Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
test.serial('Request accepted if authorized', async t => {
const request = new MockExpressRequest({
method: 'GET',
route: {
path: Routes[Action.LIST]
}
})
const abilityForAuthorizedRequest = AbilityBuilder.define(can => {
can(Action.READ, SchemaName)
can(Action.LIST, SchemaName)
})
request.ability = abilityForAuthorizedRequest
const response = new MockExpressResponse({ request })
const next = sinon.fake()
authorizeActions(SchemaName)(request, response, next)
t.is(next.callCount, 1)
})
test.serial('Request rejected if unauthorized', async t => {
const request = new MockExpressRequest({
method: 'DELETE',
route: {
path: Routes[Action.DELETE]
}
})
const abilityForUnauthorizedRequest = AbilityBuilder.define((can, cannot) => {
can(Action.READ, SchemaName)
cannot(Action.DELETE, SchemaName)
})
request.ability = abilityForUnauthorizedRequest
const response = new MockExpressResponse({ request })
const next = sinon.fake()
authorizeActions(SchemaName)(request, response, next)
t.is(response.statusCode, 403)
t.is(next.callCount, 0)
})
describe('`Can` component', () => {
const LocalVue = createLocalVue()
const ability = AbilityBuilder.define(can => {
can('read', 'Plugin')
can('update', 'Plugin', 'version')
})
beforeAll(() => {
LocalVue.use(abilitiesPlugin, ability)
LocalVue.component('Can', Can)
})
it('renders all children if `Ability` instance allows to do an action', () => {
const wrapper = render(`
<h1></h1>
<h2></h2>
`)
it('returns fields for `read` action by default', () => {
const ability = AbilityBuilder.define(can => can('read', 'Post', ['title', 'state']))
expect(Post.accessibleFieldsBy(ability)).to.deep.equal(['title', 'state'])
})
it('allows to override ability by passing "ability" property', () => {
const anotherAbility = AbilityBuilder.define(can => can('update', 'Post'))
const component = renderer.create(e(BoundCan, { I: 'read', a: 'Post', ability: anotherAbility }, child))
expect(component.toJSON()).to.be.null
})
})
it('is defined by `$ne` criteria', () => {
const ability = AbilityBuilder.define(can => {
can('read', 'Post', { creator: { $ne: 'me' } })
})
const query = toMongoQuery(ability, 'Post')
expect(query).to.deep.equal({ $or: [{ creator: { $ne: 'me' } }] })
})
beforeEach(() => {
ability = AbilityBuilder.define((can) => {
can('read', 'Post', { state: 'draft' })
can('update', 'Post', { state: 'published' })
})
spy.on(ability, 'rulesFor')
})
beforeEach(() => {
children = spy(returns => null)
ability = AbilityBuilder.define(can => can('read', 'Post'))
})
beforeEach(async () => {
ability = AbilityBuilder.define(can => can('read', 'Post'))
await configureApp(component, aurelia => configure(aurelia.use, ability))
})
beforeEach(() => {
ability = AbilityBuilder.define(can => can('read', 'all'))
changeDetectorRef = spy.interface('ChangeDetector', ['markForCheck'])
pipe = new CanPipe(ability, changeDetectorRef)
})