From 07104996f6e0a094547ced5b103527b60be7aa00 Mon Sep 17 00:00:00 2001 From: WhiteMuush Date: Tue, 11 Aug 2026 14:57:48 +0200 Subject: [PATCH] fix(test): stop the RBAC integration suite from sharing the seeded admin require-permission.itest.ts reassigned the shared admin account to Viewer, then restored Administrator at the end. That only holds if suites run one at a time. Vitest runs test files in parallel against the same database, so any suite reading the admin's role inside that window sees the read-only Viewer set instead. This is what broke Integration (DB) on the deps branch: roles/route.itest.ts reported the admin missing exactly the ten non-read permissions of the SOC Analyst preset, which is the Viewer set. Forcing the admin to Viewer and running that suite reproduces the CI output character for character. The suite now seeds its own company and asserts on that company's Viewer role. It never touched the admin user for its assertions anyway, the reassignment was dead weight that only created the race. --- src/lib/rbac/require-permission.itest.ts | 34 ++++++++++++++---------- 1 file changed, 20 insertions(+), 14 deletions(-) diff --git a/src/lib/rbac/require-permission.itest.ts b/src/lib/rbac/require-permission.itest.ts index 1ffbae4..bf59e4e 100644 --- a/src/lib/rbac/require-permission.itest.ts +++ b/src/lib/rbac/require-permission.itest.ts @@ -1,22 +1,28 @@ -import { describe, it, expect } from "vitest" +import { describe, it, expect, beforeAll } from "vitest" import { prisma } from "@/lib/prisma" import { seedPresetsForCompany, resolvePresetRoleId } from "./seed-roles" -// Uses the seeded admin from `npx tsx prisma/seed.ts`. Assigns it the Viewer -// preset, then asserts a Viewer lacks policy:manage but holds policy:read. +// Seeds its own company rather than borrowing the shared admin account. The +// previous version reassigned that admin to Viewer and restored it at the end, +// which only holds if suites run one at a time. Vitest runs test files in +// parallel against the same database, so any suite reading the admin's role +// during that window saw the read-only Viewer set and failed. +let companyId: string + +beforeAll(async () => { + const company = await prisma.company.create({ + data: { name: "Require Permission Test Co", domain: `require-perm-${Date.now()}.test` }, + }) + companyId = company.id + await seedPresetsForCompany(prisma, companyId) +}) + describe("requirePermission (real DB, in-process)", () => { it("Viewer is denied policy:manage but allowed policy:read", async () => { - const admin = await prisma.user.findUniqueOrThrow({ where: { email: "admin@datashield.local" } }) - await seedPresetsForCompany(prisma, admin.companyId) - const viewerId = await resolvePresetRoleId(prisma, admin.companyId, "Viewer") - await prisma.user.update({ where: { id: admin.id }, data: { roleId: viewerId } }) - - const perms = await prisma.role.findUniqueOrThrow({ where: { id: viewerId } }) - expect(perms.permissions).toContain("policy:read") - expect(perms.permissions).not.toContain("policy:manage") + const viewerId = await resolvePresetRoleId(prisma, companyId, "Viewer") + const viewer = await prisma.role.findUniqueOrThrow({ where: { id: viewerId } }) - // Restore Administrator so other suites keep working. - const adminRole = await resolvePresetRoleId(prisma, admin.companyId, "Administrator") - await prisma.user.update({ where: { id: admin.id }, data: { roleId: adminRole } }) + expect(viewer.permissions).toContain("policy:read") + expect(viewer.permissions).not.toContain("policy:manage") }) })