Function TestRenderPermissionsResolvesMe

site/site_test.go:228–297

(t *testing.T)

}

func TestRenderPermissionsResolvesMe(t *testing.T) {
	t.Parallel()

	// GIVEN: a site handler wired to a real RBAC authorizer and a
	// template that renders only the SSR permissions JSON.
	siteFS := fstest.MapFS{
		"index.html": &fstest.MapFile{
			Data: []byte("{{ .Permissions }}"),
		},
	}
	db, _ := dbtestutil.NewDB(t)
	authorizer := rbac.NewStrictCachingAuthorizer(prometheus.NewRegistry())

	handler, err := site.New(&site.Options{
		Telemetry:  telemetry.NewNoop(),
		Database:   db,
		SiteFS:     siteFS,
		Authorizer: authorizer,
	})
	require.NoError(t, err)

	// GIVEN: a user with the agents-access role at the org level.
	org := dbgen.Organization(t, db, database.Organization{})
	userWithRole := dbgen.User(t, db, database.User{})
	dbgen.OrganizationMember(t, db, database.OrganizationMember{
		OrganizationID: org.ID,
		UserID:         userWithRole.ID,
		Roles:          []string{rbac.RoleAgentsAccess()},
	})
	_, tokenWithRole := dbgen.APIKey(t, db, database.APIKey{
		UserID:    userWithRole.ID,
		ExpiresAt: time.Now().Add(time.Hour),
	})

	// WHEN: the user loads the page.
	r := httptest.NewRequest("GET", "/", nil)
	r.Header.Set(codersdk.SessionTokenHeader, tokenWithRole)
	rw := httptest.NewRecorder()
	handler.ServeHTTP(rw, r)
	require.Equal(t, http.StatusOK, rw.Code)

	// THEN: the SSR-rendered permissions include createChat = true
	// because the agents-access role grants org-scoped chat create
	// permission, and the any_org check picks it up.
	var permsWithRole codersdk.AuthorizationResponse
	err = json.Unmarshal([]byte(html.UnescapeString(rw.Body.String())), &permsWithRole)
	require.NoError(t, err)
	assert.True(t, permsWithRole["createChat"], "user with agents-access role should have createChat = true")

	// GIVEN: a user without the agents-access role.
	userWithoutRole := dbgen.User(t, db, database.User{})
	_, tokenWithoutRole := dbgen.APIKey(t, db, database.APIKey{
		UserID:    userWithoutRole.ID,
		ExpiresAt: time.Now().Add(time.Hour),
	})

	// WHEN: the user loads the page.
	r = httptest.NewRequest("GET", "/", nil)