mirror of
https://github.com/Tria-plc/edr-platform.git
synced 2026-08-26 18:42:49 +00:00
32 lines
1.5 KiB
TypeScript
32 lines
1.5 KiB
TypeScript
/**
|
|
* Auth/authorization gaps (matrix Suite J), via route guard metadata — no boot needed.
|
|
*
|
|
* C-8 ✅ FIXED (was 🔴 "The exchange-rate write routes (PUT upsert, PATCH update) carry no
|
|
* METHOD-LEVEL guard, so they get only the global JwtGuard, not @PassengerAdmin —
|
|
* unlike DELETE, which was admin-gated. Net effect: any authenticated user incl. a
|
|
* passenger could rewrite live FX rates."): currency.controller.ts now decorates
|
|
* upsert/update/remove all with @PassengerAdmin() — confirmed by reading the source.
|
|
* Updated below to assert all three routes are admin-gated, not just DELETE.
|
|
*/
|
|
import "reflect-metadata";
|
|
import { CurrencyController } from "../src/modules/fare-engine/currency.controller";
|
|
|
|
const GUARDS_METADATA = "__guards__";
|
|
function guardsOn(handler: unknown): unknown[] {
|
|
return (Reflect.getMetadata(GUARDS_METADATA, handler as object) as unknown[]) ?? [];
|
|
}
|
|
|
|
describe("Auth gaps (Suite J)", () => {
|
|
it("C-8 ✅ PUT upsert exchange-rate IS admin-gated", () => {
|
|
expect(guardsOn(CurrencyController.prototype.upsert).length).toBeGreaterThan(0);
|
|
});
|
|
|
|
it("C-8 ✅ PATCH update exchange-rate IS admin-gated", () => {
|
|
expect(guardsOn(CurrencyController.prototype.update).length).toBeGreaterThan(0);
|
|
});
|
|
|
|
it("C-8 control: DELETE exchange-rate IS admin-gated too — all three writes consistently guarded", () => {
|
|
expect(guardsOn(CurrencyController.prototype.remove).length).toBeGreaterThan(0);
|
|
});
|
|
});
|