Harden CMS security and theme contrast

src/lib/admin/staff-user.test.ts

@@ -0,0 +1,20 @@
+import { describe, expect, it } from "vitest";
+import { resolveStaffUser } from "@/lib/admin/staff-user";
+
+describe("resolveStaffUser", () => {
+  it("rejects a session whose database rank has been revoked", async () => {
+    const findUser = async () => ({ id: 7, rank: 1, username: "Alice" });
+
+    await expect(resolveStaffUser("7", 7, findUser)).resolves.toBeNull();
+  });
+
+  it("returns the current database identity instead of stale JWT values", async () => {
+    const findUser = async () => ({ id: 7, rank: 8, username: "CurrentName" });
+
+    await expect(resolveStaffUser("7", 7, findUser)).resolves.toEqual({
+      id: 7,
+      rank: 8,
+      username: "CurrentName",
+    });
+  });
+});