41 lines
1.9 KiB
TypeScript
41 lines
1.9 KiB
TypeScript
import { test, expect } from '@playwright/test';
|
|
|
|
test.describe('Scenario 09: RBAC Guard & 403 Forbidden Handling', () => {
|
|
test('denies restricted role access to protected module and restores access upon switching back to Owner', async ({ page }) => {
|
|
await page.goto('/settings');
|
|
await page.waitForLoadState('domcontentloaded');
|
|
|
|
// 1. Switch to restricted role: Cashier via Settings or Topbar
|
|
const cashierRoleBtn = page.locator('[data-testid="settings-role-cashier"]');
|
|
if (await cashierRoleBtn.isVisible()) {
|
|
await cashierRoleBtn.click();
|
|
} else {
|
|
const roleSwitcher = page.locator('[data-testid="role-switcher-btn"]');
|
|
await roleSwitcher.click();
|
|
const roleOption = page.locator('[data-testid="role-option-cashier"]');
|
|
await roleOption.click();
|
|
}
|
|
|
|
// 2. Navigate to protected route /finance (Cashier has no permission to Finance)
|
|
await page.goto('/finance');
|
|
await page.waitForLoadState('domcontentloaded');
|
|
|
|
// 3. Verify 403 Forbidden page is displayed
|
|
const forbiddenPage = page.locator('[data-testid="forbidden-page"]');
|
|
await expect(forbiddenPage).toBeVisible({ timeout: 15000 });
|
|
await expect(page.locator('text=403 Доступ ограничен').first()).toBeVisible();
|
|
|
|
// 4. Switch back to Owner using Forbidden Page quick recovery button
|
|
const switchToOwnerBtn = page.locator('[data-testid="switch-to-owner-btn"]');
|
|
await expect(switchToOwnerBtn).toBeVisible();
|
|
await switchToOwnerBtn.click();
|
|
|
|
// 5. Navigate back to /finance and verify access restored
|
|
await page.goto('/finance');
|
|
await page.waitForLoadState('domcontentloaded');
|
|
|
|
// Finance content should now be visible without 403
|
|
await expect(page.locator('[data-testid="forbidden-page"]')).not.toBeVisible();
|
|
await expect(page.locator('main').locator('text=Финансы').first()).toBeVisible({ timeout: 15000 });
|
|
});
|
|
});
|