https://happy-paws-go.lovable.app/assets/AdminSecurityTest-D-kfXkuH.js

1import{j as e}from"./ui-vendor-DUxVjM2K.js";import{u as b,an as R,P as C,ag as k,j as o,k as m,l as x,m as j,n as u,c as d,T as I,B as U,o as D}from"./index-CCvCeCQu.js";import{w as h}from"./walkerAdminService-DQvwILLQ.js";import{r as v,N as E}from"./react-vendor-BT7e8nQi.js";import{C as L}from"./circle-x-T1o7RjZu.js";import"./supabase-BmIX_j53.js";import"./query-pfTdC3Hz.js";const z=()=>{const{user:i,userProfile:n}=b(),{isAdmin:r,isModerator:l,isLoading:g,roles:f}=R(),[p,N]=v.useState([]),[y,A]=v.useState(!1);if(g)return null;if(!r)return e.jsx(E,{to:"/",replace:!0});const a=(s,t,c)=>{N(T=>[...T,{name:s,passed:t,message:c,timestamp:new Date}])},S=async()=>{A(!0),N([]),a("Client-side Role Check",!0,`useAdminRole hook returned: isAdmin=${r}, isModerator=${l}`);try{const s=await h.verifyAdminRole();if(a("Server-side Role Verification",!0,`Server verification: ${s?"ADMIN":"NOT ADMIN"}`),s){const t=await h.getAllApplications();a("Fetch Admin Data",!0,`✓ Admin access granted - fetched ${t.length} applications`)}else try{const t=await h.getAllApplications();a("Fetch Admin Data",t.length===0,t.length===0?"✓ Access denied - no data returned (expected for non-admin)":"✗ SECURITY ISSUE: Non-admin got admin data!")}catch{a("Fetch Admin Data",!0,"✓ Access properly denied (expected for non-admin)")}if(s)a("Update Application Status",!0,"✓ Admin has permission (not testing actual update)");else{const c=await h.updateApplicationStatus("test-id-12345",{status:"approved",reviewed_at:new Date().toISOString()});a("Update Application Status",!c,c?"✗ SECURITY ISSUE: Non-admin could update status!":"✓ Action blocked (expected for non-admin)")}}catch(s){a("Server-side Tests",!1,`Error during testing: ${s instanceof Error?s.message:"Unknown error"}`)}A(!1)},w=s=>s?e.jsx(D,{className:"h-5 w-5 text-green-600"}):e.jsx(L,{className:"h-5 w-5 text-red-600"});return e.jsx(C,{title:"Admin Security Test",children:e.jsxs("div",{className:"space-y-6",children:[e.jsxs("div",{className:"flex items-center gap-3",children:[e.jsx(k,{className:"h-8 w-8 text-primary"}),e.jsxs("div",{children:[e.jsx("h1",{className:"text-3xl font-bold",children:"Admin Access Control Test"}),e.jsx("p",{className:"text-muted-foreground",children:"Verify that non-admin users cannot access admin functions"})]})]}),e.jsxs(o,{children:[e.jsxs(m,{children:[e.jsx(x,{children:"Current User Status"}),e.jsx(j,{children:"Your authentication and role information"})]}),e.jsxs(u,{className:"space-y-4",children:[e.jsxs("div",{className:"grid grid-cols-1 md:grid-cols-2 gap-4",children:[e.jsxs("div",{children:[e.jsx("p",{className:"text-sm font-medium text-muted-foreground",children:"User ID"}),e.jsx("p",{className:"font-mono text-sm",children:(i==null?void 0:i.id)||"Not logged in"})]}),e.jsxs("div",{children:[e.jsx("p",{className:"text-sm font-medium text-muted-foreground",children:"Email"}),e.jsx("p",{className:"text-sm",children:(i==null?void 0:i.email)||"N/A"})]}),e.jsxs("div",{children:[e.jsx("p",{className:"text-sm font-medium text-muted-foreground",children:"Full Name"}),e.jsx("p",{className:"text-sm",children:(n==null?void 0:n.full_name)||"N/A"})]}),e.jsxs("div",{children:[e.jsx("p",{className:"text-sm font-medium text-muted-foreground",children:"User Type"}),e.jsx("p",{className:"text-sm",children:(n==null?void 0:n.user_type)||"N/A"})]})]}),e.jsxs("div",{className:"pt-4 border-t",children:[e.jsx("p",{className:"text-sm font-medium text-muted-foreground mb-2",children:"Roles"}),e.jsx("div",{className:"flex gap-2",children:g?e.jsx(d,{variant:"outline",children:"Loading..."}):f.length>0?f.map((s,t)=>e.jsx(d,{variant:s.role==="admin"?"default":"secondary",children:s.role},t)):e.jsx(d,{variant:"outline",children:"No roles assigned"})}),e.jsxs("div",{className:"flex gap-2 mt-3",children:[e.jsxs(d,{variant:r?"default":"secondary",children:["Admin: ",r?"Yes":"No"]}),e.jsxs(d,{variant:l?"default":"secondary",children:["Moderator: ",l?"Yes":"No"]})]})]}),!r&&!l&&e.jsxs("div",{className:"flex items-start gap-2 p-3 bg-yellow-50 border border-yellow-200 rounded-md",children:[e.jsx(I,{className:"h-5 w-5 text-yellow-600 mt-0.5"}),e.jsxs("div",{className:"text-sm",children:[e.jsx("p",{className:"font-medium text-yellow-900",children:"Non-Admin User Detected"}),e.jsx("p",{className:"text-yellow-700",children:"This is expected. Running tests will verify that admin functions are properly blocked."})]})]})]})]}),e.jsxs(o,{children:[e.jsxs(m,{children:[e.jsx(x,{children:"Security Tests"}),e.jsx(j,{children:"Run automated tests to verify admin access controls are working"})]}),e.jsxs(u,{children:[e.jsx(U,{onClick:S,disabled:y||!i,size:"lg",className:"w-full",children:y?"Running Tests...":"Run All Security Tests"}),!i&&e.jsx("p",{className:"text-sm text-muted-foreground mt-2",children:"You must be logged in to run tests"})]})]}),p.length>0&&e.jsxs(o,{children:[e.jsxs(m,{children:[e.jsx(x,{children:"Test Results"}),e.jsx(j,{children:p.every(s=>s.passed)?e.jsx("span",{className:"text-green-600 font-medium",children:"✓ All tests passed - Security is working correctly!"}):e.jsx("span",{className:"text-red-600 font-medium",children:"✗ Some tests failed - Security issues detected!"})})]}),e.jsx(u,{children:e.jsx("div",{className:"space-y-3",children:p.map((s,t)=>e.jsxs("div",{className:`flex items-start gap-3 p-3 border rounded-md ${s.passed?"bg-green-50 border-green-200":"bg-red-50 border-red-200"}`,children:[w(s.passed),e.jsxs("div",{className:"flex-1",children:[e.jsx("p",{className:"font-medium text-sm",children:s.name}),e.jsx("p",{className:"text-sm text-muted-foreground",children:s.message}),e.jsx("p",{className:"text-xs text-muted-foreground mt-1",children:s.timestamp.toLocaleTimeString()})]})]},t))})})]}),e.jsxs(o,{children:[e.jsx(m,{children:e.jsx(x,{children:"Testing Instructions"})}),e.jsxs(u,{className:"space-y-3 text-sm",children:[e.jsxs("div",{children:[e.jsx("p",{className:"font-medium",children:"To test as non-admin:"}),e.jsxs("ol",{className:"list-decimal list-inside space-y-1 ml-2 mt-2 text-muted-foreground",children:[e.jsx("li",{children:"Log in with a regular user account (no admin role)"}),e.jsx("li",{children:'Click "Run All Security Tests" button'}),e.jsx("li",{children:"Verify all tests pass (access properly denied)"}),e.jsx("li",{children:"Try navigating to /admin-dashboard - should redirect to /home"})]})]}),e.jsxs("div",{className:"pt-3 border-t",children:[e.jsx("p",{className:"font-medium",children:"To test as admin:"}),e.jsxs("ol",{className:"list-decimal list-inside space-y-1 ml-2 mt-2 text-muted-foreground",children:[e.jsx("li",{children:"Add admin role to user in Supabase user_roles table"}),e.jsx("li",{children:"Log out and log back in"}),e.jsx("li",{children:"Run tests - should show admin permissions granted"}),e.jsx("li",{children:"Verify /admin-dashboard is accessible"})]})]}),e.jsxs("div",{className:"pt-3 border-t",children:[e.jsx("p",{className:"font-medium text-red-600",children:"Expected Security Behavior:"}),e.jsxs("ul",{className:"list-disc list-inside space-y-1 ml-2 mt-2 text-muted-foreground",children:[e.jsx("li",{children:"Non-admin users cannot fetch walker applications"}),e.jsx("li",{children:"Non-admin users cannot update application statuses"}),e.jsx("li",{children:"Non-admin users are redirected from /admin-dashboard"}),e.jsx("li",{children:"Server-side checks prevent unauthorized data access"})]})]})]})]})]})})};export{z as default};