ehoandClaude Opus 5
772c47ea43
BIO-012: roleInterceptor/subjectInterceptor are correctly registered only under isDevMode(), but three hand-written fetch adapters (reveal-bignummer, letter-preview, org-template's proefbrief) bypass HttpClient and set X-Role/X-Subject themselves with no guard. The readers underneath, role.ts and subject.ts, were ungated too: they read ?role=/?subject= and wrote it into sessionStorage on any navigation, in any build -- for ?subject= that value is a BSN, which is exactly what SessionStore's G1 comment promises never happens. Gate both layers: currentRole()/currentSubject() return their safe default immediately outside isDevMode() (no query-param read, no sessionStorage write), and the three adapters additionally wrap their headers in isDevMode() so a production request carries neither header at all, matching what an HttpClient request already does once the interceptors aren't registered. TE-002: reveal-bignummer's response-shape validation was a "Trust boundary" a spec could only reach by stubbing globalThis.fetch. Exported it as parseRevealed(body), matching the other 30 parse* boundaries in the repo. Same treatment for letter-preview's errorMessage and org-template's proefbrief error mapping (extracted from an inline try/catch into a named, exported function first, since it wasn't already separate). BIO-006(a): reveal-bignummer sent X-Step-Up: 'true' unconditionally, so the backend's step-up precondition constrained nothing. reveal() now takes a stepUp flag; BriefStore.revealBigNummer() -- reachable only after the UI's confirm() gesture -- is the one that supplies it, so the literal no longer lives in the transport adapter. BIO-006(b): documented in roles-and-access.md that drafter is also the backend's fallback identity (StubIdentityProvider's catch-all arm), not just the dev switcher's initial choice -- so the least-privilege consequence of it also being the only role that may reveal a BSN is visible. Doc correction, same diff: roles-and-access.md's "wired only under isDevMode()" claim was false for the three hand-written fetch paths; it now says where the gate lives (interceptor registration and the reader functions) so it doesn't go stale the same way again. CLAUDE.md's dev-only claims needed no correction -- they already noted these three calls bypass the interceptor. Every fix has a test confirmed red by temporarily reverting the source change and rerunning the suite before restoring it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
66 lines
2.3 KiB
TypeScript
66 lines
2.3 KiB
TypeScript
import { describe, it, expect, beforeEach, afterEach } from 'vitest';
|
|
import { currentRole, ROLES } from './role';
|
|
|
|
const setUrl = (search: string) => history.pushState({}, '', search || '/');
|
|
|
|
// isDevMode() reads the `ngDevMode` global the Angular CLI defines away in a
|
|
// production build. There is no ambient type for it in app code, so this is
|
|
// accessed through an untyped bag rather than a `declare const`.
|
|
const globals = globalThis as Record<string, unknown>;
|
|
const originalNgDevMode = globals['ngDevMode'];
|
|
const setDevMode = (on: boolean) => {
|
|
globals['ngDevMode'] = on;
|
|
};
|
|
|
|
describe('currentRole (dev mechanism)', () => {
|
|
beforeEach(() => {
|
|
sessionStorage.clear();
|
|
setUrl('/');
|
|
setDevMode(true);
|
|
});
|
|
afterEach(() => {
|
|
globals['ngDevMode'] = originalNgDevMode;
|
|
});
|
|
|
|
it('lists the three roles', () => {
|
|
expect(ROLES).toEqual(['drafter', 'approver', 'admin']);
|
|
});
|
|
|
|
it('reads a valid ?role= from the URL and persists it for the tab', () => {
|
|
setUrl('?role=admin');
|
|
expect(currentRole()).toBe('admin');
|
|
setUrl('/'); // navigation drops the query param — value stays sticky
|
|
expect(currentRole()).toBe('admin');
|
|
});
|
|
|
|
it('falls back to drafter when nothing is set or the value is invalid', () => {
|
|
expect(currentRole()).toBe('drafter');
|
|
setUrl('?role=nonsense');
|
|
expect(currentRole()).toBe('drafter');
|
|
});
|
|
|
|
// BIO-012: the three hand-written `fetch` adapters call this function directly,
|
|
// bypassing `roleInterceptor`'s own isDevMode()-gated registration — so the gate
|
|
// has to hold here, not just at the interceptor, or `?role=` keeps working in a
|
|
// production build through that side door.
|
|
describe('outside isDevMode() (production build)', () => {
|
|
beforeEach(() => setDevMode(false));
|
|
|
|
it('ignores a ?role= in the URL and returns the default', () => {
|
|
setUrl('?role=admin');
|
|
expect(currentRole()).toBe('drafter');
|
|
});
|
|
|
|
it('never touches sessionStorage', () => {
|
|
setUrl('?role=admin');
|
|
currentRole();
|
|
expect(sessionStorage.getItem('dev-role')).toBeNull();
|
|
});
|
|
|
|
it('ignores a role already sitting in sessionStorage from a prior dev session', () => {
|
|
sessionStorage.setItem('dev-role', 'admin');
|
|
expect(currentRole()).toBe('drafter');
|
|
});
|
|
});
|
|
});
|