feat: more role backend and admin/writer roles additions and adjustments

test/site_acceptance_test.go

@@ -4,6 +4,7 @@ import (
 	"RenewCMS/api/pkg/apperr"
 	"RenewCMS/internal/domain/site"
 	"net/http"
+	"net/http/httptest"
 	"reflect"
 	"strconv"
 	"strings"
@@ -11,8 +12,9 @@ import (
 )
 
 const (
-	siteOwnerOnlyBody   = "Only the owner can do this."
+	siteOwnerOnlyBody   = apperr.MissingPermissionErrorMessage
 	siteSessionOnlyBody = "This action needs a real session."
+	siteWriterID        = 7
 )
 
 func TestSitesReading(t *testing.T) {
@@ -637,10 +639,11 @@ func TestSitesOnlyTheOwnerWrites(t *testing.T) {
 			{http.MethodDelete, "/v1/site/2", ""},
 		}
 		for _, request := range requests {
-			t.Run(request.method+" "+request.path+" with a verified admin's jwt cookie", func(t *testing.T) {
+			t.Run(request.method+" "+request.path+" with a verified writer's jwt cookie", func(t *testing.T) {
 				e := newSiteEnvWithShop(t)
+				e.addUser(siteWriterID, "", writerRoleID, true)
 				before := e.sites.snapshot()
-				rec := e.as(t, apiKeyDevId, request.method, request.path, request.body)
+				rec := e.as(t, siteWriterID, request.method, request.path, request.body)
 				expectSiteStatusAndBody(t, rec, http.StatusForbidden, siteOwnerOnlyBody)
 				if !reflect.DeepEqual(before, e.sites.snapshot()) {
 					t.Errorf("a site changed")
@@ -661,9 +664,28 @@ func TestSitesOnlyTheOwnerWrites(t *testing.T) {
 
 	t.Run("The role is checked before the body", func(t *testing.T) {
 		e := newSiteEnvWithMain(t)
+		e.addUser(siteWriterID, "", writerRoleID, true)
 
-		rec := e.as(t, apiKeyDevId, http.MethodPost, "/v1/site/", "{not json")
+		rec := e.as(t, siteWriterID, http.MethodPost, "/v1/site/", "{not json")
 
 		expectSiteStatusAndBody(t, rec, http.StatusForbidden, siteOwnerOnlyBody)
 	})
+
+	t.Run("An admin manages sites but cannot delete one", func(t *testing.T) {
+		e := newSiteEnvWithShop(t)
+
+		created := e.as(t, apiKeyDevId, http.MethodPost, "/v1/site/", `{"name": "Blog", "key": "blog", "base_url": "https://blog.example.com"}`)
+		renamed := e.as(t, apiKeyDevId, http.MethodPatch, "/v1/site/2", `{"name": "Boutique"}`)
+		madeDefault := e.as(t, apiKeyDevId, http.MethodPatch, "/v1/site/2/default", "")
+		for name, rec := range map[string]*httptest.ResponseRecorder{"create": created, "update": renamed, "default": madeDefault} {
+			if rec.Code >= http.StatusBadRequest {
+				t.Errorf("%s: status %d %s", name, rec.Code, rec.Body.String())
+			}
+		}
+		before := e.sites.snapshot()
+		expectSiteStatusAndBody(t, e.as(t, apiKeyDevId, http.MethodDelete, "/v1/site/2", ""), http.StatusForbidden, siteOwnerOnlyBody)
+		if !reflect.DeepEqual(before, e.sites.snapshot()) {
+			t.Errorf("a site changed")
+		}
+	})
 }