@indigoai-us/hq-cli 5.30.0 → 5.32.0

package/src/commands/group-grants.test.ts

@@ -0,0 +1,291 @@
+/**
+ * Unit tests for `hq group-grants grant|revoke|outbound|inbound`
+ * (group-grants.ts).
+ *
+ * Mirrors members.test.ts: mock `globalThis.fetch`, exercise the exported
+ * helper functions, assert the request body the client sends, and assert HTTP
+ * errors (esp. 403 cross-tenant) are wrapped + surfaced actionably.
+ *
+ * Covers the two story e2e behaviors:
+ *   1. Operator WITH invite rights on B grants (G, B, member) → client POSTs
+ *      /group-grants with {groupId:G, sourceCompanyUid, targetCompanyUid:B,
+ *      role:'member'} and returns the grant.
+ *   2. Operator with NO role on independent C grants (G, C) → backend 403 →
+ *      helper throws GrantHttpError(403, FORBIDDEN) and formatGrantHttpError
+ *      yields an actionable cross-tenant permission message.
+ */
+
+import { afterEach, beforeEach, describe, expect, it, vi, type MockInstance } from "vitest";
+
+import {
+  GrantHttpError,
+  formatGrantHttpError,
+  grantGroup,
+  listInboundGrants,
+  listOutboundGrants,
+  revokeGroupGrant,
+} from "./group-grants.js";
+
+function jsonResponse(status: number, body: unknown): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json" },
+  });
+}
+
+let fetchSpy: MockInstance<typeof fetch>;
+
+beforeEach(() => {
+  fetchSpy = vi.spyOn(globalThis, "fetch");
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+// ---------------------------------------------------------------------------
+// grantGroup — story e2e #1 (authorized) + validation
+// ---------------------------------------------------------------------------
+
+describe("grantGroup", () => {
+  it("POSTs /group-grants with the right body and returns the grant (operator with invite rights on B)", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(200, {
+        grant: {
+          groupId: "grp_eng",
+          sourceCompanyUid: "cmp_a",
+          targetCompanyUid: "cmp_b",
+          role: "member",
+        },
+      }),
+    );
+
+    const grant = await grantGroup({
+      groupId: "grp_eng",
+      sourceCompanyUid: "cmp_a",
+      targetCompanyUid: "cmp_b",
+      role: "member",
+      token: "test-token",
+    });
+
+    expect(grant.role).toBe("member");
+    expect(grant.targetCompanyUid).toBe("cmp_b");
+
+    const call = fetchSpy.mock.calls[0];
+    expect(String(call[0])).toContain("/group-grants");
+    expect(call[1]?.method).toBe("POST");
+    const body = JSON.parse((call[1]?.body as string) ?? "{}");
+    expect(body).toEqual({
+      groupId: "grp_eng",
+      sourceCompanyUid: "cmp_a",
+      targetCompanyUid: "cmp_b",
+      role: "member",
+    });
+  });
+
+  it("synthesizes a grant when the server omits the grant body", async () => {
+    fetchSpy.mockResolvedValueOnce(jsonResponse(200, {}));
+
+    const grant = await grantGroup({
+      groupId: "grp_eng",
+      sourceCompanyUid: "cmp_a",
+      targetCompanyUid: "cmp_b",
+      role: "admin",
+      token: "test-token",
+    });
+
+    expect(grant).toEqual({
+      groupId: "grp_eng",
+      sourceCompanyUid: "cmp_a",
+      targetCompanyUid: "cmp_b",
+      role: "admin",
+    });
+  });
+
+  it("wraps a 403 in GrantHttpError carrying the FORBIDDEN code (operator with no role on independent C)", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(403, { error: "forbidden", code: "FORBIDDEN" }),
+    );
+
+    const err = await grantGroup({
+      groupId: "grp_eng",
+      sourceCompanyUid: "cmp_a",
+      targetCompanyUid: "cmp_c",
+      role: "member",
+      token: "test-token",
+    }).catch((e) => e);
+
+    expect(err).toBeInstanceOf(GrantHttpError);
+    expect((err as GrantHttpError).status).toBe(403);
+    expect((err as GrantHttpError).code).toBe("FORBIDDEN");
+  });
+
+  it("rejects an invalid group id before calling the API", async () => {
+    await expect(
+      grantGroup({
+        groupId: "eng",
+        sourceCompanyUid: "cmp_a",
+        targetCompanyUid: "cmp_b",
+        role: "member",
+        token: "test-token",
+      }),
+    ).rejects.toThrow(/Invalid group id/);
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+
+  it("rejects an unknown role before calling the API", async () => {
+    await expect(
+      grantGroup({
+        groupId: "grp_eng",
+        sourceCompanyUid: "cmp_a",
+        targetCompanyUid: "cmp_b",
+        role: "superuser",
+        token: "test-token",
+      }),
+    ).rejects.toThrow(/Invalid role/);
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+
+  it("rejects a same-company grant before calling the API", async () => {
+    await expect(
+      grantGroup({
+        groupId: "grp_eng",
+        sourceCompanyUid: "cmp_a",
+        targetCompanyUid: "cmp_a",
+        role: "member",
+        token: "test-token",
+      }),
+    ).rejects.toThrow(/cross company boundaries/);
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// formatGrantHttpError — actionable cross-tenant messaging (story AC #3)
+// ---------------------------------------------------------------------------
+
+describe("formatGrantHttpError", () => {
+  it("renders an actionable cross-tenant 403 message naming the target company", () => {
+    const msg = formatGrantHttpError(403, "forbidden", {
+      targetCompany: "acme-c",
+      code: "FORBIDDEN",
+    });
+    expect(msg).toMatch(/Permission denied/);
+    expect(msg).toMatch(/owner or admin of the target company 'acme-c'/);
+  });
+
+  it("maps 401 to a login hint", () => {
+    expect(formatGrantHttpError(401, "x")).toMatch(/hq login/);
+  });
+
+  it("passes through a generic 400 message", () => {
+    expect(formatGrantHttpError(400, "bad role")).toBe("bad role");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// revokeGroupGrant
+// ---------------------------------------------------------------------------
+
+describe("revokeGroupGrant", () => {
+  it("POSTs /group-grants/revoke with the right body", async () => {
+    fetchSpy.mockResolvedValueOnce(jsonResponse(200, { revoked: true }));
+
+    await revokeGroupGrant({
+      groupId: "grp_eng",
+      sourceCompanyUid: "cmp_a",
+      targetCompanyUid: "cmp_b",
+      token: "test-token",
+    });
+
+    const call = fetchSpy.mock.calls[0];
+    expect(String(call[0])).toContain("/group-grants/revoke");
+    expect(call[1]?.method).toBe("POST");
+    const body = JSON.parse((call[1]?.body as string) ?? "{}");
+    expect(body).toEqual({
+      groupId: "grp_eng",
+      sourceCompanyUid: "cmp_a",
+      targetCompanyUid: "cmp_b",
+    });
+  });
+
+  it("wraps a 403 in GrantHttpError", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(403, { error: "forbidden", code: "FORBIDDEN" }),
+    );
+
+    await expect(
+      revokeGroupGrant({
+        groupId: "grp_eng",
+        sourceCompanyUid: "cmp_a",
+        targetCompanyUid: "cmp_c",
+        token: "test-token",
+      }),
+    ).rejects.toBeInstanceOf(GrantHttpError);
+  });
+
+  it("rejects an invalid group id before calling the API", async () => {
+    await expect(
+      revokeGroupGrant({
+        groupId: "eng",
+        sourceCompanyUid: "cmp_a",
+        targetCompanyUid: "cmp_b",
+        token: "test-token",
+      }),
+    ).rejects.toThrow(/Invalid group id/);
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// listOutboundGrants / listInboundGrants
+// ---------------------------------------------------------------------------
+
+describe("listOutboundGrants", () => {
+  it("GETs /group-grants/outbound with sourceCompanyUid and optional groupId", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(200, {
+        grants: [
+          {
+            groupId: "grp_eng",
+            sourceCompanyUid: "cmp_a",
+            targetCompanyUid: "cmp_b",
+            role: "member",
+          },
+        ],
+      }),
+    );
+
+    const list = await listOutboundGrants("test-token", "cmp_a", "grp_eng");
+    expect(list).toHaveLength(1);
+
+    const url = new URL(String(fetchSpy.mock.calls[0][0]));
+    expect(url.pathname).toContain("/group-grants/outbound");
+    expect(url.searchParams.get("sourceCompanyUid")).toBe("cmp_a");
+    expect(url.searchParams.get("groupId")).toBe("grp_eng");
+  });
+
+  it("returns [] when the server returns no grants", async () => {
+    fetchSpy.mockResolvedValueOnce(jsonResponse(200, {}));
+    expect(await listOutboundGrants("test-token", "cmp_a")).toEqual([]);
+  });
+});
+
+describe("listInboundGrants", () => {
+  it("GETs /group-grants/inbound with companyUid", async () => {
+    fetchSpy.mockResolvedValueOnce(jsonResponse(200, { grants: [] }));
+
+    await listInboundGrants("test-token", "cmp_b");
+
+    const url = new URL(String(fetchSpy.mock.calls[0][0]));
+    expect(url.pathname).toContain("/group-grants/inbound");
+    expect(url.searchParams.get("companyUid")).toBe("cmp_b");
+  });
+
+  it("wraps a 403 in GrantHttpError", async () => {
+    fetchSpy.mockResolvedValueOnce(jsonResponse(403, { error: "forbidden" }));
+    await expect(
+      listInboundGrants("test-token", "cmp_b"),
+    ).rejects.toBeInstanceOf(GrantHttpError);
+  });
+});