91 lines
3.8 KiB
TypeScript
91 lines
3.8 KiB
TypeScript
import { describe, it, expect } from 'vitest';
|
|
import { OPERATOR_ROLE_DEFINITIONS, OperatorRole } from '../contracts';
|
|
|
|
describe('Control Center RBAC & Operator Role Matrix', () => {
|
|
const roles: OperatorRole[] = [
|
|
'platform_owner',
|
|
'platform_admin',
|
|
'support_operator',
|
|
'billing_manager',
|
|
'security_auditor',
|
|
'release_manager',
|
|
];
|
|
|
|
it('defines all 6 operator roles in OPERATOR_ROLE_DEFINITIONS', () => {
|
|
roles.forEach((role) => {
|
|
expect(OPERATOR_ROLE_DEFINITIONS[role]).toBeDefined();
|
|
expect(OPERATOR_ROLE_DEFINITIONS[role].label).toBeTruthy();
|
|
expect(OPERATOR_ROLE_DEFINITIONS[role].description).toBeTruthy();
|
|
expect(OPERATOR_ROLE_DEFINITIONS[role].permissions).toBeDefined();
|
|
});
|
|
});
|
|
|
|
it('grants platform_owner full capabilities across all domains', () => {
|
|
const p = OPERATOR_ROLE_DEFINITIONS.platform_owner.permissions;
|
|
expect(p.canManagePlatformStatus).toBe(true);
|
|
expect(p.canGrantTrialGrace).toBe(true);
|
|
expect(p.canEditEntitlements).toBe(true);
|
|
expect(p.canTriggerRollouts).toBe(true);
|
|
expect(p.canPauseRollbackRollouts).toBe(true);
|
|
expect(p.canManageIncidents).toBe(true);
|
|
expect(p.canCreateAnnouncements).toBe(true);
|
|
expect(p.canScheduleMaintenance).toBe(true);
|
|
expect(p.canRequestDiagnostics).toBe(true);
|
|
expect(p.canExportAudit).toBe(true);
|
|
expect(p.canViewBillingDetails).toBe(true);
|
|
});
|
|
|
|
it('enforces support_operator as diagnostic and incident responder without destructive permissions', () => {
|
|
const p = OPERATOR_ROLE_DEFINITIONS.support_operator.permissions;
|
|
expect(p.canRequestDiagnostics).toBe(true);
|
|
expect(p.canManageIncidents).toBe(true);
|
|
expect(p.canCreateAnnouncements).toBe(true);
|
|
// Denied destructive/commercial
|
|
expect(p.canManagePlatformStatus).toBe(false);
|
|
expect(p.canGrantTrialGrace).toBe(false);
|
|
expect(p.canTriggerRollouts).toBe(false);
|
|
expect(p.canPauseRollbackRollouts).toBe(false);
|
|
expect(p.canEditEntitlements).toBe(false);
|
|
});
|
|
|
|
it('restricts billing_manager to financial operations and forbids infrastructure/rollouts', () => {
|
|
const p = OPERATOR_ROLE_DEFINITIONS.billing_manager.permissions;
|
|
expect(p.canViewBillingDetails).toBe(true);
|
|
expect(p.canGrantTrialGrace).toBe(true);
|
|
expect(p.canEditEntitlements).toBe(true);
|
|
// Denied tech/infra
|
|
expect(p.canTriggerRollouts).toBe(false);
|
|
expect(p.canPauseRollbackRollouts).toBe(false);
|
|
expect(p.canScheduleMaintenance).toBe(false);
|
|
expect(p.canRequestDiagnostics).toBe(false);
|
|
});
|
|
|
|
it('restricts release_manager to rollout workflows and forbids financial modifications', () => {
|
|
const p = OPERATOR_ROLE_DEFINITIONS.release_manager.permissions;
|
|
expect(p.canTriggerRollouts).toBe(true);
|
|
expect(p.canPauseRollbackRollouts).toBe(true);
|
|
expect(p.canManageIncidents).toBe(true);
|
|
expect(p.canCreateAnnouncements).toBe(true);
|
|
expect(p.canScheduleMaintenance).toBe(false);
|
|
// Denied billing & tenant status
|
|
expect(p.canManagePlatformStatus).toBe(false);
|
|
expect(p.canGrantTrialGrace).toBe(false);
|
|
expect(p.canEditEntitlements).toBe(false);
|
|
expect(p.canViewBillingDetails).toBe(false);
|
|
});
|
|
|
|
it('isolates security_auditor to immutable audit inspection without mutation capabilities', () => {
|
|
const p = OPERATOR_ROLE_DEFINITIONS.security_auditor.permissions;
|
|
expect(p.canExportAudit).toBe(true);
|
|
expect(p.canViewBillingDetails).toBe(true);
|
|
// All mutations denied
|
|
expect(p.canManagePlatformStatus).toBe(false);
|
|
expect(p.canGrantTrialGrace).toBe(false);
|
|
expect(p.canEditEntitlements).toBe(false);
|
|
expect(p.canTriggerRollouts).toBe(false);
|
|
expect(p.canPauseRollbackRollouts).toBe(false);
|
|
expect(p.canManageIncidents).toBe(false);
|
|
expect(p.canCreateAnnouncements).toBe(false);
|
|
expect(p.canScheduleMaintenance).toBe(false);
|
|
});
|
|
});
|