raisfast 0.2.21

The last backend you'll ever need. Rust-powered headless CMS with built-in blog, ecommerce, wallet, payment and 4 plugin engines.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143

use super::*;

async fn admin_token() -> String {
    let pool = test_pool().await;
    let (int_id, id) = create_admin(&pool).await;
    make_token(&id, int_id, raisfast::models::user::UserRole::Admin)
}

#[tokio::test]
async fn list_roles() {
    let (mut app, _) = test_app().await;
    let tok = admin_token().await;
    let (status, body) = send(&mut app, get_auth("/api/v1/admin/rbac/roles", &tok)).await;
    assert!(status.is_success(), "list roles: {status} {body:?}");
    assert_eq!(body["code"], 0);
    assert!(body["data"]["items"].is_array());
}

#[tokio::test]
async fn create_role_returns_in_list() {
    let (mut app, _) = test_app().await;
    let tok = admin_token().await;
    let role_name = format!("editor-{}", &uuid::Uuid::now_v7().to_string()[..8]);

    let (status, body) = send(
        &mut app,
        post_json_auth(
            "/api/v1/admin/rbac/roles",
            json!({"name": role_name, "description": "Editor role"}),
            &tok,
        ),
    )
    .await;
    assert!(status.is_success(), "create role: {status} {body:?}");
    assert_eq!(body["data"]["name"], role_name);
    let role_id = body["data"]["id"].as_str().unwrap().to_string();

    let (status, body) = send(&mut app, get_auth("/api/v1/admin/rbac/roles", &tok)).await;
    assert!(status.is_success(), "list roles: {status} {body:?}");
    let items = body["data"]["items"].as_array().unwrap();
    let found = items.iter().any(|r| r["id"] == role_id);
    assert!(found, "created role should appear in list");
}

#[tokio::test]
async fn update_role() {
    let (mut app, _) = test_app().await;
    let tok = admin_token().await;

    let (_, create_body) = send(
        &mut app,
        post_json_auth(
            "/api/v1/admin/rbac/roles",
            json!({"name": format!("mod-{}", &uuid::Uuid::now_v7().to_string()[..8])}),
            &tok,
        ),
    )
    .await;
    let id = create_body["data"]["id"].as_str().unwrap();

    let new_name = format!("super-{}", &uuid::Uuid::now_v7().to_string()[..8]);
    let (status, body) = send(
        &mut app,
        put_json_auth(
            &format!("/api/v1/admin/rbac/roles/{id}"),
            json!({"name": new_name, "description": "updated"}),
            &tok,
        ),
    )
    .await;
    assert!(status.is_success(), "update role: {status} {body:?}");
    assert_eq!(body["data"]["name"], new_name);
}

#[tokio::test]
async fn delete_role() {
    let (mut app, _) = test_app().await;
    let tok = admin_token().await;

    let role_name = format!("del-{}", &uuid::Uuid::now_v7().to_string()[..8]);
    let (_, create_body) = send(
        &mut app,
        post_json_auth("/api/v1/admin/rbac/roles", json!({"name": role_name}), &tok),
    )
    .await;
    let id = create_body["data"]["id"].as_str().unwrap();

    let (status, _) = send(
        &mut app,
        delete_auth(&format!("/api/v1/admin/rbac/roles/{id}"), &tok),
    )
    .await;
    assert!(status.is_success(), "delete role: {status}");

    let (status, body) = send(&mut app, get_auth("/api/v1/admin/rbac/roles", &tok)).await;
    assert!(status.is_success());
    let items = body["data"]["items"].as_array().unwrap();
    let found = items.iter().any(|r| r["id"] == id);
    assert!(!found, "deleted role should not appear in list");
}

#[tokio::test]
async fn set_and_get_permissions() {
    let (mut app, _) = test_app().await;
    let tok = admin_token().await;

    let (_, create_body) = send(
        &mut app,
        post_json_auth(
            "/api/v1/admin/rbac/roles",
            json!({"name": format!("perm-{}", &uuid::Uuid::now_v7().to_string()[..8])}),
            &tok,
        ),
    )
    .await;
    let role_id = create_body["data"]["id"].as_str().unwrap();

    let (status, body) = send(
        &mut app,
        put_json_auth(
            &format!("/api/v1/admin/rbac/roles/{role_id}/permissions"),
            json!({"permissions": [
                {"action": "read", "subject": "posts"},
                {"action": "write", "subject": "comments", "conditions": {"own": "true"}}
            ]}),
            &tok,
        ),
    )
    .await;
    assert!(status.is_success(), "set perms: {status} {body:?}");

    let (status, body) = send(
        &mut app,
        get_auth(
            &format!("/api/v1/admin/rbac/roles/{role_id}/permissions"),
            &tok,
        ),
    )
    .await;
    assert!(status.is_success(), "get perms: {status} {body:?}");
    let perms = body["data"].as_array().unwrap();
    assert_eq!(perms.len(), 2);
}