gsadmin/headplane
1
0
Fork 0
mirror of https://github.com/tale/headplane.git synced 2026-08-11 06:16:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(auth): support deriving roles from the IDP

Browse Source 
Closes HP-352.
This commit is contained in:
Aarnav Tale
2026-06-20 11:53:09 -04:00
parent 96f2721272
commit 0c4d175eb7
13 changed files with 252 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/unit/auth/auth-service.test.ts
+20
View File
@@ -30,6 +30,26 @@ describe("findOrCreateUser", () => {
expect(role).toBe("member");
});
test("second distinct user can receive a configured initial role", async () => {
await auth.findOrCreateUser("sub-owner", { name: "Owner" });
await auth.findOrCreateUser("sub-admin", { name: "Admin" }, { initialRole: "admin" });
const role = await auth.roleForSubject("sub-admin");
expect(role).toBe("admin");
});
test("first created user becomes owner even with a configured initial role", async () => {
await auth.findOrCreateUser("sub-owner", { name: "Owner" }, { initialRole: "viewer" });
const role = await auth.roleForSubject("sub-owner");
expect(role).toBe("owner");
});
test("configured initial roles cannot grant owner", async () => {
await auth.findOrCreateUser("sub-owner", { name: "Owner" });
await auth.findOrCreateUser("sub-other", { name: "Other" }, { initialRole: "owner" });
const role = await auth.roleForSubject("sub-other");
expect(role).toBe("member");
});
test("existing subject returns same id (idempotent)", async () => {
const id1 = await auth.findOrCreateUser("sub-1", { name: "Alice" });
const id2 = await auth.findOrCreateUser("sub-1", { name: "Alice" });