refac: DELETE /v1/user/{id}?expected_role_id=N, user.remove audit event, 409 target_role_not_found, GetAll returns its error, Own-scope visibility filter moved into repos, JSON tags removed from use-case types

web/src/data/__tests__/apiGating.spec.ts

@@ -0,0 +1,37 @@
+import { describe, expect, it } from 'vitest'
+import { permissionName } from '@/lib/permissionNames'
+import { allEndpoints } from '../apiCatalogue'
+
+const GATING: [string, string, string][] = [
+	['POST /v1/content-type/', 'schema.edit', 'Create and edit content types'],
+	['PUT /v1/content-type/{key}', 'schema.edit', 'Create and edit content types'],
+	['DELETE /v1/content-type/{key}', 'schema.delete', 'Delete content types'],
+	['GET /v1/builtin-type/', 'schema.view', 'View content types'],
+	['GET /v1/builtin-type/{key}', 'schema.view', 'View content types'],
+	['GET /v1/media/purge-settings', 'settings.view', 'View settings'],
+	['PATCH /v1/media/purge-settings', 'settings.edit_general', 'Edit general settings'],
+	['GET /v1/media/purge-preview', 'media.delete', 'Delete files'],
+	['POST /v1/media/purge', 'media.delete', 'Delete files'],
+]
+
+function endpointFor(route: string) {
+	return allEndpoints().find((endpoint) => `${endpoint.method} ${endpoint.path}` === route)!
+}
+
+describe('API gating of the permission-gated routes', () => {
+	it.each(GATING)('%s needs %s, read as "%s"', (route, key, label) => {
+		expect(permissionName(key)).toBe(label)
+		expect(endpointFor(route).description.endsWith(`Needs the permission "${label}".`)).toBe(
+			true,
+		)
+		expect(endpointFor(route).access).toBe('Needs permission')
+	})
+
+	it('covers exactly the routes the catalogue marks as Needs permission', () => {
+		expect(
+			allEndpoints()
+				.filter((endpoint) => endpoint.access === 'Needs permission')
+				.map((endpoint) => `${endpoint.method} ${endpoint.path}`),
+		).toEqual(GATING.map(([route]) => route))
+	})
+})