Edwin van den Houdt
7ec13d8b59
Replace the FE-computed authorization anti-pattern in BriefStore.editable (derived from the unverified X-Role header) with server-computed decision flags, mirroring the existing HerregistratieDecisionsDto pattern: - Backend: Authz.cs is the single authorization helper — the SAME check (Authz.CanActOn) both gates BriefStore.Review's mutations and computes the BriefDecisionsDto flags shipped on every brief response, so emit and enforce can never drift. New GET /me returns coarse, role-derived capabilities (PRD-0002 SS6). - Every brief endpoint (including send, previously ungated on HttpContext) now returns a fresh BriefViewDto so decisions never go stale after a mutation. - FE: brief.store.ts reads canEdit/canApprove/canReject/canSend off the loaded decisions instead of computing them from currentRole(); the brief.machine carries decisions through every status transition. - New shared/domain/capability.ts + shared/application/access.store.ts + shared/infrastructure/me.adapter.ts: the general capability-spine infrastructure (AccessStore.can(), capabilityGuard) for future routes. Deviates from the original WP-18 draft by NOT renaming auth/domain's Session to a Principal union — ADR-0002 explicitly defers that refactor until a second actor exists, and the brief workflow's drafter/approver identity turned out to be a separate axis from the SSP login session entirely. See docs/backlog/WP-18-abac-capability-spine.md for the full as-built record. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
25 lines
994 B
TypeScript
25 lines
994 B
TypeScript
import { describe, it, expect } from 'vitest';
|
|
import { parseMe } from './me.adapter';
|
|
|
|
describe('parseMe (trust boundary)', () => {
|
|
it('parses a known capability list', () => {
|
|
const r = parseMe({ capabilities: ['brief:approve', 'brief:reject', 'brief:send'] });
|
|
expect(r).toEqual({ ok: true, value: ['brief:approve', 'brief:reject', 'brief:send'] });
|
|
});
|
|
|
|
it('parses an empty list (drafter — no capabilities)', () => {
|
|
expect(parseMe({ capabilities: [] })).toEqual({ ok: true, value: [] });
|
|
});
|
|
|
|
it('drops unrecognized capability strings instead of rejecting the response', () => {
|
|
const r = parseMe({ capabilities: ['brief:approve', 'unknown:future-thing'] });
|
|
expect(r).toEqual({ ok: true, value: ['brief:approve'] });
|
|
});
|
|
|
|
it('rejects malformed responses instead of trusting them', () => {
|
|
expect(parseMe(null).ok).toBe(false);
|
|
expect(parseMe({}).ok).toBe(false);
|
|
expect(parseMe({ capabilities: 'brief:approve' }).ok).toBe(false);
|
|
});
|
|
});
|