Implement authorisation rules #1523

cypress/e2e/with_mock_data/items.cy.ts

@@ -413,6 +413,62 @@ describe('Items', () => {
     });
   });
 
+  it('displays add dialog in admin view when user is admin', () => {
+    cy.setCurrentUserToAdmin();
+    cy.visit('/catalogue/4/items/1/items');
+
+    cy.findByRole('button', { name: 'Add Item as Admin' }).click();
+
+    cy.findByRole('progressbar').should('not.exist');
+
+    // Operational is 'not allowed' by rules so admin user should be able to bypass this and select usasge status
+    cy.findAllByText('Operational').first().click();
+
+    // eslint-disable-next-line cypress/no-unnecessary-waiting
+    cy.wait(100);
+
+    cy.findByRole('button', { name: 'Next' }).click();
+
+    cy.findByLabelText('Usage status *').click();
+    cy.findByRole('option', { name: 'In Use' }).click();
+
+    cy.startSnoopingBrowserMockedRequest();
+
+    cy.findByRole('button', { name: 'Next' }).click();
+
+    cy.findByRole('button', { name: 'Finish' }).click();
+    cy.findByRole('dialog').should('not.exist');
+
+    cy.findBrowserMockedRequests({
+      method: 'POST',
+      url: '/v1/items',
+    }).should(async (postRequests) => {
+      expect(postRequests.length).eq(1);
+      expect(JSON.stringify(await postRequests[0].json())).equal(
+        JSON.stringify({
+          purchase_order_number: null,
+          is_defective: false,
+          usage_status_id: '1',
+          warranty_end_date: null,
+          asset_number: null,
+          serial_number: null,
+          delivered_date: null,
+          notes: null,
+          properties: [
+            { id: '1', value: 12 },
+            { id: '2', value: 30 },
+            { id: '3', value: 'CMOS' },
+            { id: '4', value: null },
+            { id: '5', value: true },
+            { id: '6', value: false },
+          ],
+          catalogue_item_id: '1',
+          system_id: '65328f34a40ff5301575a4e3',
+        })
+      );
+    });
+  });
+
   it('displays messages for incorrect input types', () => {
     cy.findByRole('button', { name: 'Add Item' }).click();
 
@@ -1775,7 +1831,49 @@ describe('Items', () => {
     });
   });
 
-  it('editing an item should display an error message if values have not been updated', () => {
+  it('displays edit dialog in admin view when user is admin', () => {
+    cy.setCurrentUserToAdmin();
+    cy.visit('/catalogue/9/items/11/items');
+    cy.findAllByLabelText('Row Actions').first().click();
+    cy.findByText('Edit as Admin').click();
+
+    cy.findByRole('progressbar').should('not.exist');
+    cy.findByText('Edit Item as Admin').should('exist');
+
+    // Scrapped is 'not allowed' by rules so admin user should be able to bypass this and override usasge status
+    cy.findByRole('button', { name: 'navigate to systems home' }).click();
+    cy.findAllByText('Scrapped').first().click();
+
+    // eslint-disable-next-line cypress/no-unnecessary-waiting
+    cy.wait(100);
+
+    cy.findByRole('button', { name: 'Next' }).click();
+
+    cy.findByLabelText('Usage status *').click();
+    cy.findByRole('option', { name: 'Used' }).click();
+
+    cy.startSnoopingBrowserMockedRequest();
+
+    cy.findByRole('button', { name: 'Next' }).click();
+
+    cy.findByRole('button', { name: 'Finish' }).click();
+    cy.findByRole('dialog').should('not.exist');
+
+    cy.findBrowserMockedRequests({
+      method: 'PATCH',
+      url: '/v1/items/:id',
+    }).should(async (patchRequests) => {
+      expect(patchRequests.length).eq(1);
+      expect(JSON.stringify(await patchRequests[0].json())).equal(
+        JSON.stringify({
+          usage_status_id: '2',
+          system_id: '657f8c3b2a1b4e5d8f9b3c4e8',
+        })
+      );
+    });
+  });
+
+  it('should display an error message if values have not been updated', () => {
     cy.findAllByLabelText('Row Actions').last().click();
     cy.findByText('Edit').click();
 
@@ -1889,4 +1987,28 @@ describe('Items', () => {
       'Please move item to a system with Type: Storage before trying to delete.'
     ).should('exist');
   });
+
+  it('admin user can bypass delete rules and delete dialog is in admin view', () => {
+    cy.setCurrentUserToAdmin();
+    cy.visit('/catalogue/4/items/1/items');
+
+    cy.findAllByLabelText('Row Actions').first().click();
+    cy.findByText('Delete as Admin').click();
+
+    cy.findByText('Serial Number: 5YUQDDjKpz2z').should('exist');
+    cy.findByText('Delete Item as Admin').should('exist');
+
+    cy.startSnoopingBrowserMockedRequest();
+
+    cy.findByRole('button', { name: 'Continue' }).click();
+
+    cy.findBrowserMockedRequests({
+      method: 'DELETE',
+      url: '/v1/items/:id',
+    }).should((deleteRequests) => {
+      expect(deleteRequests.length).equal(1);
+      const request = deleteRequests[0];
+      expect(request.url.toString()).to.contain('KvT2Ox7n');
+    });
+  });
 });

cypress/e2e/with_mock_data/systems.cy.ts

@@ -1019,6 +1019,80 @@ describe('Systems', () => {
       });
     });
 
+    it('moves items (admin mode)', () => {
+      cy.setCurrentUserToAdmin();
+      cy.visit('/systems');
+
+      cy.findByRole('link', { name: 'Pulse Laser' }).click();
+      cy.findAllByRole('button', { name: 'Show/Hide filters' })
+        .eq(1)
+        .scrollIntoView();
+      cy.findAllByRole('button', { name: 'Show/Hide filters' }).eq(1).click();
+
+      // Wait for progress bar to disappear before interacting with filters
+      cy.findAllByRole('progressbar').should('not.exist');
+
+      cy.findAllByRole('button', { name: 'Expand' }).eq(1).scrollIntoView();
+      cy.findAllByRole('button', { name: 'Expand' }).eq(1).click();
+
+      // Second table, first checkbox
+      cy.findAllByRole('table')
+        .eq(1)
+        .within(() => {
+          cy.findAllByRole('checkbox', {
+            name: 'Toggle select row',
+          })
+            .eq(1)
+            .click({ force: true });
+
+          cy.findAllByRole('checkbox', {
+            name: 'Toggle select row',
+          })
+            .eq(2)
+            .click({ force: true });
+        });
+
+      cy.findByRole('button', { name: 'Move to as Admin' }).click();
+
+      cy.startSnoopingBrowserMockedRequest();
+
+      cy.findByRole('dialog')
+        .should('be.visible')
+        .within(() => {
+          cy.findByRole('button', { name: 'navigate to systems home' }).click();
+          cy.findByLabelText('Giant laser row').click();
+          cy.findByRole('button', { name: 'Next' }).click();
+        });
+
+      cy.findAllByRole('combobox').eq(1).click();
+      cy.findByRole('option', { name: 'Scrapped' }).click();
+
+      cy.findByRole('button', { name: 'Finish' }).click();
+
+      cy.findByRole('dialog').should('not.exist');
+
+      cy.findBrowserMockedRequests({
+        method: 'PATCH',
+        url: '/v1/items/:id',
+      }).should(async (patchRequests) => {
+        expect(patchRequests.length).eq(2);
+        expect(patchRequests[0].url.toString()).to.contain('/z1hJvV8Z');
+        expect(JSON.stringify(await patchRequests[0].json())).equal(
+          JSON.stringify({
+            system_id: '65328f34a40ff5301575a4e3',
+            usage_status_id: '3',
+          })
+        );
+        expect(patchRequests[1].url.toString()).to.contain('/4mYoI7pr');
+        expect(JSON.stringify(await patchRequests[1].json())).equal(
+          JSON.stringify({
+            system_id: '65328f34a40ff5301575a4e3',
+            usage_status_id: '3',
+          })
+        );
+      });
+    });
+
     it('display errors message and clears error message when resolved', () => {
       cy.findByRole('link', { name: 'Pulse Laser' }).click();
       cy.findAllByRole('button', { name: 'Show/Hide filters' })

src/api/items.test.tsx

@@ -1,6 +1,10 @@
 import { renderHook, waitFor } from '@testing-library/react';
 import { MockInstance } from 'vitest';
-import { MoveItemsToSystem, PostItems } from '../app.types';
+import {
+  MoveItemsToSystem,
+  MoveItemsToSystemUsageStatus,
+  PostItems,
+} from '../app.types';
 import SystemsJSON from '../mocks/Systems.json';
 import {
   getItemById,
@@ -242,7 +246,7 @@ describe('items api functions', () => {
     beforeEach(() => {
       moveItemsToSystem = {
         // Prevent test interference if modifying the usage statuses or selected items
-        usageStatusId: '0',
+        usageStatusConfig: '0',
         selectedItems: JSON.parse(JSON.stringify(mockItems)),
         targetSystem: SystemsJSON[1] as System,
       };
@@ -254,7 +258,38 @@ describe('items api functions', () => {
       vi.clearAllMocks();
     });
 
-    it('sends requests to move multiple items to a system and returns a successful response for each', async () => {
+    it('sends requests to move multiple items to a system and returns a successful response for each (config as string)', async () => {
+      const { result } = renderHook(() => useMoveItemsToSystem(), {
+        wrapper: hooksWrapperWithProviders(),
+      });
+
+      expect(result.current.isIdle).toBe(true);
+
+      result.current.mutate(moveItemsToSystem);
+
+      await waitFor(() => {
+        expect(result.current.isSuccess).toBeTruthy();
+      });
+      moveItemsToSystem.selectedItems.map((item) =>
+        expect(axiosPatchSpy).toHaveBeenCalledWith(`/v1/items/${item.id}`, {
+          system_id: moveItemsToSystem.targetSystem.id,
+          usage_status_id: moveItemsToSystem.usageStatusConfig,
+        })
+      );
+      expect(result.current.data).toEqual(
+        moveItemsToSystem.selectedItems.map((item) => ({
+          message: `Successfully moved to Giant laser`,
+          name: item.serial_number,
+          state: 'success',
+        }))
+      );
+    });
+
+    it('sends requests to move multiple items to a system and returns a successful response for each (config as list)', async () => {
+      moveItemsToSystem.usageStatusConfig = [
+        { item_id: 'KvT2Ox7n', usage_status_id: '0' },
+        { item_id: 'G463gOIA', usage_status_id: '0' },
+      ];
       const { result } = renderHook(() => useMoveItemsToSystem(), {
         wrapper: hooksWrapperWithProviders(),
       });
@@ -269,7 +304,9 @@ describe('items api functions', () => {
       moveItemsToSystem.selectedItems.map((item) =>
         expect(axiosPatchSpy).toHaveBeenCalledWith(`/v1/items/${item.id}`, {
           system_id: moveItemsToSystem.targetSystem.id,
-          usage_status_id: moveItemsToSystem.usageStatusId,
+          usage_status_id: (
+            moveItemsToSystem.usageStatusConfig as Array<MoveItemsToSystemUsageStatus>
+          ).find((status) => status.item_id === item.id)?.usage_status_id,
         })
       );
       expect(result.current.data).toEqual(
@@ -287,7 +324,7 @@ describe('items api functions', () => {
         name: 'New system name',
         id: 'new_system_id',
       };
-      moveItemsToSystem.usageStatusId = '2';
+      moveItemsToSystem.usageStatusConfig = '2';
 
       // Fail just the 1st system
       moveItemsToSystem.selectedItems[0].id = 'Error 409';
@@ -307,7 +344,7 @@ describe('items api functions', () => {
       moveItemsToSystem.selectedItems.map((item) =>
         expect(axiosPatchSpy).toHaveBeenCalledWith(`/v1/items/${item.id}`, {
           system_id: 'new_system_id',
-          usage_status_id: moveItemsToSystem.usageStatusId,
+          usage_status_id: moveItemsToSystem.usageStatusConfig,
         })
       );
       expect(result.current.data).toEqual(

src/api/items.tsx

@@ -218,10 +218,18 @@ export const useMoveItemsToSystem = (): UseMutationResult<
 
       const promises = moveItemsToSystem.selectedItems.map(
         async (item: Item) => {
+          const usage_status_id: string | undefined = Array.isArray(
+            moveItemsToSystem.usageStatusConfig
+          )
+            ? moveItemsToSystem.usageStatusConfig.find(
+                (status) => status.item_id === item.id
+              )?.usage_status_id
+            : moveItemsToSystem.usageStatusConfig;
+
           return patchItem(item.id, {
             system_id: moveItemsToSystem.targetSystem?.id || '',
-            ...(moveItemsToSystem.usageStatusId && {
-              usage_status_id: moveItemsToSystem.usageStatusId,
+            ...(usage_status_id && {
+              usage_status_id: usage_status_id,
             }),
           })
             .then((result: Item) => {

src/app.types.tsx

@@ -203,8 +203,12 @@ export interface PostItems {
   item: ItemPost;
 }
 
+export interface MoveItemsToSystemUsageStatus {
+  item_id: string;
+  usage_status_id: string;
+}
 export interface MoveItemsToSystem {
-  usageStatusId?: string;
+  usageStatusConfig?: MoveItemsToSystemUsageStatus[] | string;
   selectedItems: Item[];
   targetSystem: System;
 }

src/common/actionMenu.component.test.tsx

@@ -23,6 +23,7 @@ describe('ActionMenu Component', () => {
       uploadImagesEntityId: '1',
       editMenuItem: mockEditMenuItem,
       printMenuItem: true,
+      showAdminEdit: true, // true to check it renders the option correctly
     };
     user = userEvent.setup();
     // Mock the window.print function
@@ -51,6 +52,9 @@ describe('ActionMenu Component', () => {
     // Check if the "Edit" option is visible
     expect(screen.getByText('Edit')).toBeVisible();
 
+    // Check if the "Edit as Admin" option is visible
+    expect(screen.getByText('Edit as Admin')).toBeVisible();
+
     // Check if the "Print" option is visible
     expect(screen.getByText('Print')).toBeVisible();
   });