@indigoai-us/hq-cli 5.77.13 → 5.78.0

package/src/commands/group-grants.test.ts

@@ -1,330 +0,0 @@
-/**
- * Unit tests for `hq group-grants grant|revoke|outbound|inbound`
- * (group-grants.ts).
- *
- * Mirrors members.test.ts: mock `globalThis.fetch`, exercise the exported
- * helper functions, assert the request body the client sends, and assert HTTP
- * errors (esp. 403 cross-tenant) are wrapped + surfaced actionably.
- *
- * Covers the two story e2e behaviors:
- *   1. Operator WITH invite rights on B grants (G, B, member) → client POSTs
- *      /group-grants with {groupId:G, sourceCompanyUid, targetCompanyUid:B,
- *      role:'member'} and returns the grant.
- *   2. Operator with NO role on independent C grants (G, C) → backend 403 →
- *      helper throws GrantHttpError(403, FORBIDDEN) and formatGrantHttpError
- *      yields an actionable cross-tenant permission message.
- */
-
-import { Command } from "commander";
-import { afterEach, beforeEach, describe, expect, it, vi, type MockInstance } from "vitest";
-
-const { ensureCognitoTokenSpy } = vi.hoisted(() => ({
-  ensureCognitoTokenSpy: vi.fn(),
-}));
-
-vi.mock("../utils/cognito-session.js", async (importOriginal) => ({
-  ...(await importOriginal()),
-  ensureCognitoToken: ensureCognitoTokenSpy,
-}));
-
-import {
-  GrantHttpError,
-  formatGrantHttpError,
-  grantGroup,
-  listInboundGrants,
-  listOutboundGrants,
-  registerGroupGrantsCommand,
-  revokeGroupGrant,
-} from "./group-grants.js";
-
-function jsonResponse(status: number, body: unknown): Response {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "Content-Type": "application/json" },
-  });
-}
-
-let fetchSpy: MockInstance<typeof fetch>;
-
-beforeEach(() => {
-  fetchSpy = vi.spyOn(globalThis, "fetch");
-});
-
-afterEach(() => {
-  vi.restoreAllMocks();
-  ensureCognitoTokenSpy.mockReset();
-});
-
-async function runCli(argv: string[]): Promise<void> {
-  const program = new Command();
-  program.exitOverride();
-  registerGroupGrantsCommand(program);
-  await program.parseAsync(["node", "hq", ...argv]);
-}
-
-// ---------------------------------------------------------------------------
-// grantGroup — story e2e #1 (authorized) + validation
-// ---------------------------------------------------------------------------
-
-describe("grantGroup", () => {
-  it("POSTs /group-grants with the right body and returns the grant (operator with invite rights on B)", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(200, {
-        grant: {
-          groupId: "grp_eng",
-          sourceCompanyUid: "cmp_a",
-          targetCompanyUid: "cmp_b",
-          role: "member",
-        },
-      }),
-    );
-
-    const grant = await grantGroup({
-      groupId: "grp_eng",
-      sourceCompanyUid: "cmp_a",
-      targetCompanyUid: "cmp_b",
-      role: "member",
-      token: "test-token",
-    });
-
-    expect(grant.role).toBe("member");
-    expect(grant.targetCompanyUid).toBe("cmp_b");
-
-    const call = fetchSpy.mock.calls[0];
-    expect(String(call[0])).toContain("/group-grants");
-    expect(call[1]?.method).toBe("POST");
-    const body = JSON.parse((call[1]?.body as string) ?? "{}");
-    expect(body).toEqual({
-      groupId: "grp_eng",
-      sourceCompanyUid: "cmp_a",
-      targetCompanyUid: "cmp_b",
-      role: "member",
-    });
-  });
-
-  it("synthesizes a grant when the server omits the grant body", async () => {
-    fetchSpy.mockResolvedValueOnce(jsonResponse(200, {}));
-
-    const grant = await grantGroup({
-      groupId: "grp_eng",
-      sourceCompanyUid: "cmp_a",
-      targetCompanyUid: "cmp_b",
-      role: "admin",
-      token: "test-token",
-    });
-
-    expect(grant).toEqual({
-      groupId: "grp_eng",
-      sourceCompanyUid: "cmp_a",
-      targetCompanyUid: "cmp_b",
-      role: "admin",
-    });
-  });
-
-  it("wraps a 403 in GrantHttpError carrying the FORBIDDEN code (operator with no role on independent C)", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(403, { error: "forbidden", code: "FORBIDDEN" }),
-    );
-
-    const err = await grantGroup({
-      groupId: "grp_eng",
-      sourceCompanyUid: "cmp_a",
-      targetCompanyUid: "cmp_c",
-      role: "member",
-      token: "test-token",
-    }).catch((e) => e);
-
-    expect(err).toBeInstanceOf(GrantHttpError);
-    expect((err as GrantHttpError).status).toBe(403);
-    expect((err as GrantHttpError).code).toBe("FORBIDDEN");
-  });
-
-  it("rejects an invalid group id before calling the API", async () => {
-    await expect(
-      grantGroup({
-        groupId: "eng",
-        sourceCompanyUid: "cmp_a",
-        targetCompanyUid: "cmp_b",
-        role: "member",
-        token: "test-token",
-      }),
-    ).rejects.toThrow(/Invalid group id/);
-    expect(fetchSpy).not.toHaveBeenCalled();
-  });
-
-  it("rejects an unknown role before calling the API", async () => {
-    await expect(
-      grantGroup({
-        groupId: "grp_eng",
-        sourceCompanyUid: "cmp_a",
-        targetCompanyUid: "cmp_b",
-        role: "superuser",
-        token: "test-token",
-      }),
-    ).rejects.toThrow(/Invalid role/);
-    expect(fetchSpy).not.toHaveBeenCalled();
-  });
-
-  it("rejects a same-company grant before calling the API", async () => {
-    await expect(
-      grantGroup({
-        groupId: "grp_eng",
-        sourceCompanyUid: "cmp_a",
-        targetCompanyUid: "cmp_a",
-        role: "member",
-        token: "test-token",
-      }),
-    ).rejects.toThrow(/cross company boundaries/);
-    expect(fetchSpy).not.toHaveBeenCalled();
-  });
-});
-
-// ---------------------------------------------------------------------------
-// formatGrantHttpError — actionable cross-tenant messaging (story AC #3)
-// ---------------------------------------------------------------------------
-
-describe("formatGrantHttpError", () => {
-  it("renders an actionable cross-tenant 403 message naming the target company", () => {
-    const msg = formatGrantHttpError(403, "forbidden", {
-      targetCompany: "acme-c",
-      code: "FORBIDDEN",
-    });
-    expect(msg).toMatch(/Permission denied/);
-    expect(msg).toMatch(/owner or admin of the target company 'acme-c'/);
-  });
-
-  it("maps 401 to a login hint", () => {
-    expect(formatGrantHttpError(401, "x")).toMatch(/hq login/);
-  });
-
-  it("passes through a generic 400 message", () => {
-    expect(formatGrantHttpError(400, "bad role")).toBe("bad role");
-  });
-});
-
-// ---------------------------------------------------------------------------
-// revokeGroupGrant
-// ---------------------------------------------------------------------------
-
-describe("revokeGroupGrant", () => {
-  it("POSTs /group-grants/revoke with the right body", async () => {
-    fetchSpy.mockResolvedValueOnce(jsonResponse(200, { revoked: true }));
-
-    await revokeGroupGrant({
-      groupId: "grp_eng",
-      sourceCompanyUid: "cmp_a",
-      targetCompanyUid: "cmp_b",
-      token: "test-token",
-    });
-
-    const call = fetchSpy.mock.calls[0];
-    expect(String(call[0])).toContain("/group-grants/revoke");
-    expect(call[1]?.method).toBe("POST");
-    const body = JSON.parse((call[1]?.body as string) ?? "{}");
-    expect(body).toEqual({
-      groupId: "grp_eng",
-      sourceCompanyUid: "cmp_a",
-      targetCompanyUid: "cmp_b",
-    });
-  });
-
-  it("wraps a 403 in GrantHttpError", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(403, { error: "forbidden", code: "FORBIDDEN" }),
-    );
-
-    await expect(
-      revokeGroupGrant({
-        groupId: "grp_eng",
-        sourceCompanyUid: "cmp_a",
-        targetCompanyUid: "cmp_c",
-        token: "test-token",
-      }),
-    ).rejects.toBeInstanceOf(GrantHttpError);
-  });
-
-  it("rejects an invalid group id before calling the API", async () => {
-    await expect(
-      revokeGroupGrant({
-        groupId: "eng",
-        sourceCompanyUid: "cmp_a",
-        targetCompanyUid: "cmp_b",
-        token: "test-token",
-      }),
-    ).rejects.toThrow(/Invalid group id/);
-    expect(fetchSpy).not.toHaveBeenCalled();
-  });
-});
-
-// ---------------------------------------------------------------------------
-// listOutboundGrants / listInboundGrants
-// ---------------------------------------------------------------------------
-
-describe("listOutboundGrants", () => {
-  it("GETs /group-grants/outbound with both required query parameters", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(200, {
-        grants: [
-          {
-            groupId: "grp_eng",
-            sourceCompanyUid: "cmp_a",
-            targetCompanyUid: "cmp_b",
-            role: "member",
-          },
-        ],
-      }),
-    );
-
-    const list = await listOutboundGrants("test-token", "cmp_a", "grp_eng");
-    expect(list).toHaveLength(1);
-
-    const url = new URL(String(fetchSpy.mock.calls[0][0]));
-    expect(url.pathname).toContain("/group-grants/outbound");
-    expect(url.searchParams.get("sourceCompanyUid")).toBe("cmp_a");
-    expect(url.searchParams.get("groupId")).toBe("grp_eng");
-  });
-
-  it("returns [] when the server returns no grants", async () => {
-    fetchSpy.mockResolvedValueOnce(jsonResponse(200, {}));
-    expect(await listOutboundGrants("test-token", "cmp_a", "grp_eng")).toEqual([]);
-  });
-
-  it.each(["", "eng"]) (
-    "rejects invalid group id %j before calling the API",
-    async (groupId) => {
-      await expect(
-        listOutboundGrants("test-token", "cmp_a", groupId),
-      ).rejects.toThrow(/Invalid group id/);
-      expect(fetchSpy).not.toHaveBeenCalled();
-    },
-  );
-});
-
-describe("group-grants outbound command", () => {
-  it("rejects a missing --group before authentication or fetch", async () => {
-    await expect(runCli(["group-grants", "outbound"])).rejects.toMatchObject({
-      code: "commander.missingMandatoryOptionValue",
-    });
-    expect(ensureCognitoTokenSpy).not.toHaveBeenCalled();
-    expect(fetchSpy).not.toHaveBeenCalled();
-  });
-});
-
-describe("listInboundGrants", () => {
-  it("GETs /group-grants/inbound with companyUid", async () => {
-    fetchSpy.mockResolvedValueOnce(jsonResponse(200, { grants: [] }));
-
-    await listInboundGrants("test-token", "cmp_b");
-
-    const url = new URL(String(fetchSpy.mock.calls[0][0]));
-    expect(url.pathname).toContain("/group-grants/inbound");
-    expect(url.searchParams.get("companyUid")).toBe("cmp_b");
-  });
-
-  it("wraps a 403 in GrantHttpError", async () => {
-    fetchSpy.mockResolvedValueOnce(jsonResponse(403, { error: "forbidden" }));
-    await expect(
-      listInboundGrants("test-token", "cmp_b"),
-    ).rejects.toBeInstanceOf(GrantHttpError);
-  });
-});