@actuate-media/cms-core 0.39.0 → 0.41.0

package/dist/__tests__/api/users-detail.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=users-detail.test.d.ts.map

package/dist/__tests__/api/users-detail.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"users-detail.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/api/users-detail.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/api/users-detail.test.js

@@ -0,0 +1,401 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { handleActuateAPI } from '../../api/index.js';
+import { createSession } from '../../auth/session.js';
+import { generateToken as generateCsrfToken } from '../../security/csrf.js';
+import { initDB } from '../../db.js';
+import { setEmailSender } from '../../email/sender.js';
+import { setActuateConfig } from '../../config/runtime.js';
+/**
+ * Integration tests for the User detail drawer + security action routes:
+ * GET /users/:id, sessions list/revoke/revoke-all, permissions, suspend,
+ * reactivate, lock/unlock, force/send password reset, require-mfa, mfa-reset.
+ *
+ * Focus: response contracts + the access-control guards (admin-only, Owner-only
+ * on Owners, last-Owner protection, self-action blocks, reauth on MFA reset).
+ */
+const SECRET = 'test-secret-for-users-detail-routes-1234567890abc';
+function createMockDB(userRows, sessionRows = []) {
+    const users = userRows.map((r) => ({ isActive: true, passwordHash: 'h', ...r }));
+    const sessions = [...sessionRows];
+    const audit = [];
+    const resetTokens = [];
+    return {
+        _users: users,
+        _sessions: sessions,
+        _audit: audit,
+        _resetTokens: resetTokens,
+        user: {
+            findMany: async () => users,
+            findUnique: async ({ where }) => users.find((u) => u.id === where.id) ?? null,
+            findFirst: async ({ where }) => {
+                if (where?.email?.equals) {
+                    const t = String(where.email.equals).toLowerCase();
+                    return users.find((u) => u.email.toLowerCase() === t) ?? null;
+                }
+                return null;
+            },
+            count: async ({ where } = {}) => users.filter((u) => (where?.role ? u.role === where.role : true) &&
+                (where?.isActive !== undefined ? (u.isActive ?? true) === where.isActive : true) &&
+                (where?.id?.not ? u.id !== where.id.not : true)).length,
+            update: async ({ where, data }) => {
+                const u = users.find((x) => x.id === where.id);
+                Object.assign(u, data);
+                return u;
+            },
+        },
+        session: {
+            findMany: async ({ where } = {}) => sessions.filter((s) => (where?.userId ? s.userId === where.userId : true)),
+            findUnique: async ({ where }) => {
+                const found = sessions.find((s) => s.id === where.id);
+                if (found)
+                    return found;
+                // Auth session lookup performed by extractSession — the JWT carries a
+                // `session-<userId>` id that has no corresponding row in these tests.
+                // Treat it as a valid, non-revoked session so auth succeeds.
+                if (String(where.id).startsWith('session-')) {
+                    return { id: where.id, revokedAt: null, expiresAt: new Date(Date.now() + 1e8) };
+                }
+                return null;
+            },
+            update: async ({ where, data }) => {
+                const s = sessions.find((x) => x.id === where.id);
+                Object.assign(s, data);
+                return s;
+            },
+            updateMany: async ({ where, data }) => {
+                let n = 0;
+                for (const s of sessions) {
+                    const matchUser = where?.userId ? s.userId === where.userId : true;
+                    const matchRevoked = where?.revokedAt === null ? s.revokedAt === null : true;
+                    const matchNot = where?.id?.not ? s.id !== where.id.not : true;
+                    if (matchUser && matchRevoked && matchNot) {
+                        Object.assign(s, data);
+                        n++;
+                    }
+                }
+                return { count: n };
+            },
+        },
+        auditLog: {
+            findMany: async () => audit,
+            create: async ({ data }) => {
+                audit.push(data);
+                return data;
+            },
+        },
+        oAuthAccount: { findMany: async () => [] },
+        document: {
+            count: async () => 0,
+            updateMany: async ({ where }) => {
+                // Reassign any docs "owned" by the from-user in this lightweight model.
+                const n = where?.createdById === 'u-owns' ? 2 : 0;
+                return { count: n };
+            },
+        },
+        media: { count: async () => 0, updateMany: async () => ({ count: 0 }) },
+        contentTemplate: { count: async () => 0, updateMany: async () => ({ count: 0 }) },
+        passwordResetToken: {
+            updateMany: async () => ({ count: 0 }),
+            create: async ({ data }) => {
+                resetTokens.push(data);
+                return data;
+            },
+        },
+    };
+}
+async function headersFor(userId, role) {
+    const token = await createSession({ userId, role, sessionId: `session-${userId}` }, { secret: SECRET });
+    const csrf = await generateCsrfToken();
+    return {
+        cookie: `actuate_session=${token}; actuate_csrf=${csrf}`,
+        'x-csrf-token': csrf,
+        'content-type': 'application/json',
+    };
+}
+const BASE = 'https://cms.example.com/api/cms';
+describe('User detail + security action routes', () => {
+    const original = {
+        CMS_SECRET: process.env.CMS_SECRET,
+        CMS_SESSION_SECRET: process.env.CMS_SESSION_SECRET,
+        NEXT_PUBLIC_SITE_URL: process.env.NEXT_PUBLIC_SITE_URL,
+    };
+    beforeEach(() => {
+        process.env.CMS_SECRET = SECRET;
+        delete process.env.CMS_SESSION_SECRET;
+        process.env.NEXT_PUBLIC_SITE_URL = 'https://cms.example.com';
+        setEmailSender(null);
+        // Pin a clean runtime config so a `platform.email` adapter leaked onto the
+        // global config by a previously-run test file can't make the admin
+        // password-reset flow await a foreign (possibly hanging) sender instead of
+        // the one registered via `setEmailSender`.
+        setActuateConfig({ admin: { path: '/admin' } });
+    });
+    afterEach(() => {
+        setEmailSender(null);
+        for (const [k, v] of Object.entries(original)) {
+            if (v === undefined)
+                delete process.env[k];
+            else
+                process.env[k] = v;
+        }
+    });
+    function makeHandler(users, sessions = []) {
+        const db = createMockDB(users, sessions);
+        initDB(db);
+        return { handler: handleActuateAPI({ prismaClient: db }), db };
+    }
+    const admin = () => ({
+        id: 'admin-1',
+        email: 'admin@a.com',
+        name: 'Admin',
+        role: 'ADMIN',
+    });
+    const owner = () => ({
+        id: 'owner-1',
+        email: 'owner@a.com',
+        name: 'Owner',
+        role: 'OWNER',
+    });
+    function req(path, headers, method = 'GET', body) {
+        return new Request(`${BASE}${path}`, {
+            method,
+            headers,
+            ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
+        });
+    }
+    it('GET /users/:id returns the detail shape (admin-only)', async () => {
+        const { handler } = makeHandler([
+            admin(),
+            { id: 'u2', email: 'p@a.com', name: 'Priya', role: 'EDITOR' },
+        ]);
+        const res = await handler(req('/users/u2', await headersFor('admin-1', 'ADMIN')));
+        expect(res.status).toBe(200);
+        const body = (await res.json());
+        expect(body.data.id).toBe('u2');
+        expect(body.data.roleName).toBe('Editor');
+        expect(body.data.status).toBe('active');
+    });
+    it('rejects a non-admin (editor) with 403', async () => {
+        const { handler } = makeHandler([{ id: 'ed-1', email: 'e@a.com', name: 'Ed', role: 'EDITOR' }]);
+        const res = await handler(req('/users/ed-1', await headersFor('ed-1', 'EDITOR')));
+        expect(res.status).toBe(403);
+    });
+    it('GET /users/:id/sessions lists sessions with current marker', async () => {
+        const { handler } = makeHandler([admin()], [
+            {
+                id: 'session-admin-1',
+                userId: 'admin-1',
+                userAgent: 'Chrome',
+                expiresAt: new Date(Date.now() + 86400000),
+                createdAt: new Date(),
+                revokedAt: null,
+            },
+        ]);
+        const res = await handler(req('/users/admin-1/sessions', await headersFor('admin-1', 'ADMIN')));
+        expect(res.status).toBe(200);
+        const body = (await res.json());
+        expect(body.data[0].current).toBe(true);
+        expect(body.data[0].active).toBe(true);
+    });
+    it('DELETE /users/:id/sessions/:sessionId revokes one session', async () => {
+        const { handler, db } = makeHandler([admin(), { id: 'u2', email: 'p@a.com', name: 'Priya', role: 'EDITOR' }], [
+            {
+                id: 'sx',
+                userId: 'u2',
+                expiresAt: new Date(Date.now() + 86400000),
+                createdAt: new Date(),
+                revokedAt: null,
+            },
+        ]);
+        const res = await handler(req('/users/u2/sessions/sx', await headersFor('admin-1', 'ADMIN'), 'DELETE'));
+        expect(res.status).toBe(200);
+        expect(db._sessions[0].revokedAt).toBeInstanceOf(Date);
+    });
+    it('POST /users/:id/sessions/revoke-all revokes every active session for another user', async () => {
+        const { handler, db } = makeHandler([admin(), { id: 'u2', email: 'p@a.com', name: 'Priya', role: 'EDITOR' }], [
+            {
+                id: 's1',
+                userId: 'u2',
+                expiresAt: new Date(Date.now() + 1e8),
+                createdAt: new Date(),
+                revokedAt: null,
+            },
+            {
+                id: 's2',
+                userId: 'u2',
+                expiresAt: new Date(Date.now() + 1e8),
+                createdAt: new Date(),
+                revokedAt: null,
+            },
+        ]);
+        const res = await handler(req('/users/u2/sessions/revoke-all', await headersFor('admin-1', 'ADMIN'), 'POST'));
+        expect(res.status).toBe(200);
+        expect(db._sessions.every((s) => s.revokedAt instanceof Date)).toBe(true);
+    });
+    it('GET /users/:id/permissions returns derived permissions', async () => {
+        const { handler } = makeHandler([
+            admin(),
+            { id: 'u2', email: 'v@a.com', name: 'V', role: 'VIEWER' },
+        ]);
+        const res = await handler(req('/users/u2/permissions', await headersFor('admin-1', 'ADMIN')));
+        const body = (await res.json());
+        expect(body.data.roleName).toBe('Viewer');
+        expect(body.data.permissions).toEqual(['dashboard.view', 'content.view']);
+    });
+    it('POST /users/:id/suspend suspends a user and revokes sessions', async () => {
+        const { handler, db } = makeHandler([admin(), { id: 'u2', email: 'p@a.com', name: 'Priya', role: 'EDITOR' }], [
+            {
+                id: 's1',
+                userId: 'u2',
+                expiresAt: new Date(Date.now() + 1e8),
+                createdAt: new Date(),
+                revokedAt: null,
+            },
+        ]);
+        const res = await handler(req('/users/u2/suspend', await headersFor('admin-1', 'ADMIN'), 'POST'));
+        expect(res.status).toBe(200);
+        expect(db._users.find((u) => u.id === 'u2').suspendedAt).toBeInstanceOf(Date);
+        expect(db._sessions[0].revokedAt).toBeInstanceOf(Date);
+    });
+    it('blocks suspending your own account', async () => {
+        const { handler } = makeHandler([admin()]);
+        const res = await handler(req('/users/admin-1/suspend', await headersFor('admin-1', 'ADMIN'), 'POST'));
+        expect(res.status).toBe(400);
+    });
+    it('protects the last Owner from suspension', async () => {
+        const { handler } = makeHandler([owner(), admin()]);
+        const res = await handler(req('/users/owner-1/suspend', await headersFor('owner-1', 'OWNER'), 'POST'));
+        // owner-1 is acting on themselves here → blocked as self-action first
+        expect(res.status).toBe(400);
+    });
+    it('forbids a non-Owner admin from acting on an Owner', async () => {
+        const { handler } = makeHandler([admin(), owner()]);
+        const res = await handler(req('/users/owner-1/suspend', await headersFor('admin-1', 'ADMIN'), 'POST'));
+        expect(res.status).toBe(403);
+    });
+    it('blocks suspending the last Owner (acted on by another Owner)', async () => {
+        const { handler } = makeHandler([
+            owner(),
+            { id: 'owner-2', email: 'o2@a.com', name: 'O2', role: 'OWNER', isActive: false },
+        ]);
+        const res = await handler(req('/users/owner-1/suspend', await headersFor('owner-2', 'OWNER'), 'POST'));
+        // owner-2 is inactive but still the actor; owner-1 is the only active Owner.
+        expect(res.status).toBe(409);
+    });
+    it('reactivate clears suspension', async () => {
+        const { handler, db } = makeHandler([
+            admin(),
+            { id: 'u2', email: 'p@a.com', name: 'Priya', role: 'EDITOR', suspendedAt: new Date() },
+        ]);
+        const res = await handler(req('/users/u2/reactivate', await headersFor('admin-1', 'ADMIN'), 'POST'));
+        expect(res.status).toBe(200);
+        expect(db._users.find((u) => u.id === 'u2').suspendedAt).toBeNull();
+    });
+    it('force-password-reset sets the flag', async () => {
+        const { handler, db } = makeHandler([
+            admin(),
+            { id: 'u2', email: 'p@a.com', name: 'P', role: 'EDITOR' },
+        ]);
+        const res = await handler(req('/users/u2/force-password-reset', await headersFor('admin-1', 'ADMIN'), 'POST', {
+            enabled: true,
+        }));
+        expect(res.status).toBe(200);
+        expect(db._users.find((u) => u.id === 'u2').forcePasswordReset).toBe(true);
+    });
+    it('require-mfa sets the flag', async () => {
+        const { handler, db } = makeHandler([
+            admin(),
+            { id: 'u2', email: 'p@a.com', name: 'P', role: 'EDITOR' },
+        ]);
+        const res = await handler(req('/users/u2/require-mfa', await headersFor('admin-1', 'ADMIN'), 'POST', {
+            required: true,
+        }));
+        expect(res.status).toBe(200);
+        expect(db._users.find((u) => u.id === 'u2').mfaRequired).toBe(true);
+    });
+    it('mfa-reset requires reauthentication (401) when no password header is sent', async () => {
+        const { handler } = makeHandler([
+            admin(),
+            { id: 'u2', email: 'p@a.com', name: 'P', role: 'EDITOR', totpEnabled: true },
+        ]);
+        const res = await handler(req('/users/u2/mfa-reset', await headersFor('admin-1', 'ADMIN'), 'POST'));
+        expect(res.status).toBe(401);
+        const body = (await res.json());
+        expect(body.code ?? body.error).toBeTruthy();
+    });
+    it('password-reset is rejected for SSO-only accounts (409)', async () => {
+        const { handler } = makeHandler([
+            admin(),
+            { id: 'u2', email: 'sso@a.com', name: 'SSO', role: 'EDITOR', passwordHash: null },
+        ]);
+        const res = await handler(req('/users/u2/password-reset', await headersFor('admin-1', 'ADMIN'), 'POST'));
+        expect(res.status).toBe(409);
+    });
+    it('password-reset sends a reset email for a normal user when email is configured', async () => {
+        const sent = [];
+        setEmailSender({ send: async (o) => void sent.push({ to: o.to }) });
+        const { handler } = makeHandler([
+            admin(),
+            { id: 'u2', email: 'p@a.com', name: 'P', role: 'EDITOR', passwordHash: 'h' },
+        ]);
+        const res = await handler(req('/users/u2/password-reset', await headersFor('admin-1', 'ADMIN'), 'POST'));
+        expect(res.status).toBe(200);
+        expect(sent).toEqual([{ to: 'p@a.com' }]);
+    });
+    it('transfer-content reassigns ownership to an active recipient', async () => {
+        const { handler } = makeHandler([
+            admin(),
+            { id: 'u-owns', email: 'owns@a.com', name: 'Owns', role: 'EDITOR' },
+            { id: 'u-recv', email: 'recv@a.com', name: 'Recv', role: 'EDITOR' },
+        ]);
+        const res = await handler(req('/users/u-owns/transfer-content', await headersFor('admin-1', 'ADMIN'), 'POST', {
+            toUserId: 'u-recv',
+        }));
+        expect(res.status).toBe(200);
+        const body = (await res.json());
+        expect(body.data.documents).toBe(2);
+        expect(body.data.total).toBe(2);
+    });
+    it('transfer-content rejects a missing recipient (400)', async () => {
+        const { handler } = makeHandler([
+            admin(),
+            { id: 'u-owns', email: 'o@a.com', name: 'O', role: 'EDITOR' },
+        ]);
+        const res = await handler(req('/users/u-owns/transfer-content', await headersFor('admin-1', 'ADMIN'), 'POST', {}));
+        expect(res.status).toBe(400);
+    });
+    it('transfer-content rejects transferring to a suspended user (409)', async () => {
+        const { handler } = makeHandler([
+            admin(),
+            { id: 'u-owns', email: 'o@a.com', name: 'O', role: 'EDITOR' },
+            { id: 'u-susp', email: 's@a.com', name: 'S', role: 'EDITOR', suspendedAt: new Date() },
+        ]);
+        const res = await handler(req('/users/u-owns/transfer-content', await headersFor('admin-1', 'ADMIN'), 'POST', {
+            toUserId: 'u-susp',
+        }));
+        expect(res.status).toBe(409);
+    });
+    it('transfer-content rejects transferring to the same user (400)', async () => {
+        const { handler } = makeHandler([
+            admin(),
+            { id: 'u-owns', email: 'o@a.com', name: 'O', role: 'EDITOR' },
+        ]);
+        const res = await handler(req('/users/u-owns/transfer-content', await headersFor('admin-1', 'ADMIN'), 'POST', {
+            toUserId: 'u-owns',
+        }));
+        expect(res.status).toBe(400);
+    });
+    it('lock then unlock toggles the locked state', async () => {
+        const { handler, db } = makeHandler([
+            admin(),
+            { id: 'u2', email: 'p@a.com', name: 'P', role: 'EDITOR' },
+        ]);
+        const lock = await handler(req('/users/u2/lock', await headersFor('admin-1', 'ADMIN'), 'POST'));
+        expect(lock.status).toBe(200);
+        expect(db._users.find((u) => u.id === 'u2').lockedAt).toBeInstanceOf(Date);
+        const unlock = await handler(req('/users/u2/unlock', await headersFor('admin-1', 'ADMIN'), 'POST'));
+        expect(unlock.status).toBe(200);
+        expect(db._users.find((u) => u.id === 'u2').lockedAt).toBeNull();
+    });
+});
+//# sourceMappingURL=users-detail.test.js.map

package/dist/__tests__/api/users-detail.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"users-detail.test.js","sourceRoot":"","sources":["../../../src/__tests__/api/users-detail.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAEpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC3E,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAE1D;;;;;;;GAOG;AAEH,MAAM,MAAM,GAAG,mDAAmD,CAAA;AAwBlE,SAAS,YAAY,CAAC,QAAmB,EAAE,cAA4B,EAAE;IACvE,MAAM,KAAK,GAAc,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;IAC3F,MAAM,QAAQ,GAAiB,CAAC,GAAG,WAAW,CAAC,CAAA;IAC/C,MAAM,KAAK,GAAmC,EAAE,CAAA;IAChD,MAAM,WAAW,GAAmC,EAAE,CAAA;IAEtD,OAAO;QACL,MAAM,EAAE,KAAK;QACb,SAAS,EAAE,QAAQ;QACnB,MAAM,EAAE,KAAK;QACb,YAAY,EAAE,WAAW;QACzB,IAAI,EAAE;YACJ,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;YAC3B,UAAU,EAAE,KAAK,EAAE,EAAE,KAAK,EAAO,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,IAAI,IAAI;YAClF,SAAS,EAAE,KAAK,EAAE,EAAE,KAAK,EAAO,EAAE,EAAE;gBAClC,IAAI,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;oBACzB,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAA;oBAClD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,IAAI,IAAI,CAAA;gBAC/D,CAAC;gBACD,OAAO,IAAI,CAAA;YACb,CAAC;YACD,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,KAAU,EAAE,EAAE,EAAE,CACnC,KAAK,CAAC,MAAM,CACV,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC5C,CAAC,KAAK,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;gBAChF,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAClD,CAAC,MAAM;YACV,MAAM,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAO,EAAE,EAAE;gBACrC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAE,CAAA;gBAC/C,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;gBACtB,OAAO,CAAC,CAAA;YACV,CAAC;SACF;QACD,OAAO,EAAE;YACP,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,KAAU,EAAE,EAAE,EAAE,CACtC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC5E,UAAU,EAAE,KAAK,EAAE,EAAE,KAAK,EAAO,EAAE,EAAE;gBACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAA;gBACrD,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAA;gBACvB,sEAAsE;gBACtE,sEAAsE;gBACtE,6DAA6D;gBAC7D,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,EAAE,CAAA;gBACjF,CAAC;gBACD,OAAO,IAAI,CAAA;YACb,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAO,EAAE,EAAE;gBACrC,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAE,CAAA;gBAClD,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;gBACtB,OAAO,CAAC,CAAA;YACV,CAAC;YACD,UAAU,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAO,EAAE,EAAE;gBACzC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACT,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACzB,MAAM,SAAS,GAAG,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;oBAClE,MAAM,YAAY,GAAG,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;oBAC5E,MAAM,QAAQ,GAAG,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;oBAC9D,IAAI,SAAS,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;wBAC1C,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;wBACtB,CAAC,EAAE,CAAA;oBACL,CAAC;gBACH,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAA;YACrB,CAAC;SACF;QACD,QAAQ,EAAE;YACR,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;YAC3B,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAO,EAAE,EAAE;gBAC9B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAChB,OAAO,IAAI,CAAA;YACb,CAAC;SACF;QACD,YAAY,EAAE,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE;QAC1C,QAAQ,EAAE;YACR,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YACpB,UAAU,EAAE,KAAK,EAAE,EAAE,KAAK,EAAO,EAAE,EAAE;gBACnC,wEAAwE;gBACxE,MAAM,CAAC,GAAG,KAAK,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;gBACjD,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAA;YACrB,CAAC;SACF;QACD,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE;QACvE,eAAe,EAAE,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE;QACjF,kBAAkB,EAAE;YAClB,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YACtC,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAO,EAAE,EAAE;gBAC9B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBACtB,OAAO,IAAI,CAAA;YACb,CAAC;SACF;KACF,CAAA;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,IAAkC;IAC1E,MAAM,KAAK,GAAG,MAAM,aAAa,CAC/B,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,MAAM,EAAE,EAAE,EAChD,EAAE,MAAM,EAAE,MAAM,EAAE,CACnB,CAAA;IACD,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAA;IACtC,OAAO;QACL,MAAM,EAAE,mBAAmB,KAAK,kBAAkB,IAAI,EAAE;QACxD,cAAc,EAAE,IAAI;QACpB,cAAc,EAAE,kBAAkB;KACnC,CAAA;AACH,CAAC;AAED,MAAM,IAAI,GAAG,iCAAiC,CAAA;AAE9C,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;IACpD,MAAM,QAAQ,GAAG;QACf,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;QAClC,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAClD,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;KACvD,CAAA;IAED,UAAU,CAAC,GAAG,EAAE;QACd,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,MAAM,CAAA;QAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAA;QACrC,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,yBAAyB,CAAA;QAC5D,cAAc,CAAC,IAAI,CAAC,CAAA;QACpB,2EAA2E;QAC3E,mEAAmE;QACnE,2EAA2E;QAC3E,2CAA2C;QAC3C,gBAAgB,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAW,CAAC,CAAA;IAC1D,CAAC,CAAC,CAAA;IAEF,SAAS,CAAC,GAAG,EAAE;QACb,cAAc,CAAC,IAAI,CAAC,CAAA;QACpB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAA0B,CAAC,CAAA;;gBAC9D,OAAO,CAAC,GAAG,CAAC,CAA0B,CAAC,GAAG,CAAC,CAAA;QAClD,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,SAAS,WAAW,CAAC,KAAgB,EAAE,WAAyB,EAAE;QAChE,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QACxC,MAAM,CAAC,EAAW,CAAC,CAAA;QACnB,OAAO,EAAE,OAAO,EAAE,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAW,EAAE,CAAC,EAAE,EAAE,EAAE,CAAA;IACzE,CAAC;IAED,MAAM,KAAK,GAAG,GAAY,EAAE,CAAC,CAAC;QAC5B,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,aAAa;QACpB,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,OAAO;KACd,CAAC,CAAA;IACF,MAAM,KAAK,GAAG,GAAY,EAAE,CAAC,CAAC;QAC5B,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,aAAa;QACpB,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,OAAO;KACd,CAAC,CAAA;IAEF,SAAS,GAAG,CAAC,IAAY,EAAE,OAA+B,EAAE,MAAM,GAAG,KAAK,EAAE,IAAc;QACxF,OAAO,IAAI,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE;YACnC,MAAM;YACN,OAAO;YACP,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAA;IACJ,CAAC;IAED,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC;YAC9B,KAAK,EAAE;YACP,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC9D,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;QACjF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA+D,CAAA;QAC7F,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACzC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAA;QAC/F,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;QACjF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAC7B,CAAC,KAAK,EAAE,CAAC,EACT;YACE;gBACE,EAAE,EAAE,iBAAiB;gBACrB,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,QAAQ;gBACnB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC;gBAC1C,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,SAAS,EAAE,IAAI;aAChB;SACF,CACF,CAAA;QACD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,MAAM,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;QAC/F,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAE7B,CAAA;QACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACxC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,WAAW,CACjC,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EACxE;YACE;gBACE,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC;gBAC1C,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,SAAS,EAAE,IAAI;aAChB;SACF,CACF,CAAA;QACD,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,GAAG,CAAC,uBAAuB,EAAE,MAAM,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAC7E,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,SAAS,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAA;IACzD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,WAAW,CACjC,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EACxE;YACE;gBACE,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC;gBACrC,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,SAAS,EAAE,IAAI;aAChB;YACD;gBACE,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC;gBACrC,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,SAAS,EAAE,IAAI;aAChB;SACF,CACF,CAAA;QACD,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,GAAG,CAAC,+BAA+B,EAAE,MAAM,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CACnF,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC;YAC9B,KAAK,EAAE;YACP,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC1D,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;QAC7F,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0D,CAAA;QACxF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACzC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,WAAW,CACjC,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EACxE;YACE;gBACE,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC;gBACrC,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,SAAS,EAAE,IAAI;aAChB;SACF,CACF,CAAA;QACD,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,GAAG,CAAC,mBAAmB,EAAE,MAAM,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CACvE,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAE,CAAC,WAAW,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAA;QAC9E,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,SAAS,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAA;IACzD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;QAC1C,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,GAAG,CAAC,wBAAwB,EAAE,MAAM,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAC5E,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;QACnD,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,GAAG,CAAC,wBAAwB,EAAE,MAAM,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAC5E,CAAA;QACD,sEAAsE;QACtE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;QACnD,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,GAAG,CAAC,wBAAwB,EAAE,MAAM,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAC5E,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC;YAC9B,KAAK,EAAE;YACP,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE;SACjF,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,GAAG,CAAC,wBAAwB,EAAE,MAAM,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAC5E,CAAA;QACD,6EAA6E;QAC7E,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,WAAW,CAAC;YAClC,KAAK,EAAE;YACP,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,EAAE;SACvF,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,GAAG,CAAC,sBAAsB,EAAE,MAAM,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAC1E,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAE,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAA;IACtE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,WAAW,CAAC;YAClC,KAAK,EAAE;YACP,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC1D,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,GAAG,CAAC,gCAAgC,EAAE,MAAM,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE;YAClF,OAAO,EAAE,IAAI;SACd,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAE,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,WAAW,CAAC;YAClC,KAAK,EAAE;YACP,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC1D,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,GAAG,CAAC,uBAAuB,EAAE,MAAM,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE;YACzE,QAAQ,EAAE,IAAI;SACf,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAE,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACtE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC;YAC9B,KAAK,EAAE;YACP,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE;SAC7E,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,GAAG,CAAC,qBAAqB,EAAE,MAAM,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CACzE,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsC,CAAA;QACpE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,CAAA;IAC9C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC;YAC9B,KAAK,EAAE;YACP,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE;SAClF,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,GAAG,CAAC,0BAA0B,EAAE,MAAM,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAC9E,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,IAAI,GAA0B,EAAE,CAAA;QACtC,cAAc,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;QACnE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC;YAC9B,KAAK,EAAE;YACP,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,EAAE;SAC7E,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,GAAG,CAAC,0BAA0B,EAAE,MAAM,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAC9E,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC;YAC9B,KAAK,EAAE;YACP,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;YACnE,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;SACpE,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,GAAG,CAAC,gCAAgC,EAAE,MAAM,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE;YAClF,QAAQ,EAAE,QAAQ;SACnB,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmD,CAAA;QACjF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACnC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC;YAC9B,KAAK,EAAE;YACP,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC9D,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,GAAG,CAAC,gCAAgC,EAAE,MAAM,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,CACxF,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC;YAC9B,KAAK,EAAE;YACP,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC7D,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,EAAE;SACvF,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,GAAG,CAAC,gCAAgC,EAAE,MAAM,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE;YAClF,QAAQ,EAAE,QAAQ;SACnB,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC;YAC9B,KAAK,EAAE;YACP,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC9D,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,GAAG,CAAC,gCAAgC,EAAE,MAAM,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE;YAClF,QAAQ,EAAE,QAAQ;SACnB,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,WAAW,CAAC;YAClC,KAAK,EAAE;YACP,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC1D,CAAC,CAAA;QACF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAA;QAC/F,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7B,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAE,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAA;QAC3E,MAAM,MAAM,GAAG,MAAM,OAAO,CAC1B,GAAG,CAAC,kBAAkB,EAAE,MAAM,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CACtE,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC/B,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAE,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAA;IACnE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/api/users-invite.test.js

@@ -7,28 +7,77 @@ import { setEmailSender } from '../../email/sender.js';
 /**
  * Integration tests for `POST /api/cms/users/invite`.
  *
- * The endpoint provisions a user with an unusable password and a single-use
- * reset token, then returns a set-password link (and/or emails it). It is
- * admin-only — the only multi-user provisioning path in the product.
+ * The endpoint records a first-class Invite (hashed single-use token) and
+ * provisions a placeholder user, then returns a set-password link (and/or
+ * emails it). It is admin-only, seat-aware, and Owner-gated for the Owner role.
  */
 const SECRET = 'test-secret-for-users-invite-routes-1234567890abc';
 function createMockDB(rows) {
-    const users = [...rows];
+    const users = rows.map((r) => ({ isActive: true, ...r }));
     const tokens = [];
+    const invites = [];
+    const invite = {
+        findMany: async ({ where } = {}) => {
+            let list = invites;
+            if (where?.status)
+                list = list.filter((i) => i.status === where.status);
+            return list;
+        },
+        findFirst: async ({ where }) => {
+            if (where?.email?.equals) {
+                const target = String(where.email.equals).toLowerCase();
+                return (invites.find((i) => i.email.toLowerCase() === target && (!where.status || i.status === where.status)) ?? null);
+            }
+            return null;
+        },
+        findUnique: async ({ where }) => invites.find((i) => i.id === where.id) ?? null,
+        count: async ({ where } = {}) => {
+            let list = invites;
+            if (where?.status)
+                list = list.filter((i) => i.status === where.status);
+            return list.length;
+        },
+        create: async ({ data }) => {
+            const row = {
+                id: `inv_${invites.length + 1}`,
+                createdAt: new Date(),
+                ...data,
+            };
+            invites.push(row);
+            return row;
+        },
+        update: async ({ where, data }) => {
+            const row = invites.find((i) => i.id === where.id);
+            Object.assign(row, data);
+            return row;
+        },
+        updateMany: async ({ where, data }) => {
+            let n = 0;
+            for (const i of invites) {
+                if (!where?.status || i.status === where.status) {
+                    Object.assign(i, data);
+                    n++;
+                }
+            }
+            return { count: n };
+        },
+    };
     return {
         _users: users,
         _tokens: tokens,
+        _invites: invites,
         session: { findUnique: async () => ({ revokedAt: null }) },
         user: {
-            // hasModel() probes for findMany; the invite route never calls it.
             findMany: async () => users,
             findUnique: async ({ where }) => users.find((u) => u.id === where.id) ?? null,
+            count: async ({ where } = {}) => users.filter((u) => (where?.role ? u.role === where.role : true) &&
+                (where?.isActive !== undefined ? (u.isActive ?? true) === where.isActive : true)).length,
             findFirst: async ({ where }) => {
                 const target = String(where.email.equals).toLowerCase();
                 return users.find((u) => u.email.toLowerCase() === target) ?? null;
             },
             create: async ({ data }) => {
-                const u = { id: `u_${users.length + 1}`, ...data };
+                const u = { id: `u_${users.length + 1}`, isActive: true, ...data };
                 users.push(u);
                 return u;
             },
@@ -40,6 +89,7 @@ function createMockDB(rows) {
                 return t;
             },
         },
+        invite,
     };
 }
 async function roleHeaders(userId, role) {
@@ -91,37 +141,33 @@ describe('POST /api/cms/users/invite', () => {
         const res = await handler(new Request('https://cms.example.com/api/cms/users/invite', {
             method: 'POST',
             headers: { 'content-type': 'application/json' },
-            body: JSON.stringify({ email: 'a@example.com', role: 'author' }),
+            body: JSON.stringify({ email: 'a@example.com', role: 'editor' }),
         }));
-        // CSRF runs before auth, so an anonymous POST without a token can return
-        // either — both prove the write was blocked.
         expect([401, 403]).toContain(res.status);
     });
     it('rejects non-admin roles with 403', async () => {
         const { handler, db } = makeHandler([
             { id: 'editor-1', email: 'ed@example.com', name: 'Ed', role: 'EDITOR' },
         ]);
-        const res = await handler(inviteRequest(await editorHeaders('editor-1'), { email: 'a@example.com', role: 'author' }));
+        const res = await handler(inviteRequest(await editorHeaders('editor-1'), { email: 'a@example.com', role: 'editor' }));
         expect(res.status).toBe(403);
-        expect(db._users).toHaveLength(1);
+        expect(db._invites).toHaveLength(0);
     });
-    it('creates the user + token and returns a shareable link when email is unconfigured', async () => {
+    it('records an invite + token and returns a shareable link when email is unconfigured', async () => {
         const { handler, db } = makeHandler([
             { id: 'admin-1', email: 'admin@example.com', name: 'Admin', role: 'ADMIN' },
         ]);
-        const res = await handler(inviteRequest(await adminHeaders('admin-1'), {
-            email: 'new@example.com',
-            name: 'New Person',
-            role: 'editor',
-        }));
+        const res = await handler(inviteRequest(await adminHeaders('admin-1'), { email: 'new@example.com', role: 'editor' }));
         expect(res.status).toBe(200);
         const body = (await res.json());
         expect(body.data.success).toBe(true);
         expect(body.data.emailed).toBe(false);
-        expect(body.data.user.role).toBe('EDITOR');
+        expect(body.data.invite.role).toBe('EDITOR');
         expect(body.data.inviteUrl).toContain('/admin/reset-password?token=');
         expect(db._tokens).toHaveLength(1);
-        // The created user is the second row (after the admin fixture).
+        expect(db._invites).toHaveLength(1);
+        // The hashed token is stored — never the raw token.
+        expect(db._invites[0].tokenHash).not.toContain(body.data.inviteUrl.split('token=')[1]);
         expect(db._users.map((u) => u.email)).toContain('new@example.com');
     });
     it('emails the invite (and hides the link) when a sender is registered', async () => {
@@ -134,33 +180,41 @@ describe('POST /api/cms/users/invite', () => {
         const { handler } = makeHandler([
             { id: 'admin-1', email: 'admin@example.com', name: 'Admin', role: 'ADMIN' },
         ]);
-        const res = await handler(inviteRequest(await adminHeaders('admin-1'), { email: 'new@example.com', role: 'author' }));
+        const res = await handler(inviteRequest(await adminHeaders('admin-1'), { email: 'new@example.com', role: 'viewer' }));
         const body = (await res.json());
         expect(body.data.emailed).toBe(true);
         expect(body.data.inviteUrl).toBeUndefined();
         expect(sent).toEqual([{ to: 'new@example.com' }]);
     });
-    it('rejects a duplicate email with 400', async () => {
+    it('rejects a duplicate existing user with 400', async () => {
         const { handler, db } = makeHandler([
             { id: 'admin-1', email: 'admin@example.com', name: 'Admin', role: 'ADMIN' },
-            { id: 'u-2', email: 'taken@example.com', name: 'Taken', role: 'AUTHOR' },
+            { id: 'u-2', email: 'taken@example.com', name: 'Taken', role: 'EDITOR' },
         ]);
-        const res = await handler(inviteRequest(await adminHeaders('admin-1'), { email: 'Taken@Example.com', role: 'author' }));
+        const res = await handler(inviteRequest(await adminHeaders('admin-1'), { email: 'Taken@Example.com', role: 'editor' }));
         expect(res.status).toBe(400);
-        expect(db._users).toHaveLength(2);
+        expect(db._invites).toHaveLength(0);
     });
     it('rejects an invalid role with 400', async () => {
         const { handler } = makeHandler([
             { id: 'admin-1', email: 'admin@example.com', name: 'Admin', role: 'ADMIN' },
         ]);
-        const res = await handler(inviteRequest(await adminHeaders('admin-1'), { email: 'a@example.com', role: 'viewer' }));
+        const res = await handler(inviteRequest(await adminHeaders('admin-1'), { email: 'a@example.com', role: 'superuser' }));
         expect(res.status).toBe(400);
     });
+    it('forbids a non-Owner from inviting an Owner (403)', async () => {
+        const { handler, db } = makeHandler([
+            { id: 'admin-1', email: 'admin@example.com', name: 'Admin', role: 'ADMIN' },
+        ]);
+        const res = await handler(inviteRequest(await adminHeaders('admin-1'), { email: 'owner@example.com', role: 'owner' }));
+        expect(res.status).toBe(403);
+        expect(db._invites).toHaveLength(0);
+    });
     it('requires an email', async () => {
         const { handler } = makeHandler([
             { id: 'admin-1', email: 'admin@example.com', name: 'Admin', role: 'ADMIN' },
         ]);
-        const res = await handler(inviteRequest(await adminHeaders('admin-1'), { role: 'author' }));
+        const res = await handler(inviteRequest(await adminHeaders('admin-1'), { role: 'editor' }));
         expect(res.status).toBe(400);
     });
 });