feat: add backup recovery, setup wizard and user-view guards

2026-09-18 17:23:03 +12:00
parent a6a4a9aa24
commit fd6671cf7e
44 changed files with 4650 additions and 114 deletions
@@ -0,0 +1,46 @@
+import { describe, expect, it } from "vitest";
+import { getEffectiveRole, isAdminPage } from "./user-view-policy";
+
+describe("user view preview policy", () => {
+  it("downgrades only the displayed administrator role during preview", () => {
+    expect(getEffectiveRole("admin", true)).toBe("user");
+    expect(getEffectiveRole("admin", false)).toBe("admin");
+    for (const role of ["user", null, undefined]) {
+      expect(getEffectiveRole(role, true)).toBe(role);
+      expect(getEffectiveRole(role, false)).toBe(role);
+    }
+  });
+  it("covers configuration, nested admin pages, user management and setup", () => {
+    for (const path of [
+      "/admin",
+      "/admin/",
+      "/admin/backups",
+      "/admin/recaps",
+      "/users",
+      "/users/42",
+      "/setup",
+      "/admin?section=site",
+      "/%61dmin/diagnostics",
+    ]) {
+      expect(isAdminPage(path), path).toBe(true);
+    }
+  });
+  it("does not restrict normal member pages or similarly named paths", () => {
+    for (const path of [
+      "/",
+      "/profile",
+      "/profile/invites",
+      "/portal/issues",
+      "/requests/3580",
+      "/insights",
+      "/administrator",
+      "/users-guide",
+    ]) {
+      expect(isAdminPage(path), path).toBe(false);
+    }
+  });
+  it("keeps public first-install setup separate from admin authentication", () => {
+    expect(isAdminPage("/setup", false)).toBe(false);
+    expect(isAdminPage("/admin/backups", false)).toBe(true);
+  });
+});