optima/api/tests/unit/permissionNodes.test.ts

import { describe, test, expect } from "bun:test";

/**
 * Tests for the PermissionNodes type definitions and structure.
 * We import the permission nodes and validate the shape of the data.
 */
import {
  PERMISSION_NODES,
  getAllPermissionNodes,
} from "../../src/types/PermissionNodes";
import type {
  PermissionNode,
  PermissionCategory,
} from "../../src/types/PermissionNodes";

/** Recursively collect permissions from a category and its sub-categories. */
function collectPerms(cat: PermissionCategory): PermissionNode[] {
  const direct = cat.permissions as PermissionNode[];
  const nested = cat.subCategories
    ? Object.values(cat.subCategories).flatMap(collectPerms)
    : [];
  return [...direct, ...nested];
}

describe("PermissionNodes", () => {
  test("PERMISSION_NODES is defined and is an object", () => {
    expect(PERMISSION_NODES).toBeDefined();
    expect(typeof PERMISSION_NODES).toBe("object");
  });

  test("has required top-level categories", () => {
    expect(PERMISSION_NODES).toHaveProperty("global");
    expect(PERMISSION_NODES).toHaveProperty("company");
    expect(PERMISSION_NODES).toHaveProperty("credential");
    expect(PERMISSION_NODES).toHaveProperty("credentialType");
    expect(PERMISSION_NODES).toHaveProperty("sales");
    expect(PERMISSION_NODES).toHaveProperty("procurement");
    expect(PERMISSION_NODES).toHaveProperty("objectTypes");
    expect(PERMISSION_NODES).toHaveProperty("permission");
    expect(PERMISSION_NODES).toHaveProperty("role");
    expect(PERMISSION_NODES).toHaveProperty("user");
    expect(PERMISSION_NODES).toHaveProperty("uiNavigation");
    expect(PERMISSION_NODES).toHaveProperty("adminUI");
    expect(PERMISSION_NODES).toHaveProperty("cwCallbacks");
    expect(PERMISSION_NODES).toHaveProperty("unifi");
  });

  test("each category has name, description, and permissions", () => {
    for (const [key, category] of Object.entries(PERMISSION_NODES)) {
      const cat = category as PermissionCategory;
      expect(cat).toHaveProperty("name");
      expect(typeof cat.name).toBe("string");
      expect(cat).toHaveProperty("description");
      expect(typeof cat.description).toBe("string");
      expect(cat).toHaveProperty("permissions");
      expect(Array.isArray(cat.permissions)).toBe(true);
    }
  });

  test("each permission node has required fields", () => {
    for (const [_key, category] of Object.entries(PERMISSION_NODES)) {
      const cat = category as PermissionCategory;
      for (const perm of collectPerms(cat)) {
        expect(perm).toHaveProperty("node");
        expect(typeof perm.node).toBe("string");
        expect(perm.node.length).toBeGreaterThan(0);
        expect(perm).toHaveProperty("description");
        expect(typeof perm.description).toBe("string");
        expect(perm).toHaveProperty("usedIn");
        expect(Array.isArray(perm.usedIn)).toBe(true);
      }
    }
  });

  test("global category contains the wildcard * node", () => {
    const globalPerms = (PERMISSION_NODES.global as PermissionCategory)
      .permissions;
    const wildcard = globalPerms.find((p) => p.node === "*");
    expect(wildcard).toBeDefined();
    expect(wildcard!.description).toContain("Full access");
  });

  test("all permission nodes are non-empty strings", () => {
    for (const [_key, category] of Object.entries(PERMISSION_NODES)) {
      const cat = category as PermissionCategory;
      for (const perm of collectPerms(cat)) {
        expect(typeof perm.node).toBe("string");
        expect(perm.node.length).toBeGreaterThan(0);
      }
    }
  });

  test("dependencies reference existing permission nodes", () => {
    // Collect all nodes including sub-categories
    const allNodes = new Set<string>();
    for (const [_key, category] of Object.entries(PERMISSION_NODES)) {
      const cat = category as PermissionCategory;
      for (const perm of collectPerms(cat)) {
        allNodes.add(perm.node);
      }
    }

    // Check all dependencies point to real nodes
    for (const [_key, category] of Object.entries(PERMISSION_NODES)) {
      const cat = category as PermissionCategory;
      for (const perm of collectPerms(cat)) {
        if (perm.dependencies) {
          for (const dep of perm.dependencies) {
            expect(allNodes.has(dep)).toBe(true);
          }
        }
      }
    }
  });

  test("sales category includes note CRUD permission nodes", () => {
    const salesPerms = collectPerms(
      PERMISSION_NODES.sales as PermissionCategory,
    );
    const nodes = salesPerms.map((p) => p.node);
    expect(nodes).toContain("sales.opportunity.note.create");
    expect(nodes).toContain("sales.opportunity.note.update");
    expect(nodes).toContain("sales.opportunity.note.delete");
    expect(nodes).toContain("sales.opportunity.product.update");
  });

  test("objectTypes category has subCategories", () => {
    const objTypes = PERMISSION_NODES.objectTypes as PermissionCategory;
    expect(objTypes.subCategories).toBeDefined();
    expect(objTypes.subCategories!.company).toBeDefined();
    expect(objTypes.subCategories!.credential).toBeDefined();
    expect(objTypes.subCategories!.user).toBeDefined();
    expect(objTypes.subCategories!.opportunity).toBeDefined();
    expect(objTypes.subCategories!.catalogItem).toBeDefined();
  });

  test("getAllPermissionNodes returns all nodes including nested", () => {
    const allNodes = getAllPermissionNodes();
    expect(allNodes.length).toBeGreaterThan(0);

    const nodeNames = allNodes.map((p) => p.node);
    // Should include top-level node
    expect(nodeNames).toContain("*");
    // Should include nested objectTypes nodes
    expect(nodeNames).toContain("obj.company");
    expect(nodeNames).toContain("obj.user");
    expect(nodeNames).toContain("obj.opportunity");
    expect(nodeNames).toContain("obj.catalogItem");
  });

  test("field-level permissions are listed on objectTypes nodes", () => {
    const allNodes = getAllPermissionNodes();
    const objCompany = allNodes.find((p) => p.node === "obj.company");
    expect(objCompany).toBeDefined();
    expect(objCompany!.fieldLevelPermissions).toBeDefined();
    expect(objCompany!.fieldLevelPermissions!.length).toBeGreaterThan(0);
    expect(objCompany!.fieldLevelPermissions).toContain("obj.company.id");
    expect(objCompany!.fieldLevelPermissions).toContain("obj.company.name");
  });
});