328 lines
14 KiB
JavaScript
328 lines
14 KiB
JavaScript
/**
|
|
* Comprehensive RBAC System Test Suite
|
|
* Tests granular permissions for all roles and provides detailed analysis
|
|
*/
|
|
|
|
const { hasPermission, ROLES, PERMISSIONS } = require('./middleware/rbac');
|
|
|
|
// Mock users with different roles
|
|
const testUsers = {
|
|
admin: {
|
|
id: 1,
|
|
username: 'super_admin',
|
|
role: 'admin'
|
|
},
|
|
user_admin: {
|
|
id: 2,
|
|
username: 'user_manager',
|
|
role: 'user_admin'
|
|
},
|
|
security_admin: {
|
|
id: 3,
|
|
username: 'security_manager',
|
|
role: 'security_admin'
|
|
},
|
|
branding_admin: {
|
|
id: 4,
|
|
username: 'branding_manager',
|
|
role: 'branding_admin'
|
|
},
|
|
operator: {
|
|
id: 5,
|
|
username: 'device_operator',
|
|
role: 'operator'
|
|
},
|
|
viewer: {
|
|
id: 6,
|
|
username: 'read_only_user',
|
|
role: 'viewer'
|
|
}
|
|
};
|
|
|
|
// Comprehensive test scenarios for each role
|
|
const testScenarios = [
|
|
{
|
|
name: 'Admin - Full System Access',
|
|
user: testUsers.admin,
|
|
description: 'Should have access to all system functions',
|
|
tests: [
|
|
{ permission: 'tenant.view', expected: true, category: 'Tenant' },
|
|
{ permission: 'tenant.edit', expected: true, category: 'Tenant' },
|
|
{ permission: 'branding.view', expected: true, category: 'Branding' },
|
|
{ permission: 'branding.edit', expected: true, category: 'Branding' },
|
|
{ permission: 'security.view', expected: true, category: 'Security' },
|
|
{ permission: 'security.edit', expected: true, category: 'Security' },
|
|
{ permission: 'users.view', expected: true, category: 'Users' },
|
|
{ permission: 'users.create', expected: true, category: 'Users' },
|
|
{ permission: 'users.edit', expected: true, category: 'Users' },
|
|
{ permission: 'users.delete', expected: true, category: 'Users' },
|
|
{ permission: 'users.manage_roles', expected: true, category: 'Users' },
|
|
{ permission: 'auth.view', expected: true, category: 'Authentication' },
|
|
{ permission: 'auth.edit', expected: true, category: 'Authentication' },
|
|
{ permission: 'devices.manage', expected: true, category: 'Devices' },
|
|
{ permission: 'debug.access', expected: true, category: 'Debug' }
|
|
]
|
|
},
|
|
{
|
|
name: 'User Admin - User Management Specialist',
|
|
user: testUsers.user_admin,
|
|
description: 'Should only manage users, not system settings',
|
|
tests: [
|
|
{ permission: 'tenant.view', expected: true, category: 'Tenant' },
|
|
{ permission: 'tenant.edit', expected: false, category: 'Tenant' },
|
|
{ permission: 'branding.view', expected: false, category: 'Branding' },
|
|
{ permission: 'branding.edit', expected: false, category: 'Branding' },
|
|
{ permission: 'security.view', expected: false, category: 'Security' },
|
|
{ permission: 'security.edit', expected: false, category: 'Security' },
|
|
{ permission: 'users.view', expected: true, category: 'Users' },
|
|
{ permission: 'users.create', expected: true, category: 'Users' },
|
|
{ permission: 'users.edit', expected: true, category: 'Users' },
|
|
{ permission: 'users.delete', expected: true, category: 'Users' },
|
|
{ permission: 'users.manage_roles', expected: true, category: 'Users' },
|
|
{ permission: 'auth.view', expected: false, category: 'Authentication' },
|
|
{ permission: 'auth.edit', expected: false, category: 'Authentication' },
|
|
{ permission: 'devices.manage', expected: false, category: 'Devices' },
|
|
{ permission: 'debug.access', expected: false, category: 'Debug' }
|
|
]
|
|
},
|
|
{
|
|
name: 'Security Admin - Security Specialist',
|
|
user: testUsers.security_admin,
|
|
description: 'Should only manage security and authentication settings',
|
|
tests: [
|
|
{ permission: 'tenant.view', expected: true, category: 'Tenant' },
|
|
{ permission: 'tenant.edit', expected: false, category: 'Tenant' },
|
|
{ permission: 'branding.view', expected: false, category: 'Branding' },
|
|
{ permission: 'branding.edit', expected: false, category: 'Branding' },
|
|
{ permission: 'security.view', expected: true, category: 'Security' },
|
|
{ permission: 'security.edit', expected: true, category: 'Security' },
|
|
{ permission: 'users.view', expected: true, category: 'Users' },
|
|
{ permission: 'users.create', expected: false, category: 'Users' },
|
|
{ permission: 'users.edit', expected: false, category: 'Users' },
|
|
{ permission: 'users.delete', expected: false, category: 'Users' },
|
|
{ permission: 'users.manage_roles', expected: false, category: 'Users' },
|
|
{ permission: 'auth.view', expected: true, category: 'Authentication' },
|
|
{ permission: 'auth.edit', expected: true, category: 'Authentication' },
|
|
{ permission: 'devices.manage', expected: false, category: 'Devices' },
|
|
{ permission: 'debug.access', expected: false, category: 'Debug' }
|
|
]
|
|
},
|
|
{
|
|
name: 'Branding Admin - Branding Specialist',
|
|
user: testUsers.branding_admin,
|
|
description: 'Should only manage branding and visual customization',
|
|
tests: [
|
|
{ permission: 'tenant.view', expected: true, category: 'Tenant' },
|
|
{ permission: 'tenant.edit', expected: false, category: 'Tenant' },
|
|
{ permission: 'branding.view', expected: true, category: 'Branding' },
|
|
{ permission: 'branding.edit', expected: true, category: 'Branding' },
|
|
{ permission: 'security.view', expected: false, category: 'Security' },
|
|
{ permission: 'security.edit', expected: false, category: 'Security' },
|
|
{ permission: 'users.view', expected: false, category: 'Users' },
|
|
{ permission: 'users.create', expected: false, category: 'Users' },
|
|
{ permission: 'users.edit', expected: false, category: 'Users' },
|
|
{ permission: 'users.delete', expected: false, category: 'Users' },
|
|
{ permission: 'users.manage_roles', expected: false, category: 'Users' },
|
|
{ permission: 'auth.view', expected: false, category: 'Authentication' },
|
|
{ permission: 'auth.edit', expected: false, category: 'Authentication' },
|
|
{ permission: 'devices.manage', expected: false, category: 'Devices' },
|
|
{ permission: 'debug.access', expected: false, category: 'Debug' }
|
|
]
|
|
},
|
|
{
|
|
name: 'Operator - Limited Operational Access',
|
|
user: testUsers.operator,
|
|
description: 'Should have basic operational access without admin privileges',
|
|
tests: [
|
|
{ permission: 'tenant.view', expected: true, category: 'Tenant' },
|
|
{ permission: 'tenant.edit', expected: false, category: 'Tenant' },
|
|
{ permission: 'branding.view', expected: false, category: 'Branding' },
|
|
{ permission: 'branding.edit', expected: false, category: 'Branding' },
|
|
{ permission: 'security.view', expected: false, category: 'Security' },
|
|
{ permission: 'security.edit', expected: false, category: 'Security' },
|
|
{ permission: 'users.view', expected: false, category: 'Users' },
|
|
{ permission: 'users.create', expected: false, category: 'Users' },
|
|
{ permission: 'users.edit', expected: false, category: 'Users' },
|
|
{ permission: 'users.delete', expected: false, category: 'Users' },
|
|
{ permission: 'users.manage_roles', expected: false, category: 'Users' },
|
|
{ permission: 'auth.view', expected: false, category: 'Authentication' },
|
|
{ permission: 'auth.edit', expected: false, category: 'Authentication' },
|
|
{ permission: 'devices.manage', expected: true, category: 'Devices' },
|
|
{ permission: 'debug.access', expected: false, category: 'Debug' }
|
|
]
|
|
},
|
|
{
|
|
name: 'Viewer - Read-Only Access',
|
|
user: testUsers.viewer,
|
|
description: 'Should only have read access to basic information',
|
|
tests: [
|
|
{ permission: 'tenant.view', expected: false, category: 'Tenant' },
|
|
{ permission: 'tenant.edit', expected: false, category: 'Tenant' },
|
|
{ permission: 'branding.view', expected: false, category: 'Branding' },
|
|
{ permission: 'branding.edit', expected: false, category: 'Branding' },
|
|
{ permission: 'security.view', expected: false, category: 'Security' },
|
|
{ permission: 'security.edit', expected: false, category: 'Security' },
|
|
{ permission: 'users.view', expected: false, category: 'Users' },
|
|
{ permission: 'users.create', expected: false, category: 'Users' },
|
|
{ permission: 'users.edit', expected: false, category: 'Users' },
|
|
{ permission: 'users.delete', expected: false, category: 'Users' },
|
|
{ permission: 'users.manage_roles', expected: false, category: 'Users' },
|
|
{ permission: 'auth.view', expected: false, category: 'Authentication' },
|
|
{ permission: 'auth.edit', expected: false, category: 'Authentication' },
|
|
{ permission: 'devices.manage', expected: false, category: 'Devices' },
|
|
{ permission: 'debug.access', expected: false, category: 'Debug' }
|
|
]
|
|
}
|
|
];
|
|
|
|
// Console formatting helpers
|
|
const colors = {
|
|
reset: '\x1b[0m',
|
|
bright: '\x1b[1m',
|
|
red: '\x1b[31m',
|
|
green: '\x1b[32m',
|
|
yellow: '\x1b[33m',
|
|
blue: '\x1b[34m',
|
|
magenta: '\x1b[35m',
|
|
cyan: '\x1b[36m'
|
|
};
|
|
|
|
function colorText(text, color) {
|
|
return `${colors[color]}${text}${colors.reset}`;
|
|
}
|
|
|
|
// Main test execution
|
|
console.log(colorText('🧪 COMPREHENSIVE RBAC SYSTEM TEST SUITE', 'bright'));
|
|
console.log(colorText('=' .repeat(60), 'cyan'));
|
|
console.log();
|
|
|
|
// Display system overview
|
|
console.log(colorText('📋 RBAC System Overview:', 'blue'));
|
|
console.log();
|
|
|
|
console.log(colorText('Available Roles:', 'cyan'));
|
|
Object.entries(ROLES).forEach(([role, permissions]) => {
|
|
console.log(` ${colorText('●', 'green')} ${colorText(role, 'bright')}: ${permissions.length} permissions`);
|
|
console.log(` ${permissions.slice(0, 5).join(', ')}${permissions.length > 5 ? '...' : ''}`);
|
|
});
|
|
|
|
console.log();
|
|
console.log(colorText('Available Permissions:', 'cyan'));
|
|
const permissionsByCategory = {};
|
|
Object.keys(PERMISSIONS).forEach(permission => {
|
|
const category = permission.split('.')[0];
|
|
if (!permissionsByCategory[category]) {
|
|
permissionsByCategory[category] = [];
|
|
}
|
|
permissionsByCategory[category].push(permission);
|
|
});
|
|
|
|
Object.entries(permissionsByCategory).forEach(([category, permissions]) => {
|
|
console.log(` ${colorText('●', 'yellow')} ${colorText(category.toUpperCase(), 'bright')}: ${permissions.join(', ')}`);
|
|
});
|
|
|
|
console.log();
|
|
console.log(colorText('🔍 RUNNING PERMISSION TESTS:', 'blue'));
|
|
console.log(colorText('=' .repeat(60), 'cyan'));
|
|
|
|
// Test execution
|
|
let totalTests = 0;
|
|
let passedTests = 0;
|
|
const results = {};
|
|
|
|
testScenarios.forEach(scenario => {
|
|
console.log();
|
|
console.log(colorText(`👤 ${scenario.name}`, 'bright'));
|
|
console.log(colorText(` ${scenario.description}`, 'yellow'));
|
|
console.log(colorText('─'.repeat(60), 'cyan'));
|
|
|
|
results[scenario.user.role] = {
|
|
passed: 0,
|
|
failed: 0,
|
|
details: {}
|
|
};
|
|
|
|
// Group tests by category for better organization
|
|
const testsByCategory = {};
|
|
scenario.tests.forEach(test => {
|
|
if (!testsByCategory[test.category]) {
|
|
testsByCategory[test.category] = [];
|
|
}
|
|
testsByCategory[test.category].push(test);
|
|
});
|
|
|
|
Object.entries(testsByCategory).forEach(([category, tests]) => {
|
|
console.log(colorText(` 📁 ${category}:`, 'magenta'));
|
|
|
|
tests.forEach(test => {
|
|
totalTests++;
|
|
const result = hasPermission(scenario.user.role, test.permission);
|
|
const passed = result === test.expected;
|
|
|
|
if (passed) {
|
|
passedTests++;
|
|
results[scenario.user.role].passed++;
|
|
} else {
|
|
results[scenario.user.role].failed++;
|
|
}
|
|
|
|
const status = passed ? colorText('✅', 'green') : colorText('❌', 'red');
|
|
const expectedText = test.expected ? colorText('ALLOW', 'green') : colorText('DENY', 'red');
|
|
const actualText = result ? colorText('ALLOW', 'green') : colorText('DENY', 'red');
|
|
|
|
console.log(` ${status} ${test.permission}: Expected ${expectedText}, Got ${actualText}`);
|
|
|
|
if (!results[scenario.user.role].details[category]) {
|
|
results[scenario.user.role].details[category] = { passed: 0, failed: 0 };
|
|
}
|
|
results[scenario.user.role].details[category][passed ? 'passed' : 'failed']++;
|
|
});
|
|
});
|
|
});
|
|
|
|
console.log();
|
|
console.log(colorText('📊 DETAILED TEST RESULTS:', 'blue'));
|
|
console.log(colorText('=' .repeat(60), 'cyan'));
|
|
|
|
// Display detailed results
|
|
Object.entries(results).forEach(([role, result]) => {
|
|
const total = result.passed + result.failed;
|
|
const successRate = Math.round((result.passed / total) * 100);
|
|
const statusColor = successRate === 100 ? 'green' : successRate >= 80 ? 'yellow' : 'red';
|
|
|
|
console.log();
|
|
console.log(colorText(`🔐 ${role.toUpperCase()}:`, 'bright'));
|
|
console.log(` Overall: ${colorText(result.passed, 'green')}/${total} (${colorText(successRate + '%', statusColor)})`);
|
|
|
|
Object.entries(result.details).forEach(([category, details]) => {
|
|
const categoryTotal = details.passed + details.failed;
|
|
const categoryRate = Math.round((details.passed / categoryTotal) * 100);
|
|
const categoryColor = categoryRate === 100 ? 'green' : categoryRate >= 80 ? 'yellow' : 'red';
|
|
console.log(` ${category}: ${colorText(details.passed, 'green')}/${categoryTotal} (${colorText(categoryRate + '%', categoryColor)})`);
|
|
});
|
|
});
|
|
|
|
console.log();
|
|
console.log(colorText('📈 SUMMARY:', 'blue'));
|
|
console.log(colorText('─'.repeat(30), 'cyan'));
|
|
console.log(`Total Tests: ${totalTests}`);
|
|
console.log(`Passed: ${colorText(passedTests, 'green')}`);
|
|
console.log(`Failed: ${colorText(totalTests - passedTests, totalTests > passedTests ? 'red' : 'green')}`);
|
|
console.log(`Success Rate: ${colorText(Math.round((passedTests/totalTests) * 100) + '%', passedTests === totalTests ? 'green' : 'yellow')}`);
|
|
|
|
console.log();
|
|
if (passedTests === totalTests) {
|
|
console.log(colorText('🎉 ALL TESTS PASSED! RBAC system is working correctly.', 'green'));
|
|
console.log(colorText('✓ Role separation is properly enforced', 'green'));
|
|
console.log(colorText('✓ Granular permissions are functioning as expected', 'green'));
|
|
console.log(colorText('✓ Security boundaries are maintained', 'green'));
|
|
} else {
|
|
console.log(colorText('⚠️ SOME TESTS FAILED!', 'red'));
|
|
console.log(colorText('Please review the RBAC configuration and role definitions.', 'yellow'));
|
|
console.log(colorText('Failed tests indicate potential security vulnerabilities.', 'red'));
|
|
}
|
|
|
|
console.log();
|
|
console.log(colorText('🔐 Security Validation Complete', 'cyan'));
|
|
console.log(colorText('=' .repeat(60), 'cyan'));
|