Brummel/doctate
1
0
Fork 0
Code Issues 9 Pull Requests Actions Packages Projects Releases Wiki Activity

Enforce admin-only for bulk and purge actions

Browse Source 
Move admin checks from individual bulk actions to the main handler for
`bulk.rs` and `case_actions.rs`. This consolidates the authorization
logic for these sensitive operations.

Additionally, refine the HTML template to conditionally render bulk
action UI elements and the purge form only when the user is an admin.
This ensures that non-admin users do not see or have access to these
administrative functions.

Update tests to reflect these changes, ensuring that non-admin users are
correctly rejected for these actions and that the UI is properly hidden.
This commit is contained in:
Brummel
2026-04-21 19:48:24 +02:00
parent d13bd5307e
commit 1182f4817e
5 changed files with 127 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/tests/analyze_test.rs
+92 -5
View File
@@ -988,7 +988,12 @@ async fn reopen_is_noop_on_open_case() {
#[tokio::test]
async fn purge_closed_removes_directory() {
let config = config_with_llm(unique_tmp("purge-1"), "http://unused".into());
// purge-closed is admin-only (matches the UI, which hides the bar).
let config = config_with_llm_users(
unique_tmp("purge-1"),
"http://unused".into(),
vec![make_admin("dr_a")],
);
let case_id = "11111111-1111-1111-1111-111111111111";
let case_dir = seed_case(&config.data_path, "dr_a", case_id);
seed_recording(&case_dir, "10-00-00", Some("ok"));
@@ -1016,7 +1021,11 @@ async fn purge_closed_removes_directory() {
#[tokio::test]
async fn purge_requires_confirm_param() {
let config = config_with_llm(unique_tmp("purge-2"), "http://unused".into());
let config = config_with_llm_users(
unique_tmp("purge-2"),
"http://unused".into(),
vec![make_admin("dr_a")],
);
let case_id = "11111111-1111-1111-1111-111111111111";
let case_dir = seed_case(&config.data_path, "dr_a", case_id);
seed_recording(&case_dir, "10-00-00", Some("ok"));
@@ -1044,7 +1053,11 @@ async fn purge_requires_confirm_param() {
#[tokio::test]
async fn purge_closed_keeps_open_cases() {
let config = config_with_llm(unique_tmp("purge-3"), "http://unused".into());
let config = config_with_llm_users(
unique_tmp("purge-3"),
"http://unused".into(),
vec![make_admin("dr_a")],
);
let closed_id = "11111111-1111-1111-1111-111111111111";
let open_id = "22222222-2222-2222-2222-222222222222";
let dir_closed = seed_case(&config.data_path, "dr_a", closed_id);
@@ -1070,9 +1083,44 @@ async fn purge_closed_keeps_open_cases() {
assert!(dir_open.exists(), "open case must survive the purge");
}
/// Regression guard: purge-closed is destructive and admin-only. A
/// non-admin POST must be rejected with 403 and leave the closed case
/// directory intact.
#[tokio::test]
async fn purge_closed_rejected_for_non_admin() {
// Default `make_user` is role=doctor.
let config = config_with_llm(unique_tmp("purge-nonadmin"), "http://unused".into());
let case_id = "11111111-1111-1111-1111-111111111111";
let case_dir = seed_case(&config.data_path, "dr_a", case_id);
seed_recording(&case_dir, "10-00-00", Some("ok"));
let app = doctate_server::create_router(config);
let cookie = login(app.clone(), "dr_a").await;
// Close the case first so there is something for purge to target.
let _ = app
.clone()
.oneshot(close_request(case_id, &cookie))
.await
.unwrap();
let resp = app
.oneshot(purge_closed_request(&cookie, Some("yes")))
.await
.unwrap();
assert_eq!(resp.status(), StatusCode::FORBIDDEN);
assert!(case_dir.exists(), "non-admin must not be able to purge");
}
#[tokio::test]
async fn bulk_close_shares_one_closed_at_timestamp() {
let config = config_with_llm(unique_tmp("bulk-c"), "http://unused".into());
// Bulk actions are admin-only since the UI hides the selection
// from non-admins; the handler enforces the same gate.
let config = config_with_llm_users(
unique_tmp("bulk-c"),
"http://unused".into(),
vec![make_admin("dr_a")],
);
let case_a = "11111111-1111-1111-1111-111111111111";
let case_b = "22222222-2222-2222-2222-222222222222";
let dir_a = seed_case(&config.data_path, "dr_a", case_a);
@@ -1110,7 +1158,12 @@ async fn bulk_close_shares_one_closed_at_timestamp() {
#[tokio::test]
async fn bulk_analyze_processes_each_selected_case() {
let config = config_with_llm(unique_tmp("bulk-a"), "http://unused".into());
// Bulk analyze is admin-only (UI + handler).
let config = config_with_llm_users(
unique_tmp("bulk-a"),
"http://unused".into(),
vec![make_admin("dr_a")],
);
let case_a = "11111111-1111-1111-1111-111111111111";
let case_b = "22222222-2222-2222-2222-222222222222";
let dir_a = seed_case(&config.data_path, "dr_a", case_a);
@@ -1300,6 +1353,40 @@ async fn bulk_reset_processes_multiple_cases_admin_only() {
assert!(dir_c.join("2026-04-15T11-00-00Z.transcript.txt").exists());
}
/// Regression guard: the bulk route handles *all* actions (including
/// `close`) and is admin-only. A non-admin POST must be rejected with
/// 403 and the case must remain open. Matches the UI which no longer
/// renders the bulk bar for non-admins.
#[tokio::test]
async fn bulk_close_rejected_for_non_admin() {
let tmp = unique_tmp("bulk-close-nonadmin");
// Default `make_user` is role=doctor.
let config = config_with_llm(tmp.clone(), "http://unused".into());
let case_id = "11111111-1111-1111-1111-111111111111";
let dir = seed_case(&config.data_path, "dr_a", case_id);
seed_recording(&dir, "10-00-00", Some("a"));
let app = doctate_server::create_router(config);
let cookie = login(app.clone(), "dr_a").await;
let body = format!("action=close&case_id={case_id}");
let resp = app
.oneshot(
Request::builder()
.method("POST")
.uri("/web/cases/bulk")
.header(header::COOKIE, &cookie)
.header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
.body(Body::from(body))
.unwrap(),
)
.await
.unwrap();
assert_eq!(resp.status(), StatusCode::FORBIDDEN);
// Close marker must NOT have been written.
assert!(!dir.join(".closed").exists());
}
// ---------------------------------------------------------------------
// Ollama-style (no-auth) provider
// ---------------------------------------------------------------------