caterium/caterium-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test: guard exact Caterium employee roles

Browse Source
This commit is contained in:
pavlov346346-source 2026-09-11 07:54:37 +03:00
parent da78e3125e
commit 53a8451132
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
tests/edge-security-v1774.mjs
View File

@ -6,6 +6,8 @@ check(!src.includes('"Access-Control-Allow-Origin": "*"'),'wildcard CORS is remo
check(src.includes('https://app.caterium.ru')&&src.includes('WORKERS_DEV_ORIGIN'),'production and backup origins are allowlisted'); check(src.includes('https://app.caterium.ru')&&src.includes('WORKERS_DEV_ORIGIN'),'production and backup origins are allowlisted');
check(src.includes('origin_not_allowed'),'unknown browser origins fail closed'); check(src.includes('origin_not_allowed'),'unknown browser origins fail closed');
check(src.includes('UUID_RE')&&src.includes('EMAIL_RE')&&src.includes('ALLOWED_ROLES'),'employee inputs are validated'); check(src.includes('UUID_RE')&&src.includes('EMAIL_RE')&&src.includes('ALLOWED_ROLES'),'employee inputs are validated');
check(src.includes('["admin", "manager", "kitchen", "courier", "viewer"]'),'edge roles match database roles');
check(!src.includes('"operator"')&&!src.includes('"owner", "admin"'),'invented employee roles are not accepted');
check(src.includes('console.error("[caterium-create-employee]"'),'internal errors remain server-side'); check(src.includes('console.error("[caterium-create-employee]"'),'internal errors remain server-side');
check(src.includes('employee_create_failed'),'unexpected failures return a safe public code'); check(src.includes('employee_create_failed'),'unexpected failures return a safe public code');
check(!src.includes('return reply({ error: e instanceof Error ? e.message'),'raw exception messages are not returned'); check(!src.includes('return reply({ error: e instanceof Error ? e.message'),'raw exception messages are not returned');