feat(web): enforce server-driven GoAuto menus (#138)

server/app/goauto/access/modules_test.go

@@ -44,7 +44,7 @@ func TestAIMatchingIsHardHiddenFromPurchaser(t *testing.T) {
 	}
 }
 
-func TestGoAutoModuleRoutesMatchCurrentWebRouter(t *testing.T) {
+func TestGoAutoRoutesAreGeneratedFromServerMenus(t *testing.T) {
 	_, fileName, _, ok := runtime.Caller(0)
 	if !ok {
 		t.Fatal("cannot locate test source")
@@ -56,15 +56,33 @@ func TestGoAutoModuleRoutesMatchCurrentWebRouter(t *testing.T) {
 	}
 	router := string(content)
 	for _, module := range GoAutoModules() {
-		want := []string{
-			"path: '" + module.Path + "'",
-			"component: () => import('@/views" + module.Component + "')",
-			"name: '" + module.RouteName + "'",
-		}
-		for _, fragment := range want {
-			if !strings.Contains(router, fragment) {
-				t.Fatalf("Web router is inconsistent with module %s: missing %q", module.Key, fragment)
-			}
+		if strings.Contains(router, "name: '"+module.RouteName+"'") {
+			t.Fatalf("GoAuto route %s must not be a public constant route", module.RouteName)
 		}
 	}
+
+	permissionPath := filepath.Join(filepath.Dir(fileName), "..", "..", "..", "..", "web", "src", "store", "modules", "permission.js")
+	content, err = os.ReadFile(permissionPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	permission := string(content)
+	for _, fragment := range []string{
+		"getRoutes()",
+		"generaMenu(dynamicRoutes, loadMenuData)",
+		"commit('SET_SIDEBAR_ROUTERS', constantRoutes.concat(sidebarRoutes))",
+	} {
+		if !strings.Contains(permission, fragment) {
+			t.Fatalf("Web permission routing is missing %q", fragment)
+		}
+	}
+
+	userPath := filepath.Join(filepath.Dir(fileName), "..", "..", "..", "..", "web", "src", "store", "modules", "user.js")
+	content, err = os.ReadFile(userPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Count(string(content), "resetRouter()") < 3 {
+		t.Fatal("login role changes must clear previously registered dynamic routes")
+	}
 }