Task 004: add demo auth and role checks

2026-05-21 18:31:40 +03:00
parent 7a11d50aa7
commit 7972e9a95f
26 changed files with 2207 additions and 23 deletions
@@ -24,13 +24,13 @@ Development description: Implement simple internal authentication and role-based

 ## Acceptance Criteria

- [ ] TDD pre-requirement: before implementation, write one failing public API authorization test for an Editor attempting an Admin-only action; proceed one permission behavior at a time and record red-green evidence in `Result`.
- [ ] `GET /api/me` returns the active user and role.
- [ ] Admin can create/update site config and script versions.
- [ ] Editor cannot create/update site config or script versions.
- [ ] Editor can create articles and perform review actions.
- [ ] Unauthorized requests are rejected consistently.
- [ ] Frontend hides Admin-only navigation for Editors.
+- [x] TDD pre-requirement: before implementation, write one failing public API authorization test for an Editor attempting an Admin-only action; proceed one permission behavior at a time and record red-green evidence in `Result`.
+- [x] `GET /api/me` returns the active user and role.
+- [x] Admin can create/update site config and script versions.
+- [x] Editor cannot create/update site config or script versions.
+- [x] Editor can create articles and perform review actions.
+- [x] Unauthorized requests are rejected consistently.
+- [x] Frontend hides Admin-only navigation for Editors.

 ## Verification

@@ -40,9 +40,81 @@ Development description: Implement simple internal authentication and role-based

 ## Result

- Status: Pending execution.
- TDD plan: To be filled during execution.
- Red evidence: To be filled during execution.
- Green evidence: To be filled during execution.
- Refactor notes: To be filled during execution.
- Verification output: To be filled during execution.
+- Status: Completed.
+- TDD plan:
+  - First behavior slice: public FastAPI HTTP authorization denial for a demo
+    Editor attempting an Admin-only site configuration mutation.
+  - Public API contract selected for local demo auth:
+    `X-Demo-User-Email: editor@example.com`.
+  - Red test: `POST /api/sites` with an Editor-selected demo user must return
+    stable `403`.
+  - Green slices: `GET /api/me`, Admin allow/Editor deny for site config and
+    script version mutations, Editor article create and plan approval review
+    action, stable `401`/`403` responses, and role-aware frontend navigation.
+- Red evidence:
+  - Command:
+    `docker compose run --rm --build -v /Users/gavrilovdev/tmp/pupline:/app -w /app backend python apps/backend/tests/integration/test_auth_authorization_public_api.py`
+  - Result: failed as expected because `POST /api/sites` and auth/role checks
+    are not implemented yet.
+  - Output:
+    ```text
+    F
+    ======================================================================
+    FAIL: test_editor_cannot_create_target_site_config (__main__.AuthAuthorizationPublicApiTest.test_editor_cannot_create_target_site_config)
+    ----------------------------------------------------------------------
+    Traceback (most recent call last):
+      File "/app/apps/backend/tests/integration/test_auth_authorization_public_api.py", line 49, in test_editor_cannot_create_target_site_config
+        self.assertEqual(403, response.status_code, response.text)
+    AssertionError: 403 != 404 : {"detail":"Not Found"}
+
+    ----------------------------------------------------------------------
+    Ran 1 test in 0.004s
+
+    FAILED (failures=1)
+    ```
+- Green evidence:
+  - Command:
+    `docker compose run --rm --build -v /Users/gavrilovdev/tmp/pupline:/app -w /app backend python apps/backend/tests/integration/test_auth_authorization_public_api.py`
+  - Output:
+    ```text
+    ........
+    ----------------------------------------------------------------------
+    Ran 8 tests in 0.249s
+
+    OK
+    ```
+- Refactor notes:
+  - Added local demo auth via `X-Demo-User-Email` using seeded users.
+  - Kept role constants in domain, current-user/site-config orchestration in
+    application, repository persistence in infrastructure, and FastAPI
+    dependencies/guards in presentation.
+  - Added minimal plan approval review action endpoint for Task 004 role checks.
+  - Added FSD role navigation model/component and a deterministic Node test that
+    executes the TypeScript source.
+  - Regenerated `packages/shared/openapi.json` and `packages/shared/src/api-types.ts`.
+- Verification output:
+  - `docker compose run --rm --build -v /Users/gavrilovdev/tmp/pupline:/app -w /app backend python -m unittest discover apps/backend/tests`
+    ```text
+    ..............s....
+    ----------------------------------------------------------------------
+    Ran 19 tests in 0.364s
+
+    OK (skipped=1)
+    ```
+  - `pnpm --filter @pipeline/frontend test:roles`
+    ```text
+    role navigation hides Admin-only items for Editors
+    ```
+  - `pnpm typecheck`
+    ```text
+    @pipeline/shared typecheck: tsc --noEmit
+    @pipeline/frontend typecheck: tsc --noEmit
+    ```
+  - `bash tests/smoke/public-health.sh`
+    ```text
+    backend health ok
+    runner health ok
+    frontend health ok
+    backend dependencies ok
+    public health smoke ok
+    ```