342 lines
8.3 KiB
Go
342 lines
8.3 KiB
Go
// Copyright (c) 2026 Probo Inc <hello@probo.com>.
|
|
//
|
|
// Permission to use, copy, modify, and/or distribute this software for any
|
|
// purpose with or without fee is hereby granted, provided that the above
|
|
// copyright notice and this permission notice appear in all copies.
|
|
//
|
|
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
|
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
|
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
|
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
|
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
|
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
|
// PERFORMANCE OF THIS SOFTWARE.
|
|
|
|
package console_test
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
"go.probo.inc/probo/e2e/internal/factory"
|
|
"go.probo.inc/probo/e2e/internal/testutil"
|
|
)
|
|
|
|
func TestRisk_PublishRiskList(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
t.Run(
|
|
"publish without approvers publishes immediately",
|
|
func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
factory.CreateRisk(owner, factory.Attrs{"name": "Test Risk"})
|
|
|
|
const query = `
|
|
mutation($input: PublishRiskListInput!) {
|
|
publishRiskList(input: $input) {
|
|
documentEdge {
|
|
node {
|
|
id
|
|
writeMode
|
|
status
|
|
}
|
|
}
|
|
documentVersionEdge {
|
|
node {
|
|
id
|
|
title
|
|
documentType
|
|
status
|
|
major
|
|
minor
|
|
content
|
|
}
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
var result struct {
|
|
PublishRiskList struct {
|
|
DocumentEdge struct {
|
|
Node struct {
|
|
ID string `json:"id"`
|
|
WriteMode string `json:"writeMode"`
|
|
Status string `json:"status"`
|
|
} `json:"node"`
|
|
} `json:"documentEdge"`
|
|
DocumentVersionEdge struct {
|
|
Node struct {
|
|
ID string `json:"id"`
|
|
Title string `json:"title"`
|
|
DocumentType string `json:"documentType"`
|
|
Status string `json:"status"`
|
|
Major int `json:"major"`
|
|
Minor int `json:"minor"`
|
|
Content string `json:"content"`
|
|
} `json:"node"`
|
|
} `json:"documentVersionEdge"`
|
|
} `json:"publishRiskList"`
|
|
}
|
|
|
|
err := owner.Execute(
|
|
query,
|
|
map[string]any{
|
|
"input": map[string]any{
|
|
"minor": false,
|
|
"organizationId": owner.GetOrganizationID(),
|
|
},
|
|
},
|
|
&result,
|
|
)
|
|
require.NoError(t, err)
|
|
|
|
doc := result.PublishRiskList.DocumentEdge.Node
|
|
assert.NotEmpty(t, doc.ID)
|
|
assert.Equal(t, "GENERATED", doc.WriteMode)
|
|
assert.Equal(t, "ACTIVE", doc.Status)
|
|
|
|
ver := result.PublishRiskList.DocumentVersionEdge.Node
|
|
assert.NotEmpty(t, ver.ID)
|
|
assert.Equal(t, "REGISTER", ver.DocumentType)
|
|
assert.Equal(t, "PUBLISHED", ver.Status)
|
|
assert.Equal(t, 1, ver.Major)
|
|
assert.Equal(t, 0, ver.Minor)
|
|
assert.Contains(t, ver.Content, "Purpose")
|
|
},
|
|
)
|
|
|
|
t.Run(
|
|
"publish with approvers creates draft pending approval",
|
|
func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
|
|
const query = `
|
|
mutation($input: PublishRiskListInput!) {
|
|
publishRiskList(input: $input) {
|
|
documentEdge {
|
|
node { id writeMode }
|
|
}
|
|
documentVersionEdge {
|
|
node { id status major }
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
var result struct {
|
|
PublishRiskList struct {
|
|
DocumentEdge struct {
|
|
Node struct {
|
|
ID string `json:"id"`
|
|
WriteMode string `json:"writeMode"`
|
|
} `json:"node"`
|
|
} `json:"documentEdge"`
|
|
DocumentVersionEdge struct {
|
|
Node struct {
|
|
ID string `json:"id"`
|
|
Status string `json:"status"`
|
|
Major int `json:"major"`
|
|
} `json:"node"`
|
|
} `json:"documentVersionEdge"`
|
|
} `json:"publishRiskList"`
|
|
}
|
|
|
|
err := owner.Execute(
|
|
query,
|
|
map[string]any{
|
|
"input": map[string]any{
|
|
"minor": false,
|
|
"organizationId": owner.GetOrganizationID(),
|
|
"approverIds": []string{owner.GetProfileID().String()},
|
|
},
|
|
},
|
|
&result,
|
|
)
|
|
require.NoError(t, err)
|
|
|
|
doc := result.PublishRiskList.DocumentEdge.Node
|
|
assert.NotEmpty(t, doc.ID)
|
|
assert.Equal(t, "GENERATED", doc.WriteMode)
|
|
|
|
ver := result.PublishRiskList.DocumentVersionEdge.Node
|
|
assert.NotEmpty(t, ver.ID)
|
|
assert.Equal(t, "PENDING_APPROVAL", ver.Status)
|
|
},
|
|
)
|
|
|
|
t.Run(
|
|
"second publish reuses document and bumps major version",
|
|
func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
factory.CreateRisk(owner, factory.Attrs{"name": "Reuse Risk"})
|
|
|
|
const query = `
|
|
mutation($input: PublishRiskListInput!) {
|
|
publishRiskList(input: $input) {
|
|
documentEdge { node { id } }
|
|
documentVersionEdge { node { id major } }
|
|
}
|
|
}
|
|
`
|
|
|
|
var r1, r2 struct {
|
|
PublishRiskList struct {
|
|
DocumentEdge struct {
|
|
Node struct {
|
|
ID string `json:"id"`
|
|
} `json:"node"`
|
|
} `json:"documentEdge"`
|
|
DocumentVersionEdge struct {
|
|
Node struct {
|
|
ID string `json:"id"`
|
|
Major int `json:"major"`
|
|
} `json:"node"`
|
|
} `json:"documentVersionEdge"`
|
|
} `json:"publishRiskList"`
|
|
}
|
|
|
|
input := map[string]any{
|
|
"input": map[string]any{
|
|
"minor": false,
|
|
"organizationId": owner.GetOrganizationID(),
|
|
},
|
|
}
|
|
|
|
err := owner.Execute(query, input, &r1)
|
|
require.NoError(t, err)
|
|
|
|
err = owner.Execute(query, input, &r2)
|
|
require.NoError(t, err)
|
|
|
|
assert.Equal(t,
|
|
r1.PublishRiskList.DocumentEdge.Node.ID,
|
|
r2.PublishRiskList.DocumentEdge.Node.ID,
|
|
"should reuse same document",
|
|
)
|
|
assert.Equal(t, 1, r1.PublishRiskList.DocumentVersionEdge.Node.Major)
|
|
assert.Equal(t, 2, r2.PublishRiskList.DocumentVersionEdge.Node.Major)
|
|
},
|
|
)
|
|
|
|
t.Run(
|
|
"organization risksDocument links to published document",
|
|
func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
factory.CreateRisk(owner, factory.Attrs{"name": "Linked Risk"})
|
|
|
|
const publishQuery = `
|
|
mutation($input: PublishRiskListInput!) {
|
|
publishRiskList(input: $input) {
|
|
documentEdge { node { id } }
|
|
documentVersionEdge { node { id } }
|
|
}
|
|
}
|
|
`
|
|
|
|
var publishResult struct {
|
|
PublishRiskList struct {
|
|
DocumentEdge struct {
|
|
Node struct {
|
|
ID string `json:"id"`
|
|
} `json:"node"`
|
|
} `json:"documentEdge"`
|
|
DocumentVersionEdge struct {
|
|
Node struct {
|
|
ID string `json:"id"`
|
|
} `json:"node"`
|
|
} `json:"documentVersionEdge"`
|
|
} `json:"publishRiskList"`
|
|
}
|
|
|
|
err := owner.Execute(
|
|
publishQuery,
|
|
map[string]any{
|
|
"input": map[string]any{
|
|
"minor": false,
|
|
"organizationId": owner.GetOrganizationID(),
|
|
},
|
|
},
|
|
&publishResult,
|
|
)
|
|
require.NoError(t, err)
|
|
|
|
docID := publishResult.PublishRiskList.DocumentEdge.Node.ID
|
|
|
|
const orgQuery = `
|
|
query($id: ID!) {
|
|
node(id: $id) {
|
|
... on Organization {
|
|
id
|
|
risksDocument { id }
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
var orgResult struct {
|
|
Node struct {
|
|
ID string `json:"id"`
|
|
RisksDocument *struct {
|
|
ID string `json:"id"`
|
|
} `json:"risksDocument"`
|
|
} `json:"node"`
|
|
}
|
|
|
|
err = owner.Execute(
|
|
orgQuery,
|
|
map[string]any{"id": owner.GetOrganizationID()},
|
|
&orgResult,
|
|
)
|
|
require.NoError(t, err)
|
|
require.NotNil(t, orgResult.Node.RisksDocument)
|
|
assert.Equal(t, docID, orgResult.Node.RisksDocument.ID)
|
|
},
|
|
)
|
|
}
|
|
|
|
func TestRisk_PublishRiskList_RBAC(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
viewer := testutil.NewClientInOrg(t, testutil.RoleViewer, owner)
|
|
|
|
factory.CreateRisk(owner, factory.Attrs{"name": "RBAC Risk"})
|
|
|
|
const query = `
|
|
mutation($input: PublishRiskListInput!) {
|
|
publishRiskList(input: $input) {
|
|
documentEdge { node { id } }
|
|
documentVersionEdge { node { id } }
|
|
}
|
|
}
|
|
`
|
|
|
|
t.Run(
|
|
"viewer cannot publish risk list",
|
|
func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
err := viewer.ExecuteShouldFail(
|
|
query,
|
|
map[string]any{
|
|
"input": map[string]any{
|
|
"minor": false,
|
|
"organizationId": owner.GetOrganizationID(),
|
|
},
|
|
},
|
|
)
|
|
testutil.RequireForbiddenError(t, err)
|
|
},
|
|
)
|
|
}
|