logbuch/tests/lib/admin-users.test.ts

import { beforeEach, describe, expect, it } from 'vitest'
import { findUserById } from '~/data/repositories/users'
import { listAssignmentsForUser } from '~/data/repositories/user-roles'
import { performGrantRole, performRevokeRole, performSetUserAdmin } from '~/lib/admin-users'
import {
	adminViewer,
	auditEntries,
	form,
	makeBrand,
	makeProject,
	makeUser,
	moderatorViewer,
	resetAccounts,
} from '../support/admin'

beforeEach(resetAccounts)

describe('performSetUserAdmin', () => {
	it('gibt einem Konto das Verwaltungsrecht und protokolliert das', async () => {
		const user = await makeUser()

		const state = await performSetUserAdmin(adminViewer(), form({ userId: user.id, isAdmin: 'on' }))

		expect(state.status).toBe('ok')
		expect((await findUserById(user.id))?.isAdmin).toBe(true)
		expect((await auditEntries())[0]).toMatchObject({ action: 'user.admin.grant', entity: 'user', entityId: user.id })
	})

	it('entzieht das Verwaltungsrecht wieder', async () => {
		const user = await makeUser()

		await performSetUserAdmin(adminViewer(), form({ userId: user.id, isAdmin: 'on' }))
		await performSetUserAdmin(adminViewer(), form({ userId: user.id, isAdmin: '' }))

		expect((await findUserById(user.id))?.isAdmin).toBe(false)
		expect((await auditEntries())[0]?.action).toBe('user.admin.revoke')
	})

	it('lässt niemanden das eigene Verwaltungsrecht ändern', async () => {
		const user = await makeUser()

		const state = await performSetUserAdmin(adminViewer({ id: user.id }), form({ userId: user.id, isAdmin: '' }))

		expect(state.message).toBe('selfAdmin')
		expect(await auditEntries()).toHaveLength(0)
	})

	it('lässt einen Moderator keine Rechte vergeben', async () => {
		const user = await makeUser()

		const state = await performSetUserAdmin(moderatorViewer(), form({ userId: user.id, isAdmin: 'on' }))

		expect(state.message).toBe('forbidden')
		expect((await findUserById(user.id))?.isAdmin).toBe(false)
	})

	it('meldet ein unbekanntes Konto', async () => {
		const state = await performSetUserAdmin(adminViewer(), form({ userId: 'gibtsnicht', isAdmin: 'on' }))

		expect(state.message).toBe('notFound')
	})
})

describe('performGrantRole und performRevokeRole', () => {
	it('schaltet ein Konto für ein Projekt frei und protokolliert das', async () => {
		const brand = await makeBrand()
		const project = await makeProject(brand.id)
		const user = await makeUser()

		const state = await performGrantRole(adminViewer(), form({ userId: user.id, projectId: project.id }))

		expect(state.status).toBe('ok')
		expect(await listAssignmentsForUser(user.id)).toEqual([{ projectId: project.id, role: 'moderator' }])
		expect((await auditEntries())[0]).toMatchObject({ action: 'role.grant', entityId: user.id })
	})

	it('ist beim zweiten Freischalten nicht doppelt', async () => {
		const brand = await makeBrand()
		const project = await makeProject(brand.id)
		const user = await makeUser()

		await performGrantRole(adminViewer(), form({ userId: user.id, projectId: project.id }))
		await performGrantRole(adminViewer(), form({ userId: user.id, projectId: project.id }))

		expect(await listAssignmentsForUser(user.id)).toHaveLength(1)
	})

	it('entzieht die Freischaltung wieder', async () => {
		const brand = await makeBrand()
		const project = await makeProject(brand.id)
		const user = await makeUser()

		await performGrantRole(adminViewer(), form({ userId: user.id, projectId: project.id }))
		const state = await performRevokeRole(adminViewer(), form({ userId: user.id, projectId: project.id }))

		expect(state.status).toBe('ok')
		expect(await listAssignmentsForUser(user.id)).toHaveLength(0)
		expect((await auditEntries())[0]?.action).toBe('role.revoke')
	})

	it('lässt einen Moderator keine Freischaltung vergeben', async () => {
		const brand = await makeBrand()
		const project = await makeProject(brand.id)
		const user = await makeUser()

		const state = await performGrantRole(
			moderatorViewer([project.id]),
			form({ userId: user.id, projectId: project.id }),
		)

		expect(state.message).toBe('forbidden')
		expect(await listAssignmentsForUser(user.id)).toHaveLength(0)
	})

	it('meldet ein unbekanntes Projekt', async () => {
		const user = await makeUser()

		const state = await performGrantRole(
			adminViewer(),
			form({ userId: user.id, projectId: '11111111-1111-4111-8111-111111111111' }),
		)

		expect(state.message).toBe('notFound')
	})

	it('meldet eine Projektkennung, die keine Kennung ist', async () => {
		const user = await makeUser()

		const state = await performGrantRole(adminViewer(), form({ userId: user.id, projectId: 'trakk' }))

		expect(state.message).toBe('notFound')
	})
})