@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/tests/cases/integration/mocked/confirmOtpMutation.test.ts

@@ -1,10 +1,10 @@
-import { authenticatedIdentityId, executeTenantTest, now } from '../../../src/testTenant'
-import { testUuid } from '../../../src/testUuid'
-import { getPersonByIdentity } from './sql/getPersonByIdentity'
-import { confirmOtpMutation } from './gql/confirmOtp'
-import { ConfirmOtpErrorCode } from '../../../../src/schema'
+import { authenticatedIdentityId, executeTenantTest, now } from '../../../src/testTenant.js'
+import { testUuid } from '../../../src/testUuid.js'
+import { getPersonByIdentity } from './sql/getPersonByIdentity.js'
+import { generateBackupCodesSql } from './sql/generateBackupCodesSql.js'
+import { confirmOtpMutation } from './gql/confirmOtp.js'
 import { expect, test } from 'bun:test'
-import { OtpAuthenticator } from '../../../../src'
+import { OtpAuthenticator } from '../../../../src/index.js'
 import { Buffer } from 'buffer'
 
 test('confirm otp mutation with valid code', async () => {
@@ -22,33 +22,58 @@ test('confirm otp mutation with valid code', async () => {
 				response: {
 					personId,
 					password: '123',
-					otpUri: otp.uri,
+					otpPendingUri: otp.uri,
 					roles: [],
 					email: 'john@doe.com',
 				},
 			}),
 			{
-				sql: `update "tenant"."person" set "otp_activated_at" = ? where "id" = ?`,
-				parameters: [now, personId],
+				sql: `update "tenant"."person_mfa"
+					set "totp_secret" = "totp_pending_secret", "totp_secret_version" = "totp_pending_version", "totp_activated_at" = ?, "totp_pending_secret" = ?, "totp_pending_version" = ?, "totp_pending_created_at" = ?
+					where "person_id" = ? and "totp_pending_secret" is not null`,
+				parameters: [now, null, null, null, personId],
 				response: {
 					rowCount: 1,
 				},
 			},
+			...generateBackupCodesSql({ personId, firstUuidIndex: 1 }),
 		],
 		return: {
 			data: {
 				confirmOtp: {
 					ok: true,
 					errors: [],
+					result: {
+						backupCodes: [
+							'aaaaa-aaaaa',
+							'aaaaa-aaaaa',
+							'aaaaa-aaaaa',
+							'aaaaa-aaaaa',
+							'aaaaa-aaaaa',
+							'aaaaa-aaaaa',
+							'aaaaa-aaaaa',
+							'aaaaa-aaaaa',
+							'aaaaa-aaaaa',
+							'aaaaa-aaaaa',
+						],
+					},
 				},
 			},
 		},
-		expectedAuthLog: expect.objectContaining({
-			type: '2fa_enable',
-			response: expect.objectContaining({
-				ok: true,
+		expectedAuthLog: [
+			expect.objectContaining({
+				type: '2fa_enable',
+				response: expect.objectContaining({
+					ok: true,
+				}),
 			}),
-		}),
+			expect.objectContaining({
+				type: 'backup_code_generated',
+				response: expect.objectContaining({
+					ok: true,
+				}),
+			}),
+		],
 	})
 })
 
@@ -62,7 +87,7 @@ test('confirm otp mutation with invalid code', async () => {
 				response: {
 					personId,
 					password: '123',
-					otpUri: 'otpauth://totp/contember:john?secret=ABDEF&period=30&digits=6&algorithm=SHA1&issuer=contember',
+					otpPendingUri: 'otpauth://totp/contember:john?secret=ABDEF&period=30&digits=6&algorithm=SHA1&issuer=contember',
 					roles: [],
 					email: 'john@doe.com',
 				},
@@ -73,6 +98,7 @@ test('confirm otp mutation with invalid code', async () => {
 				confirmOtp: {
 					ok: false,
 					errors: [{ code: 'INVALID_OTP_TOKEN' }],
+					result: null,
 				},
 			},
 		},

package/tests/cases/integration/mocked/createApiKeyMutation.test.ts

@@ -1,15 +1,15 @@
-import { testUuid } from '../../../src/testUuid'
-import { executeTenantTest } from '../../../src/testTenant'
-import { SQL } from '../../../src/tags'
-import { selectMembershipsSql } from './sql/selectMembershipsSql'
-import { createApiKeyMutation } from './gql/createApiKey'
-import { getProjectBySlugSql } from './sql/getProjectBySlugSql'
-import { createMembershipSql } from './sql/createMembershipSql'
-import { createMembershipVariableSql } from './sql/createMembershipVariableSql'
-import { createIdentitySql } from './sql/createIdentitySql'
-import { createApiKeySql } from './sql/createApiKeySql'
-import { getProjectMembershipSql } from './sql/getProjectMembershipSql'
-import { sqlTransaction } from './sql/sqlTransaction'
+import { testUuid } from '../../../src/testUuid.js'
+import { executeTenantTest } from '../../../src/testTenant.js'
+import { SQL } from '../../../src/tags.js'
+import { selectMembershipsSql } from './sql/selectMembershipsSql.js'
+import { createApiKeyMutation } from './gql/createApiKey.js'
+import { getProjectBySlugSql } from './sql/getProjectBySlugSql.js'
+import { createMembershipSql } from './sql/createMembershipSql.js'
+import { createMembershipVariableSql } from './sql/createMembershipVariableSql.js'
+import { createIdentitySql } from './sql/createIdentitySql.js'
+import { createApiKeySql } from './sql/createApiKeySql.js'
+import { getProjectMembershipSql } from './sql/getProjectMembershipSql.js'
+import { sqlTransaction } from './sql/sqlTransaction.js'
 import { test } from 'bun:test'
 
 test('create api key', async () => {
@@ -71,5 +71,22 @@ test('create api key', async () => {
 				},
 			},
 		},
+		expectedAuthLog: {
+			type: 'api_key_create',
+			response: { ok: true, result: null },
+			eventData: {
+				scope: 'project',
+				projectSlug,
+				apiKeyId,
+				identityId,
+				description: 'test key',
+				memberships: [
+					{
+						role,
+						variables: [{ name: 'language', values: [languageId] }],
+					},
+				],
+			},
+		},
 	})
 })

package/tests/cases/integration/mocked/createSessionKeyMutation.test.ts

@@ -1,13 +1,16 @@
-import { executeTenantTest } from '../../../src/testTenant'
-import { SQL } from '../../../src/tags'
-import { testUuid } from '../../../src/testUuid'
-import { selectMembershipsSql } from './sql/selectMembershipsSql'
-import { getPersonByEmailSql } from './sql/getPersonByEmailSql'
+import { executeTenantTest } from '../../../src/testTenant.js'
+import { SQL } from '../../../src/tags.js'
+import { testUuid } from '../../../src/testUuid.js'
+import { selectMembershipsSql } from './sql/selectMembershipsSql.js'
+import { getPersonByEmailSql } from './sql/getPersonByEmailSql.js'
 import { expect, test } from 'bun:test'
-import { getIdentityProjectsSql } from './sql/getIdentityProjectsSql'
-import { createSessionTokenMutation } from './gql/createSessionToken'
-import { createSessionKeySql } from './sql/createSessionKeySql'
-import { getConfigSql } from './sql/getConfigSql'
+import { getIdentityProjectsSql } from './sql/getIdentityProjectsSql.js'
+import { createSessionTokenMutation } from './gql/createSessionToken.js'
+import { createSessionKeySql } from './sql/createSessionKeySql.js'
+import { getConfigSql } from './sql/getConfigSql.js'
+import { getIdentityByIdSql } from './sql/getIdentityByIdSql.js'
+import { getAuthPoliciesSql } from './sql/authPolicySql.js'
+import { getIdentityProjectMembershipPresenceSql } from './sql/getIdentityProjectMembershipPresenceSql.js'
 
 test('create session key', async () => {
 	const email = 'john@doe.com'
@@ -19,7 +22,10 @@ test('create session key', async () => {
 		query: createSessionTokenMutation({ email }, { withData: true }),
 		executes: [
 			getPersonByEmailSql({ email, response: { personId, identityId, password: 'aaa', roles: [] } }),
+			getIdentityProjectMembershipPresenceSql(identityId),
 			getConfigSql(),
+			getIdentityByIdSql({ identityId }),
+			getAuthPoliciesSql(),
 			createSessionKeySql({ apiKeyId: apiKeyId, identityId: identityId }),
 			getIdentityProjectsSql({ identityId: identityId, projectId: projectId }),
 			selectMembershipsSql({
@@ -64,3 +70,34 @@ test('create session key', async () => {
 		}),
 	})
 })
+
+test('create session key is refused for a disabled person', async () => {
+	const email = 'john@doe.com'
+	const identityId = testUuid(2)
+	const personId = testUuid(7)
+	await executeTenantTest({
+		query: createSessionTokenMutation({ email }),
+		executes: [
+			getPersonByEmailSql({
+				email,
+				response: { personId, identityId, password: 'aaa', roles: [], disabledAt: new Date() },
+			}),
+		],
+		return: {
+			data: {
+				createSessionToken: {
+					ok: false,
+					error: { code: 'PERSON_DISABLED' },
+					result: null,
+				},
+			},
+		},
+		expectedAuthLog: expect.objectContaining({
+			type: 'create_session_token',
+			response: expect.objectContaining({
+				ok: false,
+				error: 'PERSON_DISABLED',
+			}),
+		}),
+	})
+})

package/tests/cases/integration/mocked/customRoleCrud.test.ts

@@ -0,0 +1,442 @@
+import { expect, test } from 'bun:test'
+import { executeTenantTest, now } from '../../../src/testTenant.js'
+import { GQL, SQL } from '../../../src/tags.js'
+import { testUuid } from '../../../src/testUuid.js'
+import { sqlReadCommittedTransaction } from './sql/sqlTransaction.js'
+
+const listGrantInput = [{ permission: 'person:list' }]
+const listGrant = [{ permission: 'person:list', config: null }]
+
+const customRoleRow = (
+	slug: string,
+	grants: readonly object[],
+	description: string | null = null,
+) => ({
+	id: testUuid(50),
+	slug,
+	description,
+	grants,
+	created_at: now,
+	updated_at: now,
+})
+
+const identitiesHoldingRoleQuery = (role: string, count: number) => ({
+	sql: SQL`select count(*)::int as "count"  from "tenant"."identity" where roles \\? ?`,
+	parameters: [role],
+	response: { rows: [{ count }] },
+})
+
+test('createCustomRole stores canonical grants and audits the full role state', async () => {
+	await executeTenantTest({
+		query: {
+			query: GQL`mutation($slug: String!, $grants: [CustomRoleGrantInput!]!) {
+				createCustomRole(slug: $slug, grants: $grants) { ok error { code } }
+			}`,
+			variables: { slug: 'support', grants: listGrantInput },
+		},
+		executes: [
+			...sqlReadCommittedTransaction(
+				{
+					sql: SQL`select *  from "tenant"."custom_role" where "slug" in (?)  order by "slug" asc`,
+					parameters: ['support'],
+					response: { rows: [] },
+				},
+				identitiesHoldingRoleQuery('support', 0),
+				{
+					sql: SQL`insert into  "tenant"."custom_role" ("id", "slug", "description", "grants", "created_at", "updated_at")
+						values  (?, ?, ?, ?, ?, ?)`,
+					parameters: [testUuid(1), 'support', null, JSON.stringify(listGrant), now, now],
+					response: { rowCount: 1 },
+				},
+			),
+		],
+		return: {
+			data: { createCustomRole: { ok: true, error: null } },
+		},
+		expectedAuthLog: {
+			type: 'custom_role_change',
+			response: { ok: true, result: null },
+			eventData: {
+				operation: 'create',
+				after: { slug: 'support', description: null, grants: listGrant },
+			},
+		},
+	})
+})
+
+test('createCustomRole rejects invalid and duplicate grant definitions', async () => {
+	await executeTenantTest({
+		query: {
+			query: GQL`mutation($slug: String!, $grants: [CustomRoleGrantInput!]!) {
+				createCustomRole(slug: $slug, grants: $grants) { ok error { code } }
+			}`,
+			variables: {
+				slug: 'support',
+				grants: [{ permission: 'person:list' }, { permission: 'person:list' }],
+			},
+		},
+		executes: [...sqlReadCommittedTransaction()],
+		return: {
+			data: {
+				createCustomRole: {
+					ok: false,
+					error: { code: 'DUPLICATE_PERMISSION' },
+				},
+			},
+		},
+	})
+
+	await executeTenantTest({
+		query: {
+			query: GQL`mutation($slug: String!, $grants: [CustomRoleGrantInput!]!) {
+				createCustomRole(slug: $slug, grants: $grants) { ok error { code } }
+			}`,
+			variables: {
+				slug: 'support',
+				grants: [{ permission: 'identity:addGlobalRoles' }],
+			},
+		},
+		executes: [...sqlReadCommittedTransaction()],
+		return: {
+			data: {
+				createCustomRole: {
+					ok: false,
+					error: { code: 'INVALID_PERMISSION_CONFIGURATION' },
+				},
+			},
+		},
+	})
+})
+
+test('createCustomRole rejects nonexistent role references', async () => {
+	await executeTenantTest({
+		query: {
+			query: GQL`mutation($slug: String!, $grants: [CustomRoleGrantInput!]!) {
+				createCustomRole(slug: $slug, grants: $grants) { ok error { code } }
+			}`,
+			variables: {
+				slug: 'support',
+				grants: [{
+					permission: 'person:signUp',
+					config: { roles: { allowed: ['ghost'] } },
+				}],
+			},
+		},
+		executes: [
+			...sqlReadCommittedTransaction({
+				sql: SQL`select *  from "tenant"."custom_role" where "slug" in (?)  order by "slug" asc for share`,
+				parameters: ['ghost'],
+				response: { rows: [] },
+			}),
+		],
+		return: {
+			data: {
+				createCustomRole: {
+					ok: false,
+					error: { code: 'INVALID_PERMISSION_CONFIGURATION' },
+				},
+			},
+		},
+	})
+})
+
+test('createCustomRole refuses a slug that identities already hold as a free-form role string', async () => {
+	await executeTenantTest({
+		query: {
+			query: GQL`mutation($slug: String!, $grants: [CustomRoleGrantInput!]!) {
+				createCustomRole(slug: $slug, grants: $grants) { ok error { code } }
+			}`,
+			variables: { slug: 'deployer', grants: listGrantInput },
+		},
+		executes: [
+			...sqlReadCommittedTransaction(
+				{
+					sql: SQL`select *  from "tenant"."custom_role" where "slug" in (?)  order by "slug" asc`,
+					parameters: ['deployer'],
+					response: { rows: [] },
+				},
+				identitiesHoldingRoleQuery('deployer', 2),
+			),
+		],
+		return: {
+			data: {
+				createCustomRole: {
+					ok: false,
+					error: { code: 'SLUG_ALREADY_ASSIGNED' },
+				},
+			},
+		},
+	})
+})
+
+test('createCustomRole rejects a slug that is already taken', async () => {
+	await executeTenantTest({
+		query: {
+			query: GQL`mutation($slug: String!, $grants: [CustomRoleGrantInput!]!) {
+				createCustomRole(slug: $slug, grants: $grants) { ok error { code } }
+			}`,
+			variables: { slug: 'support', grants: listGrantInput },
+		},
+		executes: [
+			...sqlReadCommittedTransaction({
+				sql: SQL`select *  from "tenant"."custom_role" where "slug" in (?)  order by "slug" asc`,
+				parameters: ['support'],
+				response: { rows: [customRoleRow('support', listGrant)] },
+			}),
+		],
+		return: {
+			data: {
+				createCustomRole: {
+					ok: false,
+					error: { code: 'SLUG_ALREADY_EXISTS' },
+				},
+			},
+		},
+	})
+})
+
+test('updateCustomRole stores canonical grants and audits before and after state', async () => {
+	const forceSignOutGrant = [{
+		permission: 'person:forceSignOut',
+		config: {
+			target: {
+				globalRoles: { allowed: ['person'] },
+				projectMemberships: 'none',
+			},
+		},
+	}]
+	await executeTenantTest({
+		query: {
+			query: GQL`mutation($slug: String!, $grants: [CustomRoleGrantInput!]) {
+				updateCustomRole(slug: $slug, grants: $grants) { ok error { code } }
+			}`,
+			variables: { slug: 'support', grants: forceSignOutGrant },
+		},
+		executes: [
+			...sqlReadCommittedTransaction(
+				{
+					sql: SQL`select *  from "tenant"."custom_role" where "slug" in (?)  order by "slug" asc for update`,
+					parameters: ['support'],
+					response: { rows: [customRoleRow('support', listGrant, 'Support team')] },
+				},
+				{
+					sql: SQL`update "tenant"."custom_role" set "grants" = ?, "updated_at" = ? where "slug" = ?`,
+					parameters: [JSON.stringify(forceSignOutGrant), now, 'support'],
+					response: { rowCount: 1 },
+				},
+			),
+		],
+		return: {
+			data: { updateCustomRole: { ok: true, error: null } },
+		},
+		expectedAuthLog: {
+			type: 'custom_role_change',
+			response: { ok: true, result: null },
+			eventData: {
+				operation: 'update',
+				before: { slug: 'support', description: 'Support team', grants: listGrant },
+				after: { slug: 'support', description: 'Support team', grants: forceSignOutGrant },
+			},
+		},
+	})
+})
+
+test('updateCustomRole rejects an explicit null grants value', async () => {
+	await executeTenantTest({
+		query: {
+			query: GQL`mutation($slug: String!, $grants: [CustomRoleGrantInput!]) {
+				updateCustomRole(slug: $slug, grants: $grants) { ok error { code } }
+			}`,
+			variables: { slug: 'support', grants: null },
+		},
+		executes: [
+			...sqlReadCommittedTransaction({
+				sql: SQL`select *  from "tenant"."custom_role" where "slug" in (?)  order by "slug" asc for update`,
+				parameters: ['support'],
+				response: { rows: [customRoleRow('support', listGrant)] },
+			}),
+		],
+		return: {
+			data: {
+				updateCustomRole: {
+					ok: false,
+					error: { code: 'INVALID_PERMISSION_CONFIGURATION' },
+				},
+			},
+		},
+	})
+})
+
+test('deleteCustomRole removes the role and every stale assignment atomically', async () => {
+	await executeTenantTest({
+		query: {
+			query: GQL`mutation($slug: String!) {
+				deleteCustomRole(slug: $slug) { ok error { code } }
+			}`,
+			variables: { slug: 'support' },
+		},
+		executes: [
+			...sqlReadCommittedTransaction(
+				{
+					sql: SQL`select *  from "tenant"."custom_role" where "slug" in (?)  order by "slug" asc for update`,
+					parameters: ['support'],
+					response: { rows: [customRoleRow('support', listGrant, 'Support team')] },
+				},
+				{
+					// no FK can reach a reference buried in another role's grants jsonb, so it is scanned
+					sql: SQL`select *  from "tenant"."custom_role" order by "slug" asc`,
+					parameters: [],
+					response: { rows: [customRoleRow('support', listGrant, 'Support team')] },
+				},
+				{
+					sql: SQL`delete from  "tenant"."custom_role"  where "slug" = ?`,
+					parameters: ['support'],
+					response: { rowCount: 1 },
+				},
+				{
+					sql: SQL`update  "tenant"."identity" set  "roles" =  roles - ?  where roles \\? ?  returning "id"`,
+					parameters: ['support', 'support'],
+					response: { rows: [{ id: testUuid(60) }, { id: testUuid(61) }] },
+				},
+			),
+		],
+		return: {
+			data: { deleteCustomRole: { ok: true, error: null } },
+		},
+		expectedAuthLog: {
+			type: 'custom_role_change',
+			response: { ok: true, result: null },
+			eventData: {
+				operation: 'delete',
+				before: { slug: 'support', description: 'Support team', grants: listGrant },
+				removedAssignments: 2,
+				removedAssignmentIdentityIds: [testUuid(60), testUuid(61)],
+			},
+		},
+	})
+})
+
+test('deleteCustomRole refuses a role another role references and leaves both intact', async () => {
+	const referencingGrant = [{
+		permission: 'identity:addGlobalRoles',
+		config: {
+			roles: { allowed: ['support'] },
+			target: { globalRoles: { allowed: ['person'] }, projectMemberships: 'any' },
+			allowSelf: false,
+		},
+	}]
+	await executeTenantTest({
+		query: {
+			query: GQL`mutation($slug: String!) {
+				deleteCustomRole(slug: $slug) { ok error { code developerMessage } }
+			}`,
+			variables: { slug: 'support' },
+		},
+		executes: [
+			...sqlReadCommittedTransaction(
+				{
+					sql: SQL`select *  from "tenant"."custom_role" where "slug" in (?)  order by "slug" asc for update`,
+					parameters: ['support'],
+					response: { rows: [customRoleRow('support', listGrant)] },
+				},
+				{
+					sql: SQL`select *  from "tenant"."custom_role" order by "slug" asc`,
+					parameters: [],
+					response: {
+						rows: [customRoleRow('manager', referencingGrant), customRoleRow('support', listGrant)],
+					},
+				},
+			),
+		],
+		// no DELETE and no identity UPDATE follow — the guard runs before either
+		return: {
+			data: {
+				deleteCustomRole: {
+					ok: false,
+					error: {
+						code: 'ROLE_IN_USE',
+						developerMessage: 'Custom role support is referenced by the grant configuration of manager',
+					},
+				},
+			},
+		},
+	})
+})
+
+test('customRoles returns full grants and the catalog describes configuration requirements', async () => {
+	await executeTenantTest({
+		query: {
+			query: GQL`query {
+				customRoles { slug description grants { permission config } }
+				customRolePermissions { name configurationKind configurationRequired defaultConfig }
+			}`,
+			variables: {},
+		},
+		executes: [
+			{
+				sql: SQL`select *  from "tenant"."custom_role" order by "slug" asc`,
+				parameters: [],
+				response: { rows: [customRoleRow('support', listGrant, 'Support team')] },
+			},
+		],
+		return: (response: object) => {
+			expect(response).toHaveProperty('data.customRoles', [
+				{ slug: 'support', description: 'Support team', grants: listGrant },
+			])
+			expect(response).toHaveProperty('data.customRolePermissions')
+			const serialized = JSON.stringify(response)
+			expect(serialized).toContain('"name":"identity:addGlobalRoles"')
+			expect(serialized).toContain('"configurationKind":"ROLE_MUTATION"')
+			expect(serialized).not.toContain('"name":"project:addMember"')
+		},
+	})
+})
+
+test('customRoles reports a persisted-invalid role as inert', async () => {
+	await executeTenantTest({
+		query: GQL`query {
+			customRoles { slug grants { permission config } }
+		}`,
+		executes: [{
+			sql: SQL`select *  from "tenant"."custom_role" order by "slug" asc`,
+			parameters: [],
+			response: {
+				rows: [customRoleRow('support', [
+					...listGrant,
+					{ permission: 'person:changePassword', config: { target: 'invalid' } },
+				])],
+			},
+		}],
+		return: {
+			data: {
+				customRoles: [{ slug: 'support', grants: [] }],
+			},
+		},
+	})
+})
+
+// `customRole:manage` is the single rail stopping a delegated principal from writing its own
+// permission bundle. These run through the REAL authorization stack (`identityRoles`), so
+// dropping any of the three `requireAccess` calls in CustomRoleMutationResolver turns them red.
+test.each([
+	[
+		'createCustomRole',
+		GQL`mutation { createCustomRole(slug: "escalated", grants: [{ permission: "person:list" }]) { ok } }`,
+	],
+	[
+		'updateCustomRole',
+		GQL`mutation { updateCustomRole(slug: "support", grants: [{ permission: "person:list" }]) { ok } }`,
+	],
+	['deleteCustomRole', GQL`mutation { deleteCustomRole(slug: "support") { ok } }`],
+])('%s is refused to project_admin and touches no data', async (field, query) => {
+	await executeTenantTest({
+		identityRoles: ['project_admin'],
+		query,
+		// project_admin is builtin-only, so the request-scoped custom_role preload is skipped too
+		executes: [],
+		return: {
+			data: { [field]: null },
+			errors: [{ message: 'You are not allowed to manage custom roles' }],
+		},
+	})
+})

package/tests/cases/integration/mocked/disableApiKeyMutation.ts

@@ -1,7 +1,7 @@
-import { executeTenantTest } from '../../../src/testTenant'
-import { GQL } from '../../../src/tags'
-import { testUuid } from '../../../src/testUuid'
-import { disableApiKey } from './sql/disableApiKeySql'
+import { executeTenantTest } from '../../../src/testTenant.js'
+import { GQL } from '../../../src/tags.js'
+import { testUuid } from '../../../src/testUuid.js'
+import { disableApiKey } from './sql/disableApiKeySql.js'
 import { test } from 'bun:test'
 
 test('disable api key', async () => {