Initial

server/test/drift-rbac.test.mjs

@@ -0,0 +1,62 @@
+import './setup.mjs';
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { load } from './setup.mjs';
+
+const { computeDrift } = await load('../services/intuneDriftService.js');
+const { canPublish, canApprove } = await load('../services/graphRbac.js');
+
+// --- drift ----------------------------------------------------------------
+
+test('computeDrift reports in-sync when plan matches tenant', () => {
+  const app = { displayName: 'Edge', publisher: 'Microsoft', installCommandLine: 'a', uninstallCommandLine: 'b', applicableArchitectures: 'x64' };
+  const assignment = { intent: 'required', target: { '@odata.type': '#microsoft.graph.groupAssignmentTarget', groupId: 'g1' } };
+  const rel = { '@odata.type': '#microsoft.graph.mobileAppSupersedence', targetId: 'old' };
+  const drift = computeDrift({
+    expectedApp: app, liveApp: { ...app },
+    expectedAssignments: [assignment], liveAssignments: [assignment],
+    expectedRelationships: [rel], liveRelationships: [rel]
+  });
+  assert.equal(drift.inSync, true);
+});
+
+test('computeDrift detects field, assignment, and relationship differences', () => {
+  const drift = computeDrift({
+    expectedApp: { displayName: 'Edge', installCommandLine: 'new' },
+    liveApp: { displayName: 'Edge', installCommandLine: 'old' },
+    expectedAssignments: [{ intent: 'required', target: { '@odata.type': '#microsoft.graph.groupAssignmentTarget', groupId: 'g1' } }],
+    liveAssignments: [{ intent: 'available', target: { '@odata.type': '#microsoft.graph.groupAssignmentTarget', groupId: 'g1' } }],
+    expectedRelationships: [{ '@odata.type': '#microsoft.graph.mobileAppSupersedence', targetId: 'old' }],
+    liveRelationships: []
+  });
+  assert.equal(drift.inSync, false);
+  assert.ok(drift.appDrift.some((d) => d.field === 'installCommandLine'));
+  assert.equal(drift.assignmentDrift.missing.length, 1); // required|...|g1 missing in tenant
+  assert.equal(drift.assignmentDrift.extra.length, 1);   // available|...|g1 extra in tenant
+  assert.equal(drift.relationshipDrift.missing.length, 1);
+});
+
+// --- per-connection RBAC --------------------------------------------------
+
+const admin = { id: 'u-admin', role: 'admin' };
+const alice = { id: 'u-alice', role: 'user' };
+const bob = { id: 'u-bob', role: 'user' };
+
+test('canPublish: admins always; empty list allows all; otherwise listed only', () => {
+  assert.equal(canPublish({ publisherIds: [] }, admin), true);
+  assert.equal(canPublish({ publisherIds: [] }, alice), true);
+  assert.equal(canPublish({ publisherIds: ['u-alice'] }, alice), true);
+  assert.equal(canPublish({ publisherIds: ['u-alice'] }, bob), false);
+});
+
+test('canApprove: admins always; otherwise only named approvers (empty = none)', () => {
+  assert.equal(canApprove({ approverIds: [] }, admin), true);
+  assert.equal(canApprove({ approverIds: [] }, alice), false);
+  assert.equal(canApprove({ approverIds: ['u-alice'] }, alice), true);
+  assert.equal(canApprove({ approverIds: ['u-alice'] }, bob), false);
+});
+
+test('RBAC helpers tolerate JSON-string list columns', () => {
+  assert.equal(canPublish({ publisher_ids: '["u-alice"]' }, alice), true);
+  assert.equal(canApprove({ approver_ids: '["u-bob"]' }, bob), true);
+});