Release v2.20.1: migrate authentication to Better Auth

test/rbac-permissions.test.js

@@ -8,6 +8,77 @@ const rbacRoutesSource = fs.readFileSync(require.resolve('../src/web/routes/admi
 const { buildPermissionSections, buildRbacEditViewModel } = require('../src/web/routes/settings/rbac/form-view-model');
 const rbacFormViewModel = fs.readFileSync(require.resolve('../src/web/routes/settings/rbac/form-view-model.js'), 'utf8');
 const rbacSource = fs.readFileSync(require.resolve('../src/rbac.js'), 'utf8');
+
+for (const create of [true, false]) {
+  for (const enabled of [true, false]) {
+    test((create ? 'create' : 'update') + ' role persists two-factor requirement ' + enabled, async () => {
+      require('../src/common');
+      const registerRbacRoutes = require('../src/web/routes/admin/rbac');
+      const handlers = {};
+      const writes = [];
+      let auditEvent;
+      const connection = {
+        async beginTransaction() {},
+        async commit() {},
+        async rollback() {},
+        release() {},
+        async query(sql, params) { writes.push({ sql, params }); return [{ insertId: 9 }]; }
+      };
+      registerRbacRoutes({
+        get() {},
+        post(path, ...routeHandlers) { handlers[path] = routeHandlers; }
+      }, {
+        pool: { async query() { return [[]]; }, async getConnection() { return connection; } },
+        common: {
+          validateMaxLength: value => value,
+          getSearchQuery: () => '',
+          getSortQuery: () => '',
+          getSortDirectionQuery: () => '',
+          fetchDuplicateName: async () => null
+        },
+        pages: {},
+        requirePermission: () => (_req, _res, next) => next(),
+        getAuditUserId: () => 3,
+        recordRequestAuditEvent: async (_pool, _req, event) => { auditEvent = event; },
+        readArrayField: () => [],
+        normalizePermissionKeys: value => value,
+        permissions: [],
+        rbacData: {
+          fetchRoleById: async () => ({ id: 9, name: 'Secure', description: '', require_two_factor: enabled ? 0 : 1 }),
+          fetchPermissions: async () => [],
+          fetchUsersWithRolesPage: async () => ({ users: [], currentPage: 1, totalItems: 0 }),
+          fetchUsersWithRoles: async () => [],
+          syncRoleUsers: async () => {}
+        }
+      });
+      const response = { redirect(url) { this.redirectedTo = url; } };
+      await handlers[create ? '/settings/roles' : '/settings/roles/:id'][1]({
+        params: { id: '9' }, query: {}, currentUser: { id: 3 },
+        body: { name: 'Secure', description: '', ...(enabled ? { require_two_factor: '1' } : {}) }
+      }, response, error => { throw error; });
+      assert.equal(writes.length, 1);
+      assert.match(writes[0].sql, /require_two_factor/);
+      assert.equal(writes[0].params[create ? 3 : 2], enabled ? 1 : 0);
+      assert.match(response.redirectedTo, /^\/settings\/roles\/9\/edit/);
+      if (create) assert.equal(auditEvent.details.requireTwoFactor, enabled);
+      else assert.deepEqual(auditEvent.details.changes.requireTwoFactor, { from: !enabled, to: enabled });
+    });
+  }
+}
+
+test('duplicating a role retains its two-factor requirement and the editor renders the toggle', () => {
+  require('../src/common');
+  const { buildDuplicateRole } = require('../src/web/routes/settings/rbac/duplicate');
+  const pages = require('../src/web/pages');
+  for (const enabled of [true, false]) {
+    const role = { id: 9, name: 'Secure', require_two_factor: enabled };
+    assert.equal(buildDuplicateRole(role).require_two_factor, enabled);
+    const html = pages.renderRbacEditPage(role, '', null, [], [], null);
+    const toggle = html.match(/<input id="role-require-two-factor"[^>]+>/)[0];
+    assert.equal(toggle.includes('checked'), enabled);
+  }
+});
+
 test('rbac form exposes bulk permission controls', () => {
   assert.match(rbacFormTemplate, /name="permissions_present" value="1"/);
   assert.match(rbacFormTemplate, /name="user_ids_present\[\]" value="\{\{id\}\}"/);