From 502ccb1585710ea9a4ca530db8d4ea747167b6bc Mon Sep 17 00:00:00 2001
From: AdrianoDev <adrianodalpastro@gmail.com>
Date: Fri, 21 Aug 2026 19:41:45 +0200
Subject: [PATCH] longevity: ruoli cliente e trainer con le rispettive rotte

---
 src/lib/auth.ts               |  9 ++++++++-
 tests/longevity/ruoli.test.ts | 31 +++++++++++++++++++++++++++++++
 2 files changed, 39 insertions(+), 1 deletion(-)
 create mode 100644 tests/longevity/ruoli.test.ts

diff --git a/src/lib/auth.ts b/src/lib/auth.ts
index c9db9d7..581e4e6 100644
--- a/src/lib/auth.ts
+++ b/src/lib/auth.ts
@@ -5,7 +5,7 @@ import { randomBytes } from 'node:crypto';
 export const SESSION_COOKIE = 'session';
 const SESSION_DAYS = 7;
 
-export type Role = 'admin' | 'superuser' | 'user' | 'piattaforme';
+export type Role = 'admin' | 'superuser' | 'user' | 'piattaforme' | 'cliente' | 'trainer';
 
 export function hashPassword(plain: string): string {
   return bcrypt.hashSync(plain, 12);
@@ -62,6 +62,11 @@ const RULES: [RegExp, Role[]][] = [
   // sotto /piattaforme. Stesso ruolo per entrambe.
   [/^\/campus(\/|$)/, ['admin', 'piattaforme']],
   [/^\/piattaforme(\/|$)/, ['admin', 'piattaforme']],
+  // Longevity: il cliente vede solo il proprio spazio, il gestionale è del trainer.
+  [/^\/longevity\/gestionale(\/|$)/, ['admin', 'trainer']],
+  [/^\/api\/longevity\/gestionale(\/|$)/, ['admin', 'trainer']],
+  [/^\/longevity(\/|$)/, ['admin', 'trainer', 'cliente']],
+  [/^\/api\/longevity(\/|$)/, ['admin', 'trainer', 'cliente']],
 ];
 
 export function canAccessAdminPath(role: string, pathname: string): boolean {
@@ -71,6 +76,8 @@ export function canAccessAdminPath(role: string, pathname: string): boolean {
   }
   // piattaforme vede solo le sue sezioni (coperte da RULES) e il logout
   if (role === 'piattaforme') return pathname === '/admin/logout';
+  // cliente e trainer non sono utenti del sito: fuori dalle rotte elencate non passano.
+  if (role === 'cliente' || role === 'trainer') return pathname === '/admin/logout';
   return true; // blog, upload, logout, showtags: tutti i loggati
 }
 
diff --git a/tests/longevity/ruoli.test.ts b/tests/longevity/ruoli.test.ts
new file mode 100644
index 0000000..ab7d080
--- /dev/null
+++ b/tests/longevity/ruoli.test.ts
@@ -0,0 +1,31 @@
+import { describe, it, expect } from 'vitest';
+import { canAccessAdminPath } from '../../src/lib/auth';
+
+describe('accesso alle rotte longevity', () => {
+  it('il cliente entra nel proprio spazio', () => {
+    expect(canAccessAdminPath('cliente', '/longevity/io')).toBe(true);
+  });
+
+  it('il cliente NON entra nel gestionale', () => {
+    expect(canAccessAdminPath('cliente', '/longevity/gestionale')).toBe(false);
+  });
+
+  it('il trainer entra in entrambi', () => {
+    expect(canAccessAdminPath('trainer', '/longevity/io')).toBe(true);
+    expect(canAccessAdminPath('trainer', '/longevity/gestionale')).toBe(true);
+  });
+
+  it('il cliente non entra nelle altre piattaforme ne nel blog', () => {
+    expect(canAccessAdminPath('cliente', '/campus')).toBe(false);
+    expect(canAccessAdminPath('cliente', '/admin/content')).toBe(false);
+    expect(canAccessAdminPath('cliente', '/admin/posts')).toBe(false);
+  });
+
+  it('il ruolo piattaforme non eredita longevity', () => {
+    expect(canAccessAdminPath('piattaforme', '/longevity/gestionale')).toBe(false);
+  });
+
+  it('admin passa sempre', () => {
+    expect(canAccessAdminPath('admin', '/longevity/gestionale')).toBe(true);
+  });
+});