pleno-vue/tests/unit/requires-permission.spec.js

// @vitest-environment jsdom
import { mount } from "@vue/test-utils";
import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
import RequiresPermission from "@/components/displays/permissionbased/RequiresPermission.vue";
import { SessionUser } from "@/components/session/token/SessionUser.vue";
import {
  __configureRequestQueueForTests,
  __resetRequestQueueForTests,
  requestQueueState,
} from "@/services/requestQueue.js";

const flushMicrotasks = async () => {
  await Promise.resolve();
  await Promise.resolve();
};

describe("RequiresPermission", () => {
  beforeEach(() => {
    __resetRequestQueueForTests();
    __configureRequestQueueForTests({
      componentPermissionReportWindowMs: 0,
    });
  });

  afterEach(() => {
    __resetRequestQueueForTests();
    vi.restoreAllMocks();
  });

  it("reports missing permission as COMPONENT when tracking is enabled and access is denied", async () => {
    vi.spyOn(SessionUser, "hasPermission").mockReturnValue(false);
    vi.spyOn(SessionUser, "canAccessSuperUser").mockReturnValue(false);

    mount(RequiresPermission, {
      props: {
        permission: "goals_department_create",
        trackMissingPermission: true,
        trackingSource: "DepartmentGoals:CreateGoalButton",
      },
      slots: {
        default: "<div>visible-content</div>",
      },
    });
    await flushMicrotasks();

    expect(requestQueueState.missingPermissions.length).toBe(1);
    expect(requestQueueState.missingPermissions[0].permission).toBe("goals_department_create");
    expect(requestQueueState.missingPermissions[0].method).toBe("COMPONENT");
    expect(requestQueueState.missingPermissions[0].url).toBe("DepartmentGoals:CreateGoalButton");
  });

  it("does not report when access is granted", async () => {
    vi.spyOn(SessionUser, "hasPermission").mockReturnValue(true);

    const wrapper = mount(RequiresPermission, {
      props: {
        permission: "goals_department_create",
        trackMissingPermission: true,
      },
      slots: {
        default: "<div>visible-content</div>",
      },
    });
    await flushMicrotasks();

    expect(wrapper.text()).toContain("visible-content");
    expect(requestQueueState.missingPermissions.length).toBe(0);
  });

  it("does not report when tracking is disabled", async () => {
    vi.spyOn(SessionUser, "hasPermission").mockReturnValue(false);

    mount(RequiresPermission, {
      props: {
        permission: "goals_department_create",
        trackMissingPermission: false,
      },
      slots: {
        default: "<div>visible-content</div>",
      },
    });
    await flushMicrotasks();

    expect(requestQueueState.missingPermissions.length).toBe(0);
  });

  it("allows superuser bypass without reporting when allowSuperuser is true", async () => {
    vi.spyOn(SessionUser, "hasPermission").mockReturnValue(false);
    vi.spyOn(SessionUser, "canAccessSuperUser").mockReturnValue(true);

    const wrapper = mount(RequiresPermission, {
      props: {
        permission: "goals_department_create",
        trackMissingPermission: true,
        allowSuperuser: true,
      },
      slots: {
        default: "<div>visible-content</div>",
      },
    });
    await flushMicrotasks();

    expect(wrapper.text()).toContain("visible-content");
    expect(requestQueueState.missingPermissions.length).toBe(0);
  });
});