From 53a845113252b9e11bb5cd435433bf6114e16eb0 Mon Sep 17 00:00:00 2001 From: pavlov346346-source Date: Fri, 11 Sep 2026 07:54:37 +0300 Subject: [PATCH] test: guard exact Caterium employee roles --- tests/edge-security-v1774.mjs | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tests/edge-security-v1774.mjs b/tests/edge-security-v1774.mjs index e7ef4f8..08b4f34 100644 --- a/tests/edge-security-v1774.mjs +++ b/tests/edge-security-v1774.mjs @@ -6,6 +6,8 @@ check(!src.includes('"Access-Control-Allow-Origin": "*"'),'wildcard CORS is remo check(src.includes('https://app.caterium.ru')&&src.includes('WORKERS_DEV_ORIGIN'),'production and backup origins are allowlisted'); check(src.includes('origin_not_allowed'),'unknown browser origins fail closed'); check(src.includes('UUID_RE')&&src.includes('EMAIL_RE')&&src.includes('ALLOWED_ROLES'),'employee inputs are validated'); +check(src.includes('["admin", "manager", "kitchen", "courier", "viewer"]'),'edge roles match database roles'); +check(!src.includes('"operator"')&&!src.includes('"owner", "admin"'),'invented employee roles are not accepted'); check(src.includes('console.error("[caterium-create-employee]"'),'internal errors remain server-side'); check(src.includes('employee_create_failed'),'unexpected failures return a safe public code'); check(!src.includes('return reply({ error: e instanceof Error ? e.message'),'raw exception messages are not returned');