Replaces the no-op fastify.authenticate stub and the never-implemented
identity/auth login with real bcrypt password verification, JWT session
issuance/verification (reusing the existing JWT_SECRET), and a Redis-backed
revocation denylist for logout. Adds requireRole('ADMIN') to admin-only
configuration writes across 002-009 that previously relied on a decorator
that never actually checked anything. Adds self-identity (GET /auth/me,
re-validated against live account state) and admin-provisioned accounts
(POST /admin/users).
Making the auth check genuinely reject invalid/missing tokens exposed that
~18 pre-existing integration test files called already-gated routes with no
Authorization header (safe against the old no-op stub, broken against a real
one) — fixed via a shared tests/helpers/auth.ts (loginAs/authHeader) and a
file-by-file pass, plus two related SLA-run cleanup races exposed once admin
setup calls in those files' own beforeAll blocks started actually succeeding.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
149 lines
5.3 KiB
TypeScript
149 lines
5.3 KiB
TypeScript
import { describe, it, expect, beforeAll, afterAll } from 'vitest';
|
|
import { buildApp } from '@/app';
|
|
import { prismaClient } from '@/infrastructure/database';
|
|
import { FastifyInstance } from 'fastify';
|
|
import { loginAs, authHeader } from '../helpers/auth';
|
|
|
|
/** Covers specs/004-product-knowledge/quickstart.md Scenarios 1, 2, 3 against a real Postgres. */
|
|
describe('Knowledge entry authoring, publishing, and versioning', () => {
|
|
let app: FastifyInstance;
|
|
let token: string;
|
|
const externalProductId = `TEST_KNOWLEDGE_PROD_${Date.now()}`;
|
|
const code = `KB-TEST-${Date.now()}`;
|
|
|
|
beforeAll(async () => {
|
|
app = await buildApp();
|
|
token = await loginAs(app, 'ADMIN');
|
|
await prismaClient.product.create({
|
|
data: { externalProductId, name: 'Knowledge Test Product', status: 'active' },
|
|
});
|
|
});
|
|
|
|
afterAll(async () => {
|
|
await prismaClient.knowledgeEntry.deleteMany({ where: { code } });
|
|
await prismaClient.product.deleteMany({ where: { externalProductId } });
|
|
await app.close();
|
|
});
|
|
|
|
it('Scenario 1: a draft is invisible to retrieval, publishing makes it retrievable', async () => {
|
|
const createResponse = await app.inject({
|
|
method: 'POST',
|
|
url: `/admin/products/${externalProductId}/knowledge`,
|
|
headers: authHeader(token),
|
|
payload: { code, type: 'known_issue', problem: 'PDF conversion fails' },
|
|
});
|
|
expect(createResponse.statusCode).toBe(201);
|
|
expect(createResponse.json().data.status).toBe('draft');
|
|
|
|
const beforePublish = await app.inject({
|
|
method: 'GET',
|
|
url: `/knowledge/retrieve?productId=${externalProductId}`,
|
|
});
|
|
expect(
|
|
beforePublish.json().data.find((e: { code: string }) => e.code === code),
|
|
).toBeUndefined();
|
|
|
|
const publishResponse = await app.inject({
|
|
method: 'PATCH',
|
|
url: `/admin/knowledge/${code}/publish`,
|
|
headers: authHeader(token),
|
|
});
|
|
expect(publishResponse.statusCode).toBe(200);
|
|
expect(publishResponse.json().data.status).toBe('published');
|
|
|
|
const afterPublish = await app.inject({
|
|
method: 'GET',
|
|
url: `/knowledge/retrieve?productId=${externalProductId}`,
|
|
});
|
|
expect(afterPublish.json().data.find((e: { code: string }) => e.code === code)).toBeDefined();
|
|
});
|
|
|
|
it('Scenario 2: editing creates a new version and preserves the prior one', async () => {
|
|
const editResponse = await app.inject({
|
|
method: 'PUT',
|
|
url: `/admin/knowledge/${code}`,
|
|
headers: authHeader(token),
|
|
payload: {
|
|
type: 'known_issue',
|
|
problem: 'PDF conversion fails — updated',
|
|
expectedVersion: 1,
|
|
},
|
|
});
|
|
expect(editResponse.statusCode).toBe(200);
|
|
expect(editResponse.json().data.version).toBe(2);
|
|
|
|
const versionsResponse = await app.inject({
|
|
method: 'GET',
|
|
url: `/admin/knowledge/${code}/versions`,
|
|
headers: authHeader(token),
|
|
});
|
|
const versions = versionsResponse.json().data;
|
|
expect(versions).toHaveLength(2);
|
|
const v1 = versions.find((v: { version: number }) => v.version === 1);
|
|
const v2 = versions.find((v: { version: number }) => v.version === 2);
|
|
expect(v1.problem).toBe('PDF conversion fails');
|
|
expect(v2.problem).toBe('PDF conversion fails — updated');
|
|
expect(v2.isCurrentVersion).toBe(true);
|
|
expect(v1.isCurrentVersion).toBe(false);
|
|
|
|
const retrieveResponse = await app.inject({
|
|
method: 'GET',
|
|
url: `/knowledge/retrieve?productId=${externalProductId}`,
|
|
});
|
|
const retrieved = retrieveResponse.json().data.find((e: { code: string }) => e.code === code);
|
|
expect(retrieved.problem).toBe('PDF conversion fails — updated');
|
|
});
|
|
|
|
it('Scenario 3: a stale-version edit is rejected, not silently applied', async () => {
|
|
const first = await app.inject({
|
|
method: 'PUT',
|
|
url: `/admin/knowledge/${code}`,
|
|
headers: authHeader(token),
|
|
payload: { type: 'known_issue', problem: 'edit A', expectedVersion: 2 },
|
|
});
|
|
const second = await app.inject({
|
|
method: 'PUT',
|
|
url: `/admin/knowledge/${code}`,
|
|
headers: authHeader(token),
|
|
payload: { type: 'known_issue', problem: 'edit B', expectedVersion: 2 },
|
|
});
|
|
|
|
const results = [first.statusCode, second.statusCode].sort();
|
|
expect(results).toEqual([200, 409]);
|
|
});
|
|
|
|
it('marking an entry validated is reflected on retrieval results', async () => {
|
|
const response = await app.inject({
|
|
method: 'PATCH',
|
|
url: `/admin/knowledge/${code}/validate`,
|
|
headers: authHeader(token),
|
|
payload: { validationStatus: 'validated' },
|
|
});
|
|
expect(response.statusCode).toBe(200);
|
|
expect(response.json().data.validationStatus).toBe('validated');
|
|
});
|
|
|
|
it('unpublishing removes the entry from retrieval without deleting it', async () => {
|
|
await app.inject({
|
|
method: 'PATCH',
|
|
url: `/admin/knowledge/${code}/unpublish`,
|
|
headers: authHeader(token),
|
|
});
|
|
|
|
const retrieveResponse = await app.inject({
|
|
method: 'GET',
|
|
url: `/knowledge/retrieve?productId=${externalProductId}`,
|
|
});
|
|
expect(
|
|
retrieveResponse.json().data.find((e: { code: string }) => e.code === code),
|
|
).toBeUndefined();
|
|
|
|
const versionsResponse = await app.inject({
|
|
method: 'GET',
|
|
url: `/admin/knowledge/${code}/versions`,
|
|
headers: authHeader(token),
|
|
});
|
|
expect(versionsResponse.statusCode).toBe(200);
|
|
});
|
|
});
|