Tria/edr-platform
1
0
Fork 0
mirror of https://github.com/Tria-plc/edr-platform.git synced 2026-08-26 18:42:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Adding ticket generation and booking for staff employees logic

Browse Source
This commit is contained in:
Muluhabt
2026-07-25 11:20:47 +03:00
parent 7320c359d1
commit 2a0fd9bda5
29 changed files with 2659 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
apps/edr-passenger-api/test/auth-gaps.e2e-spec.ts
View File

@@ -1,15 +1,12 @@
/**
* Auth/authorization gaps (matrix Suite J), via route guard metadata — no boot needed.
*
* C-8 🔴 The exchange-rate write routes (PUT upsert, PATCH update) carry no METHOD-LEVEL guard, so
* they get only the global JwtGuard (authentication) and NOT @PassengerAdmin (authorization)
* — unlike DELETE, which is admin-gated. Net effect (verified live in
* e2e-ui .../pb-config-propagation.spec.ts BC-11): anonymous → 401, but ANY authenticated
* user incl. a passenger → 200 rewrites live FX. fare-engine/currency.controller.ts:25,32,42
*
* NOTE: this metadata check proves the missing ADMIN guard, NOT "unauthenticated" — a global
* APP_GUARD=JwtGuard (SharedAuthModule) still requires a valid token. The earlier "unauthenticated
* FX write" reading was a false positive corrected by the live BC-11 test.
* C-8 ✅ FIXED (was 🔴 "The exchange-rate write routes (PUT upsert, PATCH update) carry no
* METHOD-LEVEL guard, so they get only the global JwtGuard, not @PassengerAdmin —
* unlike DELETE, which was admin-gated. Net effect: any authenticated user incl. a
* passenger could rewrite live FX rates."): currency.controller.ts now decorates
* upsert/update/remove all with @PassengerAdmin() — confirmed by reading the source.
* Updated below to assert all three routes are admin-gated, not just DELETE.
*/
import "reflect-metadata";
import { CurrencyController } from "../src/modules/fare-engine/currency.controller";
@@ -20,15 +17,15 @@ function guardsOn(handler: unknown): unknown[] {
}
describe("Auth gaps (Suite J)", () => {
it("C-8 🔴 PUT upsert exchange-rate has NO admin guard (only the global JwtGuard applies)", () => {
expect(guardsOn(CurrencyController.prototype.upsert)).toHaveLength(0);
it("C-8 ✅ PUT upsert exchange-rate IS admin-gated", () => {
expect(guardsOn(CurrencyController.prototype.upsert).length).toBeGreaterThan(0);
});
it("C-8 🔴 PATCH update exchange-rate has NO admin guard (only the global JwtGuard applies)", () => {
expect(guardsOn(CurrencyController.prototype.update)).toHaveLength(0);
it("C-8 ✅ PATCH update exchange-rate IS admin-gated", () => {
expect(guardsOn(CurrencyController.prototype.update).length).toBeGreaterThan(0);
});
it("C-8 control: DELETE exchange-rate IS admin-gated — proving writes should be too", () => {
it("C-8 control: DELETE exchange-rate IS admin-gated too — all three writes consistently guarded", () => {
expect(guardsOn(CurrencyController.prototype.remove).length).toBeGreaterThan(0);
});
});