mirror of
https://github.com/DarkflameUniverse/DarkflameServer.git
synced 2026-10-15 17:14:07 +00:00
821b7c8767
What someone may do on the dashboard is now their GM level's permissions plus the grants on their account, minus its denies (PermissionGrants.h). A deny beats a grant; denies never apply to GM 9, and settings and permissions_manage stay GM 9 only. The account's grants are read with every request (like its GM level), so a change applies at once, and they are passed through every check: RouteUtils::Can, CanViewCharacter, the rank rules (self_* and manage_equal_rank), routes guarded by a permission, the templates' `can`, the API documentation, API access, API key scopes (a key never does more than its owner may now) and WebSocket subscriptions. New permission grants_manage (GM 9 by default) and the API to manage grants: GET /api/grants/catalog, GET /api/grants, POST /api/grants, POST /api/grants/:id/remove. Nobody grants or takes away what they don't hold themselves (a permission, every permission of a group, a command they may use, every command up to their own GM level), and only on accounts the rank rules let them manage (their own with self_moderation). Commands with a fixed level or a floor above GM 1 (/execute) can't be granted. Every change goes in the audit log (grant_permission, deny_permission, remove_grant). Also: the Showcase gate and the traffic subscription now check their permission by name. Check: grant a GM 2 account accounts_ban (it can ban, and the Ban button shows); deny a GM 8 account accounts_view (the accounts list is refused); give an expiry a minute ahead and see it stop; try to grant a permission your account doesn't have (refused); dWebTests PermissionGrantsTests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
95 lines
3.3 KiB
CMake
95 lines
3.3 KiB
CMake
set(DWEBTESTS_SOURCES
|
|
"MiddlewareTests.cpp"
|
|
"RouteIntegrationTests.cpp"
|
|
"ServerStateTests.cpp"
|
|
"AccountActionTests.cpp"
|
|
"RouteUtilsTests.cpp"
|
|
"JWTTests.cpp"
|
|
"RequireAuthMiddlewareTests.cpp"
|
|
"WebTestDependencies.cpp"
|
|
"PlayerActionTests.cpp"
|
|
"SmtpTests.cpp"
|
|
"OAuth2Tests.cpp"
|
|
"EconomyReportTests.cpp"
|
|
"ItemTraceTests.cpp"
|
|
"CronTests.cpp"
|
|
"PermissionsTests.cpp"
|
|
"PermissionGrantsTests.cpp"
|
|
"ApiKeyTests.cpp"
|
|
"SettingsCatalogTests.cpp"
|
|
"BehaviorXmlTests.cpp"
|
|
"CharacterXmlTests.cpp"
|
|
"CharacterXmlCheckTests.cpp"
|
|
"CharacterRestoreTests.cpp"
|
|
"ZonePathsTests.cpp"
|
|
"RawTerrainTests.cpp"
|
|
"LevelObjectsTests.cpp"
|
|
"GameLabelsTests.cpp"
|
|
"VanityJsonTests.cpp"
|
|
"OpenApiTests.cpp"
|
|
"MessageInspectorTests.cpp"
|
|
"CDClientSchemaTests.cpp"
|
|
"ServerOperationsTests.cpp"
|
|
"PublicPagesTests.cpp"
|
|
"ModerationToolsTests.cpp"
|
|
"LocaleTextTests.cpp"
|
|
"ModeratorHelperTests.cpp"
|
|
"${PROJECT_SOURCE_DIR}/dDashboardServer/ai/ClaudeClient.cpp"
|
|
"${PROJECT_SOURCE_DIR}/dDashboardServer/ai/ModeratorPrompt.cpp"
|
|
"WorldViewTests.cpp"
|
|
"NifFileTests.cpp"
|
|
"DeferredReplyTests.cpp"
|
|
"WorkerPoolTests.cpp"
|
|
"OnceCacheTests.cpp"
|
|
"UgcLookupTests.cpp"
|
|
"${PROJECT_SOURCE_DIR}/dDashboardServer/routes/WorkerPool.cpp"
|
|
"BackupFilesTests.cpp"
|
|
"LogBundleTests.cpp"
|
|
"${PROJECT_SOURCE_DIR}/dDashboardServer/routes/LogBundle.cpp"
|
|
"SecurityFixesTests.cpp"
|
|
"${PROJECT_SOURCE_DIR}/dDashboardServer/routes/BackupFiles.cpp"
|
|
"MetricsFormatTests.cpp"
|
|
"TrafficHistoryTests.cpp"
|
|
"${PROJECT_SOURCE_DIR}/dDashboardServer/routes/TrafficHistory.cpp"
|
|
"${PROJECT_SOURCE_DIR}/dDashboardServer/routes/SettingsCatalog.cpp"
|
|
"AlertsAndTwoFactorTests.cpp"
|
|
"${PROJECT_SOURCE_DIR}/dDashboardServer/auth/Totp.cpp"
|
|
"${PROJECT_SOURCE_DIR}/dDashboardServer/notify/WebhookFormat.cpp"
|
|
"${PROJECT_SOURCE_DIR}/dDashboardServer/email/OAuth2.cpp"
|
|
"${PROJECT_SOURCE_DIR}/dDashboardServer/email/SmtpClient.cpp"
|
|
"${PROJECT_SOURCE_DIR}/dDashboardServer/auth/JWTUtils.cpp"
|
|
"${PROJECT_SOURCE_DIR}/dDashboardServer/auth/RequireAuthMiddleware.cpp"
|
|
)
|
|
|
|
add_executable(dWebTests ${DWEBTESTS_SOURCES})
|
|
|
|
target_include_directories(dWebTests PRIVATE
|
|
"${PROJECT_SOURCE_DIR}/dCommon"
|
|
"${PROJECT_SOURCE_DIR}/dCommon/dClient"
|
|
"${PROJECT_SOURCE_DIR}/dWeb"
|
|
"${PROJECT_SOURCE_DIR}/dDashboardServer"
|
|
"${PROJECT_SOURCE_DIR}/dDashboardServer/auth"
|
|
"${PROJECT_SOURCE_DIR}/dDashboardServer/routes"
|
|
"${PROJECT_SOURCE_DIR}/dChatFilter"
|
|
"${PROJECT_SOURCE_DIR}/dDashboardServer/email"
|
|
"${PROJECT_SOURCE_DIR}/dDashboardServer/notify"
|
|
"${PROJECT_SOURCE_DIR}/dDashboardServer/ai"
|
|
"${PROJECT_SOURCE_DIR}/dDatabase/GameDatabase/ITables"
|
|
"${PROJECT_SOURCE_DIR}/dNet"
|
|
"${PROJECT_SOURCE_DIR}/thirdparty/nlohmann"
|
|
)
|
|
|
|
target_link_libraries(dWebTests ${COMMON_LIBRARIES} dWeb dUgc sqlite3 OpenSSL::Crypto CURL::libcurl GTest::gtest_main)
|
|
|
|
gtest_discover_tests(dWebTests)
|
|
|
|
target_compile_definitions(dWebTests PRIVATE DLU_SOURCE_DIR="${PROJECT_SOURCE_DIR}")
|
|
|
|
# The 3D views' shader lookups (static/js/scenery-core.js) against the server's bits (NifFile.h), when node is there
|
|
find_program(NODE_EXECUTABLE node)
|
|
if(NODE_EXECUTABLE)
|
|
add_test(NAME SceneryCoreJs COMMAND ${NODE_EXECUTABLE} "${CMAKE_CURRENT_SOURCE_DIR}/scenery-core.test.mjs"
|
|
"${PROJECT_SOURCE_DIR}/dDashboardServer/static/js/scenery-core.js" "${PROJECT_SOURCE_DIR}/dCommon/NifFile.h"
|
|
"${PROJECT_SOURCE_DIR}/dDashboardServer/routes/Scenery.cpp")
|
|
endif()
|