Expand moderation case workflows

tests/unit/auth-guard.test.ts

@@ -290,21 +290,38 @@ describe('browser authentication guard', () => {
             }
         }
     );
-    it('protects moderation pages and Svelte page-data requests with the same role checks', async () => {
-        for (const role of ['viewer', 'super_viewer', 'operator', 'moderator', 'admin'] as const) {
-            signIn(role);
-            for (const path of ['/moderation', '/moderation/__data.json']) {
-                const call = requestFor('/moderation', { path });
-                if (role === 'viewer' || role === 'operator') {
-                    await expect(call.invoke()).rejects.toMatchObject({ status: 403 });
-                    expect(call.resolve).not.toHaveBeenCalled();
-                } else {
-                    expect((await call.invoke()).status).toBe(200);
-                    expect(call.resolve).toHaveBeenCalledOnce();
+    it.each([
+        ['/moderation', '/moderation'],
+        ['/moderation/cases/[id]', '/moderation/cases/case-123']
+    ])(
+        'protects %s pages and Svelte page-data requests with the same role checks',
+        async (route, path) => {
+            for (const role of [
+                'viewer',
+                'super_viewer',
+                'operator',
+                'moderator',
+                'admin'
+            ] as const) {
+                const session = signIn(role);
+                for (const requestPath of [path, `${path}/__data.json`]) {
+                    for (const method of ['GET', 'HEAD']) {
+                        const call = requestFor(route, { path: requestPath, method });
+                        if (role === 'viewer' || role === 'operator') {
+                            await expect(call.invoke()).rejects.toMatchObject({ status: 403 });
+                            expect(call.resolve).not.toHaveBeenCalled();
+                        } else {
+                            const response = await call.invoke();
+                            expect(response.status).toBe(200);
+                            expect(response.headers.get('Cache-Control')).toContain('no-store');
+                            expect(call.resolve).toHaveBeenCalledOnce();
+                            expect(call.event.locals.user).toEqual(session.user);
+                        }
+                    }
                 }
             }
         }
-    });
+    );
     it.each(['GET', 'HEAD', 'POST', 'PATCH', 'DELETE'])(
         'permits only administrators to write settings and Super Viewers to read them',
         async (method) => {