@ftisindia/create-app 0.1.4 → 0.1.6

package/template/test/security.e2e-spec.ts

@@ -72,7 +72,101 @@ describe('Security invariants (e2e)', () => {
       .expect(403);
   });
 
+  it('requires authentication for frontend bootstrap endpoints', async () => {
+    const { orgId } = await createUserAndOrg('bootstrap-auth');
+
+    await request(app.getHttpServer()).get('/organisations/mine').expect(401);
+    await request(app.getHttpServer()).get(`/organisations/${orgId}/access-control/me`).expect(401);
+  });
+
+  it('lists only active current-user organisations with cursor pagination shape', async () => {
+    const first = await createUserAndOrg('mine-active');
+    const second = await createOrganisation(first.accessToken, 'mine-suspended');
+
+    await prisma.membership.update({
+      where: { id: second.membershipId },
+      data: { status: MembershipStatus.SUSPENDED },
+    });
+
+    const response = await request(app.getHttpServer())
+      .get('/organisations/mine')
+      .set('Authorization', `Bearer ${first.accessToken}`)
+      .expect(200);
+
+    expect(response.body).toEqual({
+      items: [
+        expect.objectContaining({
+          id: first.orgId,
+          membershipId: first.membershipId,
+          roleId: expect.any(String),
+          role: expect.objectContaining({ name: 'Owner' }),
+          isOwner: true,
+          isBillingContact: true,
+        }),
+      ],
+      nextCursor: null,
+    });
+  });
+
+  it('returns effective access-control context for an active member without roles.read', async () => {
+    const owner = await createUserAndOrg('access-me-owner');
+    const member = await createMemberInOrg(owner.orgId, 'access-me-member');
+
+    const response = await request(app.getHttpServer())
+      .get(`/organisations/${owner.orgId}/access-control/me`)
+      .set('Authorization', `Bearer ${member.accessToken}`)
+      .expect(200);
+
+    expect(response.body).toEqual({
+      orgId: owner.orgId,
+      membershipId: member.membershipId,
+      roleId: member.roleId,
+      isOwner: false,
+      isBillingContact: false,
+      permissionKeys: [],
+    });
+  });
+
+  it('denies access-control context to non-members', async () => {
+    const first = await createUserAndOrg('access-me-a');
+    const second = await createUserAndOrg('access-me-b');
+
+    await request(app.getHttpServer())
+      .get(`/organisations/${second.orgId}/access-control/me`)
+      .set('Authorization', `Bearer ${first.accessToken}`)
+      .expect(403);
+  });
+
+  it.each([MembershipStatus.SUSPENDED, MembershipStatus.REVOKED])(
+    'denies access-control context for %s memberships',
+    async (status) => {
+      const owner = await createUserAndOrg(`access-me-${status.toLowerCase()}`);
+      const member = await createMemberInOrg(owner.orgId, `member-${status.toLowerCase()}`);
+
+      await prisma.membership.update({
+        where: { id: member.membershipId },
+        data: { status },
+      });
+
+      await request(app.getHttpServer())
+        .get(`/organisations/${owner.orgId}/access-control/me`)
+        .set('Authorization', `Bearer ${member.accessToken}`)
+        .expect(403);
+    },
+  );
+
   async function createUserAndOrg(label: string) {
+    const user = await createUser(label);
+    const org = await createOrganisation(user.accessToken, label);
+
+    return {
+      ...user,
+      orgId: org.orgId,
+      membershipId: org.membershipId,
+    };
+  }
+
+  async function createUser(label: string) {
     const suffix = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
     const signup = await request(app.getHttpServer())
       .post('/auth/signup')
@@ -83,7 +177,14 @@ describe('Security invariants (e2e)', () => {
       })
       .expect(201);
 
-    const accessToken = signup.body.accessToken as string;
+    return {
+      accessToken: signup.body.accessToken as string,
+      userId: signup.body.user.id as string,
+    };
+  }
+
+  async function createOrganisation(accessToken: string, label: string) {
+    const suffix = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
     const org = await request(app.getHttpServer())
       .post('/organisations')
       .set('Authorization', `Bearer ${accessToken}`)
@@ -94,9 +195,40 @@ describe('Security invariants (e2e)', () => {
       .expect(201);
 
     return {
-      accessToken,
       orgId: org.body.organisation.id as string,
       membershipId: org.body.membership.id as string,
     };
   }
+
+  async function createMemberInOrg(orgId: string, label: string) {
+    const user = await createUser(label);
+    const role = await prisma.role.findUniqueOrThrow({
+      where: {
+        orgId_name: {
+          orgId,
+          name: 'Viewer',
+        },
+      },
+      select: {
+        id: true,
+      },
+    });
+    const membership = await prisma.membership.create({
+      data: {
+        userId: user.userId,
+        orgId,
+        roleId: role.id,
+      },
+      select: {
+        id: true,
+        roleId: true,
+      },
+    });
+
+    return {
+      ...user,
+      membershipId: membership.id,
+      roleId: membership.roleId,
+    };
+  }
 });