testServerAccess

tcmts.cli.sync.testServerAccess · #yjusu75m · term
import { authorFor, branchFor, callerOf, refusal, tokenDigest } from "#codebase/tcmts/cli/sync";
import type { Caller } from "#codebase/tcmts/cli/sync";
import assert from "node:assert/strict";

export const testServerAccess = () => {
  const users = [{ handle: "ada", digest: tokenDigest("ada-token"), added: 0 }];
  assert.deepEqual(callerOf(users, "Bearer main-token", "main-token", false), {
    role: "maintainer",
  });
  assert.deepEqual(callerOf(users, "Bearer ada-token", "main-token", false), {
    role: "contributor",
    handle: "ada",
  });
  assert.equal(
    callerOf(users, "Bearer nope", "main-token", true),
    undefined,
    "a wrong token is no one, public or not",
  );
  assert.equal(callerOf(users, undefined, "main-token", false), undefined);
  assert.deepEqual(callerOf(users, undefined, "main-token", true), { role: "reader" });

  const ada: Caller = { role: "contributor", handle: "ada" };
  const reader: Caller = { role: "reader" };
  const owners: Record<number, string> = { 1: "@ada/faster", 2: "@grace/x" };
  const refused = (c: Caller, route: string, body: Record<string, unknown> = {}) =>
    refusal(c, route, body, (id) => owners[id]);

  for (const route of ["missing", "get", "branch", "contributions", "contribution", "whoami"])
    assert.equal(refused(reader, route), undefined, `anyone reads: ${route}`);
  assert.match(refused(reader, "put")!, /put needs a token/);
  assert.match(refused(reader, "comment")!, /needs a token/);
  for (const route of [
    "run",
    "merge-contribution",
    "put-results",
    "put-lints",
    "put-releases",
    "users",
    "add-user",
  ]) {
    assert.match(refused(ada, route)!, /only the server's maintainer can/, route);
    assert.equal(refused({ role: "maintainer" }, route), undefined, route);
  }
  assert.equal(refused(ada, "set-branch", { name: "@ada/faster" }), undefined);
  assert.match(
    refused(ada, "set-branch", { name: "main" })!,
    /can't push main: contributors push branches under @ada\//,
  );
  assert.match(refused(ada, "set-branch", { name: "@grace/x" })!, /can't push @grace\/x/);
  assert.match(
    refused(ada, "set-branch", { name: "@ada/" })!,
    /can't push/,
    "a branch under the prefix, not the prefix",
  );
  assert.match(refused(ada, "set-branch", { name: "@adam/x" })!, /can't push/);
  assert.equal(
    refused(ada, "open-contribution", { source: "@ada/faster", target: "main" }),
    undefined,
  );
  assert.match(refused(ada, "open-contribution", { source: "faster" })!, /can't propose faster/);
  assert.equal(refused(ada, "close-contribution", { id: 1 }), undefined);
  assert.match(refused(ada, "close-contribution", { id: 2 })!, /can't close #2: it isn't theirs/);
  assert.match(refused(ada, "reopen-contribution", { id: 3 })!, /can't reopen #3/);

  assert.equal(branchFor(ada, "faster"), "@ada/faster");
  assert.equal(branchFor(ada, "@ada/faster"), "@ada/faster");
  assert.equal(branchFor({ role: "maintainer" }, "faster"), "faster");
  assert.equal(authorFor(ada, "grace"), "@ada", "a contributor signs as themselves");
  assert.equal(authorFor({ role: "maintainer" }, "grace"), "grace");
}
testServerAccess

uses
