nextjs-rewrite (#5)

Reviewed-on: #5
Co-authored-by: David Gwilliam <dhgwilliam@gmail.com>
Co-committed-by: David Gwilliam <dhgwilliam@gmail.com>

src/__tests__/unit/permissions.test.ts

@@ -0,0 +1,147 @@
+/**
+ * Unit Tests: Permissions
+ * 
+ * Tests the permission system for tournament management
+ */
+
+import { describe, test, expect, vi } from 'vitest';
+import { hasRole, canManageTournament, canCreateTournaments } from '@/lib/permissions';
+import { getSession } from '@/lib/auth-simple';
+import { prisma } from '@/lib/prisma';
+
+// Helper to create mock user
+const createMockUser = (id: string, email: string, role: string) => ({
+  id,
+  email,
+  role,
+  emailVerified: false,
+  name: null,
+  image: null,
+  playerId: null,
+  createdAt: new Date(),
+  updatedAt: new Date(),
+});
+
+// Mock the getSession and prisma functions
+vi.mock('@/lib/auth-simple', () => ({
+  getSession: vi.fn(),
+}));
+
+vi.mock('@/lib/prisma', () => ({
+  prisma: {
+    user: {
+      findUnique: vi.fn(),
+    },
+    event: {
+      findUnique: vi.fn(),
+    },
+  },
+}));
+
+describe('Permissions', () => {
+  describe('hasRole', () => {
+    test('should allow club_admin to access tournament_admin resources', async () => {
+      vi.mocked(getSession).mockResolvedValue({
+        user: { id: '1', email: 'test@example.com' },
+        session: { token: 'test', expiresAt: new Date() }
+      });
+      vi.mocked(prisma.user.findUnique).mockResolvedValue(
+        createMockUser('1', 'test@example.com', 'club_admin') as any
+      );
+
+      const result = await hasRole('tournament_admin');
+      expect(result.allowed).toBe(true);
+    });
+
+    test('should deny player from accessing tournament_admin resources', async () => {
+      vi.mocked(getSession).mockResolvedValue({
+        user: { id: '1', email: 'test@example.com' },
+        session: { token: 'test', expiresAt: new Date() }
+      });
+      vi.mocked(prisma.user.findUnique).mockResolvedValue(
+        createMockUser('1', 'test@example.com', 'player') as any
+      );
+
+      const result = await hasRole('tournament_admin');
+      expect(result.allowed).toBe(false);
+    });
+
+    test('should deny unauthenticated user', async () => {
+      vi.mocked(getSession).mockResolvedValue(null);
+
+      const result = await hasRole('club_admin');
+      expect(result.allowed).toBe(false);
+      expect(result.reason).toContain('Not authenticated');
+    });
+  });
+
+  describe('canManageTournament', () => {
+    test('should allow club_admin to manage any tournament', async () => {
+      vi.mocked(getSession).mockResolvedValue({
+        user: { id: 'admin-1', email: 'admin@example.com' },
+        session: { token: 'test', expiresAt: new Date() }
+      });
+      vi.mocked(prisma.user.findUnique).mockResolvedValue(
+        createMockUser('admin-1', 'admin@example.com', 'club_admin') as any
+      );
+
+      const result = await canManageTournament(999);
+      expect(result.allowed).toBe(true);
+    });
+
+    test('should deny player from managing tournaments', async () => {
+      vi.mocked(getSession).mockResolvedValue({
+        user: { id: 'player-1', email: 'player@example.com' },
+        session: { token: 'test', expiresAt: new Date() }
+      });
+      vi.mocked(prisma.user.findUnique).mockResolvedValue(
+        createMockUser('player-1', 'player@example.com', 'player') as any
+      );
+
+      const result = await canManageTournament(999);
+      expect(result.allowed).toBe(false);
+      expect(result.reason).toContain('Insufficient permissions');
+    });
+  });
+
+  describe('canCreateTournaments', () => {
+    test('should allow tournament_admin to create tournaments', async () => {
+      vi.mocked(getSession).mockResolvedValue({
+        user: { id: 'admin-1', email: 'admin@example.com' },
+        session: { token: 'test', expiresAt: new Date() }
+      });
+      vi.mocked(prisma.user.findUnique).mockResolvedValue(
+        createMockUser('admin-1', 'admin@example.com', 'tournament_admin') as any
+      );
+
+      const result = await canCreateTournaments();
+      expect(result.allowed).toBe(true);
+    });
+
+    test('should allow club_admin to create tournaments', async () => {
+      vi.mocked(getSession).mockResolvedValue({
+        user: { id: 'admin-1', email: 'admin@example.com' },
+        session: { token: 'test', expiresAt: new Date() }
+      });
+      vi.mocked(prisma.user.findUnique).mockResolvedValue(
+        createMockUser('admin-1', 'admin@example.com', 'club_admin') as any
+      );
+
+      const result = await canCreateTournaments();
+      expect(result.allowed).toBe(true);
+    });
+
+    test('should deny player from creating tournaments', async () => {
+      vi.mocked(getSession).mockResolvedValue({
+        user: { id: 'player-1', email: 'player@example.com' },
+        session: { token: 'test', expiresAt: new Date() }
+      });
+      vi.mocked(prisma.user.findUnique).mockResolvedValue(
+        createMockUser('player-1', 'player@example.com', 'player') as any
+      );
+
+      const result = await canCreateTournaments();
+      expect(result.allowed).toBe(false);
+    });
+  });
+});