TX/artifacts/api-server/tests/executive-meetings.test.mjs

import { test, before, after } from "node:test";
import assert from "node:assert/strict";
import pg from "pg";

const API_BASE = process.env.TEST_API_BASE ?? "http://localhost:8080";
const DATABASE_URL = process.env.DATABASE_URL;
if (!DATABASE_URL) {
  throw new Error("DATABASE_URL must be set to run these tests");
}

const TEST_PASSWORD_HASH =
  "$2b$10$Bs636ukPMyz01nKrsi.5m.JlDXSN22AVCvn8cgPWWDbo5yJRQX2vu";
const TEST_PASSWORD = "TestPass123!";

const pool = new pg.Pool({ connectionString: DATABASE_URL });

const created = {
  userIds: [],
  meetingIds: [],
  requestIds: [],
  taskIds: [],
};

function uniqueName(prefix) {
  return `${prefix}_${Date.now().toString(36)}_${Math.random()
    .toString(36)
    .slice(2, 8)}`;
}

async function createUser(prefix, roleName) {
  const username = uniqueName(prefix);
  const { rows } = await pool.query(
    `INSERT INTO users (username, email, password_hash, display_name_en, preferred_language, is_active)
     VALUES ($1, $2, $3, 'EM Test', 'en', true) RETURNING id`,
    [username, `${username}@example.com`, TEST_PASSWORD_HASH],
  );
  const id = rows[0].id;
  created.userIds.push(id);
  const roles = ["user", roleName];
  for (const r of roles) {
    await pool.query(
      `INSERT INTO user_roles (user_id, role_id)
       SELECT $1, id FROM roles WHERE name = $2
       ON CONFLICT DO NOTHING`,
      [id, r],
    );
  }
  return { id, username };
}

function extractCookie(res) {
  const setCookie = res.headers.get("set-cookie");
  if (!setCookie) return null;
  return setCookie
    .split(",")
    .map((c) => c.split(";")[0].trim())
    .find((c) => c.startsWith("connect.sid=")) ?? null;
}

async function login(username, password) {
  const res = await fetch(`${API_BASE}/api/auth/login`, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ username, password }),
  });
  assert.equal(res.status, 200, `login should succeed for ${username}`);
  const cookie = extractCookie(res);
  assert.ok(cookie, "login response should set a session cookie");
  return cookie;
}

async function api(cookie, method, path, body) {
  const init = {
    method,
    headers: {
      Cookie: cookie,
      ...(body !== undefined ? { "Content-Type": "application/json" } : {}),
    },
  };
  if (body !== undefined) init.body = JSON.stringify(body);
  return fetch(`${API_BASE}${path}`, init);
}

let adminCookie = null;
let adminUserId = null;
let coordCookie = null;
let coordUserId = null;
let leadCookie = null;
let leadUserId = null;

before(async () => {
  // Reuse the seeded admin (admin/admin123) for the broad-view path.
  adminCookie = await login("admin", "admin123");
  const meRes = await api(adminCookie, "GET", "/api/auth/me");
  const me = await meRes.json();
  adminUserId = me.id ?? me.userId;

  // Create a fresh plain coordinator and a coord_lead so we can check the
  // server-side scoping behavior of GET /tasks (coordinator must only ever
  // see their own tasks even with mine=0/assigneeId=other).
  const coord = await createUser("em_coord", "executive_coordinator");
  coordUserId = coord.id;
  coordCookie = await login(coord.username, TEST_PASSWORD);

  const lead = await createUser("em_lead", "executive_coord_lead");
  leadUserId = lead.id;
  leadCookie = await login(lead.username, TEST_PASSWORD);
});

after(async () => {
  // Best-effort cleanup; per-test rows may have already been deleted.
  if (created.taskIds.length > 0) {
    await pool.query(`DELETE FROM executive_meeting_tasks WHERE id = ANY($1::int[])`, [
      created.taskIds,
    ]);
  }
  if (created.requestIds.length > 0) {
    await pool.query(`DELETE FROM executive_meeting_requests WHERE id = ANY($1::int[])`, [
      created.requestIds,
    ]);
  }
  if (created.meetingIds.length > 0) {
    await pool.query(`DELETE FROM executive_meeting_attendees WHERE meeting_id = ANY($1::int[])`, [
      created.meetingIds,
    ]);
    await pool.query(`DELETE FROM executive_meeting_audit_logs WHERE entity_id = ANY($1::int[]) AND entity_type IN ('meeting','request','task')`, [
      created.meetingIds,
    ]);
    await pool.query(`DELETE FROM executive_meetings WHERE id = ANY($1::int[])`, [
      created.meetingIds,
    ]);
  }
  if (created.userIds.length > 0) {
    await pool.query(`DELETE FROM executive_meeting_tasks WHERE assigned_to = ANY($1::int[])`, [
      created.userIds,
    ]);
    await pool.query(`DELETE FROM executive_meeting_requests WHERE requested_by = ANY($1::int[])`, [
      created.userIds,
    ]);
    await pool.query(`DELETE FROM user_roles WHERE user_id = ANY($1::int[])`, [
      created.userIds,
    ]);
    await pool.query(`DELETE FROM users WHERE id = ANY($1::int[])`, [
      created.userIds,
    ]);
  }
  await pool.end();
});

const today = new Date().toISOString().slice(0, 10);
const tomorrow = new Date(Date.now() + 24 * 60 * 60 * 1000)
  .toISOString()
  .slice(0, 10);

test("GET /executive-meetings/me exposes the full capability flag set including canViewAllTasks", async () => {
  const res = await api(adminCookie, "GET", "/api/executive-meetings/me");
  assert.equal(res.status, 200);
  const body = await res.json();
  for (const key of [
    "userId",
    "roles",
    "canRead",
    "canMutate",
    "canApprove",
    "canSubmitRequest",
    "canViewAudit",
    "canViewTasks",
    "canViewAllTasks",
  ]) {
    assert.ok(key in body, `missing ${key} in /me response`);
  }
  assert.equal(body.canViewAllTasks, true);

  const coordRes = await api(coordCookie, "GET", "/api/executive-meetings/me");
  const coordMe = await coordRes.json();
  assert.equal(coordMe.canViewTasks, true);
  assert.equal(
    coordMe.canViewAllTasks,
    false,
    "plain coordinators must not get cross-user task visibility",
  );
});

test("Meetings: POST creates → GET day returns it → DELETE removes it", async () => {
  const create = await api(adminCookie, "POST", "/api/executive-meetings", {
    titleAr: "اجتماع اختبار",
    titleEn: "Test meeting",
    meetingDate: today,
    startTime: "09:00",
    endTime: "10:00",
    platform: "none",
    status: "scheduled",
    isHighlighted: 0,
    attendees: [
      { name: "Tester One", attendanceType: "internal", sortOrder: 0 },
    ],
  });
  assert.equal(create.status, 201);
  const meeting = await create.json();
  assert.ok(meeting.id);
  created.meetingIds.push(meeting.id);

  const day = await api(
    adminCookie,
    "GET",
    `/api/executive-meetings?date=${today}`,
  );
  assert.equal(day.status, 200);
  const dayBody = await day.json();
  assert.ok(Array.isArray(dayBody.meetings));
  assert.ok(dayBody.meetings.some((m) => m.id === meeting.id));

  const del = await api(
    adminCookie,
    "DELETE",
    `/api/executive-meetings/${meeting.id}`,
  );
  assert.ok(del.status === 200 || del.status === 204);
});

test("Requests: POST creates → admin GET sees it; coord scope filter respects requester", async () => {
  const create = await api(
    adminCookie,
    "POST",
    "/api/executive-meetings/requests",
    {
      requestType: "note",
      requestDetails: { note: "Phase-2 test request" },
    },
  );
  assert.equal(create.status, 201);
  const reqRow = await create.json();
  assert.ok(reqRow.id);
  created.requestIds.push(reqRow.id);

  const list = await api(adminCookie, "GET", "/api/executive-meetings/requests");
  assert.equal(list.status, 200);
  const listBody = await list.json();
  assert.ok(Array.isArray(listBody.requests));
  assert.ok(listBody.requests.some((r) => r.id === reqRow.id));
});

test("Tasks: server-side scoping forces coordinators to assignedTo=self", async () => {
  // Admin creates a task assigned to the coordinator and another assigned to
  // the lead. The coordinator must only see the first one even when they pass
  // mine=0 / assigneeId=lead.
  const t1 = await api(adminCookie, "POST", "/api/executive-meetings/tasks", {
    taskType: "follow_up",
    assignedTo: coordUserId,
    notes: "for coord",
  });
  assert.equal(t1.status, 201);
  const task1 = await t1.json();
  created.taskIds.push(task1.id);

  const t2 = await api(adminCookie, "POST", "/api/executive-meetings/tasks", {
    taskType: "follow_up",
    assignedTo: leadUserId,
    notes: "for lead",
  });
  assert.equal(t2.status, 201);
  const task2 = await t2.json();
  created.taskIds.push(task2.id);

  // Plain coordinator: mine=0 + assigneeId=leadUserId attempts override; the
  // server must ignore both and force assignedTo=coordUserId.
  const coordList = await api(
    coordCookie,
    "GET",
    `/api/executive-meetings/tasks?mine=0&assigneeId=${leadUserId}`,
  );
  assert.equal(coordList.status, 200);
  const coordBody = await coordList.json();
  const coordIds = coordBody.tasks.map((t) => t.id);
  assert.ok(
    coordIds.includes(task1.id),
    "coordinator should see their own task",
  );
  assert.ok(
    !coordIds.includes(task2.id),
    "coordinator must NOT see another user's task even with assigneeId override",
  );
  for (const t of coordBody.tasks) {
    assert.equal(
      t.assignedTo,
      coordUserId,
      "every task returned to a coordinator must be assigned to them",
    );
  }

  // Lead: broad view honors assigneeId.
  const leadList = await api(
    leadCookie,
    "GET",
    `/api/executive-meetings/tasks?assigneeId=${leadUserId}`,
  );
  assert.equal(leadList.status, 200);
  const leadBody = await leadList.json();
  assert.ok(leadBody.tasks.some((t) => t.id === task2.id));
});

test("Audit logs: admin can list, plain coordinator gets 403", async () => {
  const ok = await api(
    adminCookie,
    "GET",
    "/api/executive-meetings/audit-logs",
  );
  assert.equal(ok.status, 200);
  const body = await ok.json();
  assert.ok(Array.isArray(body.logs ?? body.auditLogs ?? body.entries ?? []));

  const denied = await api(
    coordCookie,
    "GET",
    "/api/executive-meetings/audit-logs",
  );
  assert.equal(denied.status, 403);
});

test("Notifications: GET filters by ?date= and tolerates empty days", async () => {
  const empty = await api(
    adminCookie,
    "GET",
    `/api/executive-meetings/notifications?date=1990-01-01`,
  );
  assert.equal(empty.status, 200);
  const emptyBody = await empty.json();
  assert.ok(Array.isArray(emptyBody.notifications));

  const todayList = await api(
    adminCookie,
    "GET",
    `/api/executive-meetings/notifications?date=${today}`,
  );
  assert.equal(todayList.status, 200);
});

test("Font settings: valid combo returns 200; invalid weight or out-of-range size returns 400", async () => {
  const ok = await api(
    adminCookie,
    "PATCH",
    "/api/executive-meetings/font-settings",
    {
      scope: "user",
      fontFamily: "Cairo",
      fontSize: 16,
      fontWeight: "bold",
      alignment: "center",
    },
  );
  assert.equal(ok.status, 200);

  const badWeight = await api(
    adminCookie,
    "PATCH",
    "/api/executive-meetings/font-settings",
    { scope: "user", fontWeight: "medium" },
  );
  assert.equal(badWeight.status, 400);

  const badSize = await api(
    adminCookie,
    "PATCH",
    "/api/executive-meetings/font-settings",
    { scope: "user", fontSize: 30 },
  );
  assert.equal(badSize.status, 400);

  const badFamily = await api(
    adminCookie,
    "PATCH",
    "/api/executive-meetings/font-settings",
    { scope: "user", fontFamily: "Comic Sans" },
  );
  assert.equal(badFamily.status, 400);
});

test("PDF archives: GET returns an array and supports ?date=", async () => {
  const res = await api(
    adminCookie,
    "GET",
    `/api/executive-meetings/pdf-archives?date=${today}`,
  );
  assert.equal(res.status, 200);
  const body = await res.json();
  assert.ok(Array.isArray(body.archives ?? body.items ?? body.pdfArchives ?? []));
});