@open-mercato/core 0.4.5-develop-2e9903a57a → 0.4.5-develop-eeccf7adf4

package/src/modules/translations/__integration__/TC-TRANS-008.spec.ts

@@ -1,209 +0,0 @@
-import { expect, test } from '@playwright/test'
-import { apiRequest, getAuthToken } from '@open-mercato/core/modules/core/__integration__/helpers/api'
-import { createProductFixture, deleteCatalogProductIfExists } from '@open-mercato/core/modules/core/__integration__/helpers/catalogFixtures'
-import { deleteTranslationIfExists, ensureRoleFeatures, getLocales, restoreRoleFeatures, setLocales } from './helpers/translationFixtures'
-
-const ENTITY_TYPE = 'catalog:catalog_product'
-
-/**
- * TC-TRANS-008: RBAC Authorization per Role
- * Verifies that translation API endpoints enforce correct feature-based access
- * control for admin (translations.*) and employee (translations.view + translations.manage).
- *
- * Role matrix:
- *   superadmin — all features (implicit)
- *   admin      — translations.* (all)
- *   employee   — translations.view + translations.manage (edit translations)
- */
-test.describe('TC-TRANS-008: RBAC Authorization per Role', () => {
-  let adminOriginalFeatures: string[] = []
-  let employeeOriginalFeatures: string[] = []
-
-  test.beforeAll(async ({ request }) => {
-    const saToken = await getAuthToken(request, 'superadmin')
-    adminOriginalFeatures = await ensureRoleFeatures(request, saToken, 'admin', ['translations.*'])
-    employeeOriginalFeatures = await ensureRoleFeatures(request, saToken, 'employee', ['translations.view', 'translations.manage'])
-  })
-
-  test.afterAll(async ({ request }) => {
-    const saToken = await getAuthToken(request, 'superadmin')
-    await restoreRoleFeatures(request, saToken, 'admin', adminOriginalFeatures).catch(() => {})
-    await restoreRoleFeatures(request, saToken, 'employee', employeeOriginalFeatures).catch(() => {})
-  })
-
-  // ─── Admin: full access ───────────────────────────────────────────
-
-  test('admin can GET translations (translations.view)', async ({ request }) => {
-    const adminToken = await getAuthToken(request, 'admin')
-    const saToken = await getAuthToken(request, 'superadmin')
-    const productTitle = `QA TC-TRANS-008-admin-get ${Date.now()}`
-    const sku = `QA-T008-AG-${Date.now()}`
-    let productId: string | null = null
-
-    try {
-      productId = await createProductFixture(request, adminToken, { title: productTitle, sku })
-
-      await apiRequest(request, 'PUT', `/api/translations/${ENTITY_TYPE}/${productId}`, {
-        token: saToken,
-        data: { de: { title: 'Admin GET Test' } },
-      })
-
-      const response = await apiRequest(request, 'GET', `/api/translations/${ENTITY_TYPE}/${productId}`, { token: adminToken })
-      expect(response.ok()).toBeTruthy()
-    } finally {
-      await deleteTranslationIfExists(request, saToken, ENTITY_TYPE, productId)
-      await deleteCatalogProductIfExists(request, adminToken, productId)
-    }
-  })
-
-  test('admin can PUT translations (translations.manage)', async ({ request }) => {
-    const adminToken = await getAuthToken(request, 'admin')
-    const saToken = await getAuthToken(request, 'superadmin')
-    const productTitle = `QA TC-TRANS-008-admin-put ${Date.now()}`
-    const sku = `QA-T008-AP-${Date.now()}`
-    let productId: string | null = null
-
-    try {
-      productId = await createProductFixture(request, adminToken, { title: productTitle, sku })
-
-      const response = await apiRequest(request, 'PUT', `/api/translations/${ENTITY_TYPE}/${productId}`, {
-        token: adminToken,
-        data: { de: { title: 'Admin PUT Test' } },
-      })
-      expect(response.ok()).toBeTruthy()
-    } finally {
-      await deleteTranslationIfExists(request, saToken, ENTITY_TYPE, productId)
-      await deleteCatalogProductIfExists(request, adminToken, productId)
-    }
-  })
-
-  test('admin can DELETE translations (translations.manage)', async ({ request }) => {
-    const adminToken = await getAuthToken(request, 'admin')
-    const saToken = await getAuthToken(request, 'superadmin')
-    const productTitle = `QA TC-TRANS-008-admin-del ${Date.now()}`
-    const sku = `QA-T008-AD-${Date.now()}`
-    let productId: string | null = null
-
-    try {
-      productId = await createProductFixture(request, adminToken, { title: productTitle, sku })
-
-      await apiRequest(request, 'PUT', `/api/translations/${ENTITY_TYPE}/${productId}`, {
-        token: saToken,
-        data: { de: { title: 'To delete' } },
-      })
-
-      const response = await apiRequest(request, 'DELETE', `/api/translations/${ENTITY_TYPE}/${productId}`, { token: adminToken })
-      expect(response.status()).toBe(204)
-    } finally {
-      await deleteTranslationIfExists(request, saToken, ENTITY_TYPE, productId)
-      await deleteCatalogProductIfExists(request, adminToken, productId)
-    }
-  })
-
-  test('admin can PUT locales (translations.manage_locales)', async ({ request }) => {
-    const adminToken = await getAuthToken(request, 'admin')
-    const originalLocales = await getLocales(request, adminToken)
-
-    try {
-      const response = await apiRequest(request, 'PUT', '/api/translations/locales', {
-        token: adminToken,
-        data: { locales: ['en', 'de'] },
-      })
-      expect(response.ok()).toBeTruthy()
-    } finally {
-      await setLocales(request, adminToken, originalLocales).catch(() => {})
-    }
-  })
-
-  // ─── Employee: can edit translations, cannot manage locales ───────
-
-  test('employee can GET translations (translations.view)', async ({ request }) => {
-    const adminToken = await getAuthToken(request, 'admin')
-    const saToken = await getAuthToken(request, 'superadmin')
-    const employeeToken = await getAuthToken(request, 'employee')
-    const productTitle = `QA TC-TRANS-008-emp-get ${Date.now()}`
-    const sku = `QA-T008-EG-${Date.now()}`
-    let productId: string | null = null
-
-    try {
-      productId = await createProductFixture(request, adminToken, { title: productTitle, sku })
-
-      await apiRequest(request, 'PUT', `/api/translations/${ENTITY_TYPE}/${productId}`, {
-        token: saToken,
-        data: { de: { title: 'Employee GET Test' } },
-      })
-
-      const response = await apiRequest(request, 'GET', `/api/translations/${ENTITY_TYPE}/${productId}`, { token: employeeToken })
-      expect(response.ok()).toBeTruthy()
-      const body = (await response.json()) as { translations: Record<string, Record<string, string>> }
-      expect(body.translations.de.title).toBe('Employee GET Test')
-    } finally {
-      await deleteTranslationIfExists(request, saToken, ENTITY_TYPE, productId)
-      await deleteCatalogProductIfExists(request, adminToken, productId)
-    }
-  })
-
-  test('employee can GET locales (translations.view)', async ({ request }) => {
-    const employeeToken = await getAuthToken(request, 'employee')
-    const response = await apiRequest(request, 'GET', '/api/translations/locales', { token: employeeToken })
-    expect(response.ok()).toBeTruthy()
-    const body = (await response.json()) as { locales: string[] }
-    expect(Array.isArray(body.locales)).toBeTruthy()
-  })
-
-  test('employee can PUT translations (translations.manage)', async ({ request }) => {
-    const adminToken = await getAuthToken(request, 'admin')
-    const employeeToken = await getAuthToken(request, 'employee')
-    const productTitle = `QA TC-TRANS-008-emp-put ${Date.now()}`
-    const sku = `QA-T008-EP-${Date.now()}`
-    let productId: string | null = null
-
-    try {
-      productId = await createProductFixture(request, adminToken, { title: productTitle, sku })
-
-      const response = await apiRequest(request, 'PUT', `/api/translations/${ENTITY_TYPE}/${productId}`, {
-        token: employeeToken,
-        data: { de: { title: 'Employee PUT Test' } },
-      })
-      expect(response.ok()).toBeTruthy()
-    } finally {
-      const saToken = await getAuthToken(request, 'superadmin')
-      await deleteTranslationIfExists(request, saToken, ENTITY_TYPE, productId)
-      await deleteCatalogProductIfExists(request, adminToken, productId)
-    }
-  })
-
-  test('employee can DELETE translations (translations.manage)', async ({ request }) => {
-    const adminToken = await getAuthToken(request, 'admin')
-    const saToken = await getAuthToken(request, 'superadmin')
-    const employeeToken = await getAuthToken(request, 'employee')
-    const productTitle = `QA TC-TRANS-008-emp-del ${Date.now()}`
-    const sku = `QA-T008-ED-${Date.now()}`
-    let productId: string | null = null
-
-    try {
-      productId = await createProductFixture(request, adminToken, { title: productTitle, sku })
-
-      await apiRequest(request, 'PUT', `/api/translations/${ENTITY_TYPE}/${productId}`, {
-        token: saToken,
-        data: { de: { title: 'Cannot delete' } },
-      })
-
-      const response = await apiRequest(request, 'DELETE', `/api/translations/${ENTITY_TYPE}/${productId}`, { token: employeeToken })
-      expect(response.status()).toBe(204)
-    } finally {
-      await deleteTranslationIfExists(request, saToken, ENTITY_TYPE, productId)
-      await deleteCatalogProductIfExists(request, adminToken, productId)
-    }
-  })
-
-  test('employee cannot PUT locales (403 — missing translations.manage_locales)', async ({ request }) => {
-    const employeeToken = await getAuthToken(request, 'employee')
-
-    const response = await apiRequest(request, 'PUT', '/api/translations/locales', {
-      token: employeeToken,
-      data: { locales: ['en', 'de', 'fr'] },
-    })
-    expect(response.status()).toBe(403)
-  })
-})

package/src/modules/translations/__integration__/helpers/translationFixtures.ts

@@ -1,95 +0,0 @@
-import { type APIRequestContext } from '@playwright/test'
-import { apiRequest } from '@open-mercato/core/modules/core/__integration__/helpers/api'
-
-export async function getLocales(
-  request: APIRequestContext,
-  token: string,
-): Promise<string[]> {
-  const response = await apiRequest(request, 'GET', '/api/translations/locales', { token })
-  if (!response.ok()) return []
-  const body = (await response.json()) as { locales?: string[] }
-  return body.locales ?? []
-}
-
-export async function setLocales(
-  request: APIRequestContext,
-  token: string,
-  locales: string[],
-): Promise<void> {
-  await apiRequest(request, 'PUT', '/api/translations/locales', { token, data: { locales } })
-}
-
-export async function deleteTranslationIfExists(
-  request: APIRequestContext,
-  token: string | null,
-  entityType: string,
-  entityId: string | null,
-): Promise<void> {
-  if (!token || !entityId) return
-  try {
-    await apiRequest(request, 'DELETE', `/api/translations/${entityType}/${entityId}`, { token })
-  } catch {
-    return
-  }
-}
-
-type RoleAclPayload = { features: string[]; isSuperAdmin: boolean; organizations: string[] | null }
-
-async function findRoleId(
-  request: APIRequestContext,
-  token: string,
-  roleName: string,
-): Promise<string> {
-  const response = await apiRequest(request, 'GET', `/api/auth/roles?search=${encodeURIComponent(roleName)}&pageSize=50`, { token })
-  const body = (await response.json()) as { items?: Array<{ id: string; name: string }> }
-  const role = (body.items ?? []).find((r) => r.name === roleName)
-  if (!role) throw new Error(`Role "${roleName}" not found`)
-  return role.id
-}
-
-async function getRoleAcl(
-  request: APIRequestContext,
-  token: string,
-  roleId: string,
-): Promise<RoleAclPayload> {
-  const response = await apiRequest(request, 'GET', `/api/auth/roles/acl?roleId=${roleId}`, { token })
-  const body = (await response.json()) as Partial<RoleAclPayload>
-  return {
-    features: Array.isArray(body.features) ? body.features : [],
-    isSuperAdmin: !!body.isSuperAdmin,
-    organizations: body.organizations ?? null,
-  }
-}
-
-export async function ensureRoleFeatures(
-  request: APIRequestContext,
-  token: string,
-  roleName: string,
-  requiredFeatures: string[],
-): Promise<string[]> {
-  const roleId = await findRoleId(request, token, roleName)
-  const acl = await getRoleAcl(request, token, roleId)
-  const original = [...acl.features]
-  const merged = Array.from(new Set([...acl.features, ...requiredFeatures]))
-  if (merged.length !== acl.features.length) {
-    await apiRequest(request, 'PUT', '/api/auth/roles/acl', {
-      token,
-      data: { roleId, features: merged, isSuperAdmin: acl.isSuperAdmin },
-    })
-  }
-  return original
-}
-
-export async function restoreRoleFeatures(
-  request: APIRequestContext,
-  token: string,
-  roleName: string,
-  features: string[],
-): Promise<void> {
-  const roleId = await findRoleId(request, token, roleName)
-  const acl = await getRoleAcl(request, token, roleId)
-  await apiRequest(request, 'PUT', '/api/auth/roles/acl', {
-    token,
-    data: { roleId, features, isSuperAdmin: acl.isSuperAdmin },
-  })
-}

package/src/modules/translations/api/__tests__/locales.test.ts

@@ -1,67 +0,0 @@
-import { z } from 'zod'
-import { isValidIso639 } from '@open-mercato/shared/lib/i18n/iso639'
-
-const bodySchema = z.object({
-  locales: z.array(
-    z.string().min(2).max(10).refine(isValidIso639, { message: 'Invalid ISO 639-1 language code' }),
-  ).min(1).max(50),
-})
-
-describe('locales API body schema', () => {
-  it('accepts valid locales', () => {
-    const result = bodySchema.safeParse({ locales: ['en', 'fr'] })
-    expect(result.success).toBe(true)
-  })
-
-  it('accepts single locale', () => {
-    const result = bodySchema.safeParse({ locales: ['en'] })
-    expect(result.success).toBe(true)
-  })
-
-  it('rejects invalid ISO 639-1 code', () => {
-    const result = bodySchema.safeParse({ locales: ['xx'] })
-    expect(result.success).toBe(false)
-  })
-
-  it('rejects when any locale is invalid (mixed valid/invalid)', () => {
-    const result = bodySchema.safeParse({ locales: ['en', 'xyz'] })
-    expect(result.success).toBe(false)
-  })
-
-  it('rejects empty array', () => {
-    const result = bodySchema.safeParse({ locales: [] })
-    expect(result.success).toBe(false)
-  })
-
-  it('rejects missing locales field', () => {
-    const result = bodySchema.safeParse({})
-    expect(result.success).toBe(false)
-  })
-
-  it('rejects code shorter than 2 chars', () => {
-    const result = bodySchema.safeParse({ locales: ['e'] })
-    expect(result.success).toBe(false)
-  })
-
-  it('rejects code longer than 10 chars', () => {
-    const result = bodySchema.safeParse({ locales: ['abcdefghijk'] })
-    expect(result.success).toBe(false)
-  })
-
-  it('accepts up to 50 locales', () => {
-    // Use first 50 valid ISO codes
-    const validCodes = ['aa', 'ab', 'af', 'ak', 'am', 'an', 'ar', 'as', 'av', 'ay',
-      'az', 'ba', 'be', 'bg', 'bh', 'bi', 'bm', 'bn', 'bo', 'br',
-      'bs', 'ca', 'ce', 'ch', 'co', 'cr', 'cs', 'cu', 'cv', 'cy',
-      'da', 'de', 'dv', 'dz', 'ee', 'el', 'en', 'eo', 'es', 'et',
-      'eu', 'fa', 'ff', 'fi', 'fj', 'fo', 'fr', 'fy', 'ga', 'gd']
-    const result = bodySchema.safeParse({ locales: validCodes })
-    expect(result.success).toBe(true)
-  })
-
-  it('rejects more than 50 locales', () => {
-    const codes = Array.from({ length: 51 }, (_, i) => `l${String(i).padStart(2, '0')}`)
-    const result = bodySchema.safeParse({ locales: codes })
-    expect(result.success).toBe(false)
-  })
-})

package/src/modules/translations/data/__tests__/validators.test.ts

@@ -1,143 +0,0 @@
-import { translationBodySchema, entityTypeParamSchema, entityIdParamSchema } from '../validators'
-
-describe('translation validators', () => {
-  describe('translationBodySchema', () => {
-    it('accepts valid single-locale body', () => {
-      const result = translationBodySchema.safeParse({ en: { title: 'Hello' } })
-      expect(result.success).toBe(true)
-    })
-
-    it('accepts multiple locales', () => {
-      const result = translationBodySchema.safeParse({
-        en: { title: 'Hello' },
-        fr: { title: 'Bonjour' },
-      })
-      expect(result.success).toBe(true)
-    })
-
-    it('accepts null field values', () => {
-      const result = translationBodySchema.safeParse({ en: { title: null } })
-      expect(result.success).toBe(true)
-    })
-
-    it('accepts dot-path field keys', () => {
-      const result = translationBodySchema.safeParse({ en: { 'options.red.label': 'Rot' } })
-      expect(result.success).toBe(true)
-    })
-
-    it('rejects empty locale key', () => {
-      const result = translationBodySchema.safeParse({ '': { title: 'x' } })
-      expect(result.success).toBe(false)
-    })
-
-    it('rejects locale key longer than 10 chars', () => {
-      const result = translationBodySchema.safeParse({ abcdefghijk: { title: 'x' } })
-      expect(result.success).toBe(false)
-    })
-
-    it('rejects empty field key', () => {
-      const result = translationBodySchema.safeParse({ en: { '': 'value' } })
-      expect(result.success).toBe(false)
-    })
-
-    it('rejects field key longer than 100 chars', () => {
-      const longKey = 'a'.repeat(101)
-      const result = translationBodySchema.safeParse({ en: { [longKey]: 'value' } })
-      expect(result.success).toBe(false)
-    })
-
-    it('rejects field value longer than 10000 chars', () => {
-      const longValue = 'x'.repeat(10001)
-      const result = translationBodySchema.safeParse({ en: { title: longValue } })
-      expect(result.success).toBe(false)
-    })
-
-    it('accepts exactly 50 locales (boundary)', () => {
-      const body: Record<string, Record<string, string>> = {}
-      for (let i = 0; i < 50; i++) {
-        body[`l${String(i).padStart(2, '0')}`] = { title: `val${i}` }
-      }
-      const result = translationBodySchema.safeParse(body)
-      expect(result.success).toBe(true)
-    })
-
-    it('rejects 51 locales (over limit)', () => {
-      const body: Record<string, Record<string, string>> = {}
-      for (let i = 0; i < 51; i++) {
-        body[`l${String(i).padStart(2, '0')}`] = { title: `val${i}` }
-      }
-      const result = translationBodySchema.safeParse(body)
-      expect(result.success).toBe(false)
-    })
-
-    it('accepts field value at exactly 10000 chars', () => {
-      const exactValue = 'x'.repeat(10000)
-      const result = translationBodySchema.safeParse({ en: { title: exactValue } })
-      expect(result.success).toBe(true)
-    })
-
-    it('rejects non-string non-null field values', () => {
-      const result = translationBodySchema.safeParse({ en: { title: 123 } })
-      expect(result.success).toBe(false)
-    })
-  })
-
-  describe('entityTypeParamSchema', () => {
-    it('accepts valid entity type with colon', () => {
-      const result = entityTypeParamSchema.safeParse('catalog:product')
-      expect(result.success).toBe(true)
-    })
-
-    it('accepts snake_case entity type', () => {
-      const result = entityTypeParamSchema.safeParse('my_module:my_entity')
-      expect(result.success).toBe(true)
-    })
-
-    it('rejects missing colon', () => {
-      const result = entityTypeParamSchema.safeParse('catalogproduct')
-      expect(result.success).toBe(false)
-    })
-
-    it('rejects uppercase characters', () => {
-      const result = entityTypeParamSchema.safeParse('Catalog:Product')
-      expect(result.success).toBe(false)
-    })
-
-    it('rejects empty string', () => {
-      const result = entityTypeParamSchema.safeParse('')
-      expect(result.success).toBe(false)
-    })
-
-    it('rejects numbers in entity type', () => {
-      const result = entityTypeParamSchema.safeParse('mod1:entity2')
-      expect(result.success).toBe(false)
-    })
-
-    it('rejects hyphens', () => {
-      const result = entityTypeParamSchema.safeParse('my-module:my-entity')
-      expect(result.success).toBe(false)
-    })
-  })
-
-  describe('entityIdParamSchema', () => {
-    it('accepts UUID-like string', () => {
-      const result = entityIdParamSchema.safeParse('550e8400-e29b-41d4-a716-446655440000')
-      expect(result.success).toBe(true)
-    })
-
-    it('accepts composite ID', () => {
-      const result = entityIdParamSchema.safeParse('catalog:product:field_key')
-      expect(result.success).toBe(true)
-    })
-
-    it('accepts simple short ID', () => {
-      const result = entityIdParamSchema.safeParse('abc-123')
-      expect(result.success).toBe(true)
-    })
-
-    it('rejects empty string', () => {
-      const result = entityIdParamSchema.safeParse('')
-      expect(result.success).toBe(false)
-    })
-  })
-})

package/src/modules/translations/lib/__tests__/extract-record-id.test.ts

@@ -1,75 +0,0 @@
-import { extractRecordId } from '../extract-record-id'
-
-describe('extractRecordId', () => {
-  describe('explicit id param', () => {
-    it('returns string id directly', () => {
-      expect(extractRecordId({ id: 'abc-123-def-456-ghi' })).toBe('abc-123-def-456-ghi')
-    })
-
-    it('returns first element when id is an array', () => {
-      expect(extractRecordId({ id: ['first-id-value-abcdef', 'second'] })).toBe('first-id-value-abcdef')
-    })
-
-    it('returns numeric id as string', () => {
-      expect(extractRecordId({ id: '42' })).toBe('42')
-    })
-  })
-
-  describe('UUID-like detection from other params', () => {
-    it('finds UUID in non-id param', () => {
-      expect(extractRecordId({ slug: 'short', recordId: 'a1b2c3d4-e5f6-7890-abcd-ef1234567890' }))
-        .toBe('a1b2c3d4-e5f6-7890-abcd-ef1234567890')
-    })
-
-    it('finds UUID-like value with at least 20 hex chars', () => {
-      expect(extractRecordId({ key: '0123456789abcdef01234' }))
-        .toBe('0123456789abcdef01234')
-    })
-
-    it('finds UUID in array param', () => {
-      expect(extractRecordId({ parts: ['short', 'a1b2c3d4e5f6789012345678'] }))
-        .toBe('a1b2c3d4e5f6789012345678')
-    })
-
-    it('returns undefined when no param matches UUID pattern', () => {
-      expect(extractRecordId({ slug: 'my-product', page: '3' })).toBeUndefined()
-    })
-
-    it('requires at least 20 chars for UUID-like match', () => {
-      expect(extractRecordId({ key: 'abcdef1234567890123' })).toBeUndefined() // 19 chars
-    })
-
-    it('matches case-insensitively', () => {
-      expect(extractRecordId({ key: 'ABCDEF1234567890ABCDEF' }))
-        .toBe('ABCDEF1234567890ABCDEF')
-    })
-
-    it('allows hyphens in UUID pattern', () => {
-      expect(extractRecordId({ key: 'a1b2c3d4-e5f6-7890-abcd' }))
-        .toBe('a1b2c3d4-e5f6-7890-abcd')
-    })
-  })
-
-  describe('priority', () => {
-    it('prefers explicit id over UUID-like params', () => {
-      expect(extractRecordId({
-        id: 'explicit-id',
-        other: 'a1b2c3d4e5f6789012345678',
-      })).toBe('explicit-id')
-    })
-  })
-
-  describe('edge cases', () => {
-    it('returns undefined for empty params', () => {
-      expect(extractRecordId({})).toBeUndefined()
-    })
-
-    it('skips empty string values', () => {
-      expect(extractRecordId({ key: '' })).toBeUndefined()
-    })
-
-    it('rejects strings with non-hex characters', () => {
-      expect(extractRecordId({ key: 'this-is-not-a-valid-uuid-at-all' })).toBeUndefined()
-    })
-  })
-})