Files
support_backend/tests/integration/knowledge-entries.test.ts
T
saqib mirandClaude Sonnet 5 40687f68fa feat(010-identity-auth): real staff login, session verification, and role gating
Replaces the no-op fastify.authenticate stub and the never-implemented
identity/auth login with real bcrypt password verification, JWT session
issuance/verification (reusing the existing JWT_SECRET), and a Redis-backed
revocation denylist for logout. Adds requireRole('ADMIN') to admin-only
configuration writes across 002-009 that previously relied on a decorator
that never actually checked anything. Adds self-identity (GET /auth/me,
re-validated against live account state) and admin-provisioned accounts
(POST /admin/users).

Making the auth check genuinely reject invalid/missing tokens exposed that
~18 pre-existing integration test files called already-gated routes with no
Authorization header (safe against the old no-op stub, broken against a real
one) — fixed via a shared tests/helpers/auth.ts (loginAs/authHeader) and a
file-by-file pass, plus two related SLA-run cleanup races exposed once admin
setup calls in those files' own beforeAll blocks started actually succeeding.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-07 12:45:37 +05:30

149 lines
5.3 KiB
TypeScript

import { describe, it, expect, beforeAll, afterAll } from 'vitest';
import { buildApp } from '@/app';
import { prismaClient } from '@/infrastructure/database';
import { FastifyInstance } from 'fastify';
import { loginAs, authHeader } from '../helpers/auth';
/** Covers specs/004-product-knowledge/quickstart.md Scenarios 1, 2, 3 against a real Postgres. */
describe('Knowledge entry authoring, publishing, and versioning', () => {
let app: FastifyInstance;
let token: string;
const externalProductId = `TEST_KNOWLEDGE_PROD_${Date.now()}`;
const code = `KB-TEST-${Date.now()}`;
beforeAll(async () => {
app = await buildApp();
token = await loginAs(app, 'ADMIN');
await prismaClient.product.create({
data: { externalProductId, name: 'Knowledge Test Product', status: 'active' },
});
});
afterAll(async () => {
await prismaClient.knowledgeEntry.deleteMany({ where: { code } });
await prismaClient.product.deleteMany({ where: { externalProductId } });
await app.close();
});
it('Scenario 1: a draft is invisible to retrieval, publishing makes it retrievable', async () => {
const createResponse = await app.inject({
method: 'POST',
url: `/admin/products/${externalProductId}/knowledge`,
headers: authHeader(token),
payload: { code, type: 'known_issue', problem: 'PDF conversion fails' },
});
expect(createResponse.statusCode).toBe(201);
expect(createResponse.json().data.status).toBe('draft');
const beforePublish = await app.inject({
method: 'GET',
url: `/knowledge/retrieve?productId=${externalProductId}`,
});
expect(
beforePublish.json().data.find((e: { code: string }) => e.code === code),
).toBeUndefined();
const publishResponse = await app.inject({
method: 'PATCH',
url: `/admin/knowledge/${code}/publish`,
headers: authHeader(token),
});
expect(publishResponse.statusCode).toBe(200);
expect(publishResponse.json().data.status).toBe('published');
const afterPublish = await app.inject({
method: 'GET',
url: `/knowledge/retrieve?productId=${externalProductId}`,
});
expect(afterPublish.json().data.find((e: { code: string }) => e.code === code)).toBeDefined();
});
it('Scenario 2: editing creates a new version and preserves the prior one', async () => {
const editResponse = await app.inject({
method: 'PUT',
url: `/admin/knowledge/${code}`,
headers: authHeader(token),
payload: {
type: 'known_issue',
problem: 'PDF conversion fails — updated',
expectedVersion: 1,
},
});
expect(editResponse.statusCode).toBe(200);
expect(editResponse.json().data.version).toBe(2);
const versionsResponse = await app.inject({
method: 'GET',
url: `/admin/knowledge/${code}/versions`,
headers: authHeader(token),
});
const versions = versionsResponse.json().data;
expect(versions).toHaveLength(2);
const v1 = versions.find((v: { version: number }) => v.version === 1);
const v2 = versions.find((v: { version: number }) => v.version === 2);
expect(v1.problem).toBe('PDF conversion fails');
expect(v2.problem).toBe('PDF conversion fails — updated');
expect(v2.isCurrentVersion).toBe(true);
expect(v1.isCurrentVersion).toBe(false);
const retrieveResponse = await app.inject({
method: 'GET',
url: `/knowledge/retrieve?productId=${externalProductId}`,
});
const retrieved = retrieveResponse.json().data.find((e: { code: string }) => e.code === code);
expect(retrieved.problem).toBe('PDF conversion fails — updated');
});
it('Scenario 3: a stale-version edit is rejected, not silently applied', async () => {
const first = await app.inject({
method: 'PUT',
url: `/admin/knowledge/${code}`,
headers: authHeader(token),
payload: { type: 'known_issue', problem: 'edit A', expectedVersion: 2 },
});
const second = await app.inject({
method: 'PUT',
url: `/admin/knowledge/${code}`,
headers: authHeader(token),
payload: { type: 'known_issue', problem: 'edit B', expectedVersion: 2 },
});
const results = [first.statusCode, second.statusCode].sort();
expect(results).toEqual([200, 409]);
});
it('marking an entry validated is reflected on retrieval results', async () => {
const response = await app.inject({
method: 'PATCH',
url: `/admin/knowledge/${code}/validate`,
headers: authHeader(token),
payload: { validationStatus: 'validated' },
});
expect(response.statusCode).toBe(200);
expect(response.json().data.validationStatus).toBe('validated');
});
it('unpublishing removes the entry from retrieval without deleting it', async () => {
await app.inject({
method: 'PATCH',
url: `/admin/knowledge/${code}/unpublish`,
headers: authHeader(token),
});
const retrieveResponse = await app.inject({
method: 'GET',
url: `/knowledge/retrieve?productId=${externalProductId}`,
});
expect(
retrieveResponse.json().data.find((e: { code: string }) => e.code === code),
).toBeUndefined();
const versionsResponse = await app.inject({
method: 'GET',
url: `/admin/knowledge/${code}/versions`,
headers: authHeader(token),
});
expect(versionsResponse.statusCode).toBe(200);
});
});