Role-Based Access Control (RBAC) Testing

SveltyCMS role-based access control permission enforcement testing details.

4/3/2026

2 min read

On this page

File: tests/unit/auth/roles/role-permission-access.test.ts (Unit) File: tests/e2e/routes/system/rbac.spec.ts (E2E) File: tests/e2e/routes/admin/editor-boundary.spec.ts (E2E — Editor Role Boundary)

Test Scenarios

1. Admin Role (Full Access)

Tests that admin users can:

✅ Access all system settings (/config/system-settings)
✅ Manage users (/config/user)
✅ Configure access management (/config/accessManagement)
✅ Create invitation tokens (Email Token button visible)

2. Developer Role (Limited Access)

Tests that developer users:

✅ CAN access system configuration
✅ CAN access development tools and APIs
❌ CANNOT manage users
❌ CANNOT access user management pages

Expected Behavior: Redirect or 403 Forbidden when accessing /config/user

3. Editor Role (Content Only)

Tests that editor users:

✅ CAN access collections (/collection)
✅ CAN create and edit content
❌ CANNOT access system settings
❌ CANNOT manage users
❌ CANNOT access access management

Expected Behavior: Redirect or 403 Forbidden for all config pages

4. API Gatekeeper Enforcement (High-Frequency)

All API endpoints are now protected by a central Fail-Closed Dispatcher. This layer ensures that:

✅ 100% Endpoint Coverage: Every single route is mapped to specific permissions. Unmapped routes are denied by default.
✅ Fast Resolution: RBAC matrix is pre-calculated in memory, achieving sub-millisecond (0.15ms) permission checks.
✅ Authentic Error Codes: Strictly enforces 401 Unauthorized for missing tokens and 403 Forbidden for insufficient privileges.

Audit Integrity Verification

RBAC enforcement is coupled with the Vectorized Audit Engine:

Worker-Offloaded Chaining: Cryptographic SHA-256 log chaining is moved to Node.js Worker Threads, ensuring security logic doesn’t slow down the API.
Tamper Evidence: Tests verify that any attempt to modify a document results in an immutable, signed record linked to the user’s userId and tenantId.

Permission Matrix

Feature	Admin	Developer	Editor
System Settings	✅	✅	❌
User Management	✅	❌	❌
Access Management	✅	❌	❌
API Tools	✅	✅	❌
Content Management	✅	✅	✅
Media Library	✅	✅	✅

Documentation