Replaces the no-op fastify.authenticate stub and the never-implemented
identity/auth login with real bcrypt password verification, JWT session
issuance/verification (reusing the existing JWT_SECRET), and a Redis-backed
revocation denylist for logout. Adds requireRole('ADMIN') to admin-only
configuration writes across 002-009 that previously relied on a decorator
that never actually checked anything. Adds self-identity (GET /auth/me,
re-validated against live account state) and admin-provisioned accounts
(POST /admin/users).
Making the auth check genuinely reject invalid/missing tokens exposed that
~18 pre-existing integration test files called already-gated routes with no
Authorization header (safe against the old no-op stub, broken against a real
one) — fixed via a shared tests/helpers/auth.ts (loginAs/authHeader) and a
file-by-file pass, plus two related SLA-run cleanup races exposed once admin
setup calls in those files' own beforeAll blocks started actually succeeding.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
108 lines
3.6 KiB
TypeScript
108 lines
3.6 KiB
TypeScript
import { describe, it, expect, beforeAll, afterAll } from 'vitest';
|
|
import { buildApp } from '@/app';
|
|
import { prismaClient } from '@/infrastructure/database';
|
|
import { FastifyInstance } from 'fastify';
|
|
import { loginAs, authHeader } from '../helpers/auth';
|
|
|
|
/** Covers specs/006-support-organization/quickstart.md Scenario 2 against a real Postgres. */
|
|
describe('Support organization — agent skills and availability (User Story 2)', () => {
|
|
let app: FastifyInstance;
|
|
let token: string;
|
|
const teamName = `Test Skills Team ${Date.now()}`;
|
|
let teamId: string;
|
|
let agentId: string;
|
|
|
|
beforeAll(async () => {
|
|
app = await buildApp();
|
|
token = await loginAs(app, 'ADMIN');
|
|
const team = await app.inject({
|
|
method: 'POST',
|
|
url: '/admin/teams',
|
|
headers: authHeader(token),
|
|
payload: { name: teamName },
|
|
});
|
|
teamId = team.json().data.id;
|
|
const agent = await app.inject({
|
|
method: 'POST',
|
|
url: `/admin/teams/${teamId}/agents`,
|
|
headers: authHeader(token),
|
|
payload: { name: 'Skilled Agent' },
|
|
});
|
|
agentId = agent.json().data.id;
|
|
});
|
|
|
|
afterAll(async () => {
|
|
await prismaClient.agentSkill.deleteMany({ where: { agentId } });
|
|
await prismaClient.agentAvailability.deleteMany({ where: { agentId } });
|
|
await prismaClient.agent.deleteMany({ where: { teamId } });
|
|
await prismaClient.team.deleteMany({ where: { id: teamId } });
|
|
await app.close();
|
|
});
|
|
|
|
it('Scenario 2: skill upsert never duplicates, availability upsert stays single-record', async () => {
|
|
const addSkill = await app.inject({
|
|
method: 'PUT',
|
|
url: `/admin/agents/${agentId}/skills/pdf_conversion`,
|
|
headers: authHeader(token),
|
|
payload: { level: 3 },
|
|
});
|
|
expect(addSkill.statusCode).toBe(200);
|
|
|
|
const updateSkill = await app.inject({
|
|
method: 'PUT',
|
|
url: `/admin/agents/${agentId}/skills/pdf_conversion`,
|
|
headers: authHeader(token),
|
|
payload: { level: 5 },
|
|
});
|
|
expect(updateSkill.statusCode).toBe(200);
|
|
|
|
const skills = await app.inject({
|
|
method: 'GET',
|
|
url: `/admin/agents/${agentId}/skills`,
|
|
headers: authHeader(token),
|
|
});
|
|
const pdfSkills = skills
|
|
.json()
|
|
.data.filter((s: { skillTag: string }) => s.skillTag === 'pdf_conversion');
|
|
expect(pdfSkills).toHaveLength(1);
|
|
expect(pdfSkills[0].level).toBe(5);
|
|
|
|
const setAvailability = await app.inject({
|
|
method: 'PUT',
|
|
url: `/admin/agents/${agentId}/availability`,
|
|
headers: authHeader(token),
|
|
payload: { status: 'busy', workingHours: { mon: '9-17' } },
|
|
});
|
|
expect(setAvailability.statusCode).toBe(200);
|
|
expect(setAvailability.json().data.currentLoad).toBe(0);
|
|
|
|
const updateAvailability = await app.inject({
|
|
method: 'PUT',
|
|
url: `/admin/agents/${agentId}/availability`,
|
|
headers: authHeader(token),
|
|
payload: { status: 'available', workingHours: { mon: '9-17' } },
|
|
});
|
|
expect(updateAvailability.statusCode).toBe(200);
|
|
|
|
const current = await app.inject({
|
|
method: 'GET',
|
|
url: `/admin/agents/${agentId}/availability`,
|
|
headers: authHeader(token),
|
|
});
|
|
expect(current.json().data.status).toBe('available');
|
|
|
|
const allRecords = await prismaClient.agentAvailability.findMany({ where: { agentId } });
|
|
expect(allRecords).toHaveLength(1);
|
|
});
|
|
|
|
it('rejects an invalid availability status', async () => {
|
|
const response = await app.inject({
|
|
method: 'PUT',
|
|
url: `/admin/agents/${agentId}/availability`,
|
|
headers: authHeader(token),
|
|
payload: { status: 'not_a_real_status', workingHours: {} },
|
|
});
|
|
expect(response.statusCode).toBe(400);
|
|
});
|
|
});
|