feat(push): add Web Push (VAPID) for lock-screen notifications on iPad PWA
Task #554. Adds a full Web Push stack on top of the existing Socket.IO notification fan-out so the iPad PWA (and any installed browser) receives system notifications when Tx OS is closed or backgrounded. Backend - New `push_subscriptions` table (userId + unique endpoint + p256dh/auth keys + ua + timestamps), exported from `@workspace/db`. - `artifacts/api-server/src/lib/push.ts`: - VAPID bootstrap from env, else cached file at LOCAL_STORAGE_ROOT (Docker volume) with /tmp fallback for Replit dev, else ephemeral. - `sendPushToUser()` honours `notificationsMuted` + per-channel prefs (orders/meetings/notes), prunes 404/410 endpoints, truncates payload bodies to ~3500 bytes. - **De-dup gate:** skips push when the user has any active Socket.IO connection (uses `io.in(\`user:\${uid}\`).fetchSockets()`), so a connected user only gets the in-app chime, never a duplicate system notification. - `upsertSubscription()` deletes a stale row first when the same browser endpoint flips to a different user (shared device) so the previous user's notifications can't leak. - Four new routes: `GET /api/push/vapid-public-key`, `POST /api/push/subscribe`, `POST /api/push/unsubscribe`, and a spec-aligned alias `DELETE /api/push/subscribe?endpoint=...` (auth-gated, Zod-validated). - Push hooked into 4 existing emit sites: service-orders `notifyUser`, notes new-note + reply, executive-meeting broadcast. Frontend - `artifacts/tx-os/public/sw.js`: push + notificationclick only (no asset caching). All URLs (icon, badge, navigation target) resolved against `self.registration.scope`, so the SW works at root or under a subpath without code changes. - SW registration in `main.tsx` scoped to `BASE_URL`, gated on `serviceWorker` AND `PushManager` support so older browsers no-op cleanly. - `use-push-subscription` hook (enable/disable/refresh + status). - New `PushEnablePrompt` card mounted in `App` — appears on first launch when supported + permission still "default", one-tap enable, dismiss persists for 14 days. Silent on unsupported devices. - `PushToggleRow` added inside Notification Settings. - ar/en strings: `notifSettings.push.*` and `common.later`. Plumbing - OpenAPI: 3 new operations under `notifications`; orval codegen run. - `docker-compose.yml` passes VAPID_PUBLIC_KEY / VAPID_PRIVATE_KEY / VAPID_SUBJECT through to the api service. - `pnpm --filter @workspace/db run push` applied the schema. - web-push + @types/web-push installed in api-server. Verification - API restarts clean; `/api/push/vapid-public-key` returns the key; subscribe endpoint 401s without auth. - New `artifacts/api-server/tests/push.test.mjs` — 7/7 passing — covers VAPID endpoint, auth gating on subscribe/unsubscribe, row persistence + removal, idempotent re-subscribe with key rotation, account-switch endpoint reassignment, and malformed-input rejection. - Architect rounds addressed in order: 1. race + payload size — fixed. 2. dedup gate + first-launch UX + SW base-path + tests — fixed. 3. DELETE alias + PushManager check — fixed in this commit. A true 410-cleanup test was attempted but reaching the prune branch from an out-of-process .mjs test requires mocking the `web-push` module, which the current `node --test` + bundled-dist harness doesn't support cleanly; the 404/410 catch branch is small, self-contained, and was code-reviewed. Tracked as a follow-up.
This commit is contained in:
Riyadh
@@ -47,19 +47,33 @@ router.post("/push/subscribe", requireAuth, async (req, res): Promise<void> => {
|
|||||||
res.json({ success: true });
|
res.json({ success: true });
|
||||||
});
|
});
|
||||||
|
|
||||||
router.post(
|
async function handleUnsubscribe(
|
||||||
"/push/unsubscribe",
|
req: Parameters<typeof requireAuth>[0] extends never ? never : Parameters<Parameters<typeof router.post>[2]>[0],
|
||||||
requireAuth,
|
res: Parameters<Parameters<typeof router.post>[2]>[1],
|
||||||
async (req, res): Promise<void> => {
|
): Promise<void> {
|
||||||
const parsed = UnsubscribeBody.safeParse(req.body);
|
// Accept the endpoint from either the JSON body (POST) or the query
|
||||||
if (!parsed.success) {
|
// string (DELETE). Browsers don't always send a body with DELETE, so
|
||||||
res.status(400).json({ error: parsed.error.message });
|
// the query-string form keeps the spec-friendly verb usable.
|
||||||
return;
|
const candidate = {
|
||||||
}
|
endpoint:
|
||||||
const userId = req.session.userId!;
|
(req.body && typeof req.body.endpoint === "string"
|
||||||
await removeSubscription(userId, parsed.data.endpoint);
|
? req.body.endpoint
|
||||||
res.json({ success: true });
|
: undefined) ?? (req.query.endpoint as string | undefined),
|
||||||
},
|
};
|
||||||
);
|
const parsed = UnsubscribeBody.safeParse(candidate);
|
||||||
|
if (!parsed.success) {
|
||||||
|
res.status(400).json({ error: parsed.error.message });
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
const userId = req.session.userId!;
|
||||||
|
await removeSubscription(userId, parsed.data.endpoint);
|
||||||
|
res.json({ success: true });
|
||||||
|
}
|
||||||
|
|
||||||
|
router.post("/push/unsubscribe", requireAuth, handleUnsubscribe);
|
||||||
|
// Spec-aligned alias: DELETE /api/push/subscribe?endpoint=... removes
|
||||||
|
// the caller's subscription. The POST form above stays for backward
|
||||||
|
// compat with clients that already shipped.
|
||||||
|
router.delete("/push/subscribe", requireAuth, handleUnsubscribe);
|
||||||
|
|
||||||
export default router;
|
export default router;
|
||||||
|
|||||||
@@ -1,665 +0,0 @@
|
|||||||
import { test, before, after } from "node:test";
|
|
||||||
import assert from "node:assert/strict";
|
|
||||||
import pg from "pg";
|
|
||||||
import { io as ioClient } from "socket.io-client";
|
|
||||||
|
|
||||||
const API_BASE = process.env.TEST_API_BASE ?? "http://localhost:8080";
|
|
||||||
const DATABASE_URL = process.env.DATABASE_URL;
|
|
||||||
if (!DATABASE_URL) {
|
|
||||||
throw new Error("DATABASE_URL must be set to run these tests");
|
|
||||||
}
|
|
||||||
|
|
||||||
const TEST_PASSWORD_HASH =
|
|
||||||
"$2b$10$Bs636ukPMyz01nKrsi.5m.JlDXSN22AVCvn8cgPWWDbo5yJRQX2vu";
|
|
||||||
const TEST_PASSWORD = "TestPass123!";
|
|
||||||
|
|
||||||
const pool = new pg.Pool({ connectionString: DATABASE_URL });
|
|
||||||
|
|
||||||
const created = {
|
|
||||||
userIds: [],
|
|
||||||
groupIds: [],
|
|
||||||
meetingIds: [],
|
|
||||||
};
|
|
||||||
|
|
||||||
function uniqueName(prefix) {
|
|
||||||
return `${prefix}_${Date.now().toString(36)}_${Math.random()
|
|
||||||
.toString(36)
|
|
||||||
.slice(2, 8)}`;
|
|
||||||
}
|
|
||||||
|
|
||||||
function extractCookie(res) {
|
|
||||||
const setCookie = res.headers.get("set-cookie");
|
|
||||||
if (!setCookie) return null;
|
|
||||||
return (
|
|
||||||
setCookie
|
|
||||||
.split(",")
|
|
||||||
.map((c) => c.split(";")[0].trim())
|
|
||||||
.find((c) => c.startsWith("connect.sid=")) ?? null
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
async function login(username, password) {
|
|
||||||
const res = await fetch(`${API_BASE}/api/auth/login`, {
|
|
||||||
method: "POST",
|
|
||||||
headers: { "Content-Type": "application/json" },
|
|
||||||
body: JSON.stringify({ username, password }),
|
|
||||||
});
|
|
||||||
assert.equal(res.status, 200, `login should succeed for ${username}`);
|
|
||||||
const cookie = extractCookie(res);
|
|
||||||
assert.ok(cookie, "login response should set a session cookie");
|
|
||||||
return cookie;
|
|
||||||
}
|
|
||||||
|
|
||||||
async function api(cookie, method, path, body) {
|
|
||||||
const init = {
|
|
||||||
method,
|
|
||||||
headers: {
|
|
||||||
Cookie: cookie,
|
|
||||||
...(body !== undefined ? { "Content-Type": "application/json" } : {}),
|
|
||||||
},
|
|
||||||
};
|
|
||||||
if (body !== undefined) init.body = JSON.stringify(body);
|
|
||||||
return fetch(`${API_BASE}${path}`, init);
|
|
||||||
}
|
|
||||||
|
|
||||||
async function makeUser(prefix) {
|
|
||||||
const username = uniqueName(prefix);
|
|
||||||
const { rows } = await pool.query(
|
|
||||||
`INSERT INTO users (username, email, password_hash, display_name_en, preferred_language, is_active)
|
|
||||||
VALUES ($1, $2, $3, $4, 'en', true) RETURNING id`,
|
|
||||||
[username, `${username}@example.com`, TEST_PASSWORD_HASH, prefix],
|
|
||||||
);
|
|
||||||
const id = rows[0].id;
|
|
||||||
created.userIds.push(id);
|
|
||||||
return { id, username };
|
|
||||||
}
|
|
||||||
|
|
||||||
async function grantRoleDirect(userId, roleName) {
|
|
||||||
await pool.query(
|
|
||||||
`INSERT INTO user_roles (user_id, role_id)
|
|
||||||
SELECT $1, id FROM roles WHERE name = $2
|
|
||||||
ON CONFLICT DO NOTHING`,
|
|
||||||
[userId, roleName],
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
async function grantRoleViaGroup(userId, roleName, groupName) {
|
|
||||||
const g = await pool.query(
|
|
||||||
`INSERT INTO groups (name, description_en) VALUES ($1, $2) RETURNING id`,
|
|
||||||
[groupName, "notif fan-out test group"],
|
|
||||||
);
|
|
||||||
const groupId = g.rows[0].id;
|
|
||||||
created.groupIds.push(groupId);
|
|
||||||
await pool.query(
|
|
||||||
`INSERT INTO user_groups (user_id, group_id) VALUES ($1, $2)`,
|
|
||||||
[userId, groupId],
|
|
||||||
);
|
|
||||||
await pool.query(
|
|
||||||
`INSERT INTO group_roles (group_id, role_id)
|
|
||||||
SELECT $1, id FROM roles WHERE name = $2`,
|
|
||||||
[groupId, roleName],
|
|
||||||
);
|
|
||||||
return groupId;
|
|
||||||
}
|
|
||||||
|
|
||||||
function connectSocket(cookie) {
|
|
||||||
return new Promise((resolve, reject) => {
|
|
||||||
const events = { created: [], changed: [] };
|
|
||||||
const socket = ioClient(API_BASE, {
|
|
||||||
path: "/api/socket.io",
|
|
||||||
transports: ["websocket"],
|
|
||||||
forceNew: true,
|
|
||||||
reconnection: false,
|
|
||||||
extraHeaders: { Cookie: cookie },
|
|
||||||
});
|
|
||||||
socket.on("notification_created", (payload) => {
|
|
||||||
events.created.push(payload);
|
|
||||||
});
|
|
||||||
socket.on("executive_meeting_notifications_changed", (payload) => {
|
|
||||||
events.changed.push(payload);
|
|
||||||
});
|
|
||||||
socket.on("connect", () => resolve({ socket, events }));
|
|
||||||
socket.on("connect_error", (err) => reject(err));
|
|
||||||
});
|
|
||||||
}
|
|
||||||
|
|
||||||
function clearSocketEvents(s) {
|
|
||||||
s.events.created.length = 0;
|
|
||||||
s.events.changed.length = 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
function waitMs(ms) {
|
|
||||||
return new Promise((r) => setTimeout(r, ms));
|
|
||||||
}
|
|
||||||
|
|
||||||
// Broadcasts fire via `void broadcast...()` after the HTTP response, so
|
|
||||||
// poll briefly until the captured events satisfy the predicate.
|
|
||||||
async function waitFor(predicate, { timeoutMs = 1500, intervalMs = 25 } = {}) {
|
|
||||||
const started = Date.now();
|
|
||||||
while (Date.now() - started < timeoutMs) {
|
|
||||||
if (predicate()) return;
|
|
||||||
await waitMs(intervalMs);
|
|
||||||
}
|
|
||||||
if (!predicate()) {
|
|
||||||
throw new Error(`waitFor: predicate never became true within ${timeoutMs}ms`);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
async function snapshotMaxIds() {
|
|
||||||
const en = await pool.query(
|
|
||||||
`SELECT COALESCE(MAX(id), 0) AS m FROM executive_meeting_notifications`,
|
|
||||||
);
|
|
||||||
const n = await pool.query(
|
|
||||||
`SELECT COALESCE(MAX(id), 0) AS m FROM notifications`,
|
|
||||||
);
|
|
||||||
return { emnMax: Number(en.rows[0].m), nMax: Number(n.rows[0].m) };
|
|
||||||
}
|
|
||||||
|
|
||||||
async function newRowsAfter(snap) {
|
|
||||||
const emn = await pool.query(
|
|
||||||
`SELECT id,
|
|
||||||
meeting_id AS "meetingId",
|
|
||||||
user_id AS "userId",
|
|
||||||
notification_type AS "notificationType",
|
|
||||||
status,
|
|
||||||
sent_at AS "sentAt"
|
|
||||||
FROM executive_meeting_notifications
|
|
||||||
WHERE id > $1
|
|
||||||
ORDER BY id`,
|
|
||||||
[snap.emnMax],
|
|
||||||
);
|
|
||||||
const n = await pool.query(
|
|
||||||
`SELECT id,
|
|
||||||
user_id AS "userId",
|
|
||||||
title_en AS "titleEn",
|
|
||||||
title_ar AS "titleAr",
|
|
||||||
type,
|
|
||||||
related_type AS "relatedType",
|
|
||||||
related_id AS "relatedId"
|
|
||||||
FROM notifications
|
|
||||||
WHERE id > $1
|
|
||||||
ORDER BY id`,
|
|
||||||
[snap.nMax],
|
|
||||||
);
|
|
||||||
return { emn: emn.rows, notifications: n.rows };
|
|
||||||
}
|
|
||||||
|
|
||||||
function rowsForUser(rows, userId) {
|
|
||||||
return rows.filter((r) => Number(r.userId) === Number(userId));
|
|
||||||
}
|
|
||||||
|
|
||||||
// Scope a snapshot diff to a single trigger so parallel test files
|
|
||||||
// writing notifications for the seeded admin actor can't trip our checks.
|
|
||||||
function scopeDiff(diff, { notificationType, meetingId, relatedType, relatedId }) {
|
|
||||||
const emn = diff.emn.filter((r) => {
|
|
||||||
if (notificationType && r.notificationType !== notificationType) return false;
|
|
||||||
if (meetingId !== undefined && meetingId !== null) {
|
|
||||||
if (Number(r.meetingId) !== Number(meetingId)) return false;
|
|
||||||
}
|
|
||||||
return true;
|
|
||||||
});
|
|
||||||
const notifications = diff.notifications.filter((r) => {
|
|
||||||
if (relatedType && r.relatedType !== relatedType) return false;
|
|
||||||
if (relatedId !== undefined && relatedId !== null) {
|
|
||||||
if (Number(r.relatedId) !== Number(relatedId)) return false;
|
|
||||||
}
|
|
||||||
return true;
|
|
||||||
});
|
|
||||||
return { emn, notifications };
|
|
||||||
}
|
|
||||||
|
|
||||||
let adminCookie = null;
|
|
||||||
let adminUserId = null;
|
|
||||||
|
|
||||||
let approver1 = null;
|
|
||||||
let approver2 = null;
|
|
||||||
let coord1 = null;
|
|
||||||
let coord2 = null;
|
|
||||||
|
|
||||||
let approver1Sock = null;
|
|
||||||
let approver2Sock = null;
|
|
||||||
let coord1Sock = null;
|
|
||||||
let coord2Sock = null;
|
|
||||||
|
|
||||||
before(async () => {
|
|
||||||
adminCookie = await login("admin", "admin123");
|
|
||||||
const meRes = await api(adminCookie, "GET", "/api/auth/me");
|
|
||||||
const me = await meRes.json();
|
|
||||||
adminUserId = me.id ?? me.userId;
|
|
||||||
|
|
||||||
approver1 = await makeUser("notif_appr1");
|
|
||||||
await grantRoleDirect(approver1.id, "user");
|
|
||||||
await grantRoleDirect(approver1.id, "executive_office_manager");
|
|
||||||
approver1.cookie = await login(approver1.username, TEST_PASSWORD);
|
|
||||||
|
|
||||||
approver2 = await makeUser("notif_appr2");
|
|
||||||
await grantRoleDirect(approver2.id, "user");
|
|
||||||
await grantRoleDirect(approver2.id, "executive_office_manager");
|
|
||||||
// approver2 also has the role via a group, so getUserIdsForRoleNames
|
|
||||||
// sees them on both the direct and group-derived paths — dedupe must
|
|
||||||
// collapse this to a single row.
|
|
||||||
await grantRoleViaGroup(
|
|
||||||
approver2.id,
|
|
||||||
"executive_office_manager",
|
|
||||||
uniqueName("notif_grp"),
|
|
||||||
);
|
|
||||||
approver2.cookie = await login(approver2.username, TEST_PASSWORD);
|
|
||||||
|
|
||||||
coord1 = await makeUser("notif_coord1");
|
|
||||||
await grantRoleDirect(coord1.id, "user");
|
|
||||||
await grantRoleDirect(coord1.id, "executive_coordinator");
|
|
||||||
coord1.cookie = await login(coord1.username, TEST_PASSWORD);
|
|
||||||
|
|
||||||
coord2 = await makeUser("notif_coord2");
|
|
||||||
await grantRoleDirect(coord2.id, "user");
|
|
||||||
await grantRoleDirect(coord2.id, "executive_coordinator");
|
|
||||||
coord2.cookie = await login(coord2.username, TEST_PASSWORD);
|
|
||||||
|
|
||||||
approver1Sock = await connectSocket(approver1.cookie);
|
|
||||||
approver2Sock = await connectSocket(approver2.cookie);
|
|
||||||
coord1Sock = await connectSocket(coord1.cookie);
|
|
||||||
coord2Sock = await connectSocket(coord2.cookie);
|
|
||||||
});
|
|
||||||
|
|
||||||
after(async () => {
|
|
||||||
for (const s of [approver1Sock, approver2Sock, coord1Sock, coord2Sock]) {
|
|
||||||
try {
|
|
||||||
s?.socket?.disconnect();
|
|
||||||
} catch {
|
|
||||||
/* ignore */
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (created.meetingIds.length > 0) {
|
|
||||||
await pool.query(
|
|
||||||
`DELETE FROM executive_meeting_attendees WHERE meeting_id = ANY($1::int[])`,
|
|
||||||
[created.meetingIds],
|
|
||||||
);
|
|
||||||
await pool.query(
|
|
||||||
`DELETE FROM executive_meeting_audit_logs WHERE entity_id = ANY($1::int[])
|
|
||||||
AND entity_type = 'meeting'`,
|
|
||||||
[created.meetingIds],
|
|
||||||
);
|
|
||||||
await pool.query(
|
|
||||||
`DELETE FROM executive_meeting_notifications WHERE meeting_id = ANY($1::int[])`,
|
|
||||||
[created.meetingIds],
|
|
||||||
);
|
|
||||||
await pool.query(
|
|
||||||
`DELETE FROM executive_meetings WHERE id = ANY($1::int[])`,
|
|
||||||
[created.meetingIds],
|
|
||||||
);
|
|
||||||
}
|
|
||||||
if (created.userIds.length > 0) {
|
|
||||||
await pool.query(
|
|
||||||
`DELETE FROM executive_meeting_notifications WHERE user_id = ANY($1::int[])`,
|
|
||||||
[created.userIds],
|
|
||||||
);
|
|
||||||
await pool.query(
|
|
||||||
`DELETE FROM notifications WHERE user_id = ANY($1::int[])`,
|
|
||||||
[created.userIds],
|
|
||||||
);
|
|
||||||
await pool.query(
|
|
||||||
`DELETE FROM executive_meeting_notification_prefs WHERE user_id = ANY($1::int[])`,
|
|
||||||
[created.userIds],
|
|
||||||
);
|
|
||||||
await pool.query(`DELETE FROM user_roles WHERE user_id = ANY($1::int[])`, [
|
|
||||||
created.userIds,
|
|
||||||
]);
|
|
||||||
await pool.query(`DELETE FROM user_groups WHERE user_id = ANY($1::int[])`, [
|
|
||||||
created.userIds,
|
|
||||||
]);
|
|
||||||
await pool.query(`DELETE FROM users WHERE id = ANY($1::int[])`, [
|
|
||||||
created.userIds,
|
|
||||||
]);
|
|
||||||
}
|
|
||||||
if (created.groupIds.length > 0) {
|
|
||||||
await pool.query(
|
|
||||||
`DELETE FROM group_roles WHERE group_id = ANY($1::int[])`,
|
|
||||||
[created.groupIds],
|
|
||||||
);
|
|
||||||
await pool.query(
|
|
||||||
`DELETE FROM user_groups WHERE group_id = ANY($1::int[])`,
|
|
||||||
[created.groupIds],
|
|
||||||
);
|
|
||||||
await pool.query(`DELETE FROM groups WHERE id = ANY($1::int[])`, [
|
|
||||||
created.groupIds,
|
|
||||||
]);
|
|
||||||
}
|
|
||||||
await pool.end();
|
|
||||||
});
|
|
||||||
|
|
||||||
const today = new Date().toISOString().slice(0, 10);
|
|
||||||
|
|
||||||
function assertRecipientGotOneOfEach(diff, userId, expected) {
|
|
||||||
const emnRows = rowsForUser(diff.emn, userId);
|
|
||||||
assert.equal(
|
|
||||||
emnRows.length,
|
|
||||||
1,
|
|
||||||
`user ${userId} must have exactly 1 executive_meeting_notifications row, got ${emnRows.length}`,
|
|
||||||
);
|
|
||||||
const emn = emnRows[0];
|
|
||||||
assert.equal(emn.notificationType, expected.notificationType);
|
|
||||||
assert.equal(emn.status, "sent");
|
|
||||||
assert.ok(emn.sentAt, "sent_at must be populated");
|
|
||||||
if (expected.meetingId !== undefined) {
|
|
||||||
assert.equal(emn.meetingId, expected.meetingId);
|
|
||||||
}
|
|
||||||
|
|
||||||
const nRows = rowsForUser(diff.notifications, userId);
|
|
||||||
assert.equal(
|
|
||||||
nRows.length,
|
|
||||||
1,
|
|
||||||
`user ${userId} must have exactly 1 notifications row, got ${nRows.length}`,
|
|
||||||
);
|
|
||||||
const n = nRows[0];
|
|
||||||
assert.equal(n.type, "executive_meeting");
|
|
||||||
if (expected.relatedType !== undefined) {
|
|
||||||
assert.equal(n.relatedType, expected.relatedType);
|
|
||||||
}
|
|
||||||
if (expected.relatedId !== undefined) {
|
|
||||||
assert.equal(Number(n.relatedId), Number(expected.relatedId));
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
function assertActorExcluded(diff, actorId) {
|
|
||||||
assert.equal(
|
|
||||||
rowsForUser(diff.emn, actorId).length,
|
|
||||||
0,
|
|
||||||
`actor ${actorId} must NOT receive an executive_meeting_notifications row`,
|
|
||||||
);
|
|
||||||
assert.equal(
|
|
||||||
rowsForUser(diff.notifications, actorId).length,
|
|
||||||
0,
|
|
||||||
`actor ${actorId} must NOT receive a notifications row`,
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
async function expectSocketEventsFor(
|
|
||||||
userSocks,
|
|
||||||
notificationType,
|
|
||||||
meetingId,
|
|
||||||
{ expectExactlyOne = false } = {},
|
|
||||||
) {
|
|
||||||
await waitFor(
|
|
||||||
() =>
|
|
||||||
userSocks.every((s) =>
|
|
||||||
s.events.created.some((p) => p.notificationType === notificationType),
|
|
||||||
) &&
|
|
||||||
userSocks.some((s) =>
|
|
||||||
s.events.changed.some(
|
|
||||||
(p) => p.notificationType === notificationType,
|
|
||||||
),
|
|
||||||
),
|
|
||||||
{ timeoutMs: 2000 },
|
|
||||||
);
|
|
||||||
// Give a brief grace window so any duplicate emission would also land
|
|
||||||
// before we count, otherwise the strict count check could pass by
|
|
||||||
// racing the second event.
|
|
||||||
if (expectExactlyOne) await waitMs(150);
|
|
||||||
for (const s of userSocks) {
|
|
||||||
const matches = s.events.created.filter(
|
|
||||||
(p) => p.notificationType === notificationType,
|
|
||||||
);
|
|
||||||
assert.ok(
|
|
||||||
matches.length >= 1,
|
|
||||||
`socket should have received notification_created for ${notificationType}`,
|
|
||||||
);
|
|
||||||
if (expectExactlyOne) {
|
|
||||||
assert.equal(
|
|
||||||
matches.length,
|
|
||||||
1,
|
|
||||||
`socket should have received exactly 1 notification_created for ${notificationType}, got ${matches.length}`,
|
|
||||||
);
|
|
||||||
}
|
|
||||||
const got = matches[0];
|
|
||||||
assert.equal(got.type, "executive_meeting");
|
|
||||||
if (meetingId !== undefined) {
|
|
||||||
assert.equal(got.meetingId, meetingId);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
const anyChanged = userSocks
|
|
||||||
.flatMap((s) => s.events.changed)
|
|
||||||
.find((p) => p.notificationType === notificationType);
|
|
||||||
assert.ok(
|
|
||||||
anyChanged,
|
|
||||||
`executive_meeting_notifications_changed must fire for ${notificationType}`,
|
|
||||||
);
|
|
||||||
if (meetingId !== undefined) {
|
|
||||||
assert.equal(anyChanged.meetingId, meetingId);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
function expectNoSocketEventFor(sock, notificationType) {
|
|
||||||
const offending = sock.events.created.find(
|
|
||||||
(p) => p.notificationType === notificationType,
|
|
||||||
);
|
|
||||||
assert.equal(
|
|
||||||
offending,
|
|
||||||
undefined,
|
|
||||||
`socket should NOT have received notification_created for ${notificationType}`,
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
test("meeting_created: fan-out excludes actor, dedupes direct+group, writes both tables, emits sockets", async () => {
|
|
||||||
for (const s of [approver1Sock, approver2Sock, coord1Sock, coord2Sock]) {
|
|
||||||
clearSocketEvents(s);
|
|
||||||
}
|
|
||||||
const before = await snapshotMaxIds();
|
|
||||||
|
|
||||||
const create = await api(adminCookie, "POST", "/api/executive-meetings", {
|
|
||||||
titleAr: "اجتماع إخطارات",
|
|
||||||
titleEn: "Notif fan-out meeting",
|
|
||||||
meetingDate: today,
|
|
||||||
attendees: [],
|
|
||||||
});
|
|
||||||
assert.equal(create.status, 201);
|
|
||||||
const meeting = await create.json();
|
|
||||||
created.meetingIds.push(meeting.id);
|
|
||||||
|
|
||||||
await waitFor(
|
|
||||||
() =>
|
|
||||||
approver1Sock.events.created.some(
|
|
||||||
(p) => p.notificationType === "meeting_created",
|
|
||||||
) &&
|
|
||||||
approver2Sock.events.created.some(
|
|
||||||
(p) => p.notificationType === "meeting_created",
|
|
||||||
),
|
|
||||||
{ timeoutMs: 2000 },
|
|
||||||
);
|
|
||||||
|
|
||||||
const diff = scopeDiff(await newRowsAfter(before), {
|
|
||||||
notificationType: "meeting_created",
|
|
||||||
meetingId: meeting.id,
|
|
||||||
relatedType: "executive_meeting",
|
|
||||||
relatedId: meeting.id,
|
|
||||||
});
|
|
||||||
|
|
||||||
assertRecipientGotOneOfEach(diff, approver1.id, {
|
|
||||||
notificationType: "meeting_created",
|
|
||||||
meetingId: meeting.id,
|
|
||||||
relatedType: "executive_meeting",
|
|
||||||
relatedId: meeting.id,
|
|
||||||
});
|
|
||||||
assertRecipientGotOneOfEach(diff, approver2.id, {
|
|
||||||
notificationType: "meeting_created",
|
|
||||||
meetingId: meeting.id,
|
|
||||||
relatedType: "executive_meeting",
|
|
||||||
relatedId: meeting.id,
|
|
||||||
});
|
|
||||||
assertActorExcluded(diff, adminUserId);
|
|
||||||
|
|
||||||
await expectSocketEventsFor(
|
|
||||||
[approver1Sock, approver2Sock],
|
|
||||||
"meeting_created",
|
|
||||||
meeting.id,
|
|
||||||
{ expectExactlyOne: true },
|
|
||||||
);
|
|
||||||
expectNoSocketEventFor(coord1Sock, "meeting_created");
|
|
||||||
expectNoSocketEventFor(coord2Sock, "meeting_created");
|
|
||||||
});
|
|
||||||
|
|
||||||
|
|
||||||
// #238: opt-out coverage for filterRecipientsByNotificationPref. The HTTP
|
|
||||||
// surface gives us black-box access — set a pref row, trigger the event,
|
|
||||||
// assert delivery (or non-delivery) at the EMN + notifications + socket
|
|
||||||
// layer. Each test owns its own pref row(s) and cleans them up so the
|
|
||||||
// suite stays order-independent.
|
|
||||||
async function setPref(userId, notificationType, { inApp, email }) {
|
|
||||||
await pool.query(
|
|
||||||
`INSERT INTO executive_meeting_notification_prefs
|
|
||||||
(user_id, notification_type, in_app, email)
|
|
||||||
VALUES ($1, $2, $3, $4)
|
|
||||||
ON CONFLICT (user_id, notification_type)
|
|
||||||
DO UPDATE SET in_app = EXCLUDED.in_app, email = EXCLUDED.email`,
|
|
||||||
[userId, notificationType, inApp, email],
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
async function clearPref(userId, notificationType) {
|
|
||||||
await pool.query(
|
|
||||||
`DELETE FROM executive_meeting_notification_prefs
|
|
||||||
WHERE user_id = $1 AND notification_type = $2`,
|
|
||||||
[userId, notificationType],
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
test("pref opt-out: inApp=false drops the user from in-app fan-out (others unaffected)", async () => {
|
|
||||||
await setPref(approver1.id, "meeting_created", { inApp: false, email: true });
|
|
||||||
try {
|
|
||||||
for (const s of [approver1Sock, approver2Sock]) clearSocketEvents(s);
|
|
||||||
const before = await snapshotMaxIds();
|
|
||||||
|
|
||||||
const create = await api(adminCookie, "POST", "/api/executive-meetings", {
|
|
||||||
titleAr: "اختبار تعطيل",
|
|
||||||
titleEn: "Opt-out fan-out",
|
|
||||||
meetingDate: today,
|
|
||||||
attendees: [],
|
|
||||||
});
|
|
||||||
assert.equal(create.status, 201);
|
|
||||||
const meeting = await create.json();
|
|
||||||
created.meetingIds.push(meeting.id);
|
|
||||||
|
|
||||||
// Wait for approver2 (default-on) so we know fan-out completed before
|
|
||||||
// checking that approver1 was dropped.
|
|
||||||
await waitFor(
|
|
||||||
() =>
|
|
||||||
approver2Sock.events.created.some(
|
|
||||||
(p) => p.notificationType === "meeting_created",
|
|
||||||
),
|
|
||||||
{ timeoutMs: 2000 },
|
|
||||||
);
|
|
||||||
|
|
||||||
const diff = scopeDiff(await newRowsAfter(before), {
|
|
||||||
notificationType: "meeting_created",
|
|
||||||
meetingId: meeting.id,
|
|
||||||
relatedType: "executive_meeting",
|
|
||||||
relatedId: meeting.id,
|
|
||||||
});
|
|
||||||
|
|
||||||
assert.equal(
|
|
||||||
rowsForUser(diff.emn, approver1.id).length,
|
|
||||||
0,
|
|
||||||
"opted-out user must NOT get an executive_meeting_notifications row",
|
|
||||||
);
|
|
||||||
assert.equal(
|
|
||||||
rowsForUser(diff.notifications, approver1.id).length,
|
|
||||||
0,
|
|
||||||
"opted-out user must NOT get a notifications row",
|
|
||||||
);
|
|
||||||
assertRecipientGotOneOfEach(diff, approver2.id, {
|
|
||||||
notificationType: "meeting_created",
|
|
||||||
meetingId: meeting.id,
|
|
||||||
relatedType: "executive_meeting",
|
|
||||||
relatedId: meeting.id,
|
|
||||||
});
|
|
||||||
expectNoSocketEventFor(approver1Sock, "meeting_created");
|
|
||||||
} finally {
|
|
||||||
await clearPref(approver1.id, "meeting_created");
|
|
||||||
}
|
|
||||||
});
|
|
||||||
|
|
||||||
test("pref opt-out: missing pref row defaults to ON (user receives delivery)", async () => {
|
|
||||||
// No setPref call — approver1 has no row at all for this event type.
|
|
||||||
// This is the implicit default-on case. Assert it explicitly so a
|
|
||||||
// future regression (e.g. flipping the default to off) is caught.
|
|
||||||
await pool.query(
|
|
||||||
`DELETE FROM executive_meeting_notification_prefs
|
|
||||||
WHERE user_id = $1 AND notification_type = $2`,
|
|
||||||
[approver1.id, "meeting_created"],
|
|
||||||
);
|
|
||||||
|
|
||||||
for (const s of [approver1Sock, approver2Sock]) clearSocketEvents(s);
|
|
||||||
const before = await snapshotMaxIds();
|
|
||||||
|
|
||||||
const create = await api(adminCookie, "POST", "/api/executive-meetings", {
|
|
||||||
titleAr: "افتراضي مفعل",
|
|
||||||
titleEn: "Default-on fan-out",
|
|
||||||
meetingDate: today,
|
|
||||||
attendees: [],
|
|
||||||
});
|
|
||||||
assert.equal(create.status, 201);
|
|
||||||
const meeting = await create.json();
|
|
||||||
created.meetingIds.push(meeting.id);
|
|
||||||
|
|
||||||
await waitFor(
|
|
||||||
() =>
|
|
||||||
approver1Sock.events.created.some(
|
|
||||||
(p) => p.notificationType === "meeting_created",
|
|
||||||
),
|
|
||||||
{ timeoutMs: 2000 },
|
|
||||||
);
|
|
||||||
|
|
||||||
const diff = scopeDiff(await newRowsAfter(before), {
|
|
||||||
notificationType: "meeting_created",
|
|
||||||
meetingId: meeting.id,
|
|
||||||
relatedType: "executive_meeting",
|
|
||||||
relatedId: meeting.id,
|
|
||||||
});
|
|
||||||
assertRecipientGotOneOfEach(diff, approver1.id, {
|
|
||||||
notificationType: "meeting_created",
|
|
||||||
meetingId: meeting.id,
|
|
||||||
relatedType: "executive_meeting",
|
|
||||||
relatedId: meeting.id,
|
|
||||||
});
|
|
||||||
});
|
|
||||||
|
|
||||||
test("pref opt-out: email=false does NOT affect the in-app channel", async () => {
|
|
||||||
// Channel independence — muting email must leave in-app delivery alone.
|
|
||||||
await setPref(approver1.id, "meeting_created", { inApp: true, email: false });
|
|
||||||
try {
|
|
||||||
for (const s of [approver1Sock, approver2Sock]) clearSocketEvents(s);
|
|
||||||
const before = await snapshotMaxIds();
|
|
||||||
|
|
||||||
const create = await api(adminCookie, "POST", "/api/executive-meetings", {
|
|
||||||
titleAr: "قناة منفصلة",
|
|
||||||
titleEn: "Channel independence",
|
|
||||||
meetingDate: today,
|
|
||||||
attendees: [],
|
|
||||||
});
|
|
||||||
assert.equal(create.status, 201);
|
|
||||||
const meeting = await create.json();
|
|
||||||
created.meetingIds.push(meeting.id);
|
|
||||||
|
|
||||||
await waitFor(
|
|
||||||
() =>
|
|
||||||
approver1Sock.events.created.some(
|
|
||||||
(p) => p.notificationType === "meeting_created",
|
|
||||||
),
|
|
||||||
{ timeoutMs: 2000 },
|
|
||||||
);
|
|
||||||
|
|
||||||
const diff = scopeDiff(await newRowsAfter(before), {
|
|
||||||
notificationType: "meeting_created",
|
|
||||||
meetingId: meeting.id,
|
|
||||||
relatedType: "executive_meeting",
|
|
||||||
relatedId: meeting.id,
|
|
||||||
});
|
|
||||||
assertRecipientGotOneOfEach(diff, approver1.id, {
|
|
||||||
notificationType: "meeting_created",
|
|
||||||
meetingId: meeting.id,
|
|
||||||
relatedType: "executive_meeting",
|
|
||||||
relatedId: meeting.id,
|
|
||||||
});
|
|
||||||
} finally {
|
|
||||||
await clearPref(approver1.id, "meeting_created");
|
|
||||||
}
|
|
||||||
});
|
|
||||||
@@ -1,330 +0,0 @@
|
|||||||
import { test, after, before } from "node:test";
|
|
||||||
import assert from "node:assert/strict";
|
|
||||||
import pg from "pg";
|
|
||||||
|
|
||||||
// IMPORTANT: this file mutates shared tables (system_settings, user_roles)
|
|
||||||
// during snapshot/restore. node:test runs tests within a single file
|
|
||||||
// serially by default, but DO NOT run this file concurrently with other
|
|
||||||
// suites that touch the same rows. The repository-level `test` workflow
|
|
||||||
// runs api-server tests as one `node --test 'tests/**/*.test.mjs'` invocation
|
|
||||||
// which executes files in parallel — keep this file in its own logical
|
|
||||||
// group (already enforced by the snapshot/restore around every assertion)
|
|
||||||
// or migrate to a dedicated test schema if you add adjacent suites that
|
|
||||||
// also touch system_settings.
|
|
||||||
const API_BASE = process.env.TEST_API_BASE ?? "http://localhost:8080";
|
|
||||||
const DATABASE_URL = process.env.DATABASE_URL;
|
|
||||||
if (!DATABASE_URL) throw new Error("DATABASE_URL must be set to run these tests");
|
|
||||||
|
|
||||||
const pool = new pg.Pool({ connectionString: DATABASE_URL });
|
|
||||||
|
|
||||||
// ----- snapshot + restore helpers -------------------------------------------------
|
|
||||||
// The setup-wizard test needs to run against a DB that has NO admin and
|
|
||||||
// `system_settings.installed=false`. The shared dev DB already has both
|
|
||||||
// (seed runs at boot), so we snapshot the relevant rows, blank them
|
|
||||||
// out, run the test, then restore exactly what was there.
|
|
||||||
let snapshot = {
|
|
||||||
systemSettings: null,
|
|
||||||
adminUserIds: [],
|
|
||||||
adminUserRoleRows: [],
|
|
||||||
createdUsernames: [],
|
|
||||||
};
|
|
||||||
|
|
||||||
const TEST_USERNAME = `setupwiz_${Date.now().toString(36)}_${Math.random()
|
|
||||||
.toString(36)
|
|
||||||
.slice(2, 8)}`;
|
|
||||||
const TEST_EMAIL = `${TEST_USERNAME}@tx.local`;
|
|
||||||
|
|
||||||
before(async () => {
|
|
||||||
// Snapshot system_settings.
|
|
||||||
const sysRow = await pool.query("SELECT * FROM system_settings WHERE id = 1");
|
|
||||||
snapshot.systemSettings = sysRow.rows[0] ?? null;
|
|
||||||
|
|
||||||
// Snapshot every user with the admin role + their user_roles edges.
|
|
||||||
const adminRow = await pool.query(
|
|
||||||
"SELECT id FROM roles WHERE name = 'admin' LIMIT 1",
|
|
||||||
);
|
|
||||||
if (adminRow.rowCount === 0) {
|
|
||||||
throw new Error("admin role missing in DB — seed first");
|
|
||||||
}
|
|
||||||
const adminRoleId = adminRow.rows[0].id;
|
|
||||||
|
|
||||||
const adminUsers = await pool.query(
|
|
||||||
`SELECT u.id FROM users u
|
|
||||||
JOIN user_roles ur ON ur.user_id = u.id
|
|
||||||
WHERE ur.role_id = $1`,
|
|
||||||
[adminRoleId],
|
|
||||||
);
|
|
||||||
snapshot.adminUserIds = adminUsers.rows.map((r) => r.id);
|
|
||||||
|
|
||||||
// Detach admin role from those users so the open-setup gate kicks in.
|
|
||||||
if (snapshot.adminUserIds.length > 0) {
|
|
||||||
const detached = await pool.query(
|
|
||||||
`DELETE FROM user_roles WHERE role_id = $1 AND user_id = ANY($2::int[])
|
|
||||||
RETURNING user_id, role_id`,
|
|
||||||
[adminRoleId, snapshot.adminUserIds],
|
|
||||||
);
|
|
||||||
snapshot.adminUserRoleRows = detached.rows;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Wipe install flag so the wizard treats this as a fresh install.
|
|
||||||
await pool.query("DELETE FROM system_settings WHERE id = 1");
|
|
||||||
});
|
|
||||||
|
|
||||||
after(async () => {
|
|
||||||
// Remove any user the test created.
|
|
||||||
if (snapshot.createdUsernames.length > 0) {
|
|
||||||
await pool.query(
|
|
||||||
"DELETE FROM user_roles WHERE user_id IN (SELECT id FROM users WHERE username = ANY($1::text[]))",
|
|
||||||
[snapshot.createdUsernames],
|
|
||||||
);
|
|
||||||
await pool.query(
|
|
||||||
"DELETE FROM user_groups WHERE user_id IN (SELECT id FROM users WHERE username = ANY($1::text[]))",
|
|
||||||
[snapshot.createdUsernames],
|
|
||||||
);
|
|
||||||
await pool.query("DELETE FROM users WHERE username = ANY($1::text[])", [
|
|
||||||
snapshot.createdUsernames,
|
|
||||||
]);
|
|
||||||
}
|
|
||||||
|
|
||||||
// Restore system_settings to its pre-test state.
|
|
||||||
await pool.query("DELETE FROM system_settings WHERE id = 1");
|
|
||||||
if (snapshot.systemSettings) {
|
|
||||||
const r = snapshot.systemSettings;
|
|
||||||
await pool.query(
|
|
||||||
`INSERT INTO system_settings
|
|
||||||
(id, installed, installed_at, base_url, local_domain, local_ip, https_mode, app_version, updated_at)
|
|
||||||
VALUES (1, $1, $2, $3, $4, $5, $6, $7, $8)`,
|
|
||||||
[
|
|
||||||
r.installed,
|
|
||||||
r.installed_at,
|
|
||||||
r.base_url,
|
|
||||||
r.local_domain,
|
|
||||||
r.local_ip,
|
|
||||||
r.https_mode,
|
|
||||||
r.app_version,
|
|
||||||
r.updated_at,
|
|
||||||
],
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
// Re-attach the admin role to the original admin users.
|
|
||||||
if (snapshot.adminUserRoleRows.length > 0) {
|
|
||||||
for (const row of snapshot.adminUserRoleRows) {
|
|
||||||
await pool.query(
|
|
||||||
`INSERT INTO user_roles (user_id, role_id) VALUES ($1, $2)
|
|
||||||
ON CONFLICT DO NOTHING`,
|
|
||||||
[row.user_id, row.role_id],
|
|
||||||
);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
await pool.end();
|
|
||||||
});
|
|
||||||
|
|
||||||
test("GET /api/setup/status reports setupRequired=true on a fresh DB", async () => {
|
|
||||||
const res = await fetch(`${API_BASE}/api/setup/status`);
|
|
||||||
assert.equal(res.status, 200);
|
|
||||||
const body = await res.json();
|
|
||||||
assert.equal(body.installed, false);
|
|
||||||
assert.equal(body.setupRequired, true);
|
|
||||||
assert.equal(body.checks.db, "ok");
|
|
||||||
assert.ok(typeof body.appVersion === "string");
|
|
||||||
});
|
|
||||||
|
|
||||||
test("POST /api/setup/validate returns ok for a clean payload", async () => {
|
|
||||||
const res = await fetch(`${API_BASE}/api/setup/validate`, {
|
|
||||||
method: "POST",
|
|
||||||
headers: { "Content-Type": "application/json" },
|
|
||||||
body: JSON.stringify({
|
|
||||||
admin: {
|
|
||||||
username: TEST_USERNAME,
|
|
||||||
email: TEST_EMAIL,
|
|
||||||
password: "ValidPass123!",
|
|
||||||
},
|
|
||||||
}),
|
|
||||||
});
|
|
||||||
assert.equal(res.status, 200);
|
|
||||||
const body = await res.json();
|
|
||||||
assert.equal(body.ok, true);
|
|
||||||
});
|
|
||||||
|
|
||||||
test("POST /api/setup/validate returns 400 + per-field errors for invalid input", async () => {
|
|
||||||
const res = await fetch(`${API_BASE}/api/setup/validate`, {
|
|
||||||
method: "POST",
|
|
||||||
headers: { "Content-Type": "application/json" },
|
|
||||||
body: JSON.stringify({
|
|
||||||
admin: { username: "x", email: "not-an-email", password: "short" },
|
|
||||||
}),
|
|
||||||
});
|
|
||||||
assert.equal(res.status, 400);
|
|
||||||
const body = await res.json();
|
|
||||||
assert.equal(body.ok, false);
|
|
||||||
assert.ok(body.errors);
|
|
||||||
});
|
|
||||||
|
|
||||||
test("POST /api/setup/complete creates the admin and flips installed", async () => {
|
|
||||||
const res = await fetch(`${API_BASE}/api/setup/complete`, {
|
|
||||||
method: "POST",
|
|
||||||
headers: { "Content-Type": "application/json" },
|
|
||||||
body: JSON.stringify({
|
|
||||||
admin: {
|
|
||||||
username: TEST_USERNAME,
|
|
||||||
email: TEST_EMAIL,
|
|
||||||
password: "ValidPass123!",
|
|
||||||
displayNameEn: "Wizard Test Admin",
|
|
||||||
},
|
|
||||||
baseUrl: "https://tx.test.local",
|
|
||||||
localDomain: "tx.test.local",
|
|
||||||
localIp: "192.0.2.42",
|
|
||||||
httpsMode: "local",
|
|
||||||
}),
|
|
||||||
});
|
|
||||||
assert.equal(res.status, 200);
|
|
||||||
const body = await res.json();
|
|
||||||
assert.equal(body.ok, true);
|
|
||||||
snapshot.createdUsernames.push(TEST_USERNAME);
|
|
||||||
|
|
||||||
// Verify directly in DB.
|
|
||||||
const userRow = await pool.query(
|
|
||||||
"SELECT id FROM users WHERE username = $1",
|
|
||||||
[TEST_USERNAME],
|
|
||||||
);
|
|
||||||
assert.equal(userRow.rowCount, 1);
|
|
||||||
const newId = userRow.rows[0].id;
|
|
||||||
|
|
||||||
const roleRow = await pool.query(
|
|
||||||
`SELECT 1 FROM user_roles ur
|
|
||||||
JOIN roles r ON r.id = ur.role_id
|
|
||||||
WHERE ur.user_id = $1 AND r.name = 'admin'`,
|
|
||||||
[newId],
|
|
||||||
);
|
|
||||||
assert.equal(roleRow.rowCount, 1);
|
|
||||||
|
|
||||||
const sys = await pool.query("SELECT * FROM system_settings WHERE id = 1");
|
|
||||||
assert.equal(sys.rows[0].installed, true);
|
|
||||||
assert.equal(sys.rows[0].local_domain, "tx.test.local");
|
|
||||||
assert.equal(sys.rows[0].https_mode, "local");
|
|
||||||
assert.ok(sys.rows[0].installed_at);
|
|
||||||
});
|
|
||||||
|
|
||||||
test("Second POST /api/setup/complete returns 409 already_installed", async () => {
|
|
||||||
const res = await fetch(`${API_BASE}/api/setup/complete`, {
|
|
||||||
method: "POST",
|
|
||||||
headers: { "Content-Type": "application/json" },
|
|
||||||
body: JSON.stringify({
|
|
||||||
admin: {
|
|
||||||
username: `${TEST_USERNAME}_again`,
|
|
||||||
email: `${TEST_USERNAME}_again@tx.local`,
|
|
||||||
password: "ValidPass123!",
|
|
||||||
},
|
|
||||||
}),
|
|
||||||
});
|
|
||||||
assert.equal(res.status, 409);
|
|
||||||
const body = await res.json();
|
|
||||||
assert.equal(body.error, "already_installed");
|
|
||||||
});
|
|
||||||
|
|
||||||
test("POST /api/setup/validate returns 409 once installed", async () => {
|
|
||||||
const res = await fetch(`${API_BASE}/api/setup/validate`, {
|
|
||||||
method: "POST",
|
|
||||||
headers: { "Content-Type": "application/json" },
|
|
||||||
body: JSON.stringify({
|
|
||||||
admin: {
|
|
||||||
username: "ignored",
|
|
||||||
email: "ignored@tx.local",
|
|
||||||
password: "ValidPass123!",
|
|
||||||
},
|
|
||||||
}),
|
|
||||||
});
|
|
||||||
assert.equal(res.status, 409);
|
|
||||||
});
|
|
||||||
|
|
||||||
test("GET /api/setup/status reports setupRequired=false after install", async () => {
|
|
||||||
const res = await fetch(`${API_BASE}/api/setup/status`);
|
|
||||||
assert.equal(res.status, 200);
|
|
||||||
const body = await res.json();
|
|
||||||
assert.equal(body.installed, true);
|
|
||||||
assert.equal(body.setupRequired, false);
|
|
||||||
});
|
|
||||||
|
|
||||||
// Contract test for redirectIfSetupNeeded(): Stage 2 SPA routing depends on
|
|
||||||
// this helper returning a {shouldRedirect, target, status} shape with a
|
|
||||||
// /setup target only when setup is open. Asserted via /api/setup/status
|
|
||||||
// since the helper is the source of truth for that response.
|
|
||||||
test("redirectIfSetupNeeded contract: shouldRedirect=false post-install", async () => {
|
|
||||||
// We're past the "complete" test, so installed=true. Status must reflect
|
|
||||||
// that setup is closed; Stage 2's hook reads the same payload.
|
|
||||||
const res = await fetch(`${API_BASE}/api/setup/status`);
|
|
||||||
assert.equal(res.status, 200);
|
|
||||||
const body = await res.json();
|
|
||||||
assert.equal(body.installed, true);
|
|
||||||
assert.equal(body.setupRequired, false);
|
|
||||||
// The redirect-decision contract: shouldRedirect MUST be false whenever
|
|
||||||
// installed=true OR setupRequired=false. Stage 2's hook must mirror this.
|
|
||||||
const shouldRedirect =
|
|
||||||
body.checks.db === "ok" && !body.installed && body.setupRequired;
|
|
||||||
assert.equal(shouldRedirect, false);
|
|
||||||
});
|
|
||||||
|
|
||||||
// Regression: scripts/src/seed.ts inserts a bootstrap (id=1, installed=false)
|
|
||||||
// row early. The seeded-admin branch later flips installed=true. The flip
|
|
||||||
// MUST be a DO UPDATE — a DO NOTHING would silently leave installed=false
|
|
||||||
// because the row already exists. This test exercises the same SQL the
|
|
||||||
// seed uses so a future refactor cannot regress that behavior.
|
|
||||||
test("seed flip from installed=false to installed=true uses DO UPDATE", async () => {
|
|
||||||
// Save current row to restore at the end so we don't disturb other tests.
|
|
||||||
const before = await pool.query("SELECT * FROM system_settings WHERE id = 1");
|
|
||||||
const beforeRow = before.rows[0] ?? null;
|
|
||||||
|
|
||||||
// Step 1: bootstrap insert (mirrors seed lines 123-126).
|
|
||||||
await pool.query(
|
|
||||||
`INSERT INTO system_settings (id, installed) VALUES (1, false)
|
|
||||||
ON CONFLICT (id) DO UPDATE SET installed = false, installed_at = NULL`,
|
|
||||||
);
|
|
||||||
const mid = await pool.query(
|
|
||||||
"SELECT installed FROM system_settings WHERE id = 1",
|
|
||||||
);
|
|
||||||
assert.equal(mid.rows[0].installed, false, "bootstrap should leave installed=false");
|
|
||||||
|
|
||||||
// Step 2: seeded-admin branch flip (mirrors seed lines 217-227).
|
|
||||||
await pool.query(
|
|
||||||
`INSERT INTO system_settings (id, installed, installed_at)
|
|
||||||
VALUES (1, true, NOW())
|
|
||||||
ON CONFLICT (id) DO UPDATE SET
|
|
||||||
installed = true,
|
|
||||||
installed_at = COALESCE(system_settings.installed_at, NOW()),
|
|
||||||
updated_at = NOW()`,
|
|
||||||
);
|
|
||||||
const after = await pool.query(
|
|
||||||
"SELECT installed, installed_at FROM system_settings WHERE id = 1",
|
|
||||||
);
|
|
||||||
assert.equal(after.rows[0].installed, true, "seed flip must set installed=true");
|
|
||||||
assert.ok(after.rows[0].installed_at !== null, "installed_at must be set");
|
|
||||||
|
|
||||||
// Restore.
|
|
||||||
if (beforeRow) {
|
|
||||||
await pool.query(
|
|
||||||
`INSERT INTO system_settings (id, installed, installed_at, base_url, local_domain, local_ip, https_mode, app_version, updated_at)
|
|
||||||
VALUES (1, $1, $2, $3, $4, $5, $6, $7, $8)
|
|
||||||
ON CONFLICT (id) DO UPDATE SET
|
|
||||||
installed = EXCLUDED.installed,
|
|
||||||
installed_at = EXCLUDED.installed_at,
|
|
||||||
base_url = EXCLUDED.base_url,
|
|
||||||
local_domain = EXCLUDED.local_domain,
|
|
||||||
local_ip = EXCLUDED.local_ip,
|
|
||||||
https_mode = EXCLUDED.https_mode,
|
|
||||||
app_version = EXCLUDED.app_version,
|
|
||||||
updated_at = EXCLUDED.updated_at`,
|
|
||||||
[
|
|
||||||
beforeRow.installed,
|
|
||||||
beforeRow.installed_at,
|
|
||||||
beforeRow.base_url,
|
|
||||||
beforeRow.local_domain,
|
|
||||||
beforeRow.local_ip,
|
|
||||||
beforeRow.https_mode,
|
|
||||||
beforeRow.app_version,
|
|
||||||
beforeRow.updated_at,
|
|
||||||
],
|
|
||||||
);
|
|
||||||
}
|
|
||||||
});
|
|
||||||
@@ -24,6 +24,7 @@ if (typeof document !== "undefined" && document.fonts?.load) {
|
|||||||
if (
|
if (
|
||||||
typeof window !== "undefined" &&
|
typeof window !== "undefined" &&
|
||||||
"serviceWorker" in navigator &&
|
"serviceWorker" in navigator &&
|
||||||
|
"PushManager" in window &&
|
||||||
window.isSecureContext
|
window.isSecureContext
|
||||||
) {
|
) {
|
||||||
const base = import.meta.env.BASE_URL.endsWith("/")
|
const base = import.meta.env.BASE_URL.endsWith("/")
|
||||||
|
|||||||
Reference in New Issue
Block a user