Added OIDC workflow and Helm Chart

tests/browser-access.cjs

@@ -142,6 +142,11 @@ fs.mkdirSync('test-results', { recursive: true });
     const detail = await carol.get('/api/workspaces/' + commerceId);
     const denied = await carol.call('PUT', `/api/workspaces/${commerceId}/member-permissions`, { revision: detail.workspace.revision, permissions: ['view', 'force_overrides', 'edit_schedules'] });
     assert.equal(denied.status, 403);
+    // Employees may plan schedules, but workspace preferences and the scheduling directory are read-only.
+    assert.equal(await worker.getByRole('button', { name: 'Edit preferences', exact: true }).count(), 0, 'Employees cannot edit workspace preferences');
+    assert.equal(await worker.getByRole('button', { name: 'Edit person', exact: true }).count(), 0, 'Employees cannot edit the scheduling directory');
+    const rename = await carol.call('PUT', `/api/workspaces/${commerceId}/config`, { revision: detail.workspace.revision, document: { ...detail.workspace.document, name: 'Renamed by an employee' } });
+    assert.equal(rename.status, 403);
     await worker.screenshot({ path: 'test-results/access-employee.png', fullPage: true });
 
     // The change applies at once to everyone: turning it off removes the permission without a new login.