Added OIDC workflow and Helm Chart

tests/access.rs

@@ -692,6 +692,7 @@ async fn only_instance_administrators_manage_password_users_and_delete_disabled_
         password: "long-enough-password".into(),
         email: None,
         groups: vec![],
+        country: None,
     };
 
     // Nothing is available to ordinary users, not even read access to the overview.
@@ -1079,6 +1080,7 @@ async fn taken_username(db: &Store, config: &Config) {
             password: "long-enough-password".into(),
             email: None,
             groups: vec![],
+            country: None,
         },
     )
     .await
@@ -1265,3 +1267,93 @@ async fn first_sign_in_links_the_email_contact_everywhere_and_never_grants_acces
     );
     iso.drop().await;
 }
+
+#[tokio::test]
+#[ignore = "requires MEGURI_TEST_DATABASE_URL"]
+async fn employees_plan_schedules_but_only_administrators_change_preferences_and_the_directory() {
+    let f = support::Fixture::new().await;
+    let (lead, bob) = (f.people[0].id, f.people[1].id);
+    let team = f.team.id;
+    // Employees may edit schedules here, as with the default employee permission set.
+    let record = service::set_member_permissions(
+        &f.db,
+        lead,
+        team,
+        f.team.revision,
+        Permission::employee_default(),
+    )
+    .await
+    .unwrap();
+    let contact = Uuid::new_v4();
+    let mut doc = record.document.clone();
+    doc.people.push(Person {
+        id: contact,
+        user_id: None,
+        display_name: "Dana Contact".into(),
+        email: Some("dana@corp.test".into()),
+        country: Some("AM".into()),
+        aliases: vec![],
+    });
+    let record = service::update_document(&f.db, lead, team, record.revision, doc)
+        .await
+        .unwrap();
+
+    let try_edit = |change: &dyn Fn(&mut WorkspaceDocument)| {
+        let mut doc = record.document.clone();
+        change(&mut doc);
+        service::update_document(&f.db, bob, team, record.revision, doc)
+    };
+    // Workspace preferences and existing directory entries are administrator-only.
+    for (label, change) in [
+        (
+            "name",
+            &(|d: &mut WorkspaceDocument| d.name = "Renamed".into())
+                as &dyn Fn(&mut WorkspaceDocument),
+        ),
+        ("horizon", &|d| d.horizon_days = 30),
+        ("person name", &|d| {
+            d.people[0].display_name = "Someone else".into()
+        }),
+        ("person email", &|d| {
+            d.people[0].email = Some("other@corp.test".into())
+        }),
+        ("person country", &|d| {
+            d.people[0].country = Some("CY".into())
+        }),
+        ("person removal", &|d| d.people.clear()),
+    ] {
+        assert!(
+            matches!(try_edit(change).await, Err(Error::Forbidden)),
+            "an employee must not change the {label}"
+        );
+    }
+    // Planning is allowed, including new email contacts and unchanged people sent back as is.
+    let planned = try_edit(&|d| {
+        d.schedules[0].name = "Weekly rotation".into();
+        d.people.push(Person {
+            id: Uuid::new_v4(),
+            user_id: None,
+            display_name: "New contact".into(),
+            email: Some("new@corp.test".into()),
+            country: None,
+            aliases: vec![],
+        });
+        d.people[0].email = Some(" DANA@corp.test ".into());
+    })
+    .await
+    .unwrap();
+    assert_eq!(planned.document.schedules[0].name, "Weekly rotation");
+    assert_eq!(planned.document.name, record.document.name);
+    assert_eq!(planned.document.people.len(), 2);
+    // The workspace administrator still changes both.
+    let mut doc = planned.document.clone();
+    doc.name = "Administrators rename".into();
+    doc.horizon_days = 45;
+    doc.people[0].display_name = "Dana Renamed".into();
+    let changed = service::update_document(&f.db, lead, team, planned.revision, doc)
+        .await
+        .unwrap();
+    assert_eq!(changed.document.name, "Administrators rename");
+    assert_eq!(changed.document.horizon_days, 45);
+    assert_eq!(changed.document.people[0].display_name, "Dana Renamed");
+}