hyb-oa/server/tests/unit/constants/permissions.test.js

const {
  hasPermission,
  resolveEntityPermission,
  resolvePermissionsForRoles,
} = require("../../../src/constants/permissions");

describe("Permission Constants", () => {
  it("separates full AP reading from payment review and preserves multi-role grants", () => {
    for (const role of ["ceo", "finance", "finance_mgr"]) {
      expect(hasPermission(resolvePermissionsForRoles([role]), "finance.ledger.view")).toBe(true);
    }
    for (const role of ["manager", "employee", "system_admin", "hr", "administration"]) {
      expect(hasPermission(resolvePermissionsForRoles([role]), "finance.ledger.view")).toBe(false);
    }
    expect(hasPermission(resolvePermissionsForRoles(["manager", "finance"]), "finance.ledger.view")).toBe(true);
    expect(hasPermission(resolvePermissionsForRoles(["manager"]), "payment.batch.review")).toBe(true);
    expect(hasPermission(resolvePermissionsForRoles(["ceo"]), "payment.batch.manage")).toBe(false);
  });

  it("grants leave self-service permissions to employee roles", () => {
    const employeePermissions = resolvePermissionsForRoles(["employee"]);

    expect(employeePermissions).toEqual(
      expect.arrayContaining(["leave.create", "leave.view_own", "leave.submit"]),
    );
  });

  it("grants leave approval only to configured approver roles", () => {
    expect(hasPermission(resolvePermissionsForRoles(["manager"]), "leave.approve")).toBe(true);
    expect(hasPermission(resolvePermissionsForRoles(["ceo"]), "leave.approve")).toBe(true);
    expect(hasPermission(resolvePermissionsForRoles(["finance"]), "leave.approve")).toBe(false);
    expect(hasPermission(resolvePermissionsForRoles(["finance_mgr"]), "leave.approve")).toBe(false);
    expect(hasPermission(resolvePermissionsForRoles(["hr"]), "leave.approve")).toBe(false);
  });

  it("grants manager leave view-all without leave.manage", () => {
    const managerPermissions = resolvePermissionsForRoles(["manager"]);

    expect(managerPermissions).toEqual(expect.arrayContaining(["leave.view_all"]));
    expect(hasPermission(managerPermissions, "leave.manage")).toBe(false);
  });


  it("grants master data permissions to finance and finance manager roles", () => {
    expect(hasPermission(resolvePermissionsForRoles(["finance"]), "masterdata.view")).toBe(true);
    expect(hasPermission(resolvePermissionsForRoles(["finance"]), "masterdata.manage")).toBe(false);
    expect(hasPermission(resolvePermissionsForRoles(["finance_mgr"]), "masterdata.manage")).toBe(true);
    expect(hasPermission(resolvePermissionsForRoles(["ceo"]), "masterdata.view")).toBe(true);
  });

  it("grants hr leave view-all and manage permissions", () => {
    const hrPermissions = resolvePermissionsForRoles(["hr"]);

    expect(hrPermissions).toEqual(expect.arrayContaining(["leave.view_all", "leave.manage"]));
  });

  it("keeps the OA system administrator separate from business and sensitive-data roles", () => {
    const permissions = resolvePermissionsForRoles(["system_admin"]);

    expect(permissions).toEqual(expect.arrayContaining([
      "system.accounts.manage",
      "system.roles.manage",
      "system.settings",
      "integration.manage",
      "notification.channel.manage",
      "system.audit.view",
    ]));
    expect(hasPermission(permissions, "expense.approve")).toBe(false);
    expect(hasPermission(permissions, "expense.finance.pay")).toBe(false);
    expect(hasPermission(permissions, "payment.batch.manage")).toBe(false);
    expect(hasPermission(permissions, "payment.batch.review")).toBe(false);
    expect(hasPermission(permissions, "payroll.manage")).toBe(false);
    expect(hasPermission(permissions, "employee.bank.read")).toBe(false);
    expect(hasPermission(permissions, "employee.bank.manage")).toBe(false);
    expect(hasPermission(permissions, "employee.identity.manage")).toBe(false);
    expect(hasPermission(permissions, "employee.contract.manage")).toBe(false);
  });

  it("assigns the new sensitive permissions only to their intended duties", () => {
    expect(hasPermission(resolvePermissionsForRoles(["finance"]), "employee.bank.read")).toBe(true);
    expect(hasPermission(resolvePermissionsForRoles(["finance"]), "employee.bank.manage")).toBe(false);
    expect(hasPermission(resolvePermissionsForRoles(["finance"]), "payroll.manage")).toBe(true);
    expect(hasPermission(resolvePermissionsForRoles(["finance_mgr"]), "payroll.manage")).toBe(true);
    expect(hasPermission(resolvePermissionsForRoles(["hr"]), "employee.bank.manage")).toBe(true);
    expect(hasPermission(resolvePermissionsForRoles(["hr"]), "employee.identity.manage")).toBe(true);
    expect(hasPermission(resolvePermissionsForRoles(["hr"]), "employee.contract.manage")).toBe(true);
    expect(hasPermission(resolvePermissionsForRoles(["manager"]), "payment.batch.review")).toBe(true);
    expect(hasPermission(resolvePermissionsForRoles(["ceo"]), "payment.batch.review")).toBe(true);
  });

  it("grants procurement permissions to configured roles", () => {
    expect(hasPermission(resolvePermissionsForRoles(["employee"]), "procurement.create")).toBe(true);
    expect(hasPermission(resolvePermissionsForRoles(["employee"]), "procurement.view_own")).toBe(true);
    expect(hasPermission(resolvePermissionsForRoles(["manager"]), "procurement.approve")).toBe(true);
    expect(hasPermission(resolvePermissionsForRoles(["finance"]), "procurement.approve")).toBe(false);
    expect(hasPermission(resolvePermissionsForRoles(["finance_mgr"]), "procurement.manage")).toBe(true);
    expect(hasPermission(resolvePermissionsForRoles(["administration"]), "procurement.manage")).toBe(true);
  });

  it("freezes travel permissions for non-admin launch roles", () => {
    expect(hasPermission(resolvePermissionsForRoles(["employee"]), "travel.create")).toBe(false);
    expect(hasPermission(resolvePermissionsForRoles(["employee"]), "travel.submit")).toBe(false);
    expect(hasPermission(resolvePermissionsForRoles(["manager"]), "travel.approve")).toBe(false);
    expect(hasPermission(resolvePermissionsForRoles(["finance"]), "travel.approve")).toBe(false);
    expect(hasPermission(resolvePermissionsForRoles(["finance_mgr"]), "travel.manage")).toBe(false);
    expect(hasPermission(resolvePermissionsForRoles(["administration"]), "travel.manage")).toBe(false);
    expect(hasPermission(resolvePermissionsForRoles(["admin"]), "travel.manage")).toBe(true);
  });

  it("freezes travel.payment.manage before travel launch", () => {
    expect(hasPermission(resolvePermissionsForRoles(["finance"]), "travel.payment.manage")).toBe(false);
    expect(hasPermission(resolvePermissionsForRoles(["finance_mgr"]), "travel.payment.manage")).toBe(false);
    expect(hasPermission(resolvePermissionsForRoles(["administration"]), "travel.payment.manage")).toBe(false);
    expect(hasPermission(resolvePermissionsForRoles(["manager"]), "travel.payment.manage")).toBe(false);
    expect(hasPermission(resolvePermissionsForRoles(["employee"]), "travel.payment.manage")).toBe(false);
    expect(hasPermission(resolvePermissionsForRoles(["admin"]), "travel.payment.manage")).toBe(true);
  });

  it("grants ai.assist only to finance manager and admin", () => {
    expect(hasPermission(resolvePermissionsForRoles(["finance_mgr"]), "ai.assist")).toBe(true);
    expect(hasPermission(resolvePermissionsForRoles(["finance"]), "ai.assist")).toBe(false);
    expect(hasPermission(resolvePermissionsForRoles(["manager"]), "ai.assist")).toBe(false);
    expect(hasPermission(resolvePermissionsForRoles(["admin"]), "ai.assist")).toBe(true);
  });

  it("grants asset permissions to configured roles", () => {
    expect(hasPermission(resolvePermissionsForRoles(["employee"]), "asset.view_own")).toBe(true);
    expect(hasPermission(resolvePermissionsForRoles(["manager"]), "asset.view_all")).toBe(true);
    expect(hasPermission(resolvePermissionsForRoles(["finance"]), "asset.view_all")).toBe(true);
    expect(hasPermission(resolvePermissionsForRoles(["administration"]), "asset.manage")).toBe(true);
    expect(hasPermission(resolvePermissionsForRoles(["administration"]), "asset.transfer")).toBe(true);
    expect(hasPermission(resolvePermissionsForRoles(["finance_mgr"]), "asset.inventory")).toBe(true);
    expect(hasPermission(resolvePermissionsForRoles(["employee"]), "asset.manage")).toBe(false);
  });

  it("maps workflow entities to correct permission codes", () => {
    expect(resolveEntityPermission("reimbursement", "approve")).toBe("expense.approve");
    expect(resolveEntityPermission("reimbursement", "transfer")).toBe("expense.transfer");
    expect(resolveEntityPermission("leave", "approve")).toBe("leave.approve");
    expect(resolveEntityPermission("leave", "submit")).toBe("leave.submit");
    expect(resolveEntityPermission("unknown", "approve")).toBe(null);
  });
});