Clintchiz
703baa1ead
Move the "don't gate on permissionsFor() with permissionMatches" warning onto permissionMatches itself so it's visible via autocomplete, not just on AuthzResolver.permissionsFor. Round out exports.test.ts to cover scopeKey, safeRecord, and AUTHZ_LOCALS_KEY, closing the gap where dropping either export from index.ts would not fail the test.
57 lines
1.4 KiB
TypeScript
57 lines
1.4 KiB
TypeScript
import { describe, expect, test } from "bun:test";
|
|
import * as authz from "../src/index.ts";
|
|
|
|
describe("@wrnexus/authz exports", () => {
|
|
test("keeps the pre-existing surface", () => {
|
|
for (const name of [
|
|
"defineRbac",
|
|
"hasRole",
|
|
"any",
|
|
"all",
|
|
"attr",
|
|
"authorize",
|
|
"requireRole",
|
|
"requirePermission",
|
|
"allow",
|
|
"deny",
|
|
"decision",
|
|
"owner",
|
|
"anyDecision",
|
|
"allDecisions",
|
|
"authorizeDecision",
|
|
"filterAuthorized",
|
|
]) {
|
|
expect(typeof (authz as Record<string, unknown>)[name]).toBe("function");
|
|
}
|
|
});
|
|
|
|
test("adds the registry, store, engine, and middleware surface", () => {
|
|
for (const name of [
|
|
"defineAuthz",
|
|
"mergeCatalogs",
|
|
"emptyCatalog",
|
|
"memoryPermissionStore",
|
|
"cachedPermissionStore",
|
|
"memoryAuditSink",
|
|
"consoleAuditSink",
|
|
"createAuthzResolver",
|
|
"expandRoles",
|
|
"permissionMatches",
|
|
"deniedBy",
|
|
"authzMiddleware",
|
|
"can",
|
|
"decideFor",
|
|
"guardPermission",
|
|
"filterCan",
|
|
"scopeKey",
|
|
"safeRecord",
|
|
]) {
|
|
expect(typeof (authz as Record<string, unknown>)[name]).toBe("function");
|
|
}
|
|
});
|
|
|
|
test("exports the locals key used to reach the per-request resolver", () => {
|
|
expect(typeof (authz as Record<string, unknown>).AUTHZ_LOCALS_KEY).toBe("string");
|
|
});
|
|
});
|