riyadhafraa
675fef47f1
T1 (audit-action rename in #93): - Updated the user force-delete test to look up audit_logs by action = ANY(['user.delete', 'user.force_delete']). - Updated the app force-delete test to look up audit_logs by action = ANY(['app.delete', 'app.force_delete']). - Used array-of-actions matchers (forward-compatible with the old name in case anything else still emits it). - The service force-delete test was left untouched because artifacts/api-server/src/routes/services.ts still emits 'service.force_delete' (only user/app/group were renamed in #93). T2 (services per-run uniqueness + defensive sweep): - Added module-level SVC_STAMP and SVC_PREFIX = `TestSvc_<stamp>_`. - Renamed the three services-test name_en literals to `${SVC_PREFIX}Clean`, `${SVC_PREFIX}Busy`, `${SVC_PREFIX}Force` so re-running the file no longer collides on services_name_en_unique. - Now pushes every created service id to createdServiceIds (clean + busy + force), not just busy. - Added a defensive sweep in after() that, after the tracked-id cleanup, deletes any leftover services whose name_en starts with SVC_PREFIX, plus their child rows in service_orders. This mirrors the apps-side sweep added in Task #116. Pre-existing pollution cleanup: - Removed the orphan rows left over from the failed 2026-04-28 test runs (services ids 166/168 = 'Clean Svc'/'Force Svc', user ids 4397/4889 = del_force_*) and their child rows. These predate the fix; removing them now keeps the workspace clean. Verification: - pnpm --filter @workspace/api-server node --test tests/delete-force-warnings.test.mjs: 9/9 PASS twice in a row. - Post-run sweep query: 0 leftover apps, 0 leftover services with the test prefixes, 0 leftover admin users. Out of scope (not touched): - Other test files in artifacts/api-server/tests/. - The audit-action rename itself (already merged in #93). - The wider failing `test` workflow — its other failures are unrelated to this file.
434 lines
14 KiB
JavaScript
434 lines
14 KiB
JavaScript
import { test, before, after } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import pg from "pg";
|
|
|
|
const API_BASE = process.env.TEST_API_BASE ?? "http://localhost:8080";
|
|
const DATABASE_URL = process.env.DATABASE_URL;
|
|
if (!DATABASE_URL) {
|
|
throw new Error("DATABASE_URL must be set to run these tests");
|
|
}
|
|
|
|
const TEST_PASSWORD = "TestPass123!";
|
|
const TEST_PASSWORD_HASH =
|
|
"$2b$10$Bs636ukPMyz01nKrsi.5m.JlDXSN22AVCvn8cgPWWDbo5yJRQX2vu";
|
|
|
|
const pool = new pg.Pool({ connectionString: DATABASE_URL });
|
|
|
|
const SVC_STAMP = `${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 6)}`;
|
|
const SVC_PREFIX = `TestSvc_${SVC_STAMP}_`;
|
|
|
|
let adminId;
|
|
let adminUsername;
|
|
let adminCookie;
|
|
let createdUserIds = [];
|
|
let createdAppIds = [];
|
|
let createdServiceIds = [];
|
|
let createdGroupIds = [];
|
|
|
|
async function loginAndGetCookie(username, password) {
|
|
const res = await fetch(`${API_BASE}/api/auth/login`, {
|
|
method: "POST",
|
|
headers: { "Content-Type": "application/json" },
|
|
body: JSON.stringify({ username, password }),
|
|
});
|
|
assert.equal(res.status, 200, `login expected 200, got ${res.status}`);
|
|
const setCookie = res.headers.get("set-cookie");
|
|
return setCookie
|
|
.split(",")
|
|
.map((c) => c.split(";")[0].trim())
|
|
.find((c) => c.startsWith("connect.sid="));
|
|
}
|
|
|
|
before(async () => {
|
|
const stamp = `${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 6)}`;
|
|
adminUsername = `del_admin_${stamp}`;
|
|
|
|
const a = await pool.query(
|
|
`INSERT INTO users (username, email, password_hash, display_name_en, preferred_language, is_active)
|
|
VALUES ($1, $2, $3, 'Delete Admin', 'en', true) RETURNING id`,
|
|
[adminUsername, `${adminUsername}@example.com`, TEST_PASSWORD_HASH],
|
|
);
|
|
adminId = a.rows[0].id;
|
|
await pool.query(
|
|
`INSERT INTO user_roles (user_id, role_id) SELECT $1, id FROM roles WHERE name = 'admin'`,
|
|
[adminId],
|
|
);
|
|
await pool.query(
|
|
`INSERT INTO user_groups (user_id, group_id)
|
|
SELECT $1, id FROM groups WHERE name IN ('Everyone', 'Admins')
|
|
ON CONFLICT DO NOTHING`,
|
|
[adminId],
|
|
);
|
|
|
|
adminCookie = await loginAndGetCookie(adminUsername, TEST_PASSWORD);
|
|
});
|
|
|
|
after(async () => {
|
|
if (createdServiceIds.length) {
|
|
await pool.query(
|
|
`DELETE FROM service_orders WHERE service_id = ANY($1::int[])`,
|
|
[createdServiceIds],
|
|
);
|
|
await pool.query(`DELETE FROM services WHERE id = ANY($1::int[])`, [
|
|
createdServiceIds,
|
|
]);
|
|
}
|
|
|
|
// Defensive sweep: kill any leftover services whose name_en matches the
|
|
// per-run test prefix, plus their child rows in service_orders. Mirrors
|
|
// the apps-side sweep added in Task #116.
|
|
const svcSweep = await pool.query(
|
|
`SELECT id FROM services WHERE name_en LIKE $1`,
|
|
[`${SVC_PREFIX}%`],
|
|
);
|
|
if (svcSweep.rowCount > 0) {
|
|
const svcIds = svcSweep.rows.map((r) => r.id);
|
|
await pool.query(
|
|
`DELETE FROM service_orders WHERE service_id = ANY($1::int[])`,
|
|
[svcIds],
|
|
);
|
|
await pool.query(`DELETE FROM services WHERE id = ANY($1::int[])`, [
|
|
svcIds,
|
|
]);
|
|
}
|
|
if (createdAppIds.length) {
|
|
await pool.query(`DELETE FROM app_opens WHERE app_id = ANY($1::int[])`, [
|
|
createdAppIds,
|
|
]);
|
|
await pool.query(
|
|
`DELETE FROM app_permissions WHERE app_id = ANY($1::int[])`,
|
|
[createdAppIds],
|
|
);
|
|
await pool.query(`DELETE FROM group_apps WHERE app_id = ANY($1::int[])`, [
|
|
createdAppIds,
|
|
]);
|
|
await pool.query(
|
|
`DELETE FROM user_app_orders WHERE app_id = ANY($1::int[])`,
|
|
[createdAppIds],
|
|
);
|
|
await pool.query(`DELETE FROM apps WHERE id = ANY($1::int[])`, [
|
|
createdAppIds,
|
|
]);
|
|
}
|
|
|
|
// Defensive sweep: kill any leftover apps whose slug matches a test prefix
|
|
// (clean_app_*, busy_app_*, force_app_*). This guards against the case
|
|
// where a test crashes between INSERT and the createdAppIds.push above.
|
|
const sweep = await pool.query(
|
|
`SELECT id FROM apps
|
|
WHERE slug LIKE 'clean_app_%'
|
|
OR slug LIKE 'busy_app_%'
|
|
OR slug LIKE 'force_app_%'`,
|
|
);
|
|
if (sweep.rowCount > 0) {
|
|
const ids = sweep.rows.map((r) => r.id);
|
|
await pool.query(`DELETE FROM app_opens WHERE app_id = ANY($1::int[])`, [ids]);
|
|
await pool.query(`DELETE FROM app_permissions WHERE app_id = ANY($1::int[])`, [ids]);
|
|
await pool.query(`DELETE FROM group_apps WHERE app_id = ANY($1::int[])`, [ids]);
|
|
await pool.query(`DELETE FROM user_app_orders WHERE app_id = ANY($1::int[])`, [ids]);
|
|
await pool.query(`DELETE FROM apps WHERE id = ANY($1::int[])`, [ids]);
|
|
}
|
|
if (createdGroupIds.length) {
|
|
await pool.query(`DELETE FROM group_apps WHERE group_id = ANY($1::int[])`, [
|
|
createdGroupIds,
|
|
]);
|
|
await pool.query(`DELETE FROM groups WHERE id = ANY($1::int[])`, [
|
|
createdGroupIds,
|
|
]);
|
|
}
|
|
for (const uid of [adminId, ...createdUserIds]) {
|
|
if (uid !== undefined) {
|
|
await pool.query(`DELETE FROM messages WHERE sender_id = $1`, [uid]);
|
|
await pool.query(`DELETE FROM conversations WHERE created_by = $1`, [
|
|
uid,
|
|
]);
|
|
await pool.query(`DELETE FROM notes WHERE user_id = $1`, [uid]);
|
|
await pool.query(`DELETE FROM service_orders WHERE user_id = $1`, [uid]);
|
|
await pool.query(`DELETE FROM user_groups WHERE user_id = $1`, [uid]);
|
|
await pool.query(`DELETE FROM user_roles WHERE user_id = $1`, [uid]);
|
|
await pool.query(`DELETE FROM users WHERE id = $1`, [uid]);
|
|
}
|
|
}
|
|
await pool.end();
|
|
});
|
|
|
|
// ---------- Users ----------
|
|
|
|
test("DELETE /api/users/:id without dependents succeeds (no force needed)", async () => {
|
|
const username = `del_clean_${Date.now().toString(36)}`;
|
|
const r = await pool.query(
|
|
`INSERT INTO users (username, email, password_hash, display_name_en, preferred_language, is_active)
|
|
VALUES ($1, $2, $3, 'Clean User', 'en', true) RETURNING id`,
|
|
[username, `${username}@example.com`, TEST_PASSWORD_HASH],
|
|
);
|
|
const uid = r.rows[0].id;
|
|
|
|
const res = await fetch(`${API_BASE}/api/users/${uid}`, {
|
|
method: "DELETE",
|
|
headers: { Cookie: adminCookie },
|
|
});
|
|
assert.equal(res.status, 204);
|
|
|
|
const check = await pool.query(`SELECT id FROM users WHERE id = $1`, [uid]);
|
|
assert.equal(check.rowCount, 0);
|
|
});
|
|
|
|
test("DELETE /api/users/:id with dependents returns 409 with counts", async () => {
|
|
const username = `del_busy_${Date.now().toString(36)}`;
|
|
const r = await pool.query(
|
|
`INSERT INTO users (username, email, password_hash, display_name_en, preferred_language, is_active)
|
|
VALUES ($1, $2, $3, 'Busy User', 'en', true) RETURNING id`,
|
|
[username, `${username}@example.com`, TEST_PASSWORD_HASH],
|
|
);
|
|
const uid = r.rows[0].id;
|
|
createdUserIds.push(uid);
|
|
|
|
await pool.query(
|
|
`INSERT INTO notes (user_id, title, content) VALUES ($1, 'Note A', 'x'), ($1, 'Note B', 'y')`,
|
|
[uid],
|
|
);
|
|
const conv = await pool.query(
|
|
`INSERT INTO conversations (created_by, name_en, is_group) VALUES ($1, 'Test Conv', true) RETURNING id`,
|
|
[uid],
|
|
);
|
|
const convId = conv.rows[0].id;
|
|
await pool.query(
|
|
`INSERT INTO messages (conversation_id, sender_id, content) VALUES ($1, $2, 'hello')`,
|
|
[convId, uid],
|
|
);
|
|
|
|
const res = await fetch(`${API_BASE}/api/users/${uid}`, {
|
|
method: "DELETE",
|
|
headers: { Cookie: adminCookie },
|
|
});
|
|
assert.equal(res.status, 409);
|
|
const body = await res.json();
|
|
assert.equal(body.noteCount, 2);
|
|
assert.equal(body.conversationCount, 1);
|
|
assert.equal(body.messageCount, 1);
|
|
|
|
const stillThere = await pool.query(`SELECT id FROM users WHERE id = $1`, [
|
|
uid,
|
|
]);
|
|
assert.equal(stillThere.rowCount, 1);
|
|
});
|
|
|
|
test("DELETE /api/users/:id?force=true deletes user and writes audit log", async () => {
|
|
const username = `del_force_${Date.now().toString(36)}`;
|
|
const r = await pool.query(
|
|
`INSERT INTO users (username, email, password_hash, display_name_en, preferred_language, is_active)
|
|
VALUES ($1, $2, $3, 'Force User', 'en', true) RETURNING id`,
|
|
[username, `${username}@example.com`, TEST_PASSWORD_HASH],
|
|
);
|
|
const uid = r.rows[0].id;
|
|
|
|
await pool.query(`INSERT INTO notes (user_id, title) VALUES ($1, 'n')`, [
|
|
uid,
|
|
]);
|
|
const conv = await pool.query(
|
|
`INSERT INTO conversations (created_by, name_en, is_group) VALUES ($1, 'Conv', true) RETURNING id`,
|
|
[uid],
|
|
);
|
|
await pool.query(
|
|
`INSERT INTO messages (conversation_id, sender_id, content) VALUES ($1, $2, 'hi')`,
|
|
[conv.rows[0].id, uid],
|
|
);
|
|
|
|
const res = await fetch(`${API_BASE}/api/users/${uid}?force=true`, {
|
|
method: "DELETE",
|
|
headers: { Cookie: adminCookie },
|
|
});
|
|
assert.equal(res.status, 204);
|
|
|
|
const check = await pool.query(`SELECT id FROM users WHERE id = $1`, [uid]);
|
|
assert.equal(check.rowCount, 0);
|
|
|
|
const audit = await pool.query(
|
|
`SELECT * FROM audit_logs WHERE action = ANY($1) AND target_id = $2`,
|
|
[["user.delete", "user.force_delete"], uid],
|
|
);
|
|
assert.equal(audit.rowCount, 1);
|
|
assert.equal(audit.rows[0].actor_user_id, adminId);
|
|
});
|
|
|
|
// ---------- Apps ----------
|
|
|
|
test("DELETE /api/apps/:id without dependents succeeds (no force needed)", async () => {
|
|
const slug = `clean_app_${Date.now().toString(36)}`;
|
|
const a = await pool.query(
|
|
`INSERT INTO apps (slug, name_ar, name_en, route, sort_order)
|
|
VALUES ($1, 'تطبيق', 'App Clean', '/x', 999) RETURNING id`,
|
|
[slug],
|
|
);
|
|
const id = a.rows[0].id;
|
|
createdAppIds.push(id);
|
|
|
|
const res = await fetch(`${API_BASE}/api/apps/${id}`, {
|
|
method: "DELETE",
|
|
headers: { Cookie: adminCookie },
|
|
});
|
|
assert.equal(res.status, 204);
|
|
});
|
|
|
|
test("DELETE /api/apps/:id with dependents returns 409 with counts", async () => {
|
|
const slug = `busy_app_${Date.now().toString(36)}`;
|
|
const a = await pool.query(
|
|
`INSERT INTO apps (slug, name_ar, name_en, route, sort_order)
|
|
VALUES ($1, 'تطبيق', 'App Busy', '/y', 999) RETURNING id`,
|
|
[slug],
|
|
);
|
|
const appId = a.rows[0].id;
|
|
createdAppIds.push(appId);
|
|
|
|
const g = await pool.query(
|
|
`INSERT INTO groups (name, description_en) VALUES ($1, 'g') RETURNING id`,
|
|
[`gApp_${Date.now().toString(36)}`],
|
|
);
|
|
const groupId = g.rows[0].id;
|
|
createdGroupIds.push(groupId);
|
|
await pool.query(
|
|
`INSERT INTO group_apps (group_id, app_id) VALUES ($1, $2)`,
|
|
[groupId, appId],
|
|
);
|
|
await pool.query(
|
|
`INSERT INTO app_opens (user_id, app_id) VALUES ($1, $2), ($1, $2)`,
|
|
[adminId, appId],
|
|
);
|
|
|
|
const res = await fetch(`${API_BASE}/api/apps/${appId}`, {
|
|
method: "DELETE",
|
|
headers: { Cookie: adminCookie },
|
|
});
|
|
assert.equal(res.status, 409);
|
|
const body = await res.json();
|
|
assert.equal(body.groupCount, 1);
|
|
assert.equal(body.openCount, 2);
|
|
|
|
const stillThere = await pool.query(`SELECT id FROM apps WHERE id = $1`, [
|
|
appId,
|
|
]);
|
|
assert.equal(stillThere.rowCount, 1);
|
|
});
|
|
|
|
test("DELETE /api/apps/:id?force=true deletes app and writes audit log", async () => {
|
|
const slug = `force_app_${Date.now().toString(36)}`;
|
|
const a = await pool.query(
|
|
`INSERT INTO apps (slug, name_ar, name_en, route, sort_order)
|
|
VALUES ($1, 'تطبيق', 'App Force', '/z', 999) RETURNING id`,
|
|
[slug],
|
|
);
|
|
const appId = a.rows[0].id;
|
|
createdAppIds.push(appId);
|
|
|
|
const g = await pool.query(
|
|
`INSERT INTO groups (name, description_en) VALUES ($1, 'g') RETURNING id`,
|
|
[`gAppF_${Date.now().toString(36)}`],
|
|
);
|
|
const groupId = g.rows[0].id;
|
|
createdGroupIds.push(groupId);
|
|
await pool.query(
|
|
`INSERT INTO group_apps (group_id, app_id) VALUES ($1, $2)`,
|
|
[groupId, appId],
|
|
);
|
|
await pool.query(
|
|
`INSERT INTO app_opens (user_id, app_id) VALUES ($1, $2)`,
|
|
[adminId, appId],
|
|
);
|
|
|
|
const res = await fetch(`${API_BASE}/api/apps/${appId}?force=true`, {
|
|
method: "DELETE",
|
|
headers: { Cookie: adminCookie },
|
|
});
|
|
assert.equal(res.status, 204);
|
|
|
|
const check = await pool.query(`SELECT id FROM apps WHERE id = $1`, [appId]);
|
|
assert.equal(check.rowCount, 0);
|
|
|
|
const audit = await pool.query(
|
|
`SELECT * FROM audit_logs WHERE action = ANY($1) AND target_id = $2`,
|
|
[["app.delete", "app.force_delete"], String(appId)],
|
|
);
|
|
assert.equal(audit.rowCount, 1);
|
|
});
|
|
|
|
// ---------- Services ----------
|
|
|
|
test("DELETE /api/services/:id without dependents succeeds (no force needed)", async () => {
|
|
const s = await pool.query(
|
|
`INSERT INTO services (name_ar, name_en, price, is_available) VALUES ('خ', $1, 1.00, true) RETURNING id`,
|
|
[`${SVC_PREFIX}Clean`],
|
|
);
|
|
const id = s.rows[0].id;
|
|
createdServiceIds.push(id);
|
|
|
|
const res = await fetch(`${API_BASE}/api/services/${id}`, {
|
|
method: "DELETE",
|
|
headers: { Cookie: adminCookie },
|
|
});
|
|
assert.equal(res.status, 204);
|
|
});
|
|
|
|
test("DELETE /api/services/:id with orders returns 409 with counts", async () => {
|
|
const s = await pool.query(
|
|
`INSERT INTO services (name_ar, name_en, price, is_available) VALUES ('خ', $1, 2.00, true) RETURNING id`,
|
|
[`${SVC_PREFIX}Busy`],
|
|
);
|
|
const sid = s.rows[0].id;
|
|
createdServiceIds.push(sid);
|
|
|
|
await pool.query(
|
|
`INSERT INTO service_orders (user_id, service_id, status) VALUES ($1, $2, 'pending'), ($1, $2, 'pending'), ($1, $2, 'completed')`,
|
|
[adminId, sid],
|
|
);
|
|
|
|
const res = await fetch(`${API_BASE}/api/services/${sid}`, {
|
|
method: "DELETE",
|
|
headers: { Cookie: adminCookie },
|
|
});
|
|
assert.equal(res.status, 409);
|
|
const body = await res.json();
|
|
assert.equal(body.orderCount, 3);
|
|
|
|
const stillThere = await pool.query(`SELECT id FROM services WHERE id = $1`, [
|
|
sid,
|
|
]);
|
|
assert.equal(stillThere.rowCount, 1);
|
|
});
|
|
|
|
test("DELETE /api/services/:id?force=true deletes service + orders and writes audit log", async () => {
|
|
const s = await pool.query(
|
|
`INSERT INTO services (name_ar, name_en, price, is_available) VALUES ('خ', $1, 3.00, true) RETURNING id`,
|
|
[`${SVC_PREFIX}Force`],
|
|
);
|
|
const sid = s.rows[0].id;
|
|
createdServiceIds.push(sid);
|
|
|
|
await pool.query(
|
|
`INSERT INTO service_orders (user_id, service_id, status) VALUES ($1, $2, 'pending')`,
|
|
[adminId, sid],
|
|
);
|
|
|
|
const res = await fetch(`${API_BASE}/api/services/${sid}?force=true`, {
|
|
method: "DELETE",
|
|
headers: { Cookie: adminCookie },
|
|
});
|
|
assert.equal(res.status, 204);
|
|
|
|
const check = await pool.query(`SELECT id FROM services WHERE id = $1`, [
|
|
sid,
|
|
]);
|
|
assert.equal(check.rowCount, 0);
|
|
|
|
const ordersGone = await pool.query(
|
|
`SELECT id FROM service_orders WHERE service_id = $1`,
|
|
[sid],
|
|
);
|
|
assert.equal(ordersGone.rowCount, 0);
|
|
|
|
const audit = await pool.query(
|
|
`SELECT * FROM audit_logs WHERE action = 'service.force_delete' AND target_id = $1`,
|
|
[String(sid)],
|
|
);
|
|
assert.equal(audit.rowCount, 1);
|
|
});
|