@open-mercato/core 0.6.4-develop.4382.1.6b4f656b77 → 0.6.4

package/src/helpers/integration/crudFormPersistence.ts

@@ -0,0 +1,178 @@
+import { expect, test, type APIRequestContext, type APIResponse } from '@playwright/test';
+import { apiRequest } from './api';
+import { expectId, readJsonSafe } from './generalFixtures';
+import {
+  CRUDFORM_EXTENSION_TESTS_DISABLED_ENV,
+  crudFormExtensionTestsDisabled,
+  getCustomFieldValue,
+  type CrudRecord,
+} from './crudFormFields';
+
+/**
+ * Playwright harness for the CrudForm field-persistence sweep (umbrella #2466).
+ *
+ * Every spec proves a CrudForm surface saves AND reloads every field type — scalars,
+ * dictionary references, multiselect/array values, and **custom fields** — on both create
+ * and update.
+ *
+ * The whole sweep is gated by `OM_INTEGRATION_CRUDFORM_EXTENSION_TESTS_DISABLED`
+ * (default `false` → tests run). When set truthy the specs `test.skip()` themselves, so the
+ * sweep can be disabled wholesale without deleting any spec.
+ */
+
+export {
+  CRUDFORM_EXTENSION_TESTS_DISABLED_ENV,
+  crudFormExtensionTestsDisabled,
+  getCustomFieldValue,
+  type CrudRecord,
+};
+
+/**
+ * Call inside `test.beforeAll` (or a test body) to skip the spec when the sweep is disabled.
+ * Uses Playwright's `test.skip(condition, reason)` so the spec is reported as skipped, not failed.
+ */
+export function skipIfCrudFormExtensionTestsDisabled(): void {
+  test.skip(
+    crudFormExtensionTestsDisabled(),
+    `${CRUDFORM_EXTENSION_TESTS_DISABLED_ENV} is set — CrudForm field-persistence sweep skipped`,
+  );
+}
+
+/** Asserts each expected scalar field round-tripped (deep equality so arrays/objects work). */
+export function assertScalarFieldsPersisted(record: CrudRecord, expected: CrudRecord, label = 'record'): void {
+  for (const [key, value] of Object.entries(expected)) {
+    expect(record[key], `${label}.${key} should persist`).toEqual(value);
+  }
+}
+
+/** Asserts each expected custom field round-tripped, regardless of response shape. */
+export function assertCustomFieldsPersisted(record: CrudRecord, expected: CrudRecord, label = 'record'): void {
+  for (const [name, value] of Object.entries(expected)) {
+    expect(getCustomFieldValue(record, name), `${label} custom field "${name}" should persist`).toEqual(value);
+  }
+}
+
+async function safeText(response: APIResponse): Promise<string> {
+  try {
+    return (await response.text()).slice(0, 500);
+  } catch {
+    return '<unreadable body>';
+  }
+}
+
+export type CrudFormExpectation = {
+  scalars?: CrudRecord;
+  customFields?: CrudRecord;
+};
+
+export type CrudFormRoundTripConfig = {
+  request: APIRequestContext;
+  token: string;
+  /** Collection route handling POST (and, without `recordPath`, the collection-style PUT/DELETE and `?id=` list GET), e.g. `/api/currencies/currencies`. */
+  collectionPath: string;
+  create: { payload: CrudRecord; expectedStatus?: number };
+  /** Build the PUT body from the created id. For makeCrud collection routes include the id the route expects; for `recordPath` (detail) routes the id is taken from the path. */
+  update: { payload: (id: string) => CrudRecord; expectedStatus?: number };
+  expectAfterCreate: CrudFormExpectation;
+  expectAfterUpdate: CrudFormExpectation;
+  /** Override id extraction from the create response (default: `id` ?? `entityId`). */
+  idFromCreate?: (body: CrudRecord) => string;
+  /** Override read-back (default: list `?id=` and match on `id`). Useful for detail-GET routes. */
+  readById?: (id: string) => Promise<CrudRecord | null>;
+  /**
+   * For hand-written detail routes (Tier B) where update + delete target `<collection>/:id`
+   * (id in the path) instead of the makeCrud collection verbs (`PUT <collection>` with the id in
+   * the body, `DELETE <collection>?id=`). When provided, the update PUT and the cleanup DELETE both
+   * use `recordPath(id)` verbatim (no `?id=` is appended); read-back still goes through `readById`.
+   * Defaults to the makeCrud collection-verb behavior so existing specs are unaffected.
+   */
+  recordPath?: (id: string) => string;
+  /** Delete the fixture in `finally` (default true). */
+  cleanup?: boolean;
+};
+
+async function defaultReadById(
+  request: APIRequestContext,
+  token: string,
+  collectionPath: string,
+  id: string,
+): Promise<CrudRecord | null> {
+  const separator = collectionPath.includes('?') ? '&' : '?';
+  const response = await apiRequest(
+    request,
+    'GET',
+    `${collectionPath}${separator}id=${encodeURIComponent(id)}&page=1&pageSize=100`,
+    { token },
+  );
+  expect(response.status(), `read-back ${collectionPath} failed: ${response.status()}`).toBe(200);
+  const body = await readJsonSafe<{ items?: CrudRecord[] } & CrudRecord>(response);
+  if (Array.isArray(body?.items)) {
+    return body!.items.find((item) => item.id === id) ?? null;
+  }
+  // Detail routes may return the record directly.
+  return body && body.id === id ? (body as CrudRecord) : null;
+}
+
+/**
+ * Runs the canonical create → read-back → assert → update → read-back → assert → delete
+ * cycle for a makeCrud collection route and asserts every declared field persisted.
+ */
+export async function runCrudFormRoundTrip(config: CrudFormRoundTripConfig): Promise<void> {
+  const { request, token, collectionPath } = config;
+  const read = config.readById ?? ((id: string) => defaultReadById(request, token, collectionPath, id));
+  let id: string | null = null;
+
+  try {
+    const createResponse = await apiRequest(request, 'POST', collectionPath, {
+      token,
+      data: config.create.payload,
+    });
+    expect(
+      createResponse.status(),
+      `create ${collectionPath} failed (${createResponse.status()}): ${await safeText(createResponse)}`,
+    ).toBe(config.create.expectedStatus ?? 201);
+    const createBody = (await readJsonSafe<CrudRecord>(createResponse)) ?? {};
+    const rawId = config.idFromCreate
+      ? config.idFromCreate(createBody)
+      : (createBody.id ?? createBody.entityId);
+    id = expectId(rawId, `create response should include an id (${collectionPath})`);
+
+    const afterCreate = await read(id);
+    expect(afterCreate, `created record ${id} should be readable from ${collectionPath}`).toBeTruthy();
+    if (config.expectAfterCreate.scalars) {
+      assertScalarFieldsPersisted(afterCreate as CrudRecord, config.expectAfterCreate.scalars, 'after-create');
+    }
+    if (config.expectAfterCreate.customFields) {
+      assertCustomFieldsPersisted(afterCreate as CrudRecord, config.expectAfterCreate.customFields, 'after-create');
+    }
+
+    const updateUrl = config.recordPath ? config.recordPath(id) : collectionPath;
+    const updateResponse = await apiRequest(request, 'PUT', updateUrl, {
+      token,
+      data: config.update.payload(id),
+    });
+    expect(
+      updateResponse.status(),
+      `update ${collectionPath} failed (${updateResponse.status()}): ${await safeText(updateResponse)}`,
+    ).toBe(config.update.expectedStatus ?? 200);
+
+    const afterUpdate = await read(id);
+    expect(afterUpdate, `updated record ${id} should be readable from ${collectionPath}`).toBeTruthy();
+    if (config.expectAfterUpdate.scalars) {
+      assertScalarFieldsPersisted(afterUpdate as CrudRecord, config.expectAfterUpdate.scalars, 'after-update');
+    }
+    if (config.expectAfterUpdate.customFields) {
+      assertCustomFieldsPersisted(afterUpdate as CrudRecord, config.expectAfterUpdate.customFields, 'after-update');
+    }
+  } finally {
+    if (id && config.cleanup !== false) {
+      const separator = collectionPath.includes('?') ? '&' : '?';
+      const deleteUrl = config.recordPath
+        ? config.recordPath(id)
+        : `${collectionPath}${separator}id=${encodeURIComponent(id)}`;
+      await apiRequest(request, 'DELETE', deleteUrl, {
+        token,
+      }).catch(() => undefined);
+    }
+  }
+}

package/src/helpers/integration/currenciesFixtures.ts

@@ -1,4 +1,5 @@
 import { expect, type APIRequestContext } from '@playwright/test';
+import { randomInt } from 'node:crypto';
 import { apiRequest } from './api';
 import { getTokenContext } from './generalFixtures';
 
@@ -18,6 +19,65 @@ export async function createCurrencyFixture(
   return body.id as string;
 }
 
+// Codes seeded by the currencies module (seedExampleCurrencies). Generated test
+// codes avoid these so fixtures never collide with seeded rows.
+const SEEDED_CURRENCY_CODES = new Set([
+  'USD', 'EUR', 'JPY', 'GBP', 'CHF', 'CAD', 'AUD', 'CNY', 'CNH', 'PLN',
+]);
+// Reserved across the worker so two fixtures never draw the same code in one run.
+const reservedCurrencyCodes = new Set<string>();
+
+/** Draws an ISO-style three-letter code unused by seeds or earlier fixtures. */
+export function generateUniqueCurrencyCode(): string {
+  const letter = () => String.fromCharCode(65 + randomInt(26));
+  for (let attempt = 0; attempt < 200; attempt += 1) {
+    const code = `${letter()}${letter()}${letter()}`;
+    if (!SEEDED_CURRENCY_CODES.has(code) && !reservedCurrencyCodes.has(code)) {
+      reservedCurrencyCodes.add(code);
+      return code;
+    }
+  }
+  throw new Error('[internal] exhausted unique currency code space');
+}
+
+/**
+ * Creates a currency with a generated unique code and returns its id and code.
+ *
+ * Currency DELETE is a soft delete, but the (organization, tenant, code) unique
+ * constraint still counts soft-deleted rows — re-using a code an earlier test
+ * soft-deleted makes the create fail. Drawing from the full three-letter space
+ * (minus seeds) and retrying with a fresh code on an accidental collision keeps
+ * fixture setup deterministic across runs that share a database.
+ */
+export async function createRandomCurrencyFixture(
+  request: APIRequestContext,
+  token: string,
+  input: { name: string; symbol?: string; isActive?: boolean },
+): Promise<{ id: string; code: string }> {
+  const { organizationId, tenantId } = getTokenContext(token);
+  let lastStatus = 0;
+  for (let attempt = 0; attempt < 8; attempt += 1) {
+    const code = generateUniqueCurrencyCode();
+    const data: Record<string, unknown> = {
+      organizationId,
+      tenantId,
+      code,
+      name: input.name,
+      symbol: input.symbol ?? null,
+    };
+    if (typeof input.isActive === 'boolean') data.isActive = input.isActive;
+    const response = await apiRequest(request, 'POST', '/api/currencies/currencies', { token, data });
+    if (response.status() === 201) {
+      const body = (await response.json()) as { id?: string };
+      if (typeof body.id === 'string' && body.id.length > 0) {
+        return { id: body.id, code };
+      }
+    }
+    lastStatus = response.status();
+  }
+  throw new Error(`[internal] failed to create currency fixture after retries (last status ${lastStatus})`);
+}
+
 export async function createFetchConfigFixture(
   request: APIRequestContext,
   token: string,

package/src/helpers/integration/customerAccountsFixtures.ts

@@ -0,0 +1,256 @@
+import { expect, type APIRequestContext } from '@playwright/test'
+import { randomUUID } from 'node:crypto'
+import { apiRequest } from './api'
+import { expectId, readJsonSafe } from './generalFixtures'
+
+/**
+ * Customer-portal / customer_accounts integration fixtures.
+ *
+ * The portal API (`/api/customer_accounts/portal/*`) authenticates with a pair
+ * of httpOnly cookies (`customer_auth_token` JWT + `customer_session_token`),
+ * not the staff Bearer token. Against the ephemeral PROD build the login route
+ * sets those cookies with `Secure: true`, which Playwright's cookie jar refuses
+ * to replay over plain `http://`. So {@link portalLogin} extracts the cookie
+ * values from the `set-cookie` header and callers pass them back as an explicit
+ * `Cookie:` header — this also keeps multiple portal actors isolated in one test
+ * (each call sends exactly the header it is given, never a shared jar).
+ *
+ * Staff-admin setup calls (create role/user, set ACL, cleanup) reuse the shared
+ * Bearer-token `apiRequest` helper.
+ */
+
+/** Short, collision-resistant token for unique emails/slugs (crypto-backed). */
+export function uniqueSuffix(): string {
+  return randomUUID().replace(/-/g, '').slice(0, 12)
+}
+
+/**
+ * A password that satisfies common complexity rules (upper + lower + digit +
+ * symbol) and the customer_accounts length bounds (8–128 chars).
+ */
+export function customerTestPassword(): string {
+  return `Aa1!${uniqueSuffix()}`
+}
+
+export type CustomerRoleFixture = { id: string; name: string; slug: string }
+
+export type CustomerUserFixture = {
+  id: string
+  email: string
+  password: string
+  displayName: string
+  customerEntityId: string | null
+}
+
+export type CreateCustomerRoleInput = {
+  /** Defaults to a unique generated name. */
+  name?: string
+  /** Defaults to a unique generated slug (lowercased, `[a-z0-9_-]`). */
+  slug?: string
+  /** When provided, the role's ACL is set to these features after creation. */
+  features?: string[]
+  /** When provided, sets the portal-admin bypass flag on the role ACL. */
+  isPortalAdmin?: boolean
+  /** Allow assignment via the portal `users/[id]/roles` endpoint. */
+  customerAssignable?: boolean
+}
+
+/**
+ * Create a customer role (staff admin) and, when `features`/`isPortalAdmin` are
+ * provided, set its ACL. Returns the created role identity.
+ */
+export async function createCustomerRoleFixture(
+  request: APIRequestContext,
+  adminToken: string,
+  input: CreateCustomerRoleInput = {},
+): Promise<CustomerRoleFixture> {
+  const suffix = uniqueSuffix()
+  const name = input.name ?? `QA Portal Role ${suffix}`
+  const slug = input.slug ?? `qa-portal-role-${suffix}`
+
+  const createRes = await apiRequest(request, 'POST', '/api/customer_accounts/admin/roles', {
+    token: adminToken,
+    data: {
+      name,
+      slug,
+      description: 'Integration fixture role',
+      customerAssignable: input.customerAssignable ?? false,
+    },
+  })
+  expect(createRes.status(), 'POST /admin/roles should return 201').toBe(201)
+  const body = await readJsonSafe<{ role?: { id?: string } }>(createRes)
+  const id = expectId(body?.role?.id, 'Role creation response should include role.id')
+
+  if (input.features || typeof input.isPortalAdmin === 'boolean') {
+    await setCustomerRoleAcl(request, adminToken, id, {
+      features: input.features ?? [],
+      isPortalAdmin: input.isPortalAdmin,
+    })
+  }
+
+  return { id, name, slug }
+}
+
+/** Set a customer role's ACL (features + optional portal-admin flag). */
+export async function setCustomerRoleAcl(
+  request: APIRequestContext,
+  adminToken: string,
+  roleId: string,
+  input: { features: string[]; isPortalAdmin?: boolean },
+): Promise<void> {
+  const data: { features: string[]; isPortalAdmin?: boolean } = { features: input.features }
+  if (typeof input.isPortalAdmin === 'boolean') data.isPortalAdmin = input.isPortalAdmin
+  const res = await apiRequest(request, 'PUT', `/api/customer_accounts/admin/roles/${roleId}/acl`, {
+    token: adminToken,
+    data,
+  })
+  expect(res.status(), 'PUT /admin/roles/[id]/acl should return 200').toBe(200)
+}
+
+/**
+ * Create a real owned CRM company (staff admin) and return its `CustomerEntity`
+ * id. `POST /admin/users` validates `customerEntityId` against an owned company
+ * in the caller's tenant+org (kind=company), so portal scoping fixtures must
+ * link users to a company that actually exists rather than a synthetic UUID.
+ */
+export async function createCustomerCompanyFixture(
+  request: APIRequestContext,
+  adminToken: string,
+  displayName?: string,
+): Promise<string> {
+  const name = displayName ?? `QA Portal Company ${uniqueSuffix()}`
+  const res = await apiRequest(request, 'POST', '/api/customers/companies', {
+    token: adminToken,
+    data: { displayName: name },
+  })
+  expect(res.status(), 'POST /customers/companies should return 201').toBe(201)
+  const body = await readJsonSafe<{ id?: string; entityId?: string }>(res)
+  return expectId(body?.id ?? body?.entityId, 'Company creation response should include the entity id')
+}
+
+/** Best-effort soft-delete of a CRM company (cleanup). */
+export async function deleteCustomerCompanyFixture(
+  request: APIRequestContext,
+  adminToken: string | null,
+  companyEntityId: string | null,
+): Promise<void> {
+  if (!adminToken || !companyEntityId) return
+  await apiRequest(request, 'DELETE', `/api/customers/companies?id=${companyEntityId}`, {
+    token: adminToken,
+  }).catch(() => undefined)
+}
+
+export type CreateCustomerUserInput = {
+  email?: string
+  password?: string
+  displayName?: string
+  roleIds?: string[]
+  /**
+   * Owned CRM company id (a `CustomerEntity` of kind=company in the caller's
+   * tenant+org) used for portal company scoping. `POST /admin/users` rejects an
+   * id that is not an owned company, so create one via
+   * {@link createCustomerCompanyFixture} rather than passing a synthetic UUID.
+   */
+  customerEntityId?: string | null
+}
+
+/**
+ * Create a customer user (staff admin). Admin-created users are email-verified
+ * automatically, so the returned credentials can log in immediately.
+ */
+export async function createCustomerUserFixture(
+  request: APIRequestContext,
+  adminToken: string,
+  input: CreateCustomerUserInput = {},
+): Promise<CustomerUserFixture> {
+  const suffix = uniqueSuffix()
+  const email = input.email ?? `qa-portal-${suffix}@test.local`
+  const password = input.password ?? customerTestPassword()
+  const displayName = input.displayName ?? `QA Portal User ${suffix}`
+
+  const data: Record<string, unknown> = { email, password, displayName }
+  if (input.roleIds && input.roleIds.length > 0) data.roleIds = input.roleIds
+  if (input.customerEntityId) data.customerEntityId = input.customerEntityId
+
+  const res = await apiRequest(request, 'POST', '/api/customer_accounts/admin/users', {
+    token: adminToken,
+    data,
+  })
+  expect(res.status(), 'POST /admin/users should return 201').toBe(201)
+  const body = await readJsonSafe<{ user?: { id?: string } }>(res)
+  const id = expectId(body?.user?.id, 'User creation response should include user.id')
+
+  return { id, email, password, displayName, customerEntityId: input.customerEntityId ?? null }
+}
+
+export type PortalSession = {
+  /** Raw `customer_auth_token` (JWT) cookie value. */
+  authToken: string
+  /** Raw `customer_session_token` cookie value. */
+  sessionToken: string
+  /** Ready-to-send `Cookie:` header carrying both portal cookies. */
+  cookieHeader: string
+}
+
+/** Build portal request options carrying the session's `Cookie` header. */
+export function portalCookieHeaders(
+  session: PortalSession,
+  extra?: Record<string, string>,
+): Record<string, string> {
+  return { Cookie: session.cookieHeader, ...(extra ?? {}) }
+}
+
+/**
+ * Log a customer in and return the portal cookies. Pass `session.cookieHeader`
+ * as the `Cookie` request header on subsequent portal calls (see
+ * {@link portalCookieHeaders}). Logging in the same user twice yields two
+ * distinct sessions.
+ */
+export async function portalLogin(
+  request: APIRequestContext,
+  input: { email: string; password: string; tenantId: string },
+): Promise<PortalSession> {
+  const res = await request.post('/api/customer_accounts/login', {
+    data: { email: input.email, password: input.password, tenantId: input.tenantId },
+    headers: { 'Content-Type': 'application/json' },
+  })
+  expect(res.ok(), `portal login should succeed (status ${res.status()})`).toBeTruthy()
+
+  const setCookie = res.headers()['set-cookie'] ?? ''
+  const authMatch = setCookie.match(/customer_auth_token=([^;]+)/)
+  const sessionMatch = setCookie.match(/customer_session_token=([^;]+)/)
+  expect(authMatch, 'login must set customer_auth_token').toBeTruthy()
+  expect(sessionMatch, 'login must set customer_session_token').toBeTruthy()
+
+  const authToken = authMatch![1]
+  const sessionToken = sessionMatch![1]
+  return {
+    authToken,
+    sessionToken,
+    cookieHeader: `customer_auth_token=${authToken}; customer_session_token=${sessionToken}`,
+  }
+}
+
+/** Best-effort soft-delete of a customer user (cleanup). */
+export async function deleteCustomerUserFixture(
+  request: APIRequestContext,
+  adminToken: string | null,
+  userId: string | null,
+): Promise<void> {
+  if (!adminToken || !userId) return
+  await apiRequest(request, 'DELETE', `/api/customer_accounts/admin/users/${userId}`, {
+    token: adminToken,
+  }).catch(() => undefined)
+}
+
+/** Best-effort delete of a customer role (cleanup). */
+export async function deleteCustomerRoleFixture(
+  request: APIRequestContext,
+  adminToken: string | null,
+  roleId: string | null,
+): Promise<void> {
+  if (!adminToken || !roleId) return
+  await apiRequest(request, 'DELETE', `/api/customer_accounts/admin/roles/${roleId}`, {
+    token: adminToken,
+  }).catch(() => undefined)
+}

package/src/helpers/integration/dbFixtures.ts

@@ -44,7 +44,7 @@ function resolveDatabaseUrl(): string {
   return url;
 }
 
-async function withClient<T>(run: (client: Client) => Promise<T>): Promise<T> {
+export async function withClient<T>(run: (client: Client) => Promise<T>): Promise<T> {
   const client = new Client({ connectionString: resolveDatabaseUrl() });
   await client.connect();
   try {
@@ -142,3 +142,17 @@ export async function deleteOrganizationInDb(organizationId: string | null): Pro
     await client.query('delete from organizations where id = $1', [organizationId]);
   });
 }
+
+/**
+ * Hard-deletes integration credential rows for an organization (best-effort test
+ * cleanup). Integration credentials are stored per (integration_id,
+ * organization_id, tenant_id, user_id) with no FK to organizations, so a
+ * throwaway org's credential rows must be removed explicitly when the org row is
+ * torn down.
+ */
+export async function deleteIntegrationCredentialsInDb(organizationId: string | null): Promise<void> {
+  if (!organizationId) return;
+  await withClient(async (client) => {
+    await client.query('delete from integration_credentials where organization_id = $1', [organizationId]);
+  });
+}

package/src/helpers/integration/inboxFixtures.ts

@@ -92,3 +92,39 @@ export async function listInboxProposals(
   const body = await readJsonSafe<{ items?: Array<Record<string, unknown>>; total?: number }>(response);
   return { items: body?.items ?? [], total: body?.total ?? 0 };
 }
+
+export type InboxProposalActionDetail = {
+  id: string;
+  actionType: string;
+  status: string;
+  payload: Record<string, unknown>;
+  description?: string;
+  createdEntityId?: string | null;
+  createdEntityType?: string | null;
+};
+
+export type InboxProposalDetail = {
+  id: string;
+  status: string;
+  category?: string | null;
+  workingLanguage?: string | null;
+  isActive?: boolean;
+  actions: InboxProposalActionDetail[];
+};
+
+export async function fetchProposalDetail(
+  request: APIRequestContext,
+  token: string,
+  proposalId: string,
+): Promise<InboxProposalDetail | null> {
+  const response = await apiRequest(request, 'GET', `/api/inbox_ops/proposals/${proposalId}`, { token });
+  if (!response.ok()) return null;
+  const body = await readJsonSafe<{ proposal?: InboxProposalDetail }>(response);
+  return body?.proposal ?? null;
+}
+
+export function findPendingAction(
+  actions: InboxProposalActionDetail[],
+): InboxProposalActionDetail | null {
+  return actions.find((action) => action.status === 'pending') ?? actions[0] ?? null;
+}