Add Super Viewer read-only administrator role

tests/unit/ui-admin-access.test.ts

@@ -0,0 +1,87 @@
+import { describe, expect, it, vi } from 'vitest';
+import { render } from 'svelte/server';
+import { writable } from 'svelte/store';
+import UsersPage from '../../src/routes/settings/users/+page.svelte';
+import ServerKeysPage from '../../src/routes/server-keys/+page.svelte';
+import MaintenancePage from '../../src/routes/maintenance/+page.svelte';
+import AccountPage from '../../src/routes/account/+page.svelte';
+import type { UserRole } from '../../src/lib/auth.js';
+
+const currentPage = writable({
+    url: new URL('http://localhost/settings/users'),
+    data: { user: { role: 'admin' as UserRole } }
+});
+vi.mock('$app/stores', () => ({
+    page: {
+        subscribe: (run: Parameters<typeof currentPage.subscribe>[0]) => currentPage.subscribe(run)
+    }
+}));
+vi.mock('$app/navigation', () => ({ goto: vi.fn(), invalidateAll: vi.fn() }));
+
+function asRole(role: UserRole) {
+    currentPage.update((value) => ({ ...value, data: { user: { role } } }));
+}
+
+describe('administrator pages', () => {
+    it('shows the Super Viewer label while preserving personal password and sign-out controls', () => {
+        asRole('super_viewer');
+        const body = render(AccountPage).body;
+        expect(body).toContain('Super Viewer');
+        expect(body).not.toContain('super_viewer');
+        expect(body).toContain('Change password');
+        expect(body).toContain('Sign out');
+    });
+
+    it('lets Super Viewers inspect account roles and activity without account mutation controls', () => {
+        asRole('super_viewer');
+        const body = render(UsersPage).body;
+        expect(body).toContain('User');
+        expect(body).toContain('Super Viewer');
+        expect(body).toContain('Account activity');
+        expect(body).toContain('Refresh activity');
+        expect(body).not.toContain('Add user');
+        expect(body).not.toContain('Edit access');
+        expect(body).not.toContain('Sign out sessions');
+        expect(body).not.toContain('You do not have access');
+    });
+
+    it.each(['viewer', 'operator'] as const)('keeps user accounts unavailable to %s', (role) => {
+        asRole(role);
+        const body = render(UsersPage).body;
+        expect(body).toContain('You do not have access');
+        expect(body).not.toContain('Account activity');
+    });
+
+    it('retains administrator user creation and describes the assignable Super Viewer role', () => {
+        asRole('admin');
+        const body = render(UsersPage).body;
+        expect(body).toContain('Add user');
+        expect(body).toContain('Super Viewer');
+        expect(body).toContain('Read all fleet and administrator pages without making changes.');
+    });
+
+    it('keeps key searches available while hiding key creation from Super Viewers', () => {
+        asRole('super_viewer');
+        const body = render(ServerKeysPage).body;
+        expect(body).toContain('Saved keys');
+        expect(body).toContain('Search keys');
+        expect(body).toContain('Filter keys by game');
+        expect(body).not.toContain('Add key');
+        expect(body).not.toContain('Save key');
+
+        asRole('admin');
+        expect(render(ServerKeysPage).body).toContain('Add key');
+    });
+
+    it('keeps maintenance views available without offering a fleet scan to Super Viewers', () => {
+        asRole('super_viewer');
+        const body = render(MaintenancePage).body;
+        expect(body).toContain('Maintenance views');
+        expect(body).toContain('Policies &amp; schedules');
+        expect(body).toContain('Activity');
+        expect(body).not.toContain('Check now');
+
+        asRole('admin');
+        expect(render(MaintenancePage).body).toContain('Check now');
+    });
+});