fix(auth/tests): align permission tests with admin carve-out for purchase execution

The Purchaser-group carve-out (issue #923) removed execute:purchases,
approve-any:purchases, and retry-any:purchases from the admin:* wildcard.
Four tests were written before that contract existed and expected admin-alone
membership to grant those verbs.

- permissions.test.ts: split the "Administrators group member passes all checks"
  test into two -- admin-alone now asserts execute:purchases === false (regression
  guard for the carve-out), admin+Purchaser asserts all three carved-out verbs pass
- recommendations-permissions.test.ts: mockUser('admin') now includes Purchaser
  group membership, matching the auto-migration path for existing admins
- history-approve-button.test.ts: ADMIN_USER gains Purchaser membership so
  approve-any:purchases is granted (approve button visible on all pending rows)
- history-retry-button.test.ts: ADMIN_USER gains Purchaser membership so
  retry-any:purchases is granted (retry button visible on all failed rows)

Author: cristim

frontend/src/__tests__/history-approve-button.test.ts

@@ -63,9 +63,12 @@ import * as api from '../api';
 import { confirmDialog } from '../confirmDialog';
 import { showToast } from '../toast';
 import { getCurrentUser } from '../state';
-import { ADMINISTRATORS_GROUP_ID } from '../permissions';
+import { ADMINISTRATORS_GROUP_ID, PURCHASER_GROUP_ID } from '../permissions';
 
-const ADMIN_USER = { id: 'admin-uuid', email: 'admin@example.com', groups: [ADMINISTRATORS_GROUP_ID] };
+// Admin user includes Purchaser membership (mirrors the auto-migration for
+// existing admins on first deploy of issue #923). approve-any:purchases is
+// carved out of admin:* and requires Purchaser group membership.
+const ADMIN_USER = { id: 'admin-uuid', email: 'admin@example.com', groups: [ADMINISTRATORS_GROUP_ID, PURCHASER_GROUP_ID] };
 const REG_USER = { id: 'user-uuid', email: 'user@example.com', groups: [] };
 const OTHER_UUID = 'other-uuid';
 

frontend/src/__tests__/history-retry-button.test.ts

@@ -69,9 +69,12 @@ import * as api from '../api';
 import { confirmDialog } from '../confirmDialog';
 import { showToast } from '../toast';
 import { getCurrentUser } from '../state';
-import { ADMINISTRATORS_GROUP_ID } from '../permissions';
+import { ADMINISTRATORS_GROUP_ID, PURCHASER_GROUP_ID } from '../permissions';
 
-const ADMIN_USER = { id: 'admin-uuid', email: 'admin@example.com', groups: [ADMINISTRATORS_GROUP_ID] };
+// Admin user includes Purchaser membership (mirrors the auto-migration for
+// existing admins on first deploy of issue #923). retry-any:purchases is
+// carved out of admin:* and requires Purchaser group membership.
+const ADMIN_USER = { id: 'admin-uuid', email: 'admin@example.com', groups: [ADMINISTRATORS_GROUP_ID, PURCHASER_GROUP_ID] };
 const REG_USER = { id: 'user-uuid', email: 'user@example.com', groups: [] };
 const OTHER_UUID = 'other-uuid';
 

frontend/src/__tests__/permissions.test.ts

@@ -10,7 +10,7 @@
  * getRolePermissions() is kept for the effective-permissions display in
  * the admin Users page and still returns the same sets as before.
  */
-import { canAccess, getRolePermissions, isAdmin, ADMINISTRATORS_GROUP_ID } from '../permissions';
+import { canAccess, getRolePermissions, isAdmin, ADMINISTRATORS_GROUP_ID, PURCHASER_GROUP_ID } from '../permissions';
 
 jest.mock('../state', () => ({
   getCurrentUser: jest.fn(),
@@ -123,12 +123,24 @@ describe('permissions', () => {
   });
 
   describe('canAccess', () => {
-    test('Administrators group member passes all checks', () => {
+    test('Administrators group member passes non-spending checks', () => {
       mockUserWithGroups([ADMIN_GID]);
       expect(canAccess('admin', '*')).toBe(true);
       expect(canAccess('view', 'users')).toBe(true);
       expect(canAccess('delete', 'plans')).toBe(true);
+      expect(canAccess('view', 'accounts')).toBe(true);
+      // execute:purchases is carved out of admin:* and requires Purchaser membership.
+      expect(canAccess('execute', 'purchases')).toBe(false);
+    });
+
+    test('Administrators + Purchaser group member passes all checks including spending', () => {
+      mockUserWithGroups([ADMIN_GID, PURCHASER_GROUP_ID]);
+      expect(canAccess('admin', '*')).toBe(true);
+      expect(canAccess('view', 'users')).toBe(true);
+      expect(canAccess('delete', 'plans')).toBe(true);
       expect(canAccess('execute', 'purchases')).toBe(true);
+      expect(canAccess('approve-any', 'purchases')).toBe(true);
+      expect(canAccess('retry-any', 'purchases')).toBe(true);
       expect(canAccess('view', 'accounts')).toBe(true);
     });
 

frontend/src/__tests__/recommendations-permissions.test.ts

@@ -63,11 +63,17 @@ jest.mock('../toast', () => ({
 }));
 
 import * as state from '../state';
-import { ADMINISTRATORS_GROUP_ID } from '../permissions';
+import { ADMINISTRATORS_GROUP_ID, PURCHASER_GROUP_ID } from '../permissions';
 
 const mockUser = (role: string | null) => {
+  // 'admin' represents a fully-capable admin: Administrators + Purchaser
+  // (mirrors the auto-migration that adds existing admins to Purchaser on
+  // first deploy of issue #923). Tests that want to assert admin-alone
+  // behaviour (no spending access) should call mockUserWithGroups directly.
   (state.getCurrentUser as jest.Mock).mockReturnValue(
-    role === null ? null : { id: 'u', email: 'u@example.com', groups: role === 'admin' ? [ADMINISTRATORS_GROUP_ID] : [] },
+    role === null
+      ? null
+      : { id: 'u', email: 'u@example.com', groups: role === 'admin' ? [ADMINISTRATORS_GROUP_ID, PURCHASER_GROUP_ID] : [] },
   );
 };