6 files+26−260/6 viewed
| 49 | 49 | repository_selection: "selected", | |
| 50 | 50 | repo: ["web", "acme/api", "web"], | |
| 51 | 51 | "perm.code": "write", | |
| 52 | − | "perm.issues": "none", | |
| 52 | + | "perm.work": "none", | |
| 53 | 53 | "perm.workflow_files": "write", | |
| 54 | 54 | "perm.packages": "delete", | |
| 55 | 55 | }), | |
| ⋯ | |||
| 88 | 88 | }); | |
| 89 | 89 | ||
| 90 | 90 | test("editing reads neither the expiry nor needs a name", () => { | |
| 91 | − | const parsed = tokenFromForm(form({ expires: "9999", "perm.issues": "read" }), { editing: true }); | |
| 91 | + | const parsed = tokenFromForm(form({ expires: "9999", "perm.work": "read" }), { editing: true }); | |
| 92 | 92 | assert.ok(parsed.ok); | |
| 93 | 93 | assert.equal(parsed.value.name, ""); | |
| 94 | 94 | }); | |
| ⋯ | |||
| 99 | 99 | assert.match(error({ name: "x", expires: "400", "perm.repo": "read" }), /366/); | |
| 100 | 100 | assert.match(error({ name: "x", workspace: "acme", repository_selection: "selected", "perm.repo": "read" }), /repository/); | |
| 101 | 101 | assert.match(error({ name: "x", "perm.workflow_files": "read" }), /Workflow files/); | |
| 102 | − | assert.match(error({ name: "x", "perm.issues": "admin" }), /Issues/); | |
| 102 | + | assert.match(error({ name: "x", "perm.work": "admin" }), /Work/); | |
| 103 | 103 | assert.match(error({ name: "x" }), /at least one permission/); | |
| 104 | 104 | }); | |
| 105 | 105 | ||
| 106 | 106 | test("permissions are scopes read per resource", () => { | |
| 107 | − | assert.deepEqual(permissionsOf(["repo:read", "repo:admin", "issues:write", "bogus"]), { repo: "admin", issues: "write" }); | |
| 108 | − | assert.deepEqual(scopesOfPermissions({ issues: "write", repo: "read" }), ["repo:read", "issues:write"]); | |
| 107 | + | assert.deepEqual(permissionsOf(["repo:read", "repo:admin", "work:write", "bogus"]), { repo: "admin", work: "write" }); | |
| 108 | + | assert.deepEqual(scopesOfPermissions({ work: "write", repo: "read" }), ["repo:read", "work:write"]); | |
| 109 | 109 | assert.equal(Object.keys(permissionsOf(null)).length, SCOPE_RESOURCES.length, "full access is every resource"); | |
| 110 | 110 | assert.equal(levelLabel("workflow_files", "write"), "Write"); | |
| 111 | − | assert.equal(levelLabel("issues", "write"), "Read and write"); | |
| 111 | + | assert.equal(levelLabel("work", "write"), "Read and write"); | |
| 112 | 112 | assert.equal(levelLabel("packages", "delete"), "Read, write and delete"); | |
| 113 | 113 | }); | |
| 114 | 114 | ||
| ⋯ | |||
| 124 | 124 | ||
| 125 | 125 | test("lists read a token in a line", () => { | |
| 126 | 126 | const token = { | |
| 127 | − | scopes: ["repo:read", "code:write", "issues:read"], | |
| 127 | + | scopes: ["repo:read", "code:write", "work:read"], | |
| 128 | 128 | workspace: "acme", | |
| 129 | 129 | repositorySelection: "selected" as const, | |
| 130 | 130 | repositories: ["acme/web", "acme/api"], | |
| ⋯ | |||
| 135 | 135 | assert.equal(reachSummary({ workspaceOwned: true, repositorySelection: "all" }), "All repositories"); | |
| 136 | 136 | assert.deepEqual( | |
| 137 | 137 | permissionChips(token).map((chip) => chip.label), | |
| 138 | − | ["Repositories: read", "Code: write", "Issues: read"], | |
| 138 | + | ["Repositories: read", "Code: write", "Work: read"], | |
| 139 | 139 | ); | |
| 140 | 140 | assert.ok(permissionChips({ scopes: ["repo:admin"] })[0]!.dangerous); | |
| 141 | 141 | assert.deepEqual(statusBadge("pending"), { label: "Pending approval", tone: "warn" }); | |
| 48 | 48 | assert.deepEqual(found.soon.map((view) => view.id), ["pagerduty"], "what is coming sorts after what works"); | |
| 49 | 49 | assert.ok(matchesQuery(personal.find((view) => view.id === "google-calendar")!, "in a meeting")); | |
| 50 | 50 | assert.ok(matchesQuery(workspace.find((view) => view.id === "incident-io")!, "incidentio")); | |
| 51 | − | assert.ok(matchesQuery(workspace.find((view) => view.id === "pagerduty")!, "opens ISSUES")); | |
| 51 | + | assert.ok(matchesQuery(workspace.find((view) => view.id === "pagerduty")!, "opens WORK ITEMS")); | |
| 52 | 52 | assert.ok(!matchesQuery(workspace.find((view) => view.id === "miro")!, "kubernetes")); | |
| 53 | 53 | }); | |
| 54 | 54 |
| 64 | 64 | ||
| 65 | 65 | test("changing one filter keeps the others", () => { | |
| 66 | 66 | const current = new URLSearchParams("state=closed&label=bug"); | |
| 67 | − | assert.equal(withFilter("/a/b/issues", current, "milestone", "3"), "/a/b/issues?state=closed&label=bug&milestone=3"); | |
| 68 | − | assert.equal(withFilter("/a/b/issues", current, "label", null), "/a/b/issues?state=closed"); | |
| 69 | − | assert.equal(withFilter("/a/b/issues", new URLSearchParams("label=bug"), "label", ""), "/a/b/issues"); | |
| 67 | + | assert.equal(withFilter("/a/-/work", current, "milestone", "3"), "/a/-/work?state=closed&label=bug&milestone=3"); | |
| 68 | + | assert.equal(withFilter("/a/-/work", current, "label", null), "/a/-/work?state=closed"); | |
| 69 | + | assert.equal(withFilter("/a/-/work", new URLSearchParams("label=bug"), "label", ""), "/a/-/work"); | |
| 70 | 70 | }); |
| 38 | 38 | ||
| 39 | 39 | test("ticked boxes store the highest level of each resource", () => { | |
| 40 | 40 | const parsed = scopesFromForm( | |
| 41 | − | form({ scope: ["issues:read", "issues:write", "code:read", "agents:run", "memory:write", "bogus:read"] }), | |
| 41 | + | form({ scope: ["work:read", "work:write", "code:read", "agents:run", "memory:write", "bogus:read"] }), | |
| 42 | 42 | ); | |
| 43 | − | assert.deepEqual(parsed, { ok: true, value: ["code:read", "issues:write"] }); | |
| 43 | + | assert.deepEqual(parsed, { ok: true, value: ["code:read", "work:write"] }); | |
| 44 | 44 | assert.deepEqual(normalizeScopes(["repo:read", "repo:admin", "repo:write"]), ["repo:admin"]); | |
| 45 | 45 | }); | |
| 46 | 46 | ||
| 47 | 47 | test("full access is null, and nothing ticked is refused", () => { | |
| 48 | − | assert.deepEqual(scopesFromForm(form({ preset: "full", scope: "issues:read" })), { ok: true, value: null }); | |
| 48 | + | assert.deepEqual(scopesFromForm(form({ preset: "full", scope: "work:read" })), { ok: true, value: null }); | |
| 49 | 49 | assert.equal(scopesFromForm(form({ preset: "full" }), { allowFull: false }).ok, false); | |
| 50 | 50 | assert.equal(scopesFromForm(form({ preset: "custom" })).ok, false); | |
| 51 | 51 | assert.deepEqual(grantFromForm(form({ scope: "observability:read" })), { ok: true, value: { scopes: ["observability:read"] } }); | |
| 52 | 52 | }); | |
| 53 | 53 | ||
| 54 | 54 | test("a higher level ticks the lower ones of its resource only", () => { | |
| 55 | − | assert.equal(impliedBy(["issues:write"], "issues:read"), "issues:write"); | |
| 55 | + | assert.equal(impliedBy(["work:write"], "work:read"), "work:write"); | |
| 56 | 56 | assert.equal(impliedBy(["repo:admin"], "repo:write"), "repo:admin"); | |
| 57 | − | assert.equal(impliedBy(["issues:write"], "issues:write"), null); | |
| 58 | − | assert.equal(impliedBy(["issues:write"], "pull_requests:read"), null); | |
| 57 | + | assert.equal(impliedBy(["work:write"], "work:write"), null); | |
| 58 | + | assert.equal(impliedBy(["work:write"], "pull_requests:read"), null); | |
| 59 | 59 | assert.equal(impliedBy(["code:read"], "code:write"), null); | |
| 60 | 60 | }); | |
| 61 | 61 | ||
| ⋯ | |||
| 72 | 72 | assert.equal(matchingPreset(null), "full"); | |
| 73 | 73 | assert.equal(matchingPreset(["repo:read", "code:write", "packages:write", "workflows:write", "checks:write", "deployments:write"]), "ci"); | |
| 74 | 74 | assert.equal(matchingPreset([...OAUTH_DEFAULT_SCOPES]), "agent"); | |
| 75 | − | assert.equal(matchingPreset(["issues:read"]), null); | |
| 75 | + | assert.equal(matchingPreset(["work:read"]), null); | |
| 76 | 76 | }); | |
| 77 | 77 | ||
| 78 | 78 | test("a token's access reads plainly", () => { | |
| 79 | 79 | assert.equal(accessSummary({ scopes: null, legacy: true }), "Legacy · full access"); | |
| 80 | 80 | assert.equal(accessSummary({ scopes: null, legacy: false }), "Full access"); | |
| 81 | 81 | assert.equal(accessSummary({ scopes: ["code:read", "code:write", "packages:write", "workflows:write", "checks:write", "deployments:write", "repo:read"], legacy: false }), "CI"); | |
| 82 | − | assert.equal(accessSummary({ scopes: ["issues:read", "issues:write", "pull_requests:read"], legacy: false }), "2 scopes"); | |
| 82 | + | assert.equal(accessSummary({ scopes: ["work:read", "work:write", "pull_requests:read"], legacy: false }), "2 scopes"); | |
| 83 | 83 | assert.equal(accessSummary({ scopes: [], legacy: false }), "No scopes"); | |
| 84 | 84 | }); | |
| 85 | 85 | ||
| ⋯ | |||
| 87 | 87 | assert.deepEqual(requestedScopes(null), OAUTH_DEFAULT_SCOPES); | |
| 88 | 88 | assert.deepEqual(requestedScopes("openid profile *"), OAUTH_DEFAULT_SCOPES); | |
| 89 | 89 | assert.ok(!requestedScopes("").some((scope) => scope.endsWith(":admin"))); | |
| 90 | − | assert.deepEqual(requestedScopes("issues:write nonsense repo:read"), ["repo:read", "issues:write"]); | |
| 90 | + | assert.deepEqual(requestedScopes("work:write nonsense repo:read"), ["repo:read", "work:write"]); | |
| 91 | 91 | }); | |
| 92 | 92 | ||
| 93 | 93 | test("consent keeps only what was asked for", () => { | |
| 94 | − | const requested = requestedScopes("repo:read issues:read issues:write"); | |
| 95 | − | assert.deepEqual(consentedScopes(form({ scope: ["issues:write", "repo:admin", "secrets:admin"] }), requested), ["issues:write"]); | |
| 96 | − | assert.deepEqual(consentedScopes(form({ scope: ["issues:read", "repo:read"] }), requested), ["repo:read", "issues:read"]); | |
| 94 | + | const requested = requestedScopes("repo:read work:read work:write"); | |
| 95 | + | assert.deepEqual(consentedScopes(form({ scope: ["work:write", "repo:admin", "secrets:admin"] }), requested), ["work:write"]); | |
| 96 | + | assert.deepEqual(consentedScopes(form({ scope: ["work:read", "repo:read"] }), requested), ["repo:read", "work:read"]); | |
| 97 | 97 | assert.deepEqual(consentedScopes(form({}), requested), []); | |
| 98 | 98 | }); | |
| 99 | 99 | ||
| 6 | 6 | * read per resource. | |
| 7 | 7 | * | |
| 8 | 8 | * The checklist posts one `scope` field per ticked box. A higher level of | |
| 9 | − | * a resource includes the lower ones (`issues:write` gives `issues:read`), | |
| 9 | + | * a resource includes the lower ones (`work:write` gives `work:read`), | |
| 10 | 10 | * so only the highest ticked level of each resource is stored. | |
| 11 | 11 | */ | |
| 12 | 12 |
| 182 | 182 | const scopedTokens = lookup({ | |
| 183 | 183 | g1t_chat_read: scoped(["chat:read", "notifications:read"]), | |
| 184 | 184 | g1t_chat_write: scoped(["chat:write", "notifications:write"]), | |
| 185 | − | g1t_no_chat: scoped(["repo:read", "issues:write", "notifications:read"]), | |
| 185 | + | g1t_no_chat: scoped(["repo:read", "work:write", "notifications:read"]), | |
| 186 | 186 | g1t_full: scoped(null), | |
| 187 | 187 | g1t_legacy: scoped(null, { legacy: true }), | |
| 188 | 188 | g1t_web: ada, |
Comments
Sign in to comment.