josh/electric-cherry
1
0
Fork 0
Code Issues 18 Pull Requests Actions Packages Projects Releases Wiki Activity

Add moderation permissions and durable player records

Browse Source
This commit is contained in:
josh
2026-10-15 21:06:08 -04:00
parent c1758cce25
commit c91d49c298
17 changed files with 699 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/unit/auth-guard.test.ts
+27
View File
@@ -235,6 +235,18 @@ describe('browser authentication guard', () => {
['operator', '/api/users', 'GET', 403],
['admin', '/api/hosts/[id]', 'PATCH', 200],
['admin', '/api/users', 'GET', 200],
['moderator', '/api/moderation', 'GET', 200],
['moderator', '/api/moderation/sanctions', 'POST', 200],
['moderator', '/api/moderation/sanctions/[id]/revoke', 'POST', 200],
['admin', '/api/moderation/sanctions', 'POST', 200],
['super_viewer', '/api/moderation', 'HEAD', 200],
['super_viewer', '/api/moderation/sanctions', 'POST', 403],
['operator', '/api/moderation', 'GET', 403],
['operator', '/api/moderation/sanctions', 'POST', 403],
['viewer', '/api/moderation', 'GET', 403],
['moderator', '/api/servers', 'POST', 403],
['moderator', '/api/configs/[id]', 'GET', 403],
['moderator', '/api/users', 'GET', 403],
['super_viewer', '/api/users', 'GET', 200],
['super_viewer', '/api/users/audit', 'GET', 200],
['super_viewer', '/api/server-keys', 'HEAD', 200],
@@ -278,6 +290,21 @@ describe('browser authentication guard', () => {
}
}
);
it('protects moderation pages and Svelte page-data requests with the same role checks', async () => {
for (const role of ['viewer', 'super_viewer', 'operator', 'moderator', 'admin'] as const) {
signIn(role);
for (const path of ['/moderation', '/moderation/__data.json']) {
const call = requestFor('/moderation', { path });
if (role === 'viewer' || role === 'operator') {
await expect(call.invoke()).rejects.toMatchObject({ status: 403 });
expect(call.resolve).not.toHaveBeenCalled();
} else {
expect((await call.invoke()).status).toBe(200);
expect(call.resolve).toHaveBeenCalledOnce();
}
}
}
});
it.each(['GET', 'HEAD', 'POST', 'PATCH', 'DELETE'])(
'permits only administrators to write settings and Super Viewers to read them',
async (method) => {