Add Logbuch: project update blog with admin, media and API

Public archive with sidebar navigation, project pages, month archive,
search and entry pages with image blocks. Admin area for brands,
projects, post types, users, api clients, media and the entry editor
with drag and drop images, preview per audience, scheduling and
publish checks. Read and write API with bearer tokens, audience
scoping, idempotent creation, OpenAPI document and editorial guide.
Magic link login with configurable allowed domains, whole app behind
the session gate. 456 tests including design rule checks.

tests/lib/auth-access.test.ts

@@ -0,0 +1,144 @@
+import { describe, expect, it } from 'vitest'
+import {
+	canAccessProject,
+	canManageInstance,
+	canOpenAdmin,
+	isAdmin,
+	isModeratorOf,
+	moderatedProjectIds,
+	visibleProjects,
+	type Viewer,
+} from '~/lib/auth-access'
+
+const trakk = '11111111-1111-4111-8111-111111111111'
+const mta360 = '22222222-2222-4222-8222-222222222222'
+
+function viewer(overrides: Partial<Viewer> = {}): Viewer {
+	return {
+		id: 'user-1',
+		name: 'Paul',
+		email: 'paul@example.test',
+		isAdmin: false,
+		assignments: [],
+		...overrides,
+	}
+}
+
+describe('isAdmin', () => {
+	it('erkennt das Verwaltungsrecht', () => {
+		expect(isAdmin(viewer({ isAdmin: true }))).toBe(true)
+	})
+
+	it('gilt nicht für ein Konto ohne Verwaltungsrecht', () => {
+		expect(isAdmin(viewer())).toBe(false)
+	})
+
+	it('gilt nicht ohne Sitzung', () => {
+		expect(isAdmin(null)).toBe(false)
+	})
+})
+
+describe('moderatedProjectIds', () => {
+	it('liefert die Projekte der Moderatorenrolle', () => {
+		const person = viewer({ assignments: [{ projectId: trakk, role: 'moderator' }] })
+
+		expect(moderatedProjectIds(person)).toEqual([trakk])
+	})
+
+	it('liefert jedes Projekt nur einmal', () => {
+		const person = viewer({
+			assignments: [
+				{ projectId: trakk, role: 'moderator' },
+				{ projectId: trakk, role: 'moderator' },
+			],
+		})
+
+		expect(moderatedProjectIds(person)).toEqual([trakk])
+	})
+
+	it('liefert nichts ohne Sitzung', () => {
+		expect(moderatedProjectIds(null)).toEqual([])
+	})
+
+	it('zählt Verwaltungsrecht nicht als Zuweisung', () => {
+		expect(moderatedProjectIds(viewer({ isAdmin: true }))).toEqual([])
+	})
+})
+
+describe('isModeratorOf', () => {
+	it('trifft auf das zugewiesene Projekt zu', () => {
+		const person = viewer({ assignments: [{ projectId: trakk, role: 'moderator' }] })
+
+		expect(isModeratorOf(person, trakk)).toBe(true)
+	})
+
+	it('trifft auf ein fremdes Projekt nicht zu', () => {
+		const person = viewer({ assignments: [{ projectId: trakk, role: 'moderator' }] })
+
+		expect(isModeratorOf(person, mta360)).toBe(false)
+	})
+
+	it('trifft auf einen Admin ohne Zuweisung nicht zu', () => {
+		expect(isModeratorOf(viewer({ isAdmin: true }), trakk)).toBe(false)
+	})
+})
+
+describe('canOpenAdmin', () => {
+	it('lässt einen Admin herein', () => {
+		expect(canOpenAdmin(viewer({ isAdmin: true }))).toBe(true)
+	})
+
+	it('lässt einen Moderator herein', () => {
+		expect(canOpenAdmin(viewer({ assignments: [{ projectId: trakk, role: 'moderator' }] }))).toBe(true)
+	})
+
+	it('sperrt ein angemeldetes Konto ohne Rolle aus', () => {
+		expect(canOpenAdmin(viewer())).toBe(false)
+	})
+
+	it('sperrt ohne Sitzung aus', () => {
+		expect(canOpenAdmin(null)).toBe(false)
+	})
+})
+
+describe('canAccessProject', () => {
+	it('gibt einem Admin jedes Projekt frei', () => {
+		expect(canAccessProject(viewer({ isAdmin: true }), mta360)).toBe(true)
+	})
+
+	it('gibt einem Moderator genau sein Projekt frei', () => {
+		const person = viewer({ assignments: [{ projectId: trakk, role: 'moderator' }] })
+
+		expect(canAccessProject(person, trakk)).toBe(true)
+		expect(canAccessProject(person, mta360)).toBe(false)
+	})
+
+	it('gibt ohne Sitzung nichts frei', () => {
+		expect(canAccessProject(null, trakk)).toBe(false)
+	})
+})
+
+describe('canManageInstance', () => {
+	it('bleibt Admins vorbehalten', () => {
+		expect(canManageInstance(viewer({ isAdmin: true }))).toBe(true)
+		expect(canManageInstance(viewer({ assignments: [{ projectId: trakk, role: 'moderator' }] }))).toBe(false)
+	})
+})
+
+describe('visibleProjects', () => {
+	const projects = [{ id: trakk }, { id: mta360 }]
+
+	it('zeigt einem Admin alle Projekte', () => {
+		expect(visibleProjects(viewer({ isAdmin: true }), projects)).toEqual(projects)
+	})
+
+	it('zeigt einem Moderator nur seine Projekte', () => {
+		const person = viewer({ assignments: [{ projectId: mta360, role: 'moderator' }] })
+
+		expect(visibleProjects(person, projects)).toEqual([{ id: mta360 }])
+	})
+
+	it('zeigt ohne Sitzung nichts', () => {
+		expect(visibleProjects(null, projects)).toEqual([])
+	})
+})