Replaces the no-op fastify.authenticate stub and the never-implemented
identity/auth login with real bcrypt password verification, JWT session
issuance/verification (reusing the existing JWT_SECRET), and a Redis-backed
revocation denylist for logout. Adds requireRole('ADMIN') to admin-only
configuration writes across 002-009 that previously relied on a decorator
that never actually checked anything. Adds self-identity (GET /auth/me,
re-validated against live account state) and admin-provisioned accounts
(POST /admin/users).
Making the auth check genuinely reject invalid/missing tokens exposed that
~18 pre-existing integration test files called already-gated routes with no
Authorization header (safe against the old no-op stub, broken against a real
one) — fixed via a shared tests/helpers/auth.ts (loginAs/authHeader) and a
file-by-file pass, plus two related SLA-run cleanup races exposed once admin
setup calls in those files' own beforeAll blocks started actually succeeding.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
152 lines
5.2 KiB
TypeScript
152 lines
5.2 KiB
TypeScript
import { describe, it, expect, beforeAll, afterAll } from 'vitest';
|
|
import { buildApp } from '@/app';
|
|
import { prismaClient } from '@/infrastructure/database';
|
|
import { FastifyInstance } from 'fastify';
|
|
import { loginAs, authHeader } from '../helpers/auth';
|
|
|
|
/** Covers specs/006-support-organization/quickstart.md Scenario 4 against a real Postgres. */
|
|
describe('Support organization — capability eligibility lookup (User Story 4)', () => {
|
|
let app: FastifyInstance;
|
|
let token: string;
|
|
const teamName = `Test Capability Team ${Date.now()}`;
|
|
const skillX = `skill_x_${Date.now()}`;
|
|
const skillY = `skill_y_${Date.now()}`;
|
|
const skillZ = `skill_z_${Date.now()}`;
|
|
let teamId: string;
|
|
let agentAId: string;
|
|
let agentBId: string;
|
|
const nodeIds: string[] = [];
|
|
|
|
beforeAll(async () => {
|
|
app = await buildApp();
|
|
token = await loginAs(app, 'ADMIN');
|
|
const team = await app.inject({
|
|
method: 'POST',
|
|
url: '/admin/teams',
|
|
headers: authHeader(token),
|
|
payload: { name: teamName },
|
|
});
|
|
teamId = team.json().data.id;
|
|
|
|
const agentA = await app.inject({
|
|
method: 'POST',
|
|
url: `/admin/teams/${teamId}/agents`,
|
|
headers: authHeader(token),
|
|
payload: { name: 'Agent A' },
|
|
});
|
|
agentAId = agentA.json().data.id;
|
|
await app.inject({
|
|
method: 'PUT',
|
|
url: `/admin/agents/${agentAId}/skills/${skillX}`,
|
|
headers: authHeader(token),
|
|
payload: { level: 3 },
|
|
});
|
|
|
|
const agentB = await app.inject({
|
|
method: 'POST',
|
|
url: `/admin/teams/${teamId}/agents`,
|
|
headers: authHeader(token),
|
|
payload: { name: 'Agent B' },
|
|
});
|
|
agentBId = agentB.json().data.id;
|
|
await app.inject({
|
|
method: 'PUT',
|
|
url: `/admin/agents/${agentBId}/skills/${skillY}`,
|
|
headers: authHeader(token),
|
|
payload: { level: 3 },
|
|
});
|
|
});
|
|
|
|
afterAll(async () => {
|
|
await prismaClient.hierarchyNode.deleteMany({ where: { id: { in: nodeIds } } });
|
|
await prismaClient.auditLog.deleteMany({
|
|
where: { entityType: 'HierarchyNode', entityId: { in: nodeIds } },
|
|
});
|
|
await prismaClient.agentSkill.deleteMany({ where: { agentId: { in: [agentAId, agentBId] } } });
|
|
await prismaClient.agentAvailability.deleteMany({
|
|
where: { agentId: { in: [agentAId, agentBId] } },
|
|
});
|
|
await prismaClient.agent.deleteMany({ where: { teamId } });
|
|
await prismaClient.team.deleteMany({ where: { id: teamId } });
|
|
await app.close();
|
|
});
|
|
|
|
it('Scenario 4: skill-only match, availability never filters, inactive excluded, empty on no match, hierarchy-scope composition', async () => {
|
|
const onlyX = await app.inject({
|
|
method: 'GET',
|
|
url: `/support-org/capability-eligibility?skills=${skillX}`,
|
|
});
|
|
const onlyXIds = onlyX.json().data.map((a: { id: string }) => a.id);
|
|
expect(onlyXIds).toContain(agentAId);
|
|
expect(onlyXIds).not.toContain(agentBId);
|
|
|
|
await app.inject({
|
|
method: 'PUT',
|
|
url: `/admin/agents/${agentAId}/availability`,
|
|
headers: authHeader(token),
|
|
payload: { status: 'offline', workingHours: {} },
|
|
});
|
|
const stillOffline = await app.inject({
|
|
method: 'GET',
|
|
url: `/support-org/capability-eligibility?skills=${skillX}`,
|
|
});
|
|
expect(stillOffline.json().data.map((a: { id: string }) => a.id)).toContain(agentAId);
|
|
|
|
await app.inject({
|
|
method: 'PATCH',
|
|
url: `/admin/agents/${agentAId}`,
|
|
headers: authHeader(token),
|
|
payload: { active: false },
|
|
});
|
|
const afterDeactivation = await app.inject({
|
|
method: 'GET',
|
|
url: `/support-org/capability-eligibility?skills=${skillX}`,
|
|
});
|
|
expect(afterDeactivation.json().data.map((a: { id: string }) => a.id)).not.toContain(agentAId);
|
|
|
|
const noMatch = await app.inject({
|
|
method: 'GET',
|
|
url: `/support-org/capability-eligibility?skills=skill_nobody_has_${Date.now()}`,
|
|
});
|
|
expect(noMatch.statusCode).toBe(200);
|
|
expect(noMatch.json().data).toEqual([]);
|
|
|
|
// Reactivate agent A and give it skillZ too, then create a scoped hierarchy node requiring
|
|
// skillZ for a given product — only an agent holding BOTH x and z should be eligible.
|
|
await app.inject({
|
|
method: 'PATCH',
|
|
url: `/admin/agents/${agentAId}`,
|
|
headers: authHeader(token),
|
|
payload: { active: true },
|
|
});
|
|
await app.inject({
|
|
method: 'PUT',
|
|
url: `/admin/agents/${agentAId}/skills/${skillZ}`,
|
|
headers: authHeader(token),
|
|
payload: { level: 2 },
|
|
});
|
|
const productId = `TEST_CAP_PRODUCT_${Date.now()}`;
|
|
const node = await app.inject({
|
|
method: 'POST',
|
|
url: '/admin/hierarchy-nodes',
|
|
headers: authHeader(token),
|
|
payload: {
|
|
name: 'Capability Scope Node',
|
|
order: 0,
|
|
productScope: [productId],
|
|
skills: [skillZ],
|
|
assignmentStrategy: 'ROUND_ROBIN',
|
|
},
|
|
});
|
|
nodeIds.push(node.json().data.id);
|
|
|
|
const scoped = await app.inject({
|
|
method: 'GET',
|
|
url: `/support-org/capability-eligibility?skills=${skillX}&productId=${productId}`,
|
|
});
|
|
const scopedIds = scoped.json().data.map((a: { id: string }) => a.id);
|
|
expect(scopedIds).toContain(agentAId); // holds x and z
|
|
expect(scopedIds).not.toContain(agentBId); // holds y only, missing x and z
|
|
});
|
|
});
|