ApiCore/ApiCore-Backend/test/compliance-permissions.e2e-spec.ts

import { PERMISSION_CATALOG } from '../src/auth/permissions/permission-catalog';
import { PrismaService } from '../src/prisma/prisma.service';

const NEW_KEYS = [
  'veterinary-medicines:read',
  'veterinary-medicines:create',
  'veterinary-medicines:update',
  'compliance:read',
  'compliance:manage',
] as const;

/**
 * The migrations grant the T6 permissions to the system roles (the boot-time
 * catalog sync only grants new permissions to ADMIN). Checked against the
 * migrated test database.
 */
describe('T6 permissions (e2e)', () => {
  let prisma: PrismaService;

  beforeAll(() => {
    prisma = new PrismaService();
  });

  afterAll(async () => {
    await prisma.$disconnect();
  });

  async function newKeysOf(roleKey: string): Promise<string[]> {
    const grants = await prisma.rolePermission.findMany({
      where: {
        role: { key: roleKey },
        permission: { key: { in: [...NEW_KEYS] } },
      },
      include: { permission: { select: { key: true } } },
    });
    return grants.map((grant) => grant.permission.key).sort();
  }

  it('BEEKEEPER holds compliance:manage and veterinary-medicines:update', async () => {
    const keys = await newKeysOf('BEEKEEPER');

    expect(keys).toEqual([...NEW_KEYS].sort());
    expect(keys).toContain('compliance:manage');
    expect(keys).toContain('veterinary-medicines:update');
  });

  it('ADMIN holds all five', async () => {
    expect(await newKeysOf('ADMIN')).toEqual([...NEW_KEYS].sort());
  });

  it('STAFF holds compliance:read and veterinary-medicines:create but not compliance:manage', async () => {
    const keys = await newKeysOf('STAFF');

    expect(keys).toContain('compliance:read');
    expect(keys).toContain('veterinary-medicines:create');
    expect(keys).not.toContain('compliance:manage');
    expect(keys).toEqual(
      [
        'veterinary-medicines:read',
        'veterinary-medicines:create',
        'veterinary-medicines:update',
        'compliance:read',
      ].sort(),
    );
  });

  it('READONLY holds the two read permissions only', async () => {
    expect(await newKeysOf('READONLY')).toEqual(
      ['compliance:read', 'veterinary-medicines:read'].sort(),
    );
  });

  it('API_CLIENT holds none of the five new permissions', async () => {
    expect(await newKeysOf('API_CLIENT')).toEqual([]);
  });

  it('the database rows carry the catalog labels, groups and sort order', async () => {
    const rows = await prisma.permission.findMany({
      where: { key: { in: [...NEW_KEYS] } },
    });

    expect(rows).toHaveLength(NEW_KEYS.length);
    for (const row of rows) {
      const entry = PERMISSION_CATALOG.find((e) => e.key === row.key);
      expect(entry).toBeDefined();
      expect({
        resource: row.resource,
        action: row.action,
        labelDe: row.labelDe,
        groupDe: row.groupDe,
        sortOrder: row.sortOrder,
      }).toEqual({
        resource: entry?.resource,
        action: entry?.action,
        labelDe: entry?.labelDe,
        groupDe: entry?.groupDe,
        sortOrder: entry?.sortOrder,
      });
    }
  });

  it('the catalog groups the new permissions at 3700 and 3800', () => {
    const order = (key: string) =>
      PERMISSION_CATALOG.find((e) => e.key === key)?.sortOrder;
    const group = (key: string) =>
      PERMISSION_CATALOG.find((e) => e.key === key)?.groupDe;

    expect(order('veterinary-medicines:read')).toBe(3700);
    expect(order('veterinary-medicines:create')).toBe(3701);
    expect(order('veterinary-medicines:update')).toBe(3702);
    expect(order('compliance:read')).toBe(3800);
    expect(order('compliance:manage')).toBe(3801);
    expect(group('veterinary-medicines:read')).toBe('Tierarzneimittel');
    expect(group('compliance:manage')).toBe('Prüfbereitschaft & Behörden');
  });
});