access.test.ts

apps/dashboard/test/access.test.ts

1. /**
2. * Who can read what.
3. *
4. * Every briefing addresses its reader directly as "you", so a page carrying all
5. * of them with the others `hidden`, or the executive brief in a `<details>`
6. * that opens on click, would let anyone through the Access door read them all
7. * from view-source.
8. *
9. * Cloudflare Access cannot prevent that: it gates a URL, and has no view inside
10. * the response. So enforcement is here, at render time, and these tests assert
11. * the negative: that content is absent from the bytes, not merely hidden in
12. * them. A test that only checked the visible view would pass on a page that
13. * leaks.
14. */
16. import { describe, expect, it } from 'vitest'
17. import { FIXTURE_SNAPSHOT } from '../src/fixtures.js'
18. import { headline } from '../src/collect.js'
19. import { render } from '../src/render.js'
20. import { MERIDIAN_PEOPLE } from '../../../config/meridian-people.js'
21. import { COMPANY_VIEWER, allViewers, companyBriefingKey, viewerFor } from '../src/viewer.js'
22. import type { Briefings } from '../src/briefings.js'
24. const EXEC_TEXT = 'EXEC-ONLY-SENTINEL-nora-capacity-view'
25. const COMPANY_TEXT = 'COMPANY-FULL-SENTINEL-names-leadership-todos'
26. const ALLHANDS_TEXT = 'ALLHANDS-SENTINEL-no-leadership-titles'
28. const briefings: Briefings = {
29. generatedAt: '2026-08-25T20:40:14+00:00',
30. day: '2026-08-12',
31. model: 'claude-opus-5',
32. payloadGeneratedAt: FIXTURE_SNAPSHOT.syncedAt,
33. mode: 'fixtures',
34. briefings: {
35. company: COMPANY_TEXT,
36. 'company-allhands': ALLHANDS_TEXT,
37. exec: EXEC_TEXT,
38. ...Object.fromEntries(MERIDIAN_PEOPLE.map((p) => [p.name, `PERSONAL-SENTINEL-${p.name}`])),
39. },
40. }
42. const pageFor = (email: string | null) =>
43. render(FIXTURE_SNAPSHOT, headline(FIXTURE_SNAPSHOT), [], '2026-08-12', briefings, viewerFor(email))
45. const EMAIL = Object.fromEntries(MERIDIAN_PEOPLE.map((p) => [p.name, p.email!])) as Record<string, string>
47. describe('the executive briefing is Nora only, hard', () => {
48. it('reaches Nora', () => {
49. expect(pageFor(EMAIL['Nora Lindqvist'])).toContain(EXEC_TEXT)
50. })
52. it('is ABSENT from every other roster page, not hidden in it', () => {
53. for (const p of MERIDIAN_PEOPLE) {
54. if (p.name === 'Nora Lindqvist') continue
55. expect(pageFor(p.email!), `${p.name} must not receive the exec brief`).not.toContain(EXEC_TEXT)
56. }
57. })
59. it('is absent for an unrecognised address', () => {
60. expect(pageFor('someone@meridiandisplay.example')).not.toContain(EXEC_TEXT)
61. expect(pageFor(null)).not.toContain(EXEC_TEXT)
62. })
64. it('is absent even from a leadership reader who is not Nora', () => {
65. // Sam may read Leadership to-dos. That is a different permission.
66. expect(pageFor(EMAIL['Sam Whitaker'])).not.toContain(EXEC_TEXT)
67. })
69. it('is held by exactly one person on the roster', () => {
70. expect(MERIDIAN_PEOPLE.filter((p) => p.seesExec).map((p) => p.name)).toEqual(['Nora Lindqvist'])
71. })
72. })
74. describe('a personal briefing reaches one person', () => {
75. it('gives each person their own', () => {
76. for (const p of MERIDIAN_PEOPLE) {
77. expect(pageFor(p.email!), p.name).toContain(`PERSONAL-SENTINEL-${p.name}`)
78. }
79. })
81. it('gives nobody the briefing of anyone else', () => {
82. // The whole failure in one assertion: seven people, forty-two pairings.
83. for (const reader of MERIDIAN_PEOPLE) {
84. const html = pageFor(reader.email!)
85. for (const other of MERIDIAN_PEOPLE) {
86. if (other.name === reader.name) continue
87. expect(html, `${reader.name} must not see ${other.name}'s briefing`)
88. .not.toContain(`PERSONAL-SENTINEL-${other.name}`)
89. }
90. }
91. })
93. it('gives an unrecognised address none of them', () => {
94. const html = pageFor('nobody@meridiandisplay.example')
95. for (const p of MERIDIAN_PEOPLE) {
96. expect(html, p.name).not.toContain(`PERSONAL-SENTINEL-${p.name}`)
97. }
98. })
100. it('no longer ships a person picker, which was the leak', () => {
101. // The dropdown implied a choice between people. It only ever worked because
102. // every person's card was already in the document.
103. const html = pageFor(EMAIL['Marco Ibáñez'])
104. expect(html).not.toContain('data-person-picker')
105. })
107. it('still shows the whole team on the board, which is not a leak', () => {
108. // Deliberate, and the line is worth knowing. What is restricted is the
109. // personalized briefings and the Leadership to-dos, not the existence of
110. // colleagues or their load. "Who is loaded, who is not, at a glance" is the
111. // board's original purpose and the reason it is organised by person at all.
112. // Hiding names here would gut it while protecting nothing that was asked to
113. // be protected.
114. const html = pageFor(EMAIL['Marco Ibáñez'])
115. expect(html).toContain('Theo Bassett')
116. // ...but still none of his prose.
117. expect(html).not.toContain('PERSONAL-SENTINEL-Theo Bassett')
118. })
119. })
121. describe('the company brief comes in two versions', () => {
122. it('serves the full one to leadership readers', () => {
123. // An inbox grant for answering mail is not a grant to read the Leadership
124. // Team's to-dos: that permission is set per person by name. Getting more
125. // than you should is the failure that matters. One line in
126. // meridian-people.ts changes it.
127. for (const name of ['Nora Lindqvist', 'Sam Whitaker', 'Theo Bassett', 'Ines Carvalho']) {
128. expect(pageFor(EMAIL[name]!), name).toContain(COMPANY_TEXT)
129. }
130. })
132. it('serves the all-hands one to everyone else', () => {
133. for (const name of ['Marco Ibáñez', 'Rafael Montero', 'Rosa Galván']) {
134. const html = pageFor(EMAIL[name]!)
135. expect(html, name).toContain(ALLHANDS_TEXT)
136. expect(html, `${name} must not get the Leadership-naming brief`).not.toContain(COMPANY_TEXT)
137. }
138. })
140. it('serves the all-hands one to an unrecognised address', () => {
141. const html = pageFor('new.hire@meridiandisplay.example')
142. expect(html).toContain(ALLHANDS_TEXT)
143. expect(html).not.toContain(COMPANY_TEXT)
144. })
146. it('never falls back from all-hands to the full brief', () => {
147. // If the redacted brief failed to generate, the page must say it is missing
148. // rather than quietly serving the one that names Leadership work.
149. const partial: Briefings = { ...briefings, briefings: { company: COMPANY_TEXT } }
150. const html = render(
151. FIXTURE_SNAPSHOT, headline(FIXTURE_SNAPSHOT), [], '2026-08-12', partial,
152. viewerFor(EMAIL['Marco Ibáñez']),
153. )
154. expect(html).not.toContain(COMPANY_TEXT)
155. expect(html).toContain('Not generated for this sync')
156. })
158. it('picks the key from the permission, not from the name', () => {
159. expect(companyBriefingKey(viewerFor(EMAIL['Nora Lindqvist']))).toBe('company')
160. expect(companyBriefingKey(viewerFor(EMAIL['Marco Ibáñez']))).toBe('company-allhands')
161. expect(companyBriefingKey(COMPANY_VIEWER)).toBe('company-allhands')
162. })
163. })
165. describe('identity resolution refuses to guess', () => {
166. it('matches the roster addresses exactly', () => {
167. expect(viewerFor('nora.l@meridiandisplay.example').person?.name).toBe('Nora Lindqvist')
168. expect(viewerFor(' NORA.L@MeridianDisplay.example ').person?.name).toBe('Nora Lindqvist')
169. })
171. it('does not infer an address from a name', () => {
172. // Six of seven are role mailboxes: hello@, orderdesk@, accounts@, frontdesk@,
173. // projects@. Any name-derived rule would be wrong for almost everyone.
174. for (const guess of ['sam@meridiandisplay.example', 'nora@meridiandisplay.example', 'marco@meridiandisplay.example']) {
175. expect(viewerFor(guess).person, guess).toBeNull()
176. }
177. })
179. it('falls back to the company viewer, which grants nothing', () => {
180. for (const bad of [null, undefined, '', ' ', 'attacker@evil.com']) {
181. const v = viewerFor(bad)
182. expect(v.person, String(bad)).toBeNull()
183. expect(v.seesExec).toBe(false)
184. expect(v.seesLeadership).toBe(false)
185. expect(v.ownBriefing).toBeNull()
186. }
187. })
189. it('defaults render() to the company viewer when none is passed', () => {
190. // A caller that forgets the argument must leak nothing. Getting less than you
191. // should is a bug report; getting more is a breach.
192. const html = render(FIXTURE_SNAPSHOT, headline(FIXTURE_SNAPSHOT), [], '2026-08-12', briefings)
193. expect(html).not.toContain(EXEC_TEXT)
194. expect(html).not.toContain(COMPANY_TEXT)
195. })
197. it('renders a variant for every person plus the company fallback', () => {
198. const vs = allViewers(MERIDIAN_PEOPLE)
199. expect(vs.map((v) => v.key)).toContain('company')
200. for (const p of MERIDIAN_PEOPLE) expect(vs.map((v) => v.key)).toContain(p.name)
201. expect(new Set(vs.map((v) => v.key)).size).toBe(vs.length)
202. })
203. })
205. /**
206. * An off-roster address keeps its email and gains nothing by it.
207. *
208. * Shared desks such as `help@` are granted the inbox by address, in both
209. * INBOX_READERS and INBOX_SENDERS, and both lists key on the viewer's email.
210. * A viewer with `email: null` would make those lines present, reviewed and
211. * inert. A permission that silently does nothing is worse than a missing one,
212. * because the missing one gets reported by the person who needed it.
213. *
214. * The two halves are both load-bearing and are tested as a pair: the address
215. * is carried, and carrying it grants nothing on its own.
216. */
217. describe('an authenticated address nobody claimed', () => {
218. it('keeps the address Access asserted, so a written grant can find it', () => {
219. const v = viewerFor('help@meridiandisplay.example')
220. expect(v.email).toBe('help@meridiandisplay.example')
221. })
223. it('normalizes it, so a grant cannot be dodged by casing or whitespace', () => {
224. expect(viewerFor(' HELP@MeridianDisplay.example ').email).toBe('help@meridiandisplay.example')
225. })
227. it('still gets the company view and every permission false', () => {
228. // Carrying the name is not carrying anything else. This is the half that
229. // stops the fix from being a widening.
230. const v = viewerFor('nobody-has-claimed-this@meridiandisplay.example')
231. expect(v.key).toBe('company')
232. expect(v.person).toBeNull()
233. expect(v.seesExec).toBe(false)
234. expect(v.seesLeadership).toBe(false)
235. expect(v.ownBriefing).toBeNull()
236. expect(companyBriefingKey(v)).toBe('company-allhands')
237. })
239. it('gives no identity at all to an absent or empty address', () => {
240. // No address and an unclaimed address are different: the first can hold no
241. // grant, the second can be granted one by name.
242. for (const bad of [null, undefined, '', ' ']) {
243. expect(viewerFor(bad).email, String(bad)).toBeNull()
244. }
245. })
247. it('does not add a rendered variant: there is still one company page', () => {
248. // allViewers filters on a roster match, so an off-roster address shares the
249. // company variant rather than getting a KV key of its own.
250. const vs = allViewers(MERIDIAN_PEOPLE)
251. expect(vs.filter((v) => v.key === 'company')).toHaveLength(1)
252. })
253. })