define admin scope (#3)

* define admin scope

* remove duplications in permission scopes

* bump version to 1.4.0

lib/authentic_jwt/authorizer.rb

@@ -39,8 +39,9 @@ def calculate_acceptable_roles(scope:)
       case scope
       when "read"  then AuthenticJwt::Role.read
       when "write" then AuthenticJwt::Role.write
+      when "admin" then AuthenticJwt::Role.admin
       else raise ArgumentError
-    end
+      end
     end
   end
 end

lib/authentic_jwt/role.rb

@@ -9,17 +9,22 @@ def self.enum
     end
 
     def self.read
-      READ + WRITE
+      READ + WRITE + ADMIN
     end
 
     def self.write
-      WRITE
+      WRITE + ADMIN
+    end
+
+    def self.admin
+      ADMIN
     end
 
     protected
 
     READ  = ["subscriber"].freeze
-    WRITE = ["contributor", "author", "editor", "partner", "admin", "internal"].freeze
+    WRITE = ["contributor", "author", "editor", "partner"].freeze
+    ADMIN = ["admin", "internal"].freeze
 
     MAPPING = {
       "subscriber"  => 10,

lib/authentic_jwt/version.rb

@@ -1,3 +1,3 @@
 module AuthenticJwt
-  VERSION = "1.3.0"
+  VERSION = "1.4.0"
 end

spec/authorizer_spec.rb

@@ -61,6 +61,22 @@
     })
   end
 
+  let(:editor_payload) do
+    AuthenticJwt::Payload.new({
+      sub:      "5",
+      name:     "Frodo Baggins",
+      email:    "[email protected]",
+      username: "frodo",
+      roles:    [:SUBSCRIBER],
+      accounts: [
+        AuthenticJwt::Payload::Account.new({
+          aud:   ENV["AUTHENTIC_AUTH_ACCOUNT_ID"],
+          roles: [:EDITOR],
+        })
+      ]
+    })
+  end
+
   it "returns forbidden if the payload doesn't have access to the account" do
     expect { authorizer.call(payload: no_accounts_payload, scope: "write") }.to raise_error(AuthenticJwt::Forbidden, "No access to account")
   end
@@ -73,6 +89,10 @@
     expect { authorizer.call(payload: insufficient_payload, scope: "write") }.to raise_error(AuthenticJwt::Forbidden, "Account role is too low")
   end
 
+  it "returns forbidden if the payload account doesn't have admin access" do
+    expect { authorizer.call(payload: editor_payload, scope: "admin") }.to raise_error(AuthenticJwt::Forbidden, "Account role is too low")
+  end
+
   it "returns true if the payload is ok" do
     expect(authorizer.call(payload: valid_payload, scope: "write")).to eq(true)
   end