Maximilian Stubhan
901c5c426e
Reworks the app from a two-role (hr_admin/manager) model to a single HR-only role gated by profiles.is_active, fixes transfer/promote/karenz/ reorg RPCs to actually defer future-dated changes via a new pending_org_changes table instead of writing them immediately (applied by a daily Vercel Cron route), makes reorg undo append-only instead of deleting history, adds Karenz-return and history-date integrity guards, deprecates the salary column, and adds explicit schema grants + perf indexes needed to run against a fresh (non-hosted) Postgres instance. Adds vitest unit + integration test suites (the latter against a real local Supabase instance) covering all of the above, plus lint/typecheck/ build wiring (`npm run check`).
94 lines
3.3 KiB
TypeScript
94 lines
3.3 KiB
TypeScript
import { afterEach, describe, expect, it } from "vitest";
|
|
import {
|
|
adminClient,
|
|
createBareAuthUser,
|
|
createHrUser,
|
|
deleteTestUser,
|
|
signInAs,
|
|
type TestUser,
|
|
} from "./helpers";
|
|
|
|
// HR-only access model (supabase/migrations/20260714120000_hr_only_access.sql):
|
|
// nobody except an active, explicitly-provisioned HR user may read or write
|
|
// anything beyond their own profile row.
|
|
describe("HR-only access (is_hr_user gate)", () => {
|
|
const createdUsers: TestUser[] = [];
|
|
|
|
afterEach(async () => {
|
|
while (createdUsers.length) {
|
|
const user = createdUsers.pop()!;
|
|
await deleteTestUser(user);
|
|
}
|
|
});
|
|
|
|
it("a bare authenticated user (no profile row) reads zero employees, not an error", async () => {
|
|
const user = await createBareAuthUser();
|
|
createdUsers.push(user);
|
|
const client = await signInAs(user);
|
|
|
|
const { data, error } = await client.from("employees").select("id");
|
|
expect(error).toBeNull();
|
|
expect(data).toEqual([]);
|
|
});
|
|
|
|
it("a bare authenticated user cannot insert into org reference tables", async () => {
|
|
const user = await createBareAuthUser();
|
|
createdUsers.push(user);
|
|
const client = await signInAs(user);
|
|
|
|
const { error } = await client.from("divisions").insert({ org_number: "20999999", name: `Test-${user.id}` });
|
|
expect(error).not.toBeNull();
|
|
});
|
|
|
|
it("an inactive HR profile can read its own profile row", async () => {
|
|
const user = await createHrUser({ active: false });
|
|
createdUsers.push(user);
|
|
const client = await signInAs(user);
|
|
|
|
const { data, error } = await client.from("profiles").select("id, is_active").eq("id", user.id);
|
|
expect(error).toBeNull();
|
|
expect(data).toHaveLength(1);
|
|
expect(data?.[0].is_active).toBe(false);
|
|
});
|
|
|
|
it("an inactive HR profile reads zero employees and cannot call mutation RPCs", async () => {
|
|
const user = await createHrUser({ active: false });
|
|
createdUsers.push(user);
|
|
const client = await signInAs(user);
|
|
|
|
const { data: employees, error: readError } = await client.from("employees").select("id");
|
|
expect(readError).toBeNull();
|
|
expect(employees).toEqual([]);
|
|
|
|
const { error: rpcError } = await client.rpc("hire_employee", {
|
|
payload: { first_name: "X", last_name: "Y", gender: "m", birth_date: "1990-01-01", entry_date: "2020-01-01" },
|
|
});
|
|
expect(rpcError?.message).toMatch(/Nicht berechtigt/);
|
|
});
|
|
|
|
it("an active HR user reads the seeded employee roster", async () => {
|
|
const user = await createHrUser({ active: true });
|
|
createdUsers.push(user);
|
|
const client = await signInAs(user);
|
|
|
|
const { data, error } = await client.from("employees").select("id").limit(1);
|
|
expect(error).toBeNull();
|
|
expect((data ?? []).length).toBeGreaterThan(0);
|
|
});
|
|
|
|
it("apply_due_pending_changes is revoked from authenticated users, even active HR", async () => {
|
|
const user = await createHrUser({ active: true });
|
|
createdUsers.push(user);
|
|
const client = await signInAs(user);
|
|
|
|
const { error } = await client.rpc("apply_due_pending_changes");
|
|
expect(error).not.toBeNull();
|
|
});
|
|
|
|
it("apply_due_pending_changes is callable by the service-role client", async () => {
|
|
const { data, error } = await adminClient.rpc("apply_due_pending_changes");
|
|
expect(error).toBeNull();
|
|
expect(typeof data).toBe("number");
|
|
});
|
|
});
|