An authorisation check. Everything here is ordinary — a role table, an owner, a couple of early returns — which is the point: the branch nobody tests is the branch that lets the wrong person through, and it will look exactly like the branches around it.
The module under test
| 1 | const RANK = { viewer: 1, editor: 2, admin: 3 }; | ||
| 2 | |||
| 3 | const NEEDED = { read: 1, write: 2, delete: 3 }; | ||
| 4 | |||
| 5 | export function canAccess(user, document, action) { | ||
| 6 | if (!user || !document) { | ||
| 7 | return false; | ||
| 8 | } | ||
| 9 | if (user.suspended) { | ||
| 10 | return false; | ||
| 11 | } | ||
| 12 | const needed = NEEDED[action]; | ||
| 13 | if (!needed) { | ||
| 14 | return false; | ||
| 15 | } | ||
| 16 | if (document.ownerId === user.id) { | ||
| 17 | return true; | ||
| 18 | } | ||
| 19 | if (document.visibility === "private") { | ||
| 20 | return false; | ||
| 21 | } | ||
| 22 | const rank = RANK[user.role] || 0; | ||
| 23 | return rank >= needed; | ||
| 24 | } | ||
| 25 |
Your tests
Mutants
0%
Mutation score
- Survived
- 0
- Killed
- 0 / 0
- Line coverage
- —
- Tests
- 0
- Assertion width
- —
- Cycle
- —
survivedkilledtimed outequivalentnot run