82 lines
2.3 KiB
JavaScript
82 lines
2.3 KiB
JavaScript
/**
|
|
* scopesToOwnRequisitions — mirrors backend users.permissions.scopes_to_own_requisitions.
|
|
*
|
|
* node permissions-scope.test.mjs
|
|
*/
|
|
import {
|
|
isAdmin,
|
|
isHiringManager,
|
|
seesAllCandidates,
|
|
scopesToOwnRequisitions,
|
|
} from './src/auth/permissions.js'
|
|
|
|
let failed = 0
|
|
function ok(name, cond, extra) {
|
|
if (cond) {
|
|
console.log(`ok ${name}`)
|
|
if (extra) console.log(` ${extra}`)
|
|
} else {
|
|
failed += 1
|
|
console.log(`FAIL ${name}`)
|
|
if (extra) console.log(` ${extra}`)
|
|
}
|
|
}
|
|
|
|
const recruiter = {
|
|
id: 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa',
|
|
role_name: 'recruiter',
|
|
permissions: ['candidates.view', 'jobs.view'],
|
|
}
|
|
ok('recruiter is not requisition-scoped', !scopesToOwnRequisitions(recruiter))
|
|
ok('recruiter does not see all candidates', !seesAllCandidates(recruiter))
|
|
|
|
const custom = {
|
|
...recruiter,
|
|
role_name: 'AI_TEAM_MANAGER',
|
|
permissions: ['candidates.view', 'jobs.view', 'requisitions.create'],
|
|
}
|
|
ok('requisitions.create alone does not scope jobs/candidates', !scopesToOwnRequisitions(custom))
|
|
ok('custom role is not hiring-manager portal', !isHiringManager(custom))
|
|
ok('custom role is not admin', !isAdmin(custom))
|
|
|
|
ok(
|
|
'Access Control requisitions.configure enables the scope',
|
|
scopesToOwnRequisitions({
|
|
...custom,
|
|
permissions: ['candidates.view', 'jobs.view', 'requisitions.create', 'requisitions.configure'],
|
|
}),
|
|
)
|
|
|
|
const manage = {
|
|
...custom,
|
|
permissions: ['candidates.view', 'candidates.manage', 'requisitions.configure'],
|
|
}
|
|
ok(
|
|
'candidates.manage wins over requisitions.configure',
|
|
!scopesToOwnRequisitions(manage) && seesAllCandidates(manage),
|
|
)
|
|
|
|
ok(
|
|
'admin is not requisition-scoped',
|
|
!scopesToOwnRequisitions({ role_name: 'admin', permissions: ['requisitions.create'] }) &&
|
|
isAdmin({ role_name: 'admin' }),
|
|
)
|
|
|
|
ok(
|
|
'hiring_manager stays portal-locked and requisition-scoped',
|
|
isHiringManager({ role_name: 'hiring_manager' }) &&
|
|
scopesToOwnRequisitions({ role_name: 'hiring_manager', permissions: ['candidates.view'] }),
|
|
)
|
|
|
|
ok(
|
|
'requisitions.manage is admin, not this scope',
|
|
isAdmin({ role_name: 'ops_lead', permissions: ['requisitions.manage'] }) &&
|
|
!scopesToOwnRequisitions({ role_name: 'ops_lead', permissions: ['requisitions.manage'] }),
|
|
)
|
|
|
|
if (failed) {
|
|
console.log(`\n${failed} failed`)
|
|
process.exit(1)
|
|
}
|
|
console.log('\nall passed')
|