Files
support_backend/tests/integration/support-org-teams-agents.test.ts
saqib mirandClaude Sonnet 5 40687f68fa feat(010-identity-auth): real staff login, session verification, and role gating
Replaces the no-op fastify.authenticate stub and the never-implemented
identity/auth login with real bcrypt password verification, JWT session
issuance/verification (reusing the existing JWT_SECRET), and a Redis-backed
revocation denylist for logout. Adds requireRole('ADMIN') to admin-only
configuration writes across 002-009 that previously relied on a decorator
that never actually checked anything. Adds self-identity (GET /auth/me,
re-validated against live account state) and admin-provisioned accounts
(POST /admin/users).

Making the auth check genuinely reject invalid/missing tokens exposed that
~18 pre-existing integration test files called already-gated routes with no
Authorization header (safe against the old no-op stub, broken against a real
one) — fixed via a shared tests/helpers/auth.ts (loginAs/authHeader) and a
file-by-file pass, plus two related SLA-run cleanup races exposed once admin
setup calls in those files' own beforeAll blocks started actually succeeding.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-07 12:45:37 +05:30

114 lines
3.7 KiB
TypeScript

import { describe, it, expect, beforeAll, afterAll } from 'vitest';
import { buildApp } from '@/app';
import { prismaClient } from '@/infrastructure/database';
import { FastifyInstance } from 'fastify';
import { loginAs, authHeader } from '../helpers/auth';
/** Covers specs/006-support-organization/quickstart.md Scenario 1 against a real Postgres. */
describe('Support organization — teams and agents (User Story 1)', () => {
let app: FastifyInstance;
let token: string;
const teamName = `Test Team ${Date.now()}`;
let teamId: string;
beforeAll(async () => {
app = await buildApp();
token = await loginAs(app, 'ADMIN');
});
afterAll(async () => {
await prismaClient.agentSkill.deleteMany({ where: { agent: { team: { name: teamName } } } });
await prismaClient.agentAvailability.deleteMany({
where: { agent: { team: { name: teamName } } },
});
await prismaClient.agent.deleteMany({ where: { team: { name: teamName } } });
await prismaClient.team.deleteMany({ where: { name: teamName } });
await app.close();
});
it('Scenario 1: create, roster, deactivate/reactivate, team deactivation does not cascade', async () => {
const createTeam = await app.inject({
method: 'POST',
url: '/admin/teams',
headers: authHeader(token),
payload: { name: teamName },
});
expect(createTeam.statusCode).toBe(201);
expect(createTeam.json().data.active).toBe(true);
teamId = createTeam.json().data.id;
const createAgent = await app.inject({
method: 'POST',
url: `/admin/teams/${teamId}/agents`,
headers: authHeader(token),
payload: { name: 'Agent A' },
});
expect(createAgent.statusCode).toBe(201);
const agentId = createAgent.json().data.id;
const roster = await app.inject({
method: 'GET',
url: `/admin/teams/${teamId}`,
headers: authHeader(token),
});
expect(roster.json().data.agents.map((a: { id: string }) => a.id)).toContain(agentId);
await app.inject({
method: 'PATCH',
url: `/admin/agents/${agentId}`,
headers: authHeader(token),
payload: { active: false },
});
const activeListing = await app.inject({
method: 'GET',
url: `/admin/agents?active=true&teamId=${teamId}`,
headers: authHeader(token),
});
expect(activeListing.json().data.map((a: { id: string }) => a.id)).not.toContain(agentId);
const directFetch = await app.inject({
method: 'GET',
url: `/admin/agents/${agentId}`,
headers: authHeader(token),
});
expect(directFetch.statusCode).toBe(200);
expect(directFetch.json().data.active).toBe(false);
await app.inject({
method: 'PATCH',
url: `/admin/agents/${agentId}`,
headers: authHeader(token),
payload: { active: true },
});
const reactivatedListing = await app.inject({
method: 'GET',
url: `/admin/agents?active=true&teamId=${teamId}`,
headers: authHeader(token),
});
expect(reactivatedListing.json().data.map((a: { id: string }) => a.id)).toContain(agentId);
await app.inject({
method: 'PATCH',
url: `/admin/teams/${teamId}`,
headers: authHeader(token),
payload: { active: false },
});
const agentAfterTeamDeactivation = await app.inject({
method: 'GET',
url: `/admin/agents/${agentId}`,
headers: authHeader(token),
});
expect(agentAfterTeamDeactivation.json().data.active).toBe(true);
});
it('404s creating an agent on a nonexistent team', async () => {
const response = await app.inject({
method: 'POST',
url: '/admin/teams/nonexistent-team-id/agents',
headers: authHeader(token),
payload: { name: 'Ghost Agent' },
});
expect(response.statusCode).toBe(404);
});
});