mirror of
https://github.com/danny-avila/LibreChat.git
synced 2025-12-23 11:50:14 +01:00
WIP: Role as Permission Principal Type
This commit is contained in:
Danny Avila
parent
7c35d17e3d
commit
89f0a4e02f
11 changed files with 1167 additions and 38 deletions
367
packages/data-schemas/src/methods/userGroup.roles.spec.ts
Normal file
367
packages/data-schemas/src/methods/userGroup.roles.spec.ts
Normal file
|
|
@ -0,0 +1,367 @@
|
|||
import mongoose from 'mongoose';
|
||||
import { PrincipalType } from 'librechat-data-provider';
|
||||
import { MongoMemoryServer } from 'mongodb-memory-server';
|
||||
import type * as t from '~/types';
|
||||
import { createUserGroupMethods } from './userGroup';
|
||||
import groupSchema from '~/schema/group';
|
||||
import userSchema from '~/schema/user';
|
||||
import roleSchema from '~/schema/role';
|
||||
|
||||
/** Mocking logger */
|
||||
jest.mock('~/config/winston', () => ({
|
||||
error: jest.fn(),
|
||||
info: jest.fn(),
|
||||
debug: jest.fn(),
|
||||
}));
|
||||
|
||||
let mongoServer: MongoMemoryServer;
|
||||
let Group: mongoose.Model<t.IGroup>;
|
||||
let User: mongoose.Model<t.IUser>;
|
||||
let Role: mongoose.Model<t.IRole>;
|
||||
let methods: ReturnType<typeof createUserGroupMethods>;
|
||||
|
||||
beforeAll(async () => {
|
||||
mongoServer = await MongoMemoryServer.create();
|
||||
const mongoUri = mongoServer.getUri();
|
||||
await mongoose.connect(mongoUri);
|
||||
|
||||
/** Register models */
|
||||
Group = mongoose.models.Group || mongoose.model<t.IGroup>('Group', groupSchema);
|
||||
User = mongoose.models.User || mongoose.model<t.IUser>('User', userSchema);
|
||||
Role = mongoose.models.Role || mongoose.model<t.IRole>('Role', roleSchema);
|
||||
|
||||
/** Initialize methods */
|
||||
methods = createUserGroupMethods(mongoose);
|
||||
});
|
||||
|
||||
afterAll(async () => {
|
||||
await mongoose.disconnect();
|
||||
await mongoServer.stop();
|
||||
});
|
||||
|
||||
beforeEach(async () => {
|
||||
await mongoose.connection.dropDatabase();
|
||||
});
|
||||
|
||||
describe('Role-based Permissions Integration', () => {
|
||||
describe('getUserPrincipals with roles', () => {
|
||||
test('should include role principal for user with role', async () => {
|
||||
const adminUser = await User.create({
|
||||
name: 'Admin User',
|
||||
email: 'admin@test.com',
|
||||
provider: 'local',
|
||||
role: 'admin',
|
||||
});
|
||||
|
||||
const principals = await methods.getUserPrincipals(adminUser._id as mongoose.Types.ObjectId);
|
||||
|
||||
// Should have user, role, and public principals
|
||||
expect(principals).toHaveLength(3);
|
||||
|
||||
const userPrincipal = principals.find((p) => p.principalType === PrincipalType.USER);
|
||||
const rolePrincipal = principals.find((p) => p.principalType === PrincipalType.ROLE);
|
||||
const publicPrincipal = principals.find((p) => p.principalType === PrincipalType.PUBLIC);
|
||||
|
||||
expect(userPrincipal).toBeDefined();
|
||||
expect(userPrincipal?.principalId?.toString()).toBe(
|
||||
(adminUser._id as mongoose.Types.ObjectId).toString(),
|
||||
);
|
||||
|
||||
expect(rolePrincipal).toBeDefined();
|
||||
expect(rolePrincipal?.principalType).toBe(PrincipalType.ROLE);
|
||||
expect(rolePrincipal?.principalId).toBe('admin');
|
||||
|
||||
expect(publicPrincipal).toBeDefined();
|
||||
expect(publicPrincipal?.principalType).toBe(PrincipalType.PUBLIC);
|
||||
expect(publicPrincipal?.principalId).toBeUndefined();
|
||||
});
|
||||
|
||||
test('should not include role principal for user without role', async () => {
|
||||
const regularUser = await User.create({
|
||||
name: 'Regular User',
|
||||
email: 'user@test.com',
|
||||
provider: 'local',
|
||||
role: null, // Explicitly set to null to override default
|
||||
});
|
||||
|
||||
const principals = await methods.getUserPrincipals(
|
||||
regularUser._id as mongoose.Types.ObjectId,
|
||||
);
|
||||
|
||||
// Should only have user and public principals
|
||||
expect(principals).toHaveLength(2);
|
||||
|
||||
const rolePrincipal = principals.find((p) => p.principalType === PrincipalType.ROLE);
|
||||
expect(rolePrincipal).toBeUndefined();
|
||||
});
|
||||
|
||||
test('should include all principal types for user with role and groups', async () => {
|
||||
const user = await User.create({
|
||||
name: 'Complete User',
|
||||
email: 'complete@test.com',
|
||||
provider: 'local',
|
||||
role: 'moderator',
|
||||
});
|
||||
|
||||
// Add user to groups
|
||||
const group1 = await Group.create({
|
||||
name: 'Group 1',
|
||||
source: 'local',
|
||||
memberIds: [(user._id as mongoose.Types.ObjectId).toString()],
|
||||
});
|
||||
|
||||
const group2 = await Group.create({
|
||||
name: 'Group 2',
|
||||
source: 'local',
|
||||
memberIds: [(user._id as mongoose.Types.ObjectId).toString()],
|
||||
});
|
||||
|
||||
const principals = await methods.getUserPrincipals(user._id as mongoose.Types.ObjectId);
|
||||
|
||||
// Should have user, role, 2 groups, and public
|
||||
expect(principals).toHaveLength(5);
|
||||
|
||||
const principalTypes = principals.map((p) => p.principalType);
|
||||
expect(principalTypes).toContain(PrincipalType.USER);
|
||||
expect(principalTypes).toContain(PrincipalType.ROLE);
|
||||
expect(principalTypes).toContain(PrincipalType.GROUP);
|
||||
expect(principalTypes).toContain(PrincipalType.PUBLIC);
|
||||
|
||||
// Check role principal
|
||||
const rolePrincipal = principals.find((p) => p.principalType === PrincipalType.ROLE);
|
||||
expect(rolePrincipal?.principalId).toBe('moderator');
|
||||
|
||||
// Check group principals
|
||||
const groupPrincipals = principals.filter((p) => p.principalType === PrincipalType.GROUP);
|
||||
expect(groupPrincipals).toHaveLength(2);
|
||||
const groupIds = groupPrincipals.map((p) => p.principalId?.toString());
|
||||
expect(groupIds).toContain(group1._id.toString());
|
||||
expect(groupIds).toContain(group2._id.toString());
|
||||
});
|
||||
|
||||
test('should handle different role values', async () => {
|
||||
const testCases = [
|
||||
{ role: 'admin', expected: 'admin' },
|
||||
{ role: 'moderator', expected: 'moderator' },
|
||||
{ role: 'editor', expected: 'editor' },
|
||||
{ role: 'viewer', expected: 'viewer' },
|
||||
{ role: 'custom_role', expected: 'custom_role' },
|
||||
];
|
||||
|
||||
for (const testCase of testCases) {
|
||||
const user = await User.create({
|
||||
name: `User with ${testCase.role}`,
|
||||
email: `${testCase.role}@test.com`,
|
||||
provider: 'local',
|
||||
role: testCase.role,
|
||||
});
|
||||
|
||||
const principals = await methods.getUserPrincipals(user._id as mongoose.Types.ObjectId);
|
||||
const rolePrincipal = principals.find((p) => p.principalType === PrincipalType.ROLE);
|
||||
|
||||
expect(rolePrincipal).toBeDefined();
|
||||
expect(rolePrincipal?.principalId).toBe(testCase.expected);
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
describe('searchPrincipals with role support', () => {
|
||||
beforeEach(async () => {
|
||||
// Create some roles in the database
|
||||
await Role.create([
|
||||
{ name: 'admin', description: 'Administrator role' },
|
||||
{ name: 'moderator', description: 'Moderator role' },
|
||||
{ name: 'editor', description: 'Editor role' },
|
||||
{ name: 'viewer', description: 'Viewer role' },
|
||||
{ name: 'guest', description: 'Guest role' },
|
||||
]);
|
||||
|
||||
// Create some users
|
||||
await User.create([
|
||||
{
|
||||
name: 'Admin User',
|
||||
email: 'admin@test.com',
|
||||
username: 'adminuser',
|
||||
provider: 'local',
|
||||
role: 'admin',
|
||||
},
|
||||
{
|
||||
name: 'Moderator User',
|
||||
email: 'moderator@test.com',
|
||||
username: 'moduser',
|
||||
provider: 'local',
|
||||
role: 'moderator',
|
||||
},
|
||||
]);
|
||||
|
||||
// Create some groups
|
||||
await Group.create([
|
||||
{
|
||||
name: 'Admin Group',
|
||||
source: 'local',
|
||||
memberIds: [],
|
||||
},
|
||||
{
|
||||
name: 'Moderator Group',
|
||||
source: 'local',
|
||||
memberIds: [],
|
||||
},
|
||||
]);
|
||||
});
|
||||
|
||||
test('should search for roles when Role model exists', async () => {
|
||||
const results = await methods.searchPrincipals('admin');
|
||||
|
||||
const roleResults = results.filter((r) => r.type === PrincipalType.ROLE);
|
||||
const userResults = results.filter((r) => r.type === PrincipalType.USER);
|
||||
const groupResults = results.filter((r) => r.type === PrincipalType.GROUP);
|
||||
|
||||
// Should find the admin role
|
||||
expect(roleResults).toHaveLength(1);
|
||||
expect(roleResults[0].id).toBe('admin');
|
||||
expect(roleResults[0].name).toBe('admin');
|
||||
expect(roleResults[0].type).toBe(PrincipalType.ROLE);
|
||||
|
||||
// Should also find admin user and group
|
||||
expect(userResults.some((u) => u.name === 'Admin User')).toBe(true);
|
||||
expect(groupResults.some((g) => g.name === 'Admin Group')).toBe(true);
|
||||
});
|
||||
|
||||
test('should filter search results by role type', async () => {
|
||||
const results = await methods.searchPrincipals('mod', 10, PrincipalType.ROLE);
|
||||
|
||||
expect(results.every((r) => r.type === PrincipalType.ROLE)).toBe(true);
|
||||
expect(results).toHaveLength(1);
|
||||
expect(results[0].name).toBe('moderator');
|
||||
});
|
||||
|
||||
test('should respect limit for role search', async () => {
|
||||
// Create many roles
|
||||
for (let i = 0; i < 10; i++) {
|
||||
await Role.create({ name: `testrole${i}` });
|
||||
}
|
||||
|
||||
const results = await methods.searchPrincipals('testrole', 5, PrincipalType.ROLE);
|
||||
|
||||
expect(results).toHaveLength(5);
|
||||
expect(results.every((r) => r.type === PrincipalType.ROLE)).toBe(true);
|
||||
});
|
||||
|
||||
test('should search across all principal types', async () => {
|
||||
const results = await methods.searchPrincipals('mod');
|
||||
|
||||
// Should find moderator role, user, and group
|
||||
const types = new Set(results.map((r) => r.type));
|
||||
expect(types.has(PrincipalType.ROLE)).toBe(true);
|
||||
expect(types.has(PrincipalType.USER)).toBe(true);
|
||||
expect(types.has(PrincipalType.GROUP)).toBe(true);
|
||||
|
||||
// Check specific results
|
||||
expect(results.some((r) => r.type === PrincipalType.ROLE && r.name === 'moderator')).toBe(
|
||||
true,
|
||||
);
|
||||
expect(
|
||||
results.some((r) => r.type === PrincipalType.USER && r.name === 'Moderator User'),
|
||||
).toBe(true);
|
||||
expect(
|
||||
results.some((r) => r.type === PrincipalType.GROUP && r.name === 'Moderator Group'),
|
||||
).toBe(true);
|
||||
});
|
||||
|
||||
test('should handle case-insensitive role search', async () => {
|
||||
const results = await methods.searchPrincipals('ADMIN', 10, PrincipalType.ROLE);
|
||||
|
||||
expect(results).toHaveLength(1);
|
||||
expect(results[0].name).toBe('admin');
|
||||
});
|
||||
|
||||
test('should return empty array for no role matches', async () => {
|
||||
const results = await methods.searchPrincipals('nonexistentrole', 10, PrincipalType.ROLE);
|
||||
|
||||
expect(results).toEqual([]);
|
||||
});
|
||||
});
|
||||
|
||||
describe('Role principals in complex scenarios', () => {
|
||||
test('should handle user role changes', async () => {
|
||||
const user = await User.create({
|
||||
name: 'Changing User',
|
||||
email: 'change@test.com',
|
||||
provider: 'local',
|
||||
role: 'viewer',
|
||||
});
|
||||
|
||||
// Initial principals
|
||||
let principals = await methods.getUserPrincipals(user._id as mongoose.Types.ObjectId);
|
||||
let rolePrincipal = principals.find((p) => p.principalType === PrincipalType.ROLE);
|
||||
expect(rolePrincipal?.principalId).toBe('viewer');
|
||||
|
||||
// Change role
|
||||
user.role = 'editor';
|
||||
await user.save();
|
||||
|
||||
// Get principals again
|
||||
principals = await methods.getUserPrincipals(user._id as mongoose.Types.ObjectId);
|
||||
rolePrincipal = principals.find((p) => p.principalType === PrincipalType.ROLE);
|
||||
expect(rolePrincipal?.principalId).toBe('editor');
|
||||
});
|
||||
|
||||
test('should handle user role removal', async () => {
|
||||
const user = await User.create({
|
||||
name: 'Demoted User',
|
||||
email: 'demoted@test.com',
|
||||
provider: 'local',
|
||||
role: 'admin',
|
||||
});
|
||||
|
||||
// Initial check
|
||||
let principals = await methods.getUserPrincipals(user._id as mongoose.Types.ObjectId);
|
||||
expect(principals).toHaveLength(3); // user, role, public
|
||||
|
||||
// Remove role
|
||||
user.role = undefined;
|
||||
await user.save();
|
||||
|
||||
// Check again
|
||||
principals = await methods.getUserPrincipals(user._id as mongoose.Types.ObjectId);
|
||||
expect(principals).toHaveLength(2); // user, public
|
||||
const rolePrincipal = principals.find((p) => p.principalType === PrincipalType.ROLE);
|
||||
expect(rolePrincipal).toBeUndefined();
|
||||
});
|
||||
|
||||
test('should handle empty or null role values', async () => {
|
||||
const testCases = [
|
||||
{ role: '', expected: false },
|
||||
{ role: null, expected: false },
|
||||
{ role: undefined, expected: true, expectedRole: 'USER' }, // undefined gets default 'USER'
|
||||
{ role: ' ', expected: false }, // whitespace-only is not a valid role
|
||||
{ role: 'valid_role', expected: true, expectedRole: 'valid_role' },
|
||||
];
|
||||
|
||||
for (const testCase of testCases) {
|
||||
const userData: Partial<t.IUser> = {
|
||||
name: `User ${Math.random()}`,
|
||||
email: `test${Math.random()}@test.com`,
|
||||
provider: 'local',
|
||||
};
|
||||
|
||||
// Only set role if it's not undefined (to test undefined case)
|
||||
if (testCase.role !== undefined) {
|
||||
userData.role = testCase.role as string;
|
||||
}
|
||||
|
||||
const user = await User.create(userData);
|
||||
|
||||
const principals = await methods.getUserPrincipals(user._id as mongoose.Types.ObjectId);
|
||||
const rolePrincipal = principals.find((p) => p.principalType === PrincipalType.ROLE);
|
||||
|
||||
if (testCase.expected) {
|
||||
expect(rolePrincipal).toBeDefined();
|
||||
expect(rolePrincipal?.principalId).toBe(testCase.expectedRole || testCase.role);
|
||||
} else {
|
||||
expect(rolePrincipal).toBeUndefined();
|
||||
}
|
||||
}
|
||||
});
|
||||
});
|
||||
});
|
||||
Loading…
Add table
Add a link
Reference in a new issue