHash,
name: 'Staff',
legacyRole: 'STAFF',
role: { connect: { key: 'STAFF' } },
},
});
ApiCore-Backend/test/task-templates.e2e-spec.ts
-1
View File
@@ -31,7 +31,6 @@ describe('TaskTemplates (e2e)', () => {
email: beekeeperEmail,
passwordHash,
name: 'Beekeeper',
legacyRole: 'BEEKEEPER',
role: { connect: { key: 'BEEKEEPER' } },
},
});
ApiCore-Backend/test/tasks.e2e-spec.ts
-2
View File
@@ -34,7 +34,6 @@ describe('Tasks (e2e)', () => {
email: staffEmail,
passwordHash,
name: 'Staff',
legacyRole: 'STAFF',
role: { connect: { key: 'STAFF' } },
},
});
@@ -44,7 +43,6 @@ describe('Tasks (e2e)', () => {
email: readonlyEmail,
passwordHash,
name: 'Readonly',
legacyRole: 'READONLY',
role: { connect: { key: 'READONLY' } },
},
});
ApiCore-Backend/test/treatments.e2e-spec.ts
-2
View File
@@ -35,7 +35,6 @@ describe('Treatments (e2e)', () => {
email: beekeeperEmail,
passwordHash,
name: 'Beekeeper',
legacyRole: 'BEEKEEPER',
role: { connect: { key: 'BEEKEEPER' } },
},
});
@@ -45,7 +44,6 @@ describe('Treatments (e2e)', () => {
email: staffEmail,
passwordHash,
name: 'Staff',
legacyRole: 'STAFF',
role: { connect: { key: 'STAFF' } },
},
});
ApiCore-Backend/test/users.e2e-spec.ts
+7 -3
View File
@@ -17,18 +17,23 @@ describe('Users (e2e)', () => {
let adminAccessToken: string;
let staffAccessToken: string;
let createdUserId: string;
let beekeeperRoleId: string;
beforeAll(async () => {
app = await createTestApp();
prisma = app.get(PrismaService);
const beekeeperRole = await prisma.role.findUniqueOrThrow({
where: { key: 'BEEKEEPER' },
});
beekeeperRoleId = beekeeperRole.id;
const passwordHash = await bcrypt.hash(password, 12);
const admin = await prisma.user.create({
data: {
email: adminEmail,
passwordHash,
name: 'Users E2E Admin',
legacyRole: 'ADMIN',
role: { connect: { key: 'ADMIN' } },
},
});
@@ -38,7 +43,6 @@ describe('Users (e2e)', () => {
email: staffEmail,
passwordHash,
name: 'Users E2E Staff',
legacyRole: 'STAFF',
role: { connect: { key: 'STAFF' } },
},
});
@@ -76,7 +80,7 @@ describe('Users (e2e)', () => {
email: `users-e2e-created-${Date.now()}@example.com`,
password: 'AnotherSecret123!',
name: 'Created via e2e',
role: 'BEEKEEPER',
roleId: beekeeperRoleId,
})
.expect(201);
const created = response.body as UserBody & { passwordHash?: string };
ApiCore-Backend/test/utils/api.ts
+3 -1
View File
@@ -11,7 +11,9 @@ export interface UserBody {
id: string;
email: string;
name: string;
role: string;
roleId: string;
roleKey: string;
roleName: string;
isActive: boolean;
createdAt: string;
deactivatedAt: string | null;
ApiCore-Backend/test/varroa.e2e-spec.ts
-2
View File
@@ -35,7 +35,6 @@ describe('Varroa measurements (e2e)', () => {
email: beekeeperEmail,
passwordHash,
name: 'Beekeeper',
legacyRole: 'BEEKEEPER',
role: { connect: { key: 'BEEKEEPER' } },
},
});
@@ -45,7 +44,6 @@ describe('Varroa measurements (e2e)', () => {
email: staffEmail,
passwordHash,
name: 'Staff',
legacyRole: 'STAFF',
role: { connect: { key: 'STAFF' } },
},
});
ApiCore-Backend/test/webhooks.e2e-spec.ts
-2
View File
@@ -48,7 +48,6 @@ describe('Webhooks (e2e)', () => {
email: adminEmail,
passwordHash,
name: 'Webhooks E2E Admin',
legacyRole: 'ADMIN',
role: { connect: { key: 'ADMIN' } },
},
});
@@ -58,7 +57,6 @@ describe('Webhooks (e2e)', () => {
email: staffEmail,
passwordHash,
name: 'Webhooks E2E Staff',
legacyRole: 'STAFF',
role: { connect: { key: 'STAFF' } },
},
});