22 lines
1.1 KiB
TypeScript
22 lines
1.1 KiB
TypeScript
import { readFileSync } from 'node:fs';
|
|
import { describe, expect, it } from 'vitest';
|
|
|
|
describe('tenant isolation migration', () => {
|
|
const sql = readFileSync('migrations/0001_infrastructure.up.sql', 'utf8');
|
|
const tables = ['staff_outbox', 'staff_inbox', 'staff_idempotency_keys', 'staff_audit_log'];
|
|
it.each(tables)('%s is tenant scoped and protected by RLS', (table) => {
|
|
const create = sql.slice(
|
|
sql.indexOf(`CREATE TABLE IF NOT EXISTS ${table}`),
|
|
sql.indexOf(';', sql.indexOf(`CREATE TABLE IF NOT EXISTS ${table}`)),
|
|
);
|
|
expect(create).toContain('tenant_id VARCHAR(26) NOT NULL');
|
|
expect(sql).toContain(`ALTER TABLE ${table} ENABLE ROW LEVEL SECURITY`);
|
|
expect(sql).toContain(`ALTER TABLE ${table} FORCE ROW LEVEL SECURITY`);
|
|
expect(sql).toMatch(new RegExp(`CREATE POLICY [a-z_]+ ON ${table} `));
|
|
});
|
|
it('sets tenant and actor locally inside each transaction', () => {
|
|
const source = readFileSync('src/infrastructure/database.ts', 'utf8');
|
|
expect(source).toContain("set_config('app.tenant_id', $1, true)");
|
|
expect(source).toContain("set_config('app.user_id', $2, true)");
|
|
});
|
|
});
|