@cedarjs/cli 9.0.0-canary.1784 → 9.0.0-canary.3124

package/dist/commands/setup/tenancy/templates/organizations.scenarios.ts.template

@@ -0,0 +1,59 @@
+import type { ScenarioData } from '@cedarjs/testing/api'
+
+import type { Membership, Organization, Prisma } from 'src/lib/db'
+
+// This scenario assumes a dbAuth-style `User` model (`email`,
+// `hashedPassword`, `salt`). Adjust the `user` fixture below to match your
+// app's actual `User` fields if you use a different auth provider.
+export const standard = defineScenario<
+  Prisma.OrganizationCreateArgs | Prisma.MembershipCreateArgs
+>({
+  organization: {
+    acme: {
+      data: {
+        name: 'Acme Inc',
+        slug: 'acme-inc',
+      },
+    },
+  },
+  membership: {
+    owner: {
+      data: {
+        role: 'owner',
+        organization: { connect: { slug: 'acme-inc' } },
+        user: {
+          create: {
+            email: 'owner@example.com',
+            hashedPassword: 'x',
+            salt: 'x',
+            fullName: 'Org Owner',
+          },
+        },
+      },
+    },
+    admin: {
+      data: {
+        role: 'admin',
+        organization: { connect: { slug: 'acme-inc' } },
+        user: {
+          create: {
+            email: 'admin@example.com',
+            hashedPassword: 'x',
+            salt: 'x',
+            fullName: 'Org Admin',
+          },
+        },
+      },
+    },
+    pending: {
+      data: {
+        role: 'admin',
+        invitationToken: 'invite-token',
+        organization: { connect: { slug: 'acme-inc' } },
+      },
+    },
+  },
+})
+
+export type StandardScenario = ScenarioData<Organization, 'organization', 'acme'> &
+  ScenarioData<Membership, 'membership', 'owner' | 'admin' | 'pending'>

package/dist/commands/setup/tenancy/templates/organizations.sdl.ts.template

@@ -0,0 +1,89 @@
+export const schema = gql`
+  type Organization {
+    id: String!
+    name: String!
+    slug: String!
+    createdAt: DateTime!
+    updatedAt: DateTime!
+  }
+
+  type Membership {
+    id: String!
+    role: String!
+    userId: String
+    organizationId: String!
+    invitedById: String
+    createdAt: DateTime!
+    updatedAt: DateTime!
+    organization: Organization!
+  }
+
+  """
+  inviteMember's result. invitationToken is deliberately not a Membership
+  field: Membership is readable by any member (myMemberships, removeMember),
+  and a selectable invitationToken there would let any member read a
+  pending invitation's token and claim it themselves. Invitation exists only
+  as inviteMember's return type, so the token reaches only the caller who
+  just created the invitation -- the one the generated flow expects to email
+  it onward.
+  """
+  type Invitation {
+    membership: Membership!
+    invitationToken: String!
+  }
+
+  input CreateOrganizationInput {
+    name: String!
+  }
+
+  input InviteMemberInput {
+    email: String!
+    role: String!
+  }
+
+  type Query {
+    "Every membership belonging to the signed-in user, across all organizations they belong to."
+    myMemberships: [Membership!]! @requireAuth
+
+    "The current organization, resolved by resolveCurrentOrg for this request."
+    organization(id: String!): Organization @requireMembership
+  }
+
+  type Mutation {
+    "Creates a new organization with the caller as its owner."
+    createOrganization(input: CreateOrganizationInput!): Organization!
+      @requireAuth
+
+    """
+    Creates a pending membership (an invitation) in the current organization,
+    for a role the caller's own role may grant (see ROLE_GRANTS in
+    organizations.ts) -- an admin can invite an admin or a member, but not an
+    owner. The app is responsible for emailing input.email a link built from
+    the returned invitationToken; Membership has no email column of its own.
+    Web callers must call reauthenticate() from useAuth() in onCompleted so
+    the invite shows up if the inviter is also the invitee.
+    """
+    inviteMember(input: InviteMemberInput!): Invitation!
+      @requireMembership(roles: ["owner", "admin"])
+
+    """
+    Attaches the pending membership matching token to the signed-in user, or
+    is a no-op if it is already attached to them. Throws if the token is
+    invalid or was already claimed by someone else.
+    Web callers must call reauthenticate() from useAuth() in onCompleted so
+    the new membership is reflected in currentUser.memberships.
+    """
+    acceptInvitation(token: String!): Organization! @requireAuth
+
+    """
+    Removes a membership from the current organization, for a role the
+    caller's own role may grant (the same rule inviteMember uses) -- an
+    admin can never remove an owner, and an organization's last owner can
+    never be removed.
+    Web callers must call reauthenticate() from useAuth() in onCompleted when
+    removing their own membership.
+    """
+    removeMember(membershipId: String!): Membership!
+      @requireMembership(roles: ["owner", "admin"])
+  }
+`

package/dist/commands/setup/tenancy/templates/organizations.test.ts.template

@@ -0,0 +1,389 @@
+import { setContext } from '@cedarjs/context'
+
+import { db } from 'src/lib/db'
+
+import {
+  myMemberships,
+  organization,
+  inviteMember,
+  acceptInvitation,
+  removeMember,
+  ensureDefaultOrganization,
+} from './organizations.js'
+import type { StandardScenario } from './organizations.scenarios.js'
+
+// Generated boilerplate tests do not account for all circumstances and can
+// fail without adjustments, e.g. a `User` model shaped by a different auth
+// provider than the dbAuth one this scenario assumes. Please refer to the
+// CedarJS Testing Docs:
+//       https://cedarjs.com/docs/testing#testing-services
+
+/**
+ * `context.currentUser` is typed from this app's `getCurrentUser`, which
+ * selects more fields than these tests need.
+ */
+const asCurrentUser = (user: { id: string; memberships?: unknown[] }) =>
+  user as unknown as typeof context.currentUser
+
+/**
+ * Sets `context.currentUser` and `context.currentOrg` the way the GraphQL
+ * `context` function does for an authenticated, in-organization request.
+ */
+const asMember = (
+  scenario: StandardScenario,
+  membership: { id: string; userId: string | null; role: string },
+) => {
+  setContext({
+    currentUser: asCurrentUser({ id: membership.userId! }),
+    currentOrg: {
+      id: scenario.organization.acme.id,
+      slug: scenario.organization.acme.slug,
+      role: membership.role,
+      membershipId: membership.id,
+    },
+  })
+}
+
+describe('organizations service', () => {
+  scenario(
+    "myMemberships returns the signed-in user's memberships",
+    async (scenario: StandardScenario) => {
+      setContext({
+        currentUser: asCurrentUser({ id: scenario.membership.owner.userId! }),
+      })
+
+      const result = await myMemberships()
+
+      expect(result).toHaveLength(1)
+      expect(result[0]).toMatchObject({ id: scenario.membership.owner.id })
+    },
+  )
+
+  scenario(
+    'organization returns the current organization',
+    async (scenario: StandardScenario) => {
+      asMember(scenario, scenario.membership.owner)
+
+      const result = await organization({ id: scenario.organization.acme.id })
+
+      expect(result?.id).toEqual(scenario.organization.acme.id)
+    },
+  )
+
+  scenario(
+    'organization refuses an id other than the current organization',
+    async (scenario: StandardScenario) => {
+      asMember(scenario, scenario.membership.owner)
+
+      await expect(organization({ id: 'some-other-org' })).rejects.toThrow()
+    },
+  )
+
+  describe('inviteMember', () => {
+    scenario(
+      'an owner can invite a member',
+      async (scenario: StandardScenario) => {
+        asMember(scenario, scenario.membership.owner)
+
+        const result = await inviteMember({
+          input: { email: 'new-member@example.com', role: 'member' },
+        })
+
+        expect(result.invitationToken).toBeTruthy()
+
+        // `Invitation.membership` is resolver-backed like any relation
+        // field, so its generated type allows a promise; read the row back
+        // from `db` instead of asserting on `result.membership` directly.
+        const created = await db.membership.findFirst({
+          where: { invitedById: scenario.membership.owner.id },
+        })
+
+        expect(created?.role).toEqual('member')
+        expect(created?.invitationToken).toEqual(result.invitationToken)
+      },
+    )
+
+    scenario(
+      'an admin cannot invite an owner',
+      async (scenario: StandardScenario) => {
+        asMember(scenario, scenario.membership.admin)
+
+        await expect(
+          inviteMember({
+            input: { email: 'new-owner@example.com', role: 'owner' },
+          }),
+        ).rejects.toThrow()
+      },
+    )
+
+    scenario(
+      'an unknown role is rejected',
+      async (scenario: StandardScenario) => {
+        asMember(scenario, scenario.membership.owner)
+
+        await expect(
+          inviteMember({
+            input: { email: 'typo@example.com', role: 'superadmin' },
+          }),
+        ).rejects.toThrow()
+      },
+    )
+  })
+
+  describe('removeMember', () => {
+    scenario(
+      'an owner can remove an admin',
+      async (scenario: StandardScenario) => {
+        asMember(scenario, scenario.membership.owner)
+
+        await removeMember({ membershipId: scenario.membership.admin.id })
+
+        const remaining = await db.membership.findUnique({
+          where: { id: scenario.membership.admin.id },
+        })
+
+        expect(remaining).toBeNull()
+      },
+    )
+
+    scenario(
+      'an admin cannot remove an owner',
+      async (scenario: StandardScenario) => {
+        asMember(scenario, scenario.membership.admin)
+
+        await expect(
+          removeMember({ membershipId: scenario.membership.owner.id }),
+        ).rejects.toThrow()
+      },
+    )
+
+    scenario(
+      "the organization's last owner cannot be removed",
+      async (scenario: StandardScenario) => {
+        asMember(scenario, scenario.membership.owner)
+
+        await expect(
+          removeMember({ membershipId: scenario.membership.owner.id }),
+        ).rejects.toThrow()
+      },
+    )
+
+    scenario(
+      'an unclaimed owner invitation does not count as the remaining owner',
+      async (scenario: StandardScenario) => {
+        asMember(scenario, scenario.membership.owner)
+
+        // Nobody has accepted this one yet, so it leaves the organization
+        // with no owner who can administer it.
+        await db.membership.create({
+          data: {
+            role: 'owner',
+            organizationId: scenario.organization.acme.id,
+            invitationToken: 'pending-owner-token',
+          },
+        })
+
+        await expect(
+          removeMember({ membershipId: scenario.membership.owner.id }),
+        ).rejects.toThrow()
+      },
+    )
+
+    scenario(
+      'an owner can be removed once another owner has accepted',
+      async (scenario: StandardScenario) => {
+        asMember(scenario, scenario.membership.owner)
+
+        const second = await db.user.create({
+          data: {
+            email: 'second-owner@example.com',
+            hashedPassword: 'x',
+            salt: 'x',
+            fullName: 'Second Owner',
+          },
+        })
+        await db.membership.create({
+          data: {
+            role: 'owner',
+            organizationId: scenario.organization.acme.id,
+            userId: second.id,
+          },
+        })
+
+        const result = await removeMember({
+          membershipId: scenario.membership.owner.id,
+        })
+
+        expect(result.id).toEqual(scenario.membership.owner.id)
+        await expect(
+          db.membership.findUnique({
+            where: { id: scenario.membership.owner.id },
+          }),
+        ).resolves.toBeNull()
+      },
+    )
+  })
+
+  describe('acceptInvitation', () => {
+    scenario(
+      'attaches a pending invitation to the signed-in user',
+      async (scenario: StandardScenario) => {
+        const invitee = await db.user.create({
+          data: {
+            email: 'invitee@example.com',
+            hashedPassword: 'x',
+            salt: 'x',
+            fullName: 'Invitee',
+          },
+        })
+
+        setContext({ currentUser: asCurrentUser({ id: invitee.id }) })
+
+        const result = await acceptInvitation({
+          token: scenario.membership.pending.invitationToken!,
+        })
+
+        expect(result.id).toEqual(scenario.organization.acme.id)
+      },
+    )
+
+    scenario(
+      'a repeat call from the same user still succeeds',
+      async (scenario: StandardScenario) => {
+        const invitee = await db.user.create({
+          data: {
+            email: 'invitee@example.com',
+            hashedPassword: 'x',
+            salt: 'x',
+            fullName: 'Invitee',
+          },
+        })
+
+        setContext({ currentUser: asCurrentUser({ id: invitee.id }) })
+
+        const token = scenario.membership.pending.invitationToken!
+
+        const first = await acceptInvitation({ token })
+        const second = await acceptInvitation({ token })
+
+        expect(second.id).toEqual(first.id)
+      },
+    )
+
+    scenario(
+      'a second user cannot claim an already-claimed token',
+      async (scenario: StandardScenario) => {
+        const firstUser = await db.user.create({
+          data: {
+            email: 'first@example.com',
+            hashedPassword: 'x',
+            salt: 'x',
+            fullName: 'First User',
+          },
+        })
+        const secondUser = await db.user.create({
+          data: {
+            email: 'second@example.com',
+            hashedPassword: 'x',
+            salt: 'x',
+            fullName: 'Second User',
+          },
+        })
+
+        const token = scenario.membership.pending.invitationToken!
+
+        setContext({ currentUser: asCurrentUser({ id: firstUser.id }) })
+        await acceptInvitation({ token })
+
+        setContext({ currentUser: asCurrentUser({ id: secondUser.id }) })
+        await expect(acceptInvitation({ token })).rejects.toThrow()
+      },
+    )
+
+    scenario(
+      'clears the invitation token once claimed',
+      async (scenario: StandardScenario) => {
+        const invitee = await db.user.create({
+          data: {
+            email: 'invitee@example.com',
+            hashedPassword: 'x',
+            salt: 'x',
+            fullName: 'Invitee',
+          },
+        })
+
+        const token = scenario.membership.pending.invitationToken!
+
+        setContext({ currentUser: asCurrentUser({ id: invitee.id }) })
+        await acceptInvitation({ token })
+
+        const claimed = await db.membership.findUnique({
+          where: { id: scenario.membership.pending.id },
+        })
+
+        expect(claimed?.userId).toEqual(invitee.id)
+        expect(claimed?.invitationToken).not.toEqual(token)
+      },
+    )
+
+    it('rejects a token that never matched a pending invitation', async () => {
+      setContext({ currentUser: asCurrentUser({ id: 'some-user-id' }) })
+
+      await expect(
+        acceptInvitation({ token: 'not-a-real-token' }),
+      ).rejects.toThrow()
+    })
+  })
+
+  it('ensureDefaultOrganization is idempotent when the user already has memberships', async () => {
+    const existingMemberships = [
+      { id: 'membership-1', organizationId: 'org-1', role: 'owner' },
+    ]
+
+    const result = await ensureDefaultOrganization({
+      currentUser: { id: 'user-1', memberships: existingMemberships },
+    })
+
+    expect(result).toBe(existingMemberships)
+  })
+
+  scenario(
+    'ensureDefaultOrganization attaches a pending invitation',
+    async (scenario: StandardScenario) => {
+      const invitee = await db.user.create({
+        data: {
+          email: 'invitee@example.com',
+          hashedPassword: 'x',
+          salt: 'x',
+          fullName: 'Invitee',
+        },
+      })
+
+      const result = await ensureDefaultOrganization({
+        currentUser: { id: invitee.id, memberships: [] },
+        invitationToken: scenario.membership.pending.invitationToken,
+      })
+
+      expect(result).toHaveLength(1)
+      expect(result[0].organizationId).toEqual(scenario.organization.acme.id)
+    },
+  )
+
+  it('ensureDefaultOrganization creates a new organization when there is no invitation', async () => {
+    const newUser = await db.user.create({
+      data: {
+        email: 'brand-new@example.com',
+        hashedPassword: 'x',
+        salt: 'x',
+        fullName: 'Brand New',
+      },
+    })
+
+    const result = await ensureDefaultOrganization({
+      currentUser: { id: newUser.id, memberships: [] },
+    })
+
+    expect(result).toHaveLength(1)
+    expect(result[0].role).toEqual('owner')
+  })
+})