@@ -136,7 +136,7 @@ describe("VaultAccessGuard", () => {
136136 const checkAccess = ( guard as any ) . checkAccess . bind ( guard ) ;
137137 const result = await checkAccess ( "meta-envelope-id" , context ) ;
138138
139- expect ( result ) . toBe ( true ) ;
139+ expect ( result . hasAccess ) . toBe ( true ) ;
140140 expect ( context . tokenPayload ) . toBeDefined ( ) ;
141141 } ) ;
142142
@@ -160,7 +160,7 @@ describe("VaultAccessGuard", () => {
160160 const checkAccess = ( guard as any ) . checkAccess . bind ( guard ) ;
161161 const result = await checkAccess ( metaEnvelope . metaEnvelope . id , context ) ;
162162
163- expect ( result ) . toBe ( true ) ;
163+ expect ( result . hasAccess ) . toBe ( true ) ;
164164 } ) ;
165165
166166 it ( "should allow access when user is in ACL" , async ( ) => {
@@ -183,7 +183,7 @@ describe("VaultAccessGuard", () => {
183183 const checkAccess = ( guard as any ) . checkAccess . bind ( guard ) ;
184184 const result = await checkAccess ( metaEnvelope . metaEnvelope . id , context ) ;
185185
186- expect ( result ) . toBe ( true ) ;
186+ expect ( result . hasAccess ) . toBe ( true ) ;
187187 } ) ;
188188
189189 it ( "should deny access when user is not in ACL" , async ( ) => {
@@ -206,7 +206,7 @@ describe("VaultAccessGuard", () => {
206206 const checkAccess = ( guard as any ) . checkAccess . bind ( guard ) ;
207207 const result = await checkAccess ( metaEnvelope . metaEnvelope . id , context ) ;
208208
209- expect ( result ) . toBe ( false ) ;
209+ expect ( result . hasAccess ) . toBe ( false ) ;
210210 } ) ;
211211
212212 it ( "should throw error when eName header is missing" , async ( ) => {
@@ -247,7 +247,8 @@ describe("VaultAccessGuard", () => {
247247
248248 // Should return false because the meta-envelope won't be found with eName2
249249 const result = await checkAccess ( metaEnvelope . metaEnvelope . id , context ) ;
250- expect ( result ) . toBe ( false ) ;
250+ expect ( result . hasAccess ) . toBe ( false ) ;
251+ expect ( result . exists ) . toBe ( false ) ;
251252 } ) ;
252253
253254 it ( "should allow access only to meta-envelopes matching the provided eName" , async ( ) => {
@@ -284,11 +285,11 @@ describe("VaultAccessGuard", () => {
284285 const checkAccess = ( guard as any ) . checkAccess . bind ( guard ) ;
285286
286287 const result1 = await checkAccess ( metaEnvelope1 . metaEnvelope . id , context1 ) ;
287- expect ( result1 ) . toBe ( true ) ;
288+ expect ( result1 . hasAccess ) . toBe ( true ) ;
288289
289290 // Tenant1 should NOT access tenant2's data
290291 const result2 = await checkAccess ( metaEnvelope2 . metaEnvelope . id , context1 ) ;
291- expect ( result2 ) . toBe ( false ) ;
292+ expect ( result2 . hasAccess ) . toBe ( false ) ;
292293
293294 // Tenant2 should only access their own data
294295 const context2 = createMockContext ( {
@@ -297,11 +298,11 @@ describe("VaultAccessGuard", () => {
297298 } ) ;
298299
299300 const result3 = await checkAccess ( metaEnvelope2 . metaEnvelope . id , context2 ) ;
300- expect ( result3 ) . toBe ( true ) ;
301+ expect ( result3 . hasAccess ) . toBe ( true ) ;
301302
302303 // Tenant2 should NOT access tenant1's data
303304 const result4 = await checkAccess ( metaEnvelope1 . metaEnvelope . id , context2 ) ;
304- expect ( result4 ) . toBe ( false ) ;
305+ expect ( result4 . hasAccess ) . toBe ( false ) ;
305306 } ) ;
306307
307308 it ( "should allow access with ACL '*' even without currentUser" , async ( ) => {
@@ -324,7 +325,8 @@ describe("VaultAccessGuard", () => {
324325 const checkAccess = ( guard as any ) . checkAccess . bind ( guard ) ;
325326 const result = await checkAccess ( metaEnvelope . metaEnvelope . id , context ) ;
326327
327- expect ( result ) . toBe ( true ) ;
328+ expect ( result . hasAccess ) . toBe ( true ) ;
329+ expect ( result . exists ) . toBe ( true ) ;
328330 } ) ;
329331 } ) ;
330332
@@ -420,10 +422,9 @@ describe("VaultAccessGuard", () => {
420422
421423 const wrappedResolver = guard . middleware ( mockResolver ) ;
422424
423- // Should throw "Access denied" because the meta-envelope won't be found with eName2
424- await expect (
425- wrappedResolver ( null , { id : metaEnvelope . metaEnvelope . id } , context )
426- ) . rejects . toThrow ( "Access denied" ) ;
425+ // When envelope doesn't exist (wrong eName), middleware returns null (not found)
426+ const result = await wrappedResolver ( null , { id : metaEnvelope . metaEnvelope . id } , context ) ;
427+ expect ( result ) . toBeNull ( ) ;
427428 } ) ;
428429 } ) ;
429430} ) ;
0 commit comments