2 Commits

Author	SHA1	Message	Date
shankar0123	8564e2fcd6	test(gui): Vitest coverage for the 2026-05-10/11 GUI batch (Fix 12) ... Audit 2026-05-11 Fix 12 closure. The original GUI-batch commit 661b6db claimed 'npx tsc --noEmit PASS' but shipped no Vitest cases for the new surfaces, leaving the regression-prevention layer wide open. This closure backfills 35 cases across five files; the next refactor of KeysPage's assign modal that drops scope_type, or the AuthProvider demo-banner predicate that gets flipped to !authRequired, surfaces in CI instead of silently shipping. What's added: * web/src/pages/auth/UsersPage.test.tsx (NEW, 8 cases) — pins the MED-11 closure's UsersPage flow: active rows render the Active status pill, deactivated rows render dimmed with the Deactivated <timestamp> status, Deactivate button fires the API call after confirm() returns true and is a no-op on false, Reactivate button works inversely, provider filter narrows the underlying authListUsers call (undefined vs provider-id), empty list renders the placeholder, loading renders 'Loading users…'. * web/src/pages/auth/AuthSettingsPage.test.tsx (EXTENDED, +4 cases) — the pre-existing 2 cases only exercised identity + bootstrap status; the runtime-config panel (MED-12 closure) had no test. New cases cover: per-key row rendering, alphabetical sort (stable for log-scraping correlation), empty-value '(empty)' placeholder, 403 rejected query silently hides the panel (non-admins shouldn't see the shell). * web/src/pages/auth/KeysPage.test.tsx (EXTENDED, +8 cases) — the HIGH-10 GUI half added scope picker + scope_id input + expires_at datetime-local to the assign modal but the pre-existing test only asserted (actor, role). New cases pin the third opts arg shape: global hides scope_id input, profile/issuer scope reveal scope_id + mark required, trimmed scope_id round-trips into the body, global omits scope_id (undefined NOT empty string), empty expires_at omits the field, filled expires_at gets :00Z appended for RFC3339 promotion, whitespace-only scope_id fires the 'scope_id is required' typed error WITHOUT calling the API, actor-demo-anon row hides both assign and revoke affordances. * web/src/pages/auth/RoleDetailPage.test.tsx (NEW, 9 cases) — no test file pre-Fix 12. Pins the MED-8 scope picker for AddPermissionForm: global hides scope_id, profile reveals + gates the Add button until scope_id is filled, submit POSTs {permission, scope_type: profile, scope_id} with whitespace trimming, global submit omits scope keys entirely, issuer scope path, Add button stays disabled without a permission selection. Plus the LOW-11 default-role delete-button hide: r-admin renders the role-delete-disabled-tooltip + NO role-delete-button, r-auditor same, custom role renders the delete button. The DEFAULT_ROLE_IDS set tracking the migration-seeded role ids is the load-bearing client-side decision so a future drift between migrations and the GUI set surfaces here too. * web/src/components/AuthProvider.test.tsx (NEW, 5 cases) — the LOW-1 demo banner had no test for its visibility predicate. Pins all four authType branches (none → visible, api-key → hidden, oidc → hidden, loading → hidden to avoid flash) plus the rejected-getAuthInfo branch: the catch treats failure as an old-server-fallback to demo mode (no authType mutation, loading flips false), so the banner SHOWS — that's the actual behavior, and pinning it prevents a future change from silently hiding the banner when the /auth/info endpoint is unreachable. Spec deviations: Phase 6 (Layout.test.tsx users-nav) and Phase 7 (per-Fix tests for Fixes 03/05/07/09/10) live on those fixes' own branches — already authored there. Including them here would have produced merge conflicts. Verify gate: * tsc --noEmit — clean * vitest run touched files — 40/40 pass (8 + 6 + 12 + 9 + 5, including the 2 + 4 + 4 pre-existing cases in the extended AuthSettingsPage + KeysPage files) * full suite (162 tests across 15 files) green — no regression from the panel-mount-in-existing-page setup or the new mocked-module entries. Refs cowork/auth-bundles-fixes-2026-05-11/12-test-vitest-gui-coverage.md.	2026-05-11 12:18:08 +00:00
shankar0123	53e6de7db9	auth-bundle-1 Phase 9 + 10: approval-bypass closure + RBAC GUI ... # Phase 9 — approval-bypass closure (Decision 9, option a) * Migration 000033_approval_kinds.up.sql: ALTER TABLE issuance_approval_requests ADD COLUMN approval_kind + payload JSONB; relax certificate_id + job_id to nullable; CHECK (approval_kind IN ('cert_issuance','profile_edit')) + CHECK (per-kind nullability invariant) + index on approval_kind. Idempotent throughout via DO blocks. * domain.ApprovalKind enum (cert_issuance / profile_edit) + IsValidApprovalKind. ApprovalRequest gains Kind + Payload []byte for the pending profile diff. * postgres.ApprovalRepository.Create + scanApprovalRow extended to round-trip the new columns; certificate_id + job_id switched to sql.NullString so profile_edit rows persist cleanly. Default Kind=cert_issuance preserves back-compat for every Phase-7-2026-05-03 caller. * ApprovalService.RequestProfileEditApproval: new entry point that creates a pending profile-edit row carrying the serialized profile diff. Bypass mode (CERTCTL_APPROVAL_BYPASS) short-circuits the same way it does for cert_issuance. * ApprovalService.SetProfileEditApply hook: cmd/server/main.go registers a closure that deserializes req.Payload + persists via profileRepo.Update + emits a profile.edit_applied audit row with category=auth. The hook avoids the Approval ↔ Profile import cycle. * ProfileService.UpdateProfile: gates when (a) the live profile carries RequiresApproval=true, OR (b) the proposed edit would set it true. Returns ErrProfileEditPendingApproval with the new approval ID; ProfileHandler maps to HTTP 202 Accepted + {pending_approval_id}. Both arms close the flip-flop loophole because every transition through an approval-tier profile fires the gate. * TestProfileEdit_RequiresApprovalLoopholeClosed pins all 3 bypass attempts (flip-off / kept-on / flip-on) gated; nil- approval-service preserves pre-Phase-9 direct-apply for test fixtures. * Approval service tests gain 4 profile_edit rows: pending row shape; same-actor self-approve rejected with ErrApproveBySameActor (load-bearing two-person integrity); approve fails-closed when apply callback unwired; apply callback invoked on approve. * docs/reference/profiles.md (new) explains the gate + edit response shape (202) + same-actor invariant + bypass + audit hooks. # Phase 10 — RBAC management GUI * useAuthMe hook (web/src/hooks/useAuthMe.ts): TanStack Query fetches /api/v1/auth/me on app boot, caches for 60s, exposes hasPerm(p) + hasAnyPerm + isAdmin predicates. Every Phase-10 page consumes this on mount + gates affordances against the cached effective_permissions slice. Server-side enforcement is the load-bearing gate; client-side hide/disable is UX. * New routes: - /auth/roles — list (auth.role.list); create-role modal (auth.role.create) hidden when missing. - /auth/roles/:id — detail + permissions; edit (auth.role.edit), delete (auth.role.delete), add/remove permission affordances each gated. - /auth/keys — list of every actor with role grants; assign + revoke modals (auth.role.assign). actor-demo-anon flagged system-managed; mutation buttons hidden for it. - /auth/settings — stub showing /v1/auth/me identity + bootstrap-endpoint availability via /v1/auth/bootstrap. * AuditPage extended with category filter ('All categories' + the 3 enum values from migration 000032). Selection flows to the API call params + the URL-driven query state. * Layout: 3 new nav entries (Roles / API Keys / Auth Settings). * api/client.ts: 12 new exported functions for the RBAC surface (authMe, list/get/create/update/delete role, list/add/remove role permissions, list keys, assign/revoke key role, bootstrap-availability probe). * data-testid attributes on every interactive element so a future Playwright suite can assert behavior without brittle CSS selectors. * Empty state, error state, and unsaved-changes warnings on every form per the prompt's implementation rules. # Frontend tests * RolesPage.test.tsx (6 tests): list render, empty state, error state, hide-create-button-without-perm, show-create-button-with-perm, submit-create-modal. * KeysPage.test.tsx (3 tests): demo-anon flagged system-managed (no buttons), permission-gated affordance hide for auditor caller, assign-modal-POST contract. * AuthSettingsPage.test.tsx (2 tests): identity surface, bootstrap-OPEN-status surface. * AuditPage.test.tsx (+1): category-filter select renders with the 4 documented options. 15 frontend tests total in src/pages/auth/ + the audit category-filter test; all pass via npx vitest run. # Verifications * go vet ./... clean. * staticcheck across internal/auth + handler + router + cli + service + repository + cmd + domain: clean. * gofmt -l clean repo-wide. * go test -short -count=1 green across internal/service, internal/api/handler, internal/api/router, internal/auth, internal/auth/bootstrap, internal/service/auth, internal/domain/auth, cmd/server, cmd/cli, internal/cli. * npx tsc --noEmit clean. * npm run build green (vite build produces dist/index.html + 946KB JS bundle; chunk-size warning is pre-existing). * npx vitest run src/pages/auth/ src/pages/AuditPage.test.tsx green (15 tests, 4 files).	2026-05-09 21:03:59 +00:00