This commit is contained in:
@@ -227,6 +227,14 @@ describe('management route permissions', () => {
|
||||
});
|
||||
|
||||
describe('authentication and machine boundaries', () => {
|
||||
it('reserves only the exact runtime POST for instance credentials', () => {
|
||||
expect(routePermission('/api/moderation/runtime', 'POST')).toBe('machine');
|
||||
for (const role of roles)
|
||||
expect(allows(role, '/api/moderation/runtime', 'POST')).toBe(false);
|
||||
expect(routePermission('/api/moderation/runtime', 'GET')).toBe('moderation-read');
|
||||
expect(routePermission('/api/moderation/runtime/other', 'POST')).toBe('moderation');
|
||||
expect(routePermission('/api/moderation/runtime-extra', 'POST')).toBe('moderation');
|
||||
});
|
||||
it('makes only leaderboard API reads public', () => {
|
||||
for (const method of ['GET', 'HEAD']) {
|
||||
expect(routePermission('/api/leaderboard', method)).toBe('public');
|
||||
|
||||
Reference in New Issue
Block a user