@critical-path/core 0.36.0 → 0.37.0

package/src/engine/authorization.test.ts

@@ -1,199 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import {
-  CriticalPathEngine,
-  SQLiteStore,
-  InMemoryFileStore,
-  createRolePolicy,
-  ForbiddenError,
-  NotFoundError,
-  type ProjectMember
-} from '../index.js';
-
-async function setup(members: ProjectMember[]) {
-  const engine = new CriticalPathEngine({ authorize: createRolePolicy() });
-  const project = await engine.createProject({ key: 'RB', name: 'RBAC', members });
-  const task = await engine.createTask({ projectId: project.id, title: 'Task' });
-  return { engine, project, task };
-}
-
-describe('role-based authorization (createRolePolicy)', () => {
-  it('lets viewers read but not write', async () => {
-    const { engine, project, task } = await setup([{ userId: 'vic', role: 'viewer' }]);
-    const vic = engine.withActor({ userId: 'vic' });
-
-    expect(await vic.getProject(project.id)).not.toBeNull();
-    expect(await vic.getTasks(project.id)).toHaveLength(1);
-    await expect(vic.createTask({ projectId: project.id, title: 'Nope' })).rejects.toThrow(ForbiddenError);
-    await expect(vic.updateTask(task.id, { title: 'Nope' })).rejects.toThrow(ForbiddenError);
-    await expect(vic.addComment({ taskId: task.id, content: 'hi' })).rejects.toThrow(ForbiddenError);
-  });
-
-  it('lets contributors work on tasks but not delete them or manage the plan', async () => {
-    const { engine, project, task } = await setup([{ userId: 'cora', role: 'contributor' }]);
-    const cora = engine.withActor({ userId: 'cora' });
-
-    await cora.updateTask(task.id, { title: 'Progress' });
-    await cora.logTime({ taskId: task.id, hours: 1 });
-    await expect(cora.deleteTask(task.id)).rejects.toThrow(ForbiddenError);
-    await expect(cora.createIteration({ projectId: project.id, name: 'S1', status: 'planning' })).rejects.toThrow(ForbiddenError);
-    await expect(cora.updateProject(project.id, { name: 'Renamed' })).rejects.toThrow(ForbiddenError);
-  });
-
-  it('lets project managers delete tasks and manage members, and only admins delete projects', async () => {
-    const { engine, project, task } = await setup([
-      { userId: 'pam', role: 'project_manager' },
-      { userId: 'ada', role: 'admin' }
-    ]);
-    const pam = engine.withActor({ userId: 'pam' });
-
-    await pam.createIteration({ projectId: project.id, name: 'S1', status: 'planning' });
-    await pam.updateProject(project.id, { members: [...project.members!, { userId: 'new', role: 'viewer' }] });
-    expect(await pam.deleteTask(task.id)).toBe(true);
-    await expect(pam.deleteProject(project.id)).rejects.toThrow(ForbiddenError);
-
-    expect(await engine.withActor({ userId: 'ada' }).deleteProject(project.id)).toBe(true);
-  });
-
-  it('hides projects from non-members as if they did not exist', async () => {
-    const { engine, project, task } = await setup([]);
-    const eve = engine.withActor({ userId: 'eve' });
-
-    expect(await eve.getProjects()).toHaveLength(0);
-    expect(await eve.getProject(project.id)).toBeNull();
-    expect(await eve.getTask(task.id)).toBeNull();
-    expect(await eve.getTasks()).toHaveLength(0);
-    expect(await eve.getActivities({ projectId: project.id })).toHaveLength(0);
-    expect(await eve.updateTask(task.id, { title: 'x' })).toBeNull();
-    await expect(eve.createTask({ projectId: project.id, title: 'x' })).rejects.toThrow(NotFoundError);
-    await expect(eve.calculateCriticalPath(project.id)).rejects.toThrow(NotFoundError);
-  });
-
-  it('makes the creator an admin of new projects and denies anonymous creation', async () => {
-    const engine = new CriticalPathEngine({ authorize: createRolePolicy() });
-    const project = await engine.withActor({ userId: 'carl' }).createProject({ name: 'Mine' });
-    expect(project.members).toEqual([{ userId: 'carl', role: 'admin' }]);
-
-    await expect(engine.withActor({ userId: 'anonymous' }).createProject({ name: 'Nope' })).rejects.toThrow(ForbiddenError);
-  });
-
-  it('lets authors edit their own comments while moderators can edit anyone’s', async () => {
-    const { engine, task } = await setup([
-      { userId: 'a1', role: 'contributor' },
-      { userId: 'a2', role: 'contributor' },
-      { userId: 'pm', role: 'project_manager' }
-    ]);
-    const comment = await engine.withActor({ userId: 'a1' }).addComment({ taskId: task.id, content: 'mine' });
-
-    await engine.withActor({ userId: 'a1' }).updateComment(comment.id, { content: 'edited' });
-    await expect(engine.withActor({ userId: 'a2' }).updateComment(comment.id, { content: 'hijack' })).rejects.toThrow(ForbiddenError);
-    expect(await engine.withActor({ userId: 'pm' }).deleteComment(comment.id)).toBe(true);
-  });
-
-  it('treats workspace superusers as allowed everywhere and gates workspace management', async () => {
-    const { engine, project } = await setup([{ userId: 'mem', role: 'admin' }]);
-    const root = engine.withActor({ userId: 'root', roles: ['admin'] });
-
-    expect(await root.getProject(project.id)).not.toBeNull();
-    await root.createTeam({ name: 'Core', memberIds: [] });
-    await expect(engine.withActor({ userId: 'mem' }).createTeam({ name: 'Nope', memberIds: [] })).rejects.toThrow(ForbiddenError);
-  });
-
-  it('runs project deletion cascades without per-task checks', async () => {
-    const engine = new CriticalPathEngine({
-      authorize: createRolePolicy({ rolePermissions: { admin: ['project.read', 'project.delete'] } })
-    });
-    const project = await engine.createProject({ name: 'Cascade', members: [{ userId: 'ada', role: 'admin' }] });
-    const task = await engine.createTask({ projectId: project.id, title: 'Child' });
-
-    expect(await engine.withActor({ userId: 'ada' }).deleteProject(project.id)).toBe(true);
-    expect(await engine.getTask(task.id)).toBeNull();
-  });
-
-  it('keeps presigned uploads inside the project prefix', async () => {
-    const engine = new CriticalPathEngine({ authorize: createRolePolicy(), fileStorage: new InMemoryFileStore() });
-    const project = await engine.createProject({ name: 'Files', members: [{ userId: 'up', role: 'contributor' }] });
-    const up = engine.withActor({ userId: 'up' });
-
-    const presigned = await up.getPresignedAttachmentUploadUrl({ projectId: project.id, filename: 'spec.pdf' });
-    expect(presigned.storageKey).toMatch(new RegExp(`^projects/${project.id}/\\d+_[0-9a-f]+_spec\\.pdf$`));
-    await expect(up.getPresignedAttachmentUploadUrl({ filename: 'x' } as any)).rejects.toThrow(/projectId is required/);
-
-    const outsider = engine.withActor({ userId: 'nobody' });
-    await expect(outsider.getPresignedAttachmentUploadUrl({ projectId: project.id, filename: 'x' })).rejects.toThrow(/not found/);
-
-    // Registering someone else's file (so that deleting the attachment deletes it) is rejected
-    await expect(
-      up.createAttachment({ projectId: project.id, filename: 'x', url: 'https://e.com/x', mimeType: 'text/plain', sizeBytes: 1, storageKey: 'projects/other/secret.pdf' })
-    ).rejects.toThrow(/storageKey must be under/);
-    await expect(
-      up.createAttachment({ projectId: project.id, filename: 'x', url: 'https://e.com/x', mimeType: 'text/plain', sizeBytes: 1, storageKey: presigned.storageKey })
-    ).resolves.toMatchObject({ storageKey: presigned.storageKey });
-  });
-
-  it('leaves the base engine and views without a policy unrestricted', async () => {
-    const { engine, project } = await setup([]);
-    expect(await engine.getProject(project.id)).not.toBeNull();
-
-    const open = new CriticalPathEngine();
-    const p = await open.createProject({ name: 'Open' });
-    expect(await open.withActor({ userId: 'anyone' }).getProject(p.id)).not.toBeNull();
-  });
-});
-
-describe('tenant isolation', () => {
-  it('scopes projects, workflows and teams to the actor tenant and stamps new records', async () => {
-    const engine = new CriticalPathEngine();
-    const acme = engine.withActor({ userId: 'a', tenantId: 'acme' });
-    const globex = engine.withActor({ userId: 'g', tenantId: 'globex' });
-
-    const project = await acme.createProject({ name: 'Acme roadmap' });
-    expect(project.tenantId).toBe('acme');
-    const workflow = await acme.createWorkflow({ name: 'Acme flow', statuses: [], transitions: [] });
-    const team = await acme.createTeam({ name: 'Acme team', memberIds: [] });
-
-    expect(await globex.getProjects()).toHaveLength(0);
-    expect(await globex.getProject(project.id)).toBeNull();
-    expect(await globex.getWorkflow(workflow.id)).toBeNull();
-    expect(await globex.getTeams()).toHaveLength(0);
-    expect(await globex.updateTeam(team.id, { name: 'x' })).toBeNull();
-
-    // Tenancy cannot be changed through a view
-    await acme.updateProject(project.id, { tenantId: 'globex' } as any);
-    expect((await engine.getProject(project.id))?.tenantId).toBe('acme');
-  });
-
-  it('never lets a view choose a tenant, while trusted base-engine calls may', async () => {
-    const engine = new CriticalPathEngine();
-    const viaView = await engine.withActor({ userId: 'x' }).createProject({ name: 'View', tenantId: 'acme' } as any);
-    expect(viaView.tenantId).toBeUndefined();
-
-    const seeded = await engine.createProject({ name: 'Seeded', tenantId: 'acme' } as any);
-    expect(seeded.tenantId).toBe('acme');
-    const team = await engine.createTeam({ name: 'Seeded team', memberIds: [], tenantId: 'acme' } as any);
-    expect(team.tenantId).toBe('acme');
-  });
-
-  it('only falls back to default workflows from the project tenant', async () => {
-    const engine = new CriticalPathEngine();
-    await engine.withActor({ userId: 'g', tenantId: 'globex' }).createWorkflow({
-      name: 'Globex default',
-      isDefault: true,
-      statuses: [{ key: 'only', label: 'Only', category: 'not_started' }],
-      transitions: []
-    });
-    const acmeProject = await engine.withActor({ userId: 'a', tenantId: 'acme' }).createProject({ name: 'Acme' });
-
-    const workflow = await engine.resolveProjectWorkflow(acmeProject.id);
-    expect(workflow?.name).not.toBe('Globex default');
-  });
-
-  it('persists tenancy and membership in SQLiteStore', async () => {
-    const engine = new CriticalPathEngine({ store: new SQLiteStore({ filename: ':memory:' }), authorize: createRolePolicy() });
-    const project = await engine.withActor({ userId: 'a', tenantId: 'acme' }).createProject({ name: 'Stored' });
-
-    const stored = await engine.getProject(project.id);
-    expect(stored?.tenantId).toBe('acme');
-    expect(stored?.members).toEqual([{ userId: 'a', role: 'admin' }]);
-    expect(await engine.withActor({ userId: 'a', tenantId: 'other' }).getProject(project.id)).toBeNull();
-  });
-});

package/src/engine/cascade.test.ts

@@ -1,121 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import {
-  CriticalPathEngine,
-  InMemoryStore,
-  SQLiteStore,
-  FirebaseStore,
-  InMemoryFirestoreMock,
-  InMemoryFileStore,
-  createRolePolicy,
-  ForbiddenError,
-  type StorageAdapter
-} from '../index.js';
-
-const stores: Array<[string, () => StorageAdapter]> = [
-  ['InMemoryStore', () => new InMemoryStore()],
-  ['SQLiteStore', () => new SQLiteStore({ filename: ':memory:' })],
-  ['FirebaseStore', () => new FirebaseStore({ db: new InMemoryFirestoreMock() })]
-];
-
-describe.each(stores)('cascading deletes (%s)', (_name, makeStore) => {
-  async function setup() {
-    const fileStorage = new InMemoryFileStore();
-    const engine = new CriticalPathEngine({ store: makeStore(), fileStorage });
-    const project = await engine.createProject({ name: 'Cascade' });
-    const parent = await engine.createTask({ projectId: project.id, title: 'Parent' });
-    const child = await engine.createTask({ projectId: project.id, title: 'Child', parentId: parent.id });
-    const grandchild = await engine.createTask({ projectId: project.id, title: 'Grandchild', parentId: child.id });
-    const other = await engine.createTask({ projectId: project.id, title: 'Other' });
-    return { engine, fileStorage, project, parent, child, grandchild, other };
-  }
-
-  it('removes subtasks, dependencies, comments, attachments with files, and time entries', async () => {
-    const { engine, fileStorage, parent, child, grandchild, other } = await setup();
-    const dependency = await engine.addDependency({ taskId: other.id, dependsOnTaskId: parent.id, type: 'blocking' });
-    const comment = await engine.addComment({ taskId: parent.id, content: 'note', authorId: 'u1' });
-    const upload = await engine.uploadAttachmentFile({ taskId: parent.id, filename: 'spec.txt', data: 'hello', uploaderId: 'u1' });
-    const onComment = await engine.createAttachment({ commentId: comment.id, filename: 'c.png', url: 'https://example.com/c.png', uploaderId: 'u1', mimeType: 'image/png', sizeBytes: 1 });
-    const entry = await engine.logTime({ taskId: parent.id, hours: 2 });
-
-    expect(await engine.deleteTask(parent.id)).toBe(true);
-
-    for (const id of [parent.id, child.id, grandchild.id]) expect(await engine.getTask(id)).toBeNull();
-    expect(await engine.getTask(other.id)).not.toBeNull();
-    expect(await engine.store.getDependency(dependency.id)).toBeNull();
-    expect(await engine.store.getComment(comment.id)).toBeNull();
-    expect(await engine.store.getAttachment(upload.id)).toBeNull();
-    expect(await engine.store.getAttachment(onComment.id)).toBeNull();
-    expect(await fileStorage.download!(upload.storageKey!).catch(() => null)).toBeNull();
-    expect((await engine.store.getTimeEntries(parent.id)).map((e) => e.id)).not.toContain(entry.id);
-  });
-
-  it('can detach subtasks instead of deleting them', async () => {
-    const { engine, parent, child } = await setup();
-    await engine.deleteTask(parent.id, { subtasks: 'detach' });
-    const kept = await engine.getTask(child.id);
-    expect(kept).not.toBeNull();
-    expect(kept?.parentId).toBeUndefined();
-  });
-
-  it('deletes a project with all its planning records and reports every deleted task', async () => {
-    const { engine, project, parent, child, grandchild, other } = await setup();
-    const container = await engine.createContainer({ projectId: project.id, name: 'Epic' });
-    const iteration = await engine.createIteration({ projectId: project.id, name: 'S1', status: 'planning' });
-    const deliverable = await engine.createDeliverable({ projectId: project.id, title: 'Cut' });
-    const projectFile = await engine.createAttachment({ projectId: project.id, filename: 'brief.pdf', url: 'https://example.com/b.pdf', uploaderId: 'u1', mimeType: 'application/pdf', sizeBytes: 1 });
-
-    let deletedTaskIds: string[] = [];
-    engine.events.subscribe('project.deleted', (e) => {
-      deletedTaskIds = (e.payload as { deletedTaskIds: string[] }).deletedTaskIds;
-    });
-    expect(await engine.deleteProject(project.id)).toBe(true);
-
-    expect(deletedTaskIds.sort()).toEqual([parent.id, child.id, grandchild.id, other.id].sort());
-    expect(await engine.store.getContainer(container.id)).toBeNull();
-    expect(await engine.store.getIteration(iteration.id)).toBeNull();
-    expect(await engine.store.getDeliverable(deliverable.id)).toBeNull();
-    expect(await engine.store.getAttachment(projectFile.id)).toBeNull();
-  });
-
-  it('clears task references when containers, iterations and deliverables are deleted', async () => {
-    const { engine, project, other } = await setup();
-    const epic = await engine.createContainer({ projectId: project.id, name: 'Epic' });
-    const nested = await engine.createContainer({ projectId: project.id, name: 'Nested', parentId: epic.id });
-    const sprint = await engine.createIteration({ projectId: project.id, name: 'S1', status: 'planning' });
-    const cut = await engine.createDeliverable({ projectId: project.id, title: 'Cut' });
-    await engine.updateTask(other.id, { containerId: epic.id, iterationId: sprint.id, deliverableId: cut.id });
-
-    await engine.deleteContainer(epic.id);
-    await engine.deleteIteration(sprint.id);
-    await engine.deleteDeliverable(cut.id);
-
-    const task = await engine.getTask(other.id);
-    expect(task?.containerId).toBeUndefined();
-    expect(task?.iterationId).toBeUndefined();
-    expect(task?.deliverableId).toBeUndefined();
-    expect((await engine.getContainer(nested.id))?.parentId).toBeUndefined();
-  });
-});
-
-describe('removeDependency', () => {
-  it('removes a dependency, publishes dependency.removed, and requires task.update', async () => {
-    const engine = new CriticalPathEngine({ authorize: createRolePolicy() });
-    const project = await engine.createProject({
-      name: 'Deps',
-      members: [
-        { userId: 'cora', role: 'contributor' },
-        { userId: 'vic', role: 'viewer' }
-      ]
-    });
-    const a = await engine.createTask({ projectId: project.id, title: 'A' });
-    const b = await engine.createTask({ projectId: project.id, title: 'B' });
-    const dependency = await engine.addDependency({ taskId: a.id, dependsOnTaskId: b.id, type: 'blocking' });
-    const events: string[] = [];
-    engine.events.subscribe('dependency.removed', (e) => void events.push(e.name));
-
-    await expect(engine.withActor({ userId: 'vic' }).removeDependency(dependency.id)).rejects.toThrow(ForbiddenError);
-    expect(await engine.withActor({ userId: 'cora' }).removeDependency(dependency.id)).toBe(true);
-    expect(await engine.removeDependency(dependency.id)).toBe(false);
-    expect(events).toEqual(['dependency.removed']);
-  });
-});

package/src/engine/config.test.ts

@@ -1,51 +0,0 @@
-import { describe, it, expect, vi } from 'vitest';
-import { CriticalPathEngine, SQLiteStore, type User } from '../index.js';
-
-const ana: User = { id: 'ana', name: 'Ana', email: 'ana@example.com', role: 'contributor', weeklyCapacityHours: 20, createdAt: '2026-01-01T00:00:00.000Z' };
-
-describe('engine configuration', () => {
-  it('rejects store strings instead of silently using memory', () => {
-    expect(() => new CriticalPathEngine({ store: 'sqlite' as any })).toThrow(/storage adapter instance/);
-    expect(new CriticalPathEngine({ store: new SQLiteStore({ filename: ':memory:' }) }).store).toBeInstanceOf(SQLiteStore);
-  });
-
-  it('merges initialData.users with the configured user directory', async () => {
-    const engine = new CriticalPathEngine({
-      initialData: { users: [ana, { ...ana, id: 'old', name: 'Seeded' }] },
-      users: [{ ...ana, name: 'Ana (directory)' }]
-    });
-    const users = await engine.getUsers();
-    expect(users.map((u) => u.name).sort()).toEqual(['Ana (directory)', 'Seeded']);
-  });
-
-  it('calls a user directory function with the calling actor', async () => {
-    const directory = vi.fn(async () => [ana]);
-    const engine = new CriticalPathEngine({ users: directory });
-    await engine.withActor({ userId: 'x', tenantId: 'acme' }).getUsers();
-    expect(directory).toHaveBeenCalledWith(expect.objectContaining({ userId: 'x', tenantId: 'acme' }));
-  });
-
-  it('uses user capacity and names in workload distribution', async () => {
-    const engine = new CriticalPathEngine({ users: [ana] });
-    const project = await engine.createProject({ name: 'Capacity' });
-    await engine.createTask({
-      projectId: project.id,
-      title: 'Work',
-      assigneeId: 'ana',
-      estimatedHours: 10,
-      plannedStartDate: '2026-10-05',
-      dueDate: '2026-10-09'
-    });
-
-    const workload = await engine.getWorkloadDistribution(project.id, {
-      startDate: '2026-10-05',
-      endDate: '2026-10-11',
-      interval: 'week',
-      groupBy: 'assignee'
-    });
-    expect(workload.seriesLabels.ana).toBe('Ana');
-    // Ana's 20h/week capacity is used instead of the 40h default
-    const capacity = workload.buckets.map((b) => b.capacity?.ana ?? 0);
-    expect(Math.max(...capacity)).toBe(20);
-  });
-});

package/src/engine/entity-events.test.ts

@@ -1,67 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { CriticalPathEngine, type DomainEvent } from '../index.js';
-
-function record(engine: CriticalPathEngine) {
-  const events: DomainEvent[] = [];
-  engine.events.subscribe('*', (e) => void events.push(e));
-  return events;
-}
-
-describe('team, container and iteration events', () => {
-  it('publishes updated and deleted events with the previous state', async () => {
-    const engine = new CriticalPathEngine();
-    const project = await engine.createProject({ name: 'Events' });
-    const team = await engine.createTeam({ name: 'Core', memberIds: [] });
-    const container = await engine.createContainer({ projectId: project.id, name: 'Epic' });
-    const events = record(engine);
-    const iteration = await engine.createIteration({ projectId: project.id, name: 'S1', status: 'planning' });
-
-    await engine.updateTeam(team.id, { name: 'Platform' });
-    await engine.updateContainer(container.id, { name: 'Epic 2' });
-    await engine.updateIteration(iteration.id, { goal: 'Ship' });
-    await engine.deleteTeam(team.id);
-    await engine.deleteContainer(container.id);
-    await engine.deleteIteration(iteration.id);
-
-    expect(events.map((e) => e.name)).toEqual([
-      'iteration.created',
-      'team.updated',
-      'container.updated',
-      'iteration.updated',
-      'team.deleted',
-      'container.deleted',
-      'iteration.deleted'
-    ]);
-    const teamUpdated = events.find((e) => e.name === 'team.updated')!.payload as any;
-    expect(teamUpdated.previous.name).toBe('Core');
-    expect(teamUpdated.team.name).toBe('Platform');
-    expect(events.find((e) => e.name === 'iteration.deleted')!.payload).toMatchObject({ projectId: project.id, name: 'S1' });
-    expect(new Set(events.map((e) => e.id)).size).toBe(events.length);
-  });
-
-  it('routes deletion webhooks to the owning tenant', async () => {
-    const delivered: Array<{ url: string; event: string }> = [];
-    const engine = new CriticalPathEngine({
-      webhookDelivery: {
-        fetch: (async (url: string, init: RequestInit) => {
-          delivered.push({ url, event: JSON.parse(init.body as string).event });
-          return new Response(null, { status: 204 });
-        }) as unknown as typeof fetch
-      }
-    });
-    const acme = engine.withActor({ userId: 'a', tenantId: 'acme' });
-    const globex = engine.withActor({ userId: 'g', tenantId: 'globex' });
-    await acme.createWebhook({ name: 'Acme', url: 'https://hooks.example.com/acme', events: ['team.deleted', 'container.deleted'] });
-    await globex.createWebhook({ name: 'Globex', url: 'https://hooks.example.com/globex', events: ['*'] });
-
-    const project = await acme.createProject({ name: 'Acme' });
-    const team = await acme.createTeam({ name: 'Team', memberIds: [] });
-    const container = await acme.createContainer({ projectId: project.id, name: 'C' });
-    await acme.deleteTeam(team.id);
-    await acme.deleteContainer(container.id);
-    await engine.webhooks.idle();
-
-    expect(delivered.map((d) => d.event).sort()).toEqual(['container.deleted', 'team.deleted']);
-    expect(delivered.every((d) => d.url.endsWith('/acme'))).toBe(true);
-  });
-});