File: tests/unit/auth/role-permission-access.test.ts (Unit) File: tests/e2e/routes/system/rbac.spec.ts (E2E)

Test Scenarios

1. Admin Role (Full Access)

Tests that admin users can:

• ✅ Access all system settings (/config/system-settings)
• ✅ Manage users (/config/user)
• ✅ Configure access management (/config/accessManagement)
• ✅ Create invitation tokens (Email Token button visible)

2. Developer Role (Limited Access)

Tests that developer users:

• ✅ CAN access system configuration
• ✅ CAN access development tools and APIs
• ❌ CANNOT manage users
• ❌ CANNOT access user management pages

Expected Behavior: Redirect or 403 Forbidden when accessing /config/user

3. Editor Role (Content Only)

Tests that editor users:

• ✅ CAN access collections (/collection)
• ✅ CAN create and edit content
• ❌ CANNOT access system settings
• ❌ CANNOT manage users
• ❌ CANNOT access access management

Expected Behavior: Redirect or 403 Forbidden for all config pages

4. API Gatekeeper Enforcement (High-Frequency)

All API endpoints are now protected by a central Fail-Closed Dispatcher. This layer ensures that:

• ✅ 100% Endpoint Coverage: Every single route is mapped to specific permissions. Unmapped routes are denied by default.
• ✅ Fast Resolution: RBAC matrix is pre-calculated in memory, achieving sub-millisecond (0.15ms) permission checks.
• ✅ Authentic Error Codes: Strictly enforces 401 Unauthorized for missing tokens and 403 Forbidden for insufficient privileges.

Audit Integrity Verification

RBAC enforcement is coupled with the Vectorized Audit Engine:

• Worker-Offloaded Chaining: Cryptographic SHA-256 log chaining is moved to Node.js Worker Threads, ensuring security logic doesn’t slow down the API.
• Tamper Evidence: Tests verify that any attempt to modify a document results in an immutable, signed record linked to the user’s userId and tenantId.

Permission Matrix

Feature	Admin	Developer	Editor
System Settings	✅	✅	❌
User Management	✅	❌	❌
Access Management	✅	❌	❌
API Tools	✅	✅	❌
Content Management	✅	✅	✅
Media Library	✅	✅	✅

---

Related

• Test Documentation
• Security Testing
• Architecture Overview