WorkRoot/WRNexusJS
2
0
Fork 0
Code Issues Pull Requests Actions 27 Packages Projects Releases Wiki Activity

fix(authz): cover grant/deny scope isolation and revoke scope-isolation in conformance suite

Browse Source
This commit is contained in:
Clintchiz
2026-08-04 16:43:08 +05:30
parent 9b6b970cae
commit a01b7bc99e
1 changed files with 42 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/authz/test/store-conformance.ts
+42
View File
@@ -85,6 +85,43 @@ export function runStoreConformance(name: string, makeStore: () => Promise<Permi
expect((await store.assignmentsFor("u1")).grants).toEqual([]);
});
test("a tenant-scoped grant does not leak into another tenant", async () => {
await store.grant("u1", "post:write", "allow", { tenantId: "t1" });
expect((await store.assignmentsFor("u1", { tenantId: "t1" })).grants).toEqual(["post:write"]);
expect((await store.assignmentsFor("u1", { tenantId: "t2" })).grants).toEqual([]);
});
test("a tenant-scoped deny does not leak into another tenant", async () => {
await store.grant("u1", "post:delete", "deny", { tenantId: "t1" });
expect((await store.assignmentsFor("u1", { tenantId: "t1" })).denies).toEqual([
"post:delete",
]);
expect((await store.assignmentsFor("u1", { tenantId: "t2" })).denies).toEqual([]);
});
test("a global grant is visible inside every tenant", async () => {
await store.grant("u1", "post:publish", "allow");
expect((await store.assignmentsFor("u1", { tenantId: "t1" })).grants).toEqual([
"post:publish",
]);
});
test("revokeGrant is scope-isolated: revoking a tenant-scoped grant leaves the global grant intact", async () => {
await store.grant("u1", "post:write", "allow");
await store.grant("u1", "post:write", "allow", { tenantId: "t1" });
await store.revokeGrant("u1", "post:write", { tenantId: "t1" });
expect((await store.assignmentsFor("u1")).grants).toEqual(["post:write"]);
expect((await store.assignmentsFor("u1", { tenantId: "t1" })).grants).toEqual(["post:write"]);
});
test("revokeRole is scope-isolated: revoking a tenant-scoped role leaves the global role intact", async () => {
await store.assignRole("u1", "editor");
await store.assignRole("u1", "editor", { tenantId: "t1" });
await store.revokeRole("u1", "editor", { tenantId: "t1" });
expect((await store.assignmentsFor("u1")).roles).toEqual(["editor"]);
expect((await store.assignmentsFor("u1", { tenantId: "t1" })).roles).toEqual(["editor"]);
});
test("listSubjects returns everyone with an assignment in scope", async () => {
await store.assignRole("u1", "editor", { tenantId: "t1" });
await store.assignRole("u2", "editor", { tenantId: "t1" });
@@ -97,5 +134,10 @@ export function runStoreConformance(name: string, makeStore: () => Promise<Permi
await store.assignRole("s1", "editor", { tenantId: "t1" });
expect(await store.listSubjects()).toEqual(["g1"]);
});
test("listSubjects credits grant-only subjects", async () => {
await store.grant("g1", "post:write", "allow", { tenantId: "t1" });
expect((await store.listSubjects({ tenantId: "t1" })).sort()).toEqual(["g1"]);
});
});
}