# Permission System Test Coverage
## Overview
Comprehensive test suite for the OAuth-DB CLI permission system, covering both unit tests and integration tests.
## Test Files
### 1. Unit Tests (`cli/src/auth.rs`)
**Location**: `cli/src/auth.rs` (in `#[cfg(test)] mod tests`)
**Test Count**: 12 tests
**Coverage**:
- ✅ API client creation for server
- ✅ Role missing error messages (admin required)
- ✅ Role missing error messages (developer required)
- ✅ Account role update detection
- ✅ Role missing error with unknown role
- ✅ Account role serialization (with role)
- ✅ Account role serialization (without role)
- ✅ Account role deserialization (with role)
- ✅ Account role deserialization (without role)
- ✅ Multiple role types (admin, developer, user)
- ✅ Save account with role functionality
- ✅ Error message formatting for different scenarios
### 2. Integration Tests (`cli/tests/e2e_permissions.rs`)
**Location**: `cli/tests/e2e_permissions.rs`
**Test Count**: 12 tests (9 active, 3 ignored)
**Active Tests** (run without backend):
1. ✅ `test_regular_user_cannot_execute_admin_commands`
- Verifies developer role cannot execute admin commands
- Checks error message contains role information
2. ✅ `test_admin_can_execute_admin_commands`
- Verifies admin role passes permission check
- Confirms command fails at API level (not permission level)
3. ✅ `test_missing_role_error_message`
- Verifies helpful error when role field is missing
- Checks for "log out and log in again" hint
4. ✅ `test_accounts_list_displays_roles`
- Verifies `accounts list` shows role information
- Tests multiple accounts with different roles
5. ✅ `test_developer_can_execute_app_commands`
- Verifies developer role can execute app commands
- Confirms permission check passes
6. ✅ `test_admin_has_all_permissions`
- Verifies admin can execute developer commands
- Tests role hierarchy (admin > developer)
7. ✅ `test_user_role_cannot_execute_admin_commands`
- Verifies user role (lowest privilege) cannot execute admin commands
- Tests error message formatting
8. ✅ `test_multiple_accounts_different_roles`
- Tests switching between accounts with different roles
- Verifies permission checks work after account switch
9. ✅ `test_role_persistence`
- Verifies role information persists across commands
- Tests config file persistence
**Ignored Tests** (require backend server):
1. 🔒 `test_whoami_displays_admin_role`
- Requires real backend to fetch user info
- Verifies whoami displays admin role from API
2. 🔒 `test_whoami_displays_developer_role`
- Requires real backend to fetch user info
- Verifies whoami displays developer role from API
3. 🔒 `test_whoami_warns_missing_role`
- Requires real backend to fetch user info
- Verifies whoami shows warning for missing role
## Test Scenarios Covered
### Permission Checks
- ✅ Admin can execute admin commands
- ✅ Admin can execute developer commands (role hierarchy)
- ✅ Developer can execute app commands
- ✅ Developer cannot execute admin commands
- ✅ User cannot execute admin commands
- ✅ User cannot execute developer commands
### Error Messages
- ✅ Clear error when role is missing (with helpful hint)
- ✅ Clear error when role is insufficient (with current/required roles)
- ✅ Helpful hint to contact administrator for role upgrade
- ✅ Helpful hint to re-login when role info is missing
### Role Display
- ✅ `accounts list` displays roles correctly
- ✅ Multiple accounts with different roles
- ✅ Accounts without role field (backward compatibility)
### Role Persistence
- ✅ Role information persists in config file
- ✅ Role information survives account switching
- ✅ Role information available across multiple commands
### Serialization
- ✅ Account with role serializes correctly
- ✅ Account without role serializes correctly (field omitted)
- ✅ Account with role deserializes correctly
- ✅ Account without role deserializes correctly (backward compatible)
## Running Tests
### Run All Tests
```bash
cargo test --package oauth-db-cli
```
### Run Unit Tests Only
```bash
cargo test --package oauth-db-cli --lib auth::tests
```
### Run Integration Tests Only
```bash
cargo test --package oauth-db-cli --test e2e_permissions
```
### Run Tests Including Ignored (Backend Required)
```bash
cargo test --package oauth-db-cli --test e2e_permissions -- --ignored
```
## Test Results Summary
- **Total Tests**: 24 tests
- **Unit Tests**: 12 tests (all passing)
- **Integration Tests**: 12 tests (9 passing, 3 ignored)
- **Ignored Tests**: 3 tests (require backend server)
- **Pass Rate**: 100% (21/21 active tests)
## Key Features Tested
1. **Role-Based Access Control**
- Three-tier role system: admin > developer > user
- Admin has all permissions
- Developer can manage apps but not platform
- User has minimal permissions
2. **Permission Enforcement**
- `require_admin()` function blocks non-admin users
- `require_developer()` function blocks non-developer users
- `require_role()` function provides flexible role checking
3. **Error Handling**
- Clear error messages with current and required roles
- Helpful hints for users to resolve permission issues
- Special handling for missing role information
4. **Backward Compatibility**
- Accounts without role field are handled gracefully
- Helpful error messages guide users to re-login
- Config file format supports optional role field
5. **Multi-Account Support**
- Role information stored per account
- Switching accounts switches active role
- Multiple accounts with different roles can coexist
## Future Test Enhancements
1. **Backend Integration Tests**
- Test login flow with role retrieval from API
- Test whoami command with real backend
- Test role updates from backend
2. **Additional Permission Scenarios**
- Test custom roles beyond admin/developer/user
- Test role-based command filtering
- Test permission inheritance
3. **Edge Cases**
- Test malformed role values
- Test role changes during active session
- Test concurrent account operations