@open-mercato/core 0.4.5-develop-2e9903a57a → 0.4.5-develop-eeccf7adf4

package/src/modules/audit_logs/api/__tests__/access.route.test.ts

@@ -1,118 +0,0 @@
-/** @jest-environment node */
-import { GET } from '@open-mercato/core/modules/audit_logs/api/audit-logs/access/route'
-
-const mockRbac = { userHasAllFeatures: jest.fn() }
-const mockAccess = { list: jest.fn() }
-const mockEm = {}
-
-jest.mock('@open-mercato/shared/lib/auth/server', () => ({
-  getAuthFromRequest: jest.fn(),
-}))
-
-jest.mock('@open-mercato/shared/lib/di/container', () => ({
-  createRequestContainer: jest.fn(async () => ({
-    resolve: (token: string) => {
-      if (token === 'rbacService') return mockRbac
-      if (token === 'accessLogService') return mockAccess
-      if (token === 'em') return mockEm
-      return null
-    },
-  })),
-}))
-
-jest.mock('@open-mercato/core/modules/directory/utils/organizationScope', () => ({
-  resolveFeatureCheckContext: jest.fn(),
-}))
-
-jest.mock('@open-mercato/core/modules/audit_logs/api/audit-logs/display', () => ({
-  loadAuditLogDisplayMaps: jest.fn(),
-}))
-
-function makeRequest(url: string) {
-  return new Request(url, { method: 'GET' })
-}
-
-describe('GET /api/audit_logs/audit-logs/access', () => {
-  beforeEach(async () => {
-    jest.clearAllMocks()
-    const { resolveFeatureCheckContext } = await import('@open-mercato/core/modules/directory/utils/organizationScope')
-    ;(resolveFeatureCheckContext as jest.Mock).mockResolvedValue({
-      organizationId: 'org-1',
-      scope: { allowedIds: null },
-    })
-    const { loadAuditLogDisplayMaps } = await import('@open-mercato/core/modules/audit_logs/api/audit-logs/display')
-    ;(loadAuditLogDisplayMaps as jest.Mock).mockResolvedValue({
-      users: { 'user-1': 'Alice' },
-      tenants: { 'tenant-1': 'Tenant' },
-      organizations: { 'org-1': 'Org' },
-    })
-    mockRbac.userHasAllFeatures.mockResolvedValue(false)
-    mockAccess.list.mockResolvedValue({
-      items: [
-        {
-          id: 'log-1',
-          resourceKind: 'auth.user',
-          resourceId: 'user-42',
-          accessType: 'view',
-          actorUserId: 'user-1',
-          tenantId: 'tenant-1',
-          organizationId: 'org-1',
-          fieldsJson: ['email'],
-          contextJson: { ip: '127.0.0.1' },
-          createdAt: new Date('2024-01-01T00:00:00.000Z'),
-        },
-      ],
-      total: 1,
-      page: 1,
-      pageSize: 50,
-      totalPages: 1,
-    })
-  })
-
-  it('returns 401 when unauthenticated', async () => {
-    const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
-    ;(getAuthFromRequest as jest.Mock).mockResolvedValue(null)
-
-    const res = await GET(makeRequest('http://localhost/api/audit_logs/audit-logs/access'))
-    expect(res.status).toBe(401)
-  })
-
-  it('returns list payload when authenticated', async () => {
-    const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
-    ;(getAuthFromRequest as jest.Mock).mockResolvedValue({
-      sub: 'user-1',
-      tenantId: 'tenant-1',
-      orgId: 'org-1',
-    })
-
-    const res = await GET(makeRequest('http://localhost/api/audit_logs/audit-logs/access?page=2&pageSize=25'))
-    expect(res.status).toBe(200)
-    const data = await res.json()
-    expect(data.page).toBe(1)
-    expect(data.items).toEqual([
-      {
-        id: 'log-1',
-        resourceKind: 'auth.user',
-        resourceId: 'user-42',
-        accessType: 'view',
-        actorUserId: 'user-1',
-        actorUserName: 'Alice',
-        tenantId: 'tenant-1',
-        tenantName: 'Tenant',
-        organizationId: 'org-1',
-        organizationName: 'Org',
-        fields: ['email'],
-        context: { ip: '127.0.0.1' },
-        createdAt: '2024-01-01T00:00:00.000Z',
-      },
-    ])
-    expect(data.canViewTenant).toBe(false)
-    expect(mockAccess.list).toHaveBeenCalledWith(expect.objectContaining({
-      tenantId: 'tenant-1',
-      organizationId: 'org-1',
-      actorUserId: 'user-1',
-      page: 2,
-      pageSize: 25,
-    }))
-  })
-})

package/src/modules/audit_logs/api/__tests__/redo.route.test.ts

@@ -1,131 +0,0 @@
-/** @jest-environment node */
-import { POST } from '@open-mercato/core/modules/audit_logs/api/audit-logs/actions/redo/route'
-
-const mockRbac = { userHasAllFeatures: jest.fn() }
-const mockLogs = {
-  findById: jest.fn(),
-  latestUndoneForActor: jest.fn(),
-  markRedone: jest.fn(),
-}
-const mockCommandBus = {
-  execute: jest.fn(),
-}
-
-jest.mock('@open-mercato/shared/lib/auth/server', () => ({
-  getAuthFromRequest: jest.fn(),
-}))
-
-jest.mock('@open-mercato/shared/lib/di/container', () => ({
-  createRequestContainer: jest.fn(async () => ({
-    resolve: (token: string) => {
-      if (token === 'rbacService') return mockRbac
-      if (token === 'actionLogService') return mockLogs
-      if (token === 'commandBus') return mockCommandBus
-      if (token === 'em') return {}
-      return null
-    },
-  })),
-}))
-
-jest.mock('@open-mercato/core/modules/directory/utils/organizationScope', () => ({
-  resolveFeatureCheckContext: jest.fn(),
-  resolveOrganizationScopeForRequest: jest.fn(),
-}))
-
-function makeRequest(body: any) {
-  return new Request('http://localhost/api/audit_logs/audit-logs/actions/redo', {
-    method: 'POST',
-    headers: { 'content-type': 'application/json' },
-    body: JSON.stringify(body),
-  })
-}
-
-describe('POST /api/audit_logs/audit-logs/actions/redo', () => {
-  beforeEach(async () => {
-    jest.clearAllMocks()
-    const { resolveFeatureCheckContext, resolveOrganizationScopeForRequest } = await import('@open-mercato/core/modules/directory/utils/organizationScope')
-    ;(resolveFeatureCheckContext as jest.Mock).mockResolvedValue({
-      organizationId: 'org-1',
-      scope: { allowedIds: null },
-    })
-    ;(resolveOrganizationScopeForRequest as jest.Mock).mockResolvedValue({
-      selectedId: 'org-1',
-      filterIds: ['org-1'],
-      allowedIds: null,
-    })
-    mockRbac.userHasAllFeatures.mockResolvedValue(false)
-    mockLogs.findById.mockResolvedValue(null)
-    mockLogs.latestUndoneForActor.mockResolvedValue(null)
-    mockLogs.markRedone.mockResolvedValue(undefined)
-    mockCommandBus.execute.mockResolvedValue({ logEntry: null })
-  })
-
-  it('returns 401 when unauthenticated', async () => {
-    const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
-    ;(getAuthFromRequest as jest.Mock).mockResolvedValue(null)
-
-    const res = await POST(makeRequest({ logId: 'log-1' }))
-    expect(res.status).toBe(401)
-  })
-
-  it('replays latest undone log and returns undo metadata', async () => {
-    const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
-    ;(getAuthFromRequest as jest.Mock).mockResolvedValue({
-      sub: 'user-1',
-      tenantId: 'tenant-1',
-      orgId: 'org-1',
-    })
-    const log = {
-      id: 'log-undo',
-      commandId: 'demo.command',
-      actionLabel: 'Demo action',
-      resourceKind: 'demo.resource',
-      resourceId: 'res-1',
-      executionState: 'undone',
-      actorUserId: 'user-1',
-      tenantId: 'tenant-1',
-      organizationId: 'org-1',
-      commandPayload: { __redoInput: { foo: 'bar' } },
-    }
-    const newLog = {
-      id: 'log-redo',
-      undoToken: 'undo-new',
-      commandId: 'demo.command',
-      actionLabel: 'Redo action',
-      resourceKind: 'demo.resource',
-      resourceId: 'res-1',
-      createdAt: new Date('2024-01-02T00:00:00.000Z'),
-    }
-    mockLogs.findById.mockResolvedValue(log)
-    mockLogs.latestUndoneForActor.mockResolvedValue(log)
-    mockCommandBus.execute.mockResolvedValue({ logEntry: newLog })
-
-    const res = await POST(makeRequest({ logId: 'log-undo' }))
-    expect(res.status).toBe(200)
-    const data = await res.json()
-    expect(data).toEqual({ ok: true, logId: 'log-redo', undoToken: 'undo-new' })
-    expect(mockCommandBus.execute).toHaveBeenCalledWith('demo.command', expect.objectContaining({
-      input: { foo: 'bar' },
-      metadata: expect.objectContaining({
-        actionLabel: 'Demo action',
-        resourceId: 'res-1',
-      }),
-    }))
-    const opHeader = res.headers.get('x-om-operation')
-    expect(opHeader).toBe(
-      'omop:' +
-        encodeURIComponent(
-          JSON.stringify({
-            id: 'log-redo',
-            undoToken: 'undo-new',
-            commandId: 'demo.command',
-            actionLabel: 'Redo action',
-            resourceKind: 'demo.resource',
-            resourceId: 'res-1',
-            executedAt: '2024-01-02T00:00:00.000Z',
-          }),
-        ),
-    )
-    expect(mockLogs.markRedone).toHaveBeenCalledWith('log-undo')
-  })
-})

package/src/modules/audit_logs/api/__tests__/undo.route.test.ts

@@ -1,103 +0,0 @@
-/** @jest-environment node */
-import { POST } from '@open-mercato/core/modules/audit_logs/api/audit-logs/actions/undo/route'
-
-const mockRbac = { userHasAllFeatures: jest.fn() }
-const mockLogs = {
-  findByUndoToken: jest.fn(),
-  latestUndoableForResource: jest.fn(),
-  latestUndoableForActor: jest.fn(),
-}
-const mockCommandBus = { undo: jest.fn() }
-
-jest.mock('@open-mercato/shared/lib/auth/server', () => ({
-  getAuthFromRequest: jest.fn(),
-}))
-
-jest.mock('@open-mercato/shared/lib/di/container', () => ({
-  createRequestContainer: jest.fn(async () => ({
-    resolve: (token: string) => {
-      if (token === 'rbacService') return mockRbac
-      if (token === 'actionLogService') return mockLogs
-      if (token === 'commandBus') return mockCommandBus
-      return null
-    },
-  })),
-}))
-
-jest.mock('@open-mercato/core/modules/directory/utils/organizationScope', () => ({
-  resolveFeatureCheckContext: jest.fn(),
-  resolveOrganizationScopeForRequest: jest.fn(),
-}))
-
-function makeRequest(body: any) {
-  return new Request('http://localhost/api/audit_logs/audit-logs/actions/undo', {
-    method: 'POST',
-    headers: { 'content-type': 'application/json' },
-    body: JSON.stringify(body),
-  })
-}
-
-describe('POST /api/audit_logs/audit-logs/actions/undo', () => {
-  beforeEach(async () => {
-    jest.clearAllMocks()
-    const { resolveFeatureCheckContext, resolveOrganizationScopeForRequest } = await import('@open-mercato/core/modules/directory/utils/organizationScope')
-    ;(resolveFeatureCheckContext as jest.Mock).mockResolvedValue({
-      organizationId: 'org-1',
-      scope: { allowedIds: null },
-    })
-    ;(resolveOrganizationScopeForRequest as jest.Mock).mockResolvedValue({
-      selectedId: 'org-1',
-      filterIds: ['org-1'],
-      allowedIds: null,
-    })
-    mockRbac.userHasAllFeatures.mockResolvedValue(false)
-    mockLogs.findByUndoToken.mockResolvedValue(null)
-    mockLogs.latestUndoableForResource.mockResolvedValue(null)
-    mockLogs.latestUndoableForActor.mockResolvedValue(null)
-    mockCommandBus.undo.mockResolvedValue(undefined)
-  })
-
-  it('returns 401 when unauthenticated', async () => {
-    const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
-    ;(getAuthFromRequest as jest.Mock).mockResolvedValue(null)
-
-    const res = await POST(makeRequest({ undoToken: 'tk' }))
-    expect(res.status).toBe(401)
-  })
-
-  it('returns 400 when token missing', async () => {
-    const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
-    ;(getAuthFromRequest as jest.Mock).mockResolvedValue({ sub: 'user-1' })
-
-    const res = await POST(makeRequest({}))
-    expect(res.status).toBe(400)
-  })
-
-  it('undoes latest action and returns ok', async () => {
-    const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
-    ;(getAuthFromRequest as jest.Mock).mockResolvedValue({
-      sub: 'user-1',
-      tenantId: 'tenant-1',
-      orgId: 'org-1',
-    })
-    const target = {
-      id: 'log-1',
-      actorUserId: 'user-1',
-      tenantId: 'tenant-1',
-      organizationId: 'org-1',
-      resourceKind: 'auth.user',
-      resourceId: 'user-42',
-      executionState: 'done',
-    }
-    mockLogs.findByUndoToken.mockResolvedValue(target)
-    mockLogs.latestUndoableForResource.mockResolvedValue(target)
-
-    const res = await POST(makeRequest({ undoToken: 'token-1' }))
-    expect(res.status).toBe(200)
-    await expect(res.json()).resolves.toEqual({ ok: true, logId: 'log-1' })
-    expect(mockCommandBus.undo).toHaveBeenCalledWith('token-1', expect.objectContaining({
-      auth: expect.objectContaining({ sub: 'user-1' }),
-      selectedOrganizationId: 'org-1',
-    }))
-  })
-})

package/src/modules/audit_logs/services/__tests__/actionLogService.test.ts

@@ -1,26 +0,0 @@
-import { ActionLogService } from '../actionLogService'
-
-describe('ActionLogService normalizeInput', () => {
-  it('maps optional strings to undefined and parent fields to null', () => {
-    const service = new ActionLogService({} as unknown as ConstructorParameters<typeof ActionLogService>[0])
-    const serviceWithPrivateAccess = service as unknown as {
-      normalizeInput: (input: Record<string, unknown>) => Record<string, unknown>
-    }
-    const normalized = serviceWithPrivateAccess.normalizeInput({
-      commandId: 'cmd-1',
-      actionLabel: null,
-      resourceKind: '',
-      resourceId: undefined,
-      undoToken: null,
-      parentResourceKind: '',
-      parentResourceId: undefined,
-    })
-
-    expect(normalized.actionLabel).toBeUndefined()
-    expect(normalized.resourceKind).toBeUndefined()
-    expect(normalized.resourceId).toBeUndefined()
-    expect(normalized.undoToken).toBeUndefined()
-    expect(normalized.parentResourceKind).toBeNull()
-    expect(normalized.parentResourceId).toBeNull()
-  })
-})

package/src/modules/auth/__integration__/TC-AUTH-001.spec.ts

@@ -1,13 +0,0 @@
-import { test, expect } from '@playwright/test';
-import { login } from '@open-mercato/core/modules/core/__integration__/helpers/auth';
-
-/**
- * TC-AUTH-001: Successful User Login
- * Source: .ai/qa/scenarios/TC-AUTH-001-user-login-success.md
- */
-test.describe('TC-AUTH-001: Successful User Login', () => {
-  test('should login with valid credentials and redirect to dashboard', async ({ page }) => {
-    await login(page, 'admin');
-    await expect(page).toHaveURL(/\/backend/);
-  });
-});

package/src/modules/auth/__integration__/TC-AUTH-002.spec.ts

@@ -1,30 +0,0 @@
-import { expect, test } from '@playwright/test';
-
-/**
- * TC-AUTH-002: Login Failure with Invalid Credentials
- * Source: .ai/qa/scenarios/TC-AUTH-002-user-login-invalid-credentials.md
- */
-test.describe('TC-AUTH-002: Login Failure with Invalid Credentials', () => {
-  test('should reject invalid credentials with a generic error', async ({ page }) => {
-    const baseUrl = process.env.BASE_URL || 'http://localhost:3000';
-    await page.context().addCookies([
-      { name: 'om_demo_notice_ack', value: 'ack', url: baseUrl, sameSite: 'Lax' },
-      { name: 'om_cookie_notice_ack', value: 'ack', url: baseUrl, sameSite: 'Lax' },
-    ]);
-
-    await page.goto('/login');
-    await page.getByLabel('Email').fill('admin@acme.com');
-    await page.getByLabel('Password').fill('wrong-password');
-    await page.getByLabel('Password').press('Enter');
-
-    await expect(page).toHaveURL(/\/login$/);
-    await expect(page.getByText(/invalid email or password|invalid credentials/i).first()).toBeVisible();
-
-    await page.getByLabel('Email').fill(`not-found-${Date.now()}@acme.com`);
-    await page.getByLabel('Password').fill('wrong-password');
-    await page.getByLabel('Password').press('Enter');
-
-    await expect(page).toHaveURL(/\/login$/);
-    await expect(page.getByText(/invalid email or password|invalid credentials/i).first()).toBeVisible();
-  });
-});

package/src/modules/auth/__integration__/TC-AUTH-003.spec.ts

@@ -1,28 +0,0 @@
-import { expect, test } from '@playwright/test';
-
-/**
- * TC-AUTH-003: Login with Remember Me
- * Source: .ai/qa/scenarios/TC-AUTH-003-user-login-remember-me.md
- */
-test.describe('TC-AUTH-003: Login with Remember Me', () => {
-  test('should set both auth and session cookies when remember me is enabled', async ({ page }) => {
-    const baseUrl = process.env.BASE_URL || 'http://localhost:3000';
-    await page.context().addCookies([
-      { name: 'om_demo_notice_ack', value: 'ack', url: baseUrl, sameSite: 'Lax' },
-      { name: 'om_cookie_notice_ack', value: 'ack', url: baseUrl, sameSite: 'Lax' },
-    ]);
-
-    await page.goto('/login');
-    await page.getByLabel('Email').fill('admin@acme.com');
-    await page.getByLabel('Password').fill('secret');
-    await page.getByRole('checkbox', { name: /remember me/i }).check();
-    await page.getByLabel('Password').press('Enter');
-
-    await expect(page).toHaveURL(/\/backend(?:\/.*)?$/);
-
-    const cookies = await page.context().cookies();
-    const names = new Set(cookies.map((cookie) => cookie.name));
-    expect(names.has('auth_token')).toBeTruthy();
-    expect(names.has('session_token')).toBeTruthy();
-  });
-});

package/src/modules/auth/__integration__/TC-AUTH-004.spec.ts

@@ -1,21 +0,0 @@
-import { expect, test } from '@playwright/test';
-import { login } from '@open-mercato/core/modules/core/__integration__/helpers/auth';
-
-/**
- * TC-AUTH-004: User Logout
- * Source: .ai/qa/scenarios/TC-AUTH-004-user-logout.md
- */
-test.describe('TC-AUTH-004: User Logout', () => {
-  test('should clear session and redirect to login', async ({ page }) => {
-    await login(page, 'admin');
-    await expect(page).toHaveURL(/\/backend(?:\/.*)?$/);
-
-    await page.getByRole('button', { name: /admin@acme.com/i }).click();
-    await page.getByRole('menuitem', { name: /logout/i }).click();
-    await page.waitForTimeout(500);
-
-    const cookies = await page.context().cookies();
-    const authCookie = cookies.find((cookie) => cookie.name === 'auth_token');
-    expect(authCookie).toBeUndefined();
-  });
-});

package/src/modules/auth/__integration__/TC-AUTH-005.spec.ts

@@ -1,17 +0,0 @@
-import { expect, test } from '@playwright/test';
-
-/**
- * TC-AUTH-005: Password Reset Request
- * Source: .ai/qa/scenarios/TC-AUTH-005-password-reset-request.md
- */
-test.describe('TC-AUTH-005: Password Reset Request', () => {
-  test('should accept reset request and show generic confirmation', async ({ page }) => {
-    await page.goto('/reset');
-    await expect(page.getByText(/reset password/i).first()).toBeVisible();
-
-    await page.getByLabel('Email').fill('admin@acme.com');
-    await page.getByRole('button', { name: /send reset link/i }).click();
-
-    await expect(page.getByText(/if an account with that email exists/i)).toBeVisible();
-  });
-});

package/src/modules/auth/__integration__/TC-AUTH-006.spec.ts

@@ -1,17 +0,0 @@
-import { expect, test } from '@playwright/test';
-
-/**
- * TC-AUTH-006: Complete Password Reset
- * Source: .ai/qa/scenarios/TC-AUTH-006-password-reset-complete.md
- */
-test.describe('TC-AUTH-006: Complete Password Reset', () => {
-  test('should show reset form and reject completion with an invalid token', async ({ page }) => {
-    await page.goto('/reset/qa-invalid-token');
-    await expect(page.getByText(/set a new password/i)).toBeVisible();
-
-    await page.getByLabel(/new password/i).fill('Valid1!Pass');
-    await page.getByRole('button', { name: /update password/i }).click();
-
-    await expect(page.getByText(/invalid or expired token/i)).toBeVisible();
-  });
-});

package/src/modules/auth/__integration__/TC-AUTH-007.spec.ts

@@ -1,19 +0,0 @@
-import { expect, test } from '@playwright/test';
-
-/**
- * TC-AUTH-007: Password Reset with Expired Token
- * Source: .ai/qa/scenarios/TC-AUTH-007-password-reset-expired-token.md
- */
-test.describe('TC-AUTH-007: Password Reset with Expired Token', () => {
-  test('should reject invalid and expired reset tokens', async ({ page }) => {
-    await page.goto('/reset/qa-expired-token');
-    await page.getByLabel(/new password/i).fill('Valid1!Pass');
-    await page.getByRole('button', { name: /update password/i }).click();
-    await expect(page.getByText(/invalid or expired token/i)).toBeVisible();
-
-    await page.goto('/reset/qa-malformed-token');
-    await page.getByLabel(/new password/i).fill('Valid1!Pass');
-    await page.getByRole('button', { name: /update password/i }).click();
-    await expect(page.getByText(/invalid or expired token/i)).toBeVisible();
-  });
-});

package/src/modules/auth/__integration__/TC-AUTH-008.spec.ts

@@ -1,31 +0,0 @@
-import { expect, test } from '@playwright/test';
-import { login } from '@open-mercato/core/modules/core/__integration__/helpers/auth';
-import { apiRequest, getAuthToken } from '@open-mercato/core/modules/core/__integration__/helpers/api';
-import { createUserViaUi } from '@open-mercato/core/modules/core/__integration__/helpers/authUi';
-
-/**
- * TC-AUTH-008: Admin Creates New User
- * Source: .ai/qa/scenarios/TC-AUTH-008-user-creation.md
- */
-test.describe('TC-AUTH-008: Admin Creates New User', () => {
-  test('should create a new user from the create form', async ({ page, request }) => {
-    const email = `qa-auth-008-${Date.now()}@acme.com`;
-    let token: string | null = null;
-    let userId: string | null = null;
-
-    try {
-      token = await getAuthToken(request);
-      await login(page, 'admin');
-      await createUserViaUi(page, { email, password: 'Valid1!Pass', role: 'employee' });
-      await expect(page.getByText(email)).toBeVisible();
-
-      await page.getByRole('row', { name: new RegExp(email, 'i') }).click();
-      await expect(page).toHaveURL(/\/backend\/users\/[0-9a-f-]{36}\/edit$/i);
-      userId = page.url().match(/\/backend\/users\/([0-9a-f-]{36})\/edit$/i)?.[1] ?? null;
-    } finally {
-      if (token && userId) {
-        await apiRequest(request, 'DELETE', `/api/auth/users?id=${encodeURIComponent(userId)}`, { token }).catch(() => {});
-      }
-    }
-  });
-});

package/src/modules/auth/__integration__/TC-AUTH-009.spec.ts

@@ -1,22 +0,0 @@
-import { expect, test } from '@playwright/test';
-import { login } from '@open-mercato/core/modules/core/__integration__/helpers/auth';
-
-/**
- * TC-AUTH-009: User Creation Validation Errors
- * Source: .ai/qa/scenarios/TC-AUTH-009-user-creation-validation.md
- */
-test.describe('TC-AUTH-009: User Creation Validation Errors', () => {
-  test('should show validation errors for invalid create payload', async ({ page }) => {
-    await login(page, 'admin');
-    await page.goto('/backend/users/create');
-
-    await page.getByRole('textbox').nth(0).fill(`qa-auth-009-${Date.now()}@acme.com`);
-    await page.getByRole('textbox').nth(1).fill('Valid1!Pass');
-    const rolesInput = page.getByRole('textbox', { name: /add tag and press enter/i });
-    await rolesInput.fill('employee');
-    await rolesInput.press('Enter');
-    await page.getByRole('button', { name: 'Create' }).first().click();
-
-    await expect(page.getByText(/expected string, received null/i).first()).toBeVisible();
-  });
-});

package/src/modules/auth/__integration__/TC-AUTH-010.spec.ts

@@ -1,39 +0,0 @@
-import { expect, test } from '@playwright/test';
-import { login } from '@open-mercato/core/modules/core/__integration__/helpers/auth';
-import { apiRequest, getAuthToken } from '@open-mercato/core/modules/core/__integration__/helpers/api';
-import { createUserViaUi } from '@open-mercato/core/modules/core/__integration__/helpers/authUi';
-
-/**
- * TC-AUTH-010: Edit Existing User
- * Source: .ai/qa/scenarios/TC-AUTH-010-user-edit.md
- */
-test.describe('TC-AUTH-010: Edit Existing User', () => {
-  test('should edit a user email and persist changes', async ({ page, request }) => {
-    const stamp = Date.now();
-    const initialEmail = `qa-auth-010-${stamp}@acme.com`;
-    const updatedEmail = `qa-auth-010-updated-${stamp}@acme.com`;
-    let token: string | null = null;
-    let userId: string | null = null;
-
-    try {
-      token = await getAuthToken(request);
-      await login(page, 'admin');
-      await createUserViaUi(page, { email: initialEmail, password: 'Valid1!Pass', role: 'employee' });
-
-      await page.getByRole('row', { name: new RegExp(initialEmail, 'i') }).click();
-      await expect(page).toHaveURL(/\/backend\/users\/[0-9a-f-]{36}\/edit$/i);
-      userId = page.url().match(/\/backend\/users\/([0-9a-f-]{36})\/edit$/i)?.[1] ?? null;
-
-      await page.getByRole('textbox').nth(0).fill(updatedEmail);
-      await page.getByRole('button', { name: 'Save' }).first().click();
-
-      await expect(page).toHaveURL(/\/backend\/users(?:\?.*)?$/);
-      await page.getByRole('textbox', { name: 'Search' }).fill(updatedEmail);
-      await expect(page.getByRole('row', { name: new RegExp(updatedEmail, 'i') })).toBeVisible();
-    } finally {
-      if (token && userId) {
-        await apiRequest(request, 'DELETE', `/api/auth/users?id=${encodeURIComponent(userId)}`, { token }).catch(() => {});
-      }
-    }
-  });
-});

package/src/modules/auth/__integration__/TC-AUTH-011.spec.ts

@@ -1,35 +0,0 @@
-import { expect, test } from '@playwright/test';
-import { login } from '@open-mercato/core/modules/core/__integration__/helpers/auth';
-import { createUserViaUi } from '@open-mercato/core/modules/core/__integration__/helpers/authUi';
-
-/**
- * TC-AUTH-011: Delete User Account
- * Source: .ai/qa/scenarios/TC-AUTH-011-user-delete.md
- */
-test.describe('TC-AUTH-011: Delete User Account', () => {
-  test('should delete a user from the edit page', async ({ page }) => {
-    const email = `qa-auth-011-${Date.now()}@acme.com`;
-
-    await login(page, 'admin');
-    await createUserViaUi(page, { email, password: 'Valid1!Pass', role: 'employee' });
-
-    const row = page.getByRole('row', { name: new RegExp(email, 'i') });
-    await expect(row).toBeVisible();
-    await row.click();
-    await expect(page).toHaveURL(/\/backend\/users\/[0-9a-f-]{36}\/edit$/i);
-
-    const deleteButton = page.getByRole('button', { name: /^Delete$/i }).first();
-    if ((await deleteButton.count()) === 0 || !(await deleteButton.isVisible().catch(() => false))) {
-      test.skip(true, 'User delete action is not available in this environment.');
-    }
-    await deleteButton.click();
-
-    const confirmDialog = page.getByRole('alertdialog');
-    if (await confirmDialog.isVisible().catch(() => false)) {
-      await confirmDialog.getByRole('button', { name: /^Delete$/i }).first().click();
-    }
-
-    await page.getByRole('textbox', { name: 'Search' }).fill(email);
-    await expect(page.getByRole('row', { name: new RegExp(email, 'i') })).toHaveCount(0);
-  });
-});