517 lines
17 KiB
TypeScript
517 lines
17 KiB
TypeScript
import {
|
|
createRbacPoliciesWorkflow,
|
|
createRbacRolesWorkflow,
|
|
} from "@medusajs/core-flows"
|
|
import { medusaIntegrationTestRunner } from "@medusajs/test-utils"
|
|
import { IRbacModuleService, MedusaContainer } from "@medusajs/types"
|
|
import { Modules } from "@medusajs/utils"
|
|
|
|
jest.setTimeout(50000)
|
|
|
|
medusaIntegrationTestRunner({
|
|
env: {},
|
|
testSuite: ({ getContainer }) => {
|
|
describe("Workflows: RBAC", () => {
|
|
let appContainer: MedusaContainer
|
|
let rbacService: IRbacModuleService
|
|
|
|
beforeAll(async () => {
|
|
appContainer = getContainer()
|
|
rbacService = appContainer.resolve(Modules.RBAC)
|
|
})
|
|
|
|
describe("Role Inheritance and Policy Management", () => {
|
|
it("should create roles with inheritance and policies, then list all inherited policies", async () => {
|
|
// Step 1: Create base policies
|
|
const policiesWorkflow = createRbacPoliciesWorkflow(appContainer)
|
|
const { result: createdPolicies } = await policiesWorkflow.run({
|
|
input: {
|
|
policies: [
|
|
{
|
|
key: "read:products",
|
|
resource: "product",
|
|
operation: "read",
|
|
name: "Read Products",
|
|
description: "Permission to read products",
|
|
},
|
|
{
|
|
key: "write:products",
|
|
resource: "product",
|
|
operation: "write",
|
|
name: "Write Products",
|
|
description: "Permission to write products",
|
|
},
|
|
{
|
|
key: "read:orders",
|
|
resource: "order",
|
|
operation: "read",
|
|
name: "Read Orders",
|
|
description: "Permission to read orders",
|
|
},
|
|
{
|
|
key: "write:orders",
|
|
resource: "order",
|
|
operation: "write",
|
|
name: "Write Orders",
|
|
description: "Permission to write orders",
|
|
},
|
|
{
|
|
key: "delete:users",
|
|
resource: "user",
|
|
operation: "delete",
|
|
name: "Delete Users",
|
|
description: "Permission to delete users",
|
|
},
|
|
],
|
|
},
|
|
})
|
|
|
|
expect(createdPolicies).toHaveLength(5)
|
|
|
|
// Step 2: Create base roles with their policies
|
|
const rolesWorkflow = createRbacRolesWorkflow(appContainer)
|
|
|
|
// Create "Viewer" role with read permissions
|
|
const { result: viewerRoles } = await rolesWorkflow.run({
|
|
input: {
|
|
roles: [
|
|
{
|
|
name: "Viewer",
|
|
description: "Can view products and orders",
|
|
policy_ids: [
|
|
createdPolicies[0].id, // read:products
|
|
createdPolicies[2].id, // read:orders
|
|
],
|
|
},
|
|
],
|
|
},
|
|
})
|
|
|
|
expect(viewerRoles).toHaveLength(1)
|
|
const viewerRole = viewerRoles[0]
|
|
|
|
// Create "Editor" role with write permissions
|
|
const { result: editorRoles } = await rolesWorkflow.run({
|
|
input: {
|
|
roles: [
|
|
{
|
|
name: "Editor",
|
|
description: "Can write products and orders",
|
|
policy_ids: [
|
|
createdPolicies[1].id, // write:products
|
|
createdPolicies[3].id, // write:orders
|
|
],
|
|
},
|
|
],
|
|
},
|
|
})
|
|
|
|
expect(editorRoles).toHaveLength(1)
|
|
const editorRole = editorRoles[0]
|
|
|
|
// Step 3: Create "Admin" role that inherits from both Viewer and Editor, plus additional permissions
|
|
const { result: adminRoles } = await rolesWorkflow.run({
|
|
input: {
|
|
roles: [
|
|
{
|
|
name: "Admin",
|
|
description:
|
|
"Inherits from Viewer and Editor, plus can delete users",
|
|
inherited_role_ids: [viewerRole.id, editorRole.id],
|
|
policy_ids: [
|
|
createdPolicies[4].id, // delete:users
|
|
],
|
|
},
|
|
],
|
|
},
|
|
})
|
|
|
|
expect(adminRoles).toHaveLength(1)
|
|
const adminRole = adminRoles[0]
|
|
|
|
// Step 4: Verify role inheritance was created
|
|
const inheritances = await rbacService.listRbacRoleInheritances({
|
|
role_id: adminRole.id,
|
|
})
|
|
|
|
expect(inheritances).toHaveLength(2)
|
|
expect(inheritances).toEqual(
|
|
expect.arrayContaining([
|
|
expect.objectContaining({
|
|
role_id: adminRole.id,
|
|
inherited_role_id: viewerRole.id,
|
|
}),
|
|
expect.objectContaining({
|
|
role_id: adminRole.id,
|
|
inherited_role_id: editorRole.id,
|
|
}),
|
|
])
|
|
)
|
|
|
|
// Step 5: Verify direct policies for Admin role
|
|
const adminDirectPolicies = await rbacService.listRbacRolePolicies({
|
|
role_id: adminRole.id,
|
|
})
|
|
|
|
expect(adminDirectPolicies).toHaveLength(1)
|
|
expect(adminDirectPolicies[0]).toEqual(
|
|
expect.objectContaining({
|
|
role_id: adminRole.id,
|
|
scope_id: createdPolicies[4].id, // delete:users
|
|
})
|
|
)
|
|
|
|
// Step 6: List ALL policies for Admin role (including inherited)
|
|
const allAdminPolicies = await rbacService.listPoliciesForRole(
|
|
adminRole.id
|
|
)
|
|
|
|
// Admin should have:
|
|
// - read:products (from Viewer)
|
|
// - read:orders (from Viewer)
|
|
// - write:products (from Editor)
|
|
// - write:orders (from Editor)
|
|
// - delete:users (direct)
|
|
expect(allAdminPolicies).toHaveLength(5)
|
|
|
|
const policyKeys = allAdminPolicies.map((p) => p.key).sort()
|
|
expect(policyKeys).toEqual([
|
|
"delete:users",
|
|
"read:orders",
|
|
"read:products",
|
|
"write:orders",
|
|
"write:products",
|
|
])
|
|
|
|
// Verify each policy has correct details
|
|
expect(allAdminPolicies).toEqual(
|
|
expect.arrayContaining([
|
|
expect.objectContaining({
|
|
key: "read:products",
|
|
resource: "product",
|
|
operation: "read",
|
|
}),
|
|
expect.objectContaining({
|
|
key: "write:products",
|
|
resource: "product",
|
|
operation: "write",
|
|
}),
|
|
expect.objectContaining({
|
|
key: "read:orders",
|
|
resource: "order",
|
|
operation: "read",
|
|
}),
|
|
expect.objectContaining({
|
|
key: "write:orders",
|
|
resource: "order",
|
|
operation: "write",
|
|
}),
|
|
expect.objectContaining({
|
|
key: "delete:users",
|
|
resource: "user",
|
|
operation: "delete",
|
|
}),
|
|
])
|
|
)
|
|
|
|
// Step 7: Verify Viewer role only has its direct policies
|
|
const viewerPolicies = await rbacService.listPoliciesForRole(
|
|
viewerRole.id
|
|
)
|
|
|
|
expect(viewerPolicies).toHaveLength(2)
|
|
expect(viewerPolicies).toEqual(
|
|
expect.arrayContaining([
|
|
expect.objectContaining({
|
|
key: "read:products",
|
|
}),
|
|
expect.objectContaining({
|
|
key: "read:orders",
|
|
}),
|
|
])
|
|
)
|
|
|
|
// Step 8: Verify Editor role only has its direct policies
|
|
const editorPolicies = await rbacService.listPoliciesForRole(
|
|
editorRole.id
|
|
)
|
|
|
|
expect(editorPolicies).toHaveLength(2)
|
|
expect(editorPolicies).toEqual(
|
|
expect.arrayContaining([
|
|
expect.objectContaining({
|
|
key: "write:products",
|
|
}),
|
|
expect.objectContaining({
|
|
key: "write:orders",
|
|
}),
|
|
])
|
|
)
|
|
})
|
|
|
|
it("should handle multi-level role inheritance", async () => {
|
|
// Create policies
|
|
const policiesWorkflow = createRbacPoliciesWorkflow(appContainer)
|
|
const { result: policies } = await policiesWorkflow.run({
|
|
input: {
|
|
policies: [
|
|
{
|
|
key: "read:catalog",
|
|
resource: "catalog",
|
|
operation: "read",
|
|
name: "Read Catalog",
|
|
},
|
|
{
|
|
key: "write:catalog",
|
|
resource: "catalog",
|
|
operation: "write",
|
|
name: "Write Catalog",
|
|
},
|
|
{
|
|
key: "admin:system",
|
|
resource: "system",
|
|
operation: "admin",
|
|
name: "System Admin",
|
|
},
|
|
],
|
|
},
|
|
})
|
|
|
|
// Create role hierarchy: Basic -> Manager -> SuperAdmin
|
|
const rolesWorkflow = createRbacRolesWorkflow(appContainer)
|
|
|
|
// Level 1: Basic role
|
|
const { result: basicRoles } = await rolesWorkflow.run({
|
|
input: {
|
|
roles: [
|
|
{
|
|
name: "Basic User",
|
|
description: "Basic read access",
|
|
policy_ids: [policies[0].id], // read:catalog
|
|
},
|
|
],
|
|
},
|
|
})
|
|
const basicRole = basicRoles[0]
|
|
|
|
// Level 2: Manager inherits from Basic
|
|
const { result: managerRoles } = await rolesWorkflow.run({
|
|
input: {
|
|
roles: [
|
|
{
|
|
name: "Manager",
|
|
description: "Manager with write access",
|
|
inherited_role_ids: [basicRole.id],
|
|
policy_ids: [policies[1].id], // write:catalog
|
|
},
|
|
],
|
|
},
|
|
})
|
|
const managerRole = managerRoles[0]
|
|
|
|
// Level 3: SuperAdmin inherits from Manager
|
|
const { result: superAdminRoles } = await rolesWorkflow.run({
|
|
input: {
|
|
roles: [
|
|
{
|
|
name: "SuperAdmin",
|
|
description: "Super admin with all access",
|
|
inherited_role_ids: [managerRole.id],
|
|
policy_ids: [policies[2].id], // admin:system
|
|
},
|
|
],
|
|
},
|
|
})
|
|
const superAdminRole = superAdminRoles[0]
|
|
|
|
// Verify SuperAdmin has all policies through inheritance chain
|
|
const superAdminPolicies = await rbacService.listPoliciesForRole(
|
|
superAdminRole.id
|
|
)
|
|
|
|
expect(superAdminPolicies).toHaveLength(3)
|
|
expect(superAdminPolicies.map((p) => p.key).sort()).toEqual([
|
|
"admin:system",
|
|
"read:catalog",
|
|
"write:catalog",
|
|
])
|
|
|
|
// Verify Manager has policies from Basic + its own
|
|
const managerPolicies = await rbacService.listPoliciesForRole(
|
|
managerRole.id
|
|
)
|
|
|
|
expect(managerPolicies).toHaveLength(2)
|
|
expect(managerPolicies.map((p) => p.key).sort()).toEqual([
|
|
"read:catalog",
|
|
"write:catalog",
|
|
])
|
|
|
|
// Verify Basic only has its own policy
|
|
const basicPolicies = await rbacService.listPoliciesForRole(
|
|
basicRole.id
|
|
)
|
|
|
|
expect(basicPolicies).toHaveLength(1)
|
|
expect(basicPolicies[0].key).toBe("read:catalog")
|
|
})
|
|
|
|
it("should propagate policy deletion from inherited role", async () => {
|
|
// Create policies
|
|
const policiesWorkflow = createRbacPoliciesWorkflow(appContainer)
|
|
const { result: policies } = await policiesWorkflow.run({
|
|
input: {
|
|
policies: [
|
|
{
|
|
key: "read:inventory",
|
|
resource: "inventory",
|
|
operation: "read",
|
|
name: "Read Inventory",
|
|
},
|
|
{
|
|
key: "write:inventory",
|
|
resource: "inventory",
|
|
operation: "write",
|
|
name: "Write Inventory",
|
|
},
|
|
{
|
|
key: "admin:inventory",
|
|
resource: "inventory",
|
|
operation: "admin",
|
|
name: "Admin Inventory",
|
|
},
|
|
],
|
|
},
|
|
})
|
|
|
|
// Create role hierarchy: Basic -> Manager -> SuperAdmin
|
|
const rolesWorkflow = createRbacRolesWorkflow(appContainer)
|
|
|
|
// Level 1: Basic role with read permission
|
|
const { result: basicRoles } = await rolesWorkflow.run({
|
|
input: {
|
|
roles: [
|
|
{
|
|
name: "Basic Inventory User",
|
|
description: "Basic inventory read access",
|
|
policy_ids: [policies[0].id], // read:inventory
|
|
},
|
|
],
|
|
},
|
|
})
|
|
const basicRole = basicRoles[0]
|
|
|
|
// Level 2: Manager inherits from Basic + write permission
|
|
const { result: managerRoles } = await rolesWorkflow.run({
|
|
input: {
|
|
roles: [
|
|
{
|
|
name: "Inventory Manager",
|
|
description: "Manager with write access",
|
|
inherited_role_ids: [basicRole.id],
|
|
policy_ids: [policies[1].id], // write:inventory
|
|
},
|
|
],
|
|
},
|
|
})
|
|
const managerRole = managerRoles[0]
|
|
|
|
// Level 3: SuperAdmin inherits from Manager + admin permission
|
|
const { result: superAdminRoles } = await rolesWorkflow.run({
|
|
input: {
|
|
roles: [
|
|
{
|
|
name: "Inventory SuperAdmin",
|
|
description: "Super admin with all access",
|
|
inherited_role_ids: [managerRole.id],
|
|
policy_ids: [policies[2].id], // admin:inventory
|
|
},
|
|
],
|
|
},
|
|
})
|
|
const superAdminRole = superAdminRoles[0]
|
|
|
|
// Verify initial state: SuperAdmin has all 3 policies
|
|
let superAdminPolicies = await rbacService.listPoliciesForRole(
|
|
superAdminRole.id
|
|
)
|
|
expect(superAdminPolicies).toHaveLength(3)
|
|
expect(superAdminPolicies.map((p) => p.key).sort()).toEqual([
|
|
"admin:inventory",
|
|
"read:inventory",
|
|
"write:inventory",
|
|
])
|
|
|
|
// Verify Manager has 2 policies (Basic's + its own)
|
|
let managerPolicies = await rbacService.listPoliciesForRole(
|
|
managerRole.id
|
|
)
|
|
expect(managerPolicies).toHaveLength(2)
|
|
expect(managerPolicies.map((p) => p.key).sort()).toEqual([
|
|
"read:inventory",
|
|
"write:inventory",
|
|
])
|
|
|
|
// Delete the read:inventory policy from Basic role
|
|
const basicRolePolicies = await rbacService.listRbacRolePolicies({
|
|
role_id: basicRole.id,
|
|
})
|
|
const readPolicyAssociation = basicRolePolicies.find(
|
|
(rp) => rp.scope_id === policies[0].id
|
|
)
|
|
await rbacService.deleteRbacRolePolicies([readPolicyAssociation!.id])
|
|
|
|
// Verify Basic role no longer has the read policy
|
|
const basicPoliciesAfterDelete =
|
|
await rbacService.listPoliciesForRole(basicRole.id)
|
|
expect(basicPoliciesAfterDelete).toHaveLength(0)
|
|
|
|
// Verify Manager role no longer inherits the read policy
|
|
managerPolicies = await rbacService.listPoliciesForRole(
|
|
managerRole.id
|
|
)
|
|
expect(managerPolicies).toHaveLength(1)
|
|
expect(managerPolicies[0].key).toBe("write:inventory")
|
|
|
|
// Verify SuperAdmin role also lost the read policy through inheritance chain
|
|
superAdminPolicies = await rbacService.listPoliciesForRole(
|
|
superAdminRole.id
|
|
)
|
|
expect(superAdminPolicies).toHaveLength(2)
|
|
expect(superAdminPolicies.map((p) => p.key).sort()).toEqual([
|
|
"admin:inventory",
|
|
"write:inventory",
|
|
])
|
|
})
|
|
|
|
it("should handle role with no inherited roles or policies", async () => {
|
|
const rolesWorkflow = createRbacRolesWorkflow(appContainer)
|
|
|
|
const { result: emptyRoles } = await rolesWorkflow.run({
|
|
input: {
|
|
roles: [
|
|
{
|
|
name: "Empty Role",
|
|
description: "Role with no permissions",
|
|
},
|
|
],
|
|
},
|
|
})
|
|
|
|
const emptyRole = emptyRoles[0]
|
|
|
|
// Verify no policies
|
|
const policies = await rbacService.listPoliciesForRole(emptyRole.id)
|
|
expect(policies).toHaveLength(0)
|
|
|
|
// Verify no inheritance
|
|
const inheritances = await rbacService.listRbacRoleInheritances({
|
|
role_id: emptyRole.id,
|
|
})
|
|
expect(inheritances).toHaveLength(0)
|
|
})
|
|
})
|
|
})
|
|
},
|
|
})
|