RBAC 3.0

Overlord-Server/src/rbac.test.ts

@@ -8,6 +8,7 @@ import {
   requireAnyPermission,
   getPermissionDescription,
   getRoleDescription,
+  getRolePermissions,
   type Permission,
 } from "./rbac";
 import type { AuthenticatedUser } from "./auth";
@@ -65,6 +66,58 @@ describe("checkPermission", () => {
   test("operator has audit:view", () => {
     expect(checkPermission(makeUser({ role: "operator" }), "audit:view")).toBe(true);
   });
+
+  test("admin has scripts:manage, operator does not", () => {
+    expect(checkPermission(makeUser({ role: "admin" }), "scripts:manage")).toBe(true);
+    expect(checkPermission(makeUser({ role: "operator" }), "scripts:manage")).toBe(false);
+    expect(checkPermission(makeUser({ role: "viewer" }), "scripts:manage")).toBe(false);
+  });
+
+  test("admin has deploys:manage, operator does not", () => {
+    expect(checkPermission(makeUser({ role: "admin" }), "deploys:manage")).toBe(true);
+    expect(checkPermission(makeUser({ role: "operator" }), "deploys:manage")).toBe(false);
+  });
+
+  test("admin and operator have plugins:manage", () => {
+    expect(checkPermission(makeUser({ role: "admin" }), "plugins:manage")).toBe(true);
+    expect(checkPermission(makeUser({ role: "operator" }), "plugins:manage")).toBe(true);
+    expect(checkPermission(makeUser({ role: "viewer" }), "plugins:manage")).toBe(false);
+  });
+
+  test("only admin has plugins:configure", () => {
+    expect(checkPermission(makeUser({ role: "admin" }), "plugins:configure")).toBe(true);
+    expect(checkPermission(makeUser({ role: "operator" }), "plugins:configure")).toBe(false);
+    expect(checkPermission(makeUser({ role: "viewer" }), "plugins:configure")).toBe(false);
+  });
+
+  test("only admin has network:manage-bans", () => {
+    expect(checkPermission(makeUser({ role: "admin" }), "network:manage-bans")).toBe(true);
+    expect(checkPermission(makeUser({ role: "operator" }), "network:manage-bans")).toBe(false);
+  });
+
+  test("only admin has clients:silent-exec", () => {
+    expect(checkPermission(makeUser({ role: "admin" }), "clients:silent-exec")).toBe(true);
+    expect(checkPermission(makeUser({ role: "operator" }), "clients:silent-exec")).toBe(false);
+    expect(checkPermission(makeUser({ role: "viewer" }), "clients:silent-exec")).toBe(false);
+  });
+
+  test("only admin has system:configure", () => {
+    expect(checkPermission(makeUser({ role: "admin" }), "system:configure")).toBe(true);
+    expect(checkPermission(makeUser({ role: "operator" }), "system:configure")).toBe(false);
+    expect(checkPermission(makeUser({ role: "viewer" }), "system:configure")).toBe(false);
+  });
+
+  test("only admin has clients:winre", () => {
+    expect(checkPermission(makeUser({ role: "admin" }), "clients:winre")).toBe(true);
+    expect(checkPermission(makeUser({ role: "operator" }), "clients:winre")).toBe(false);
+    expect(checkPermission(makeUser({ role: "viewer" }), "clients:winre")).toBe(false);
+  });
+
+  test("admin and operator have clients:reconnect", () => {
+    expect(checkPermission(makeUser({ role: "admin" }), "clients:reconnect")).toBe(true);
+    expect(checkPermission(makeUser({ role: "operator" }), "clients:reconnect")).toBe(true);
+    expect(checkPermission(makeUser({ role: "viewer" }), "clients:reconnect")).toBe(false);
+  });
 });
 
 describe("checkAnyPermission", () => {
@@ -180,7 +233,16 @@ describe("getPermissionDescription", () => {
     ["clients:control", "Control clients (execute commands, desktop, console, files)"],
     ["clients:build", "Build client binaries"],
     ["clients:enroll", "Manage client enrollment approvals"],
+    ["clients:silent-exec", "Silently execute arbitrary commands on clients"],
     ["audit:view", "View audit logs"],
+    ["chat:write", "Send messages in team chat"],
+    ["scripts:manage", "Manage auto-run scripts"],
+    ["deploys:manage", "Manage deploys and auto-deploys"],
+    ["plugins:manage", "Upload, enable, and delete plugins"],
+    ["plugins:configure", "Configure plugin trust, auto-load, and direct execution"],
+    ["network:manage-bans", "Manage IP bans"],
+    ["system:configure", "Change server-level settings (TLS, security, registration, notifications, appearance, etc.)"],
+    ["clients:winre", "Install or uninstall WinRE persistence on clients"],
   ];
 
   for (const [perm, desc] of cases) {
@@ -194,6 +256,48 @@ describe("getPermissionDescription", () => {
   });
 });
 
+describe("getRolePermissions", () => {
+  test("admin gets every declared permission", () => {
+    const perms = getRolePermissions("admin");
+    expect(perms).toContain("users:manage");
+    expect(perms).toContain("clients:control");
+    expect(perms).toContain("clients:build");
+    expect(perms).toContain("clients:enroll");
+    expect(perms).toContain("clients:silent-exec");
+    expect(perms).toContain("audit:view");
+    expect(perms).toContain("chat:write");
+    expect(perms).toContain("scripts:manage");
+    expect(perms).toContain("deploys:manage");
+    expect(perms).toContain("plugins:manage");
+    expect(perms).toContain("plugins:configure");
+    expect(perms).toContain("network:manage-bans");
+    expect(perms).toContain("system:configure");
+    expect(perms).toContain("clients:winre");
+  });
+
+  test("operator gets the role-eligible subset", () => {
+    const perms = getRolePermissions("operator");
+    expect(perms).toContain("clients:control");
+    expect(perms).toContain("clients:build");
+    expect(perms).toContain("clients:enroll");
+    expect(perms).toContain("audit:view");
+    expect(perms).toContain("chat:write");
+    expect(perms).toContain("plugins:manage");
+    expect(perms).not.toContain("users:manage");
+    expect(perms).not.toContain("scripts:manage");
+    expect(perms).not.toContain("deploys:manage");
+    expect(perms).not.toContain("plugins:configure");
+    expect(perms).not.toContain("network:manage-bans");
+    expect(perms).not.toContain("clients:silent-exec");
+    expect(perms).not.toContain("system:configure");
+    expect(perms).not.toContain("clients:winre");
+  });
+
+  test("viewer gets nothing", () => {
+    expect(getRolePermissions("viewer")).toHaveLength(0);
+  });
+});
+
 describe("getRoleDescription", () => {
   test("admin description", () => {
     expect(getRoleDescription("admin")).toBe(