@rubytech/create-maxy-code 0.1.576 → 0.1.577

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-visit-status-write.test.ts

@@ -1,6 +1,8 @@
 import { describe, it, expect } from 'vitest'
 import {
   MAX_NOTE_LENGTH,
+  INSTANT_RE,
+  MAX_OWNER_ID_LENGTH,
   MAX_STATUS_LENGTH,
   WORK_DATE_RE,
   processVisitStatus,
@@ -14,6 +16,9 @@ interface Row {
   accountId: string
   ownerId: string
   visitId: string
+  /** The visit's CURRENT status, which the Task 2511 transition pre-read needs
+   *  to know what a move is moving from. */
+  status?: string
 }
 
 /**
@@ -23,7 +28,11 @@ interface Row {
  * `meta.changes` as the number of rows the SELECT admitted. A fake that always
  * reported one change would pass a handler with no gate at all.
  */
-function db(rows: Row[], person: { ownerId: string; recordScope: string; accountId: string }) {
+function db(
+  rows: Row[],
+  person: { ownerId: string; recordScope: string; accountId: string },
+  transitions: Array<[string, string]> | string = [],
+) {
   const inserted: unknown[][] = []
   const database = {
     prepare(sql: string) {
@@ -34,7 +43,25 @@ function db(rows: Row[], person: { ownerId: string; recordScope: string; account
           return stmt
         },
         async first<T>() {
-          return person as unknown as T
+          // Three reads now use first(): the session resolve, and the Task 2511
+          // pre-read of the visit's current status with the account's published
+          // transitions. Branching on the table is what keeps the fake honest
+          // about which one answered, and the pre-read APPLIES THE SAME TWO
+          // FILTERS the insert does, so a test that deletes the scope branch in
+          // the endpoint sees the pre-read stop matching too.
+          if (!sql.includes('FROM visits')) return person as unknown as T
+          const acct = bound[0] as string
+          const visitId = bound[bound.length - 1] as string
+          let admitted = rows.filter((r) => r.accountId === acct && r.visitId === visitId)
+          if (sql.includes('AND v.ownerId = ?')) {
+            admitted = admitted.filter((r) => r.ownerId === (bound[1] as string))
+          }
+          if (admitted.length === 0) return null as unknown as T
+          return {
+            status: admitted[0].status ?? '',
+            transitions:
+              typeof transitions === 'string' ? transitions : JSON.stringify(transitions),
+          } as unknown as T
         },
         async run() {
           if (!sql.startsWith('INSERT INTO visit_status')) return { meta: { changes: 0 } }
@@ -62,10 +89,25 @@ const env = (d: D1Database): PortalEnv =>
   ({ DB: d, BUCKET: {}, PORTAL_ACCOUNT_ID: 'acc-a' }) as unknown as PortalEnv
 
 const ROWS: Row[] = [
-  { accountId: 'acc-a', ownerId: 'alice', visitId: 'v1' },
-  { accountId: 'acc-a', ownerId: 'bob', visitId: 'v2' },
-  { accountId: 'acc-a', ownerId: '', visitId: 'v3' },
-  { accountId: 'acc-b', ownerId: 'alice', visitId: 'v4' },
+  { accountId: 'acc-a', ownerId: 'alice', visitId: 'v1', status: 'booked' },
+  { accountId: 'acc-a', ownerId: 'bob', visitId: 'v2', status: 'booked' },
+  { accountId: 'acc-a', ownerId: '', visitId: 'v3', status: 'booked' },
+  { accountId: 'acc-b', ownerId: 'alice', visitId: 'v4', status: 'booked' },
+]
+
+/**
+ * Every move the tests BELOW this line make, declared legal.
+ *
+ * Those tests measure the scope gate and the field gates, not the transition
+ * gate Task 2511 added. Without this list each of them would be refused as an
+ * illegal move and would stop measuring what it was written to measure. The
+ * transition gate has its own describe block at the end of this file, where the
+ * list is stated per test.
+ */
+const DECLARED: Array<[string, string]> = [
+  ['booked', 'on-site'],
+  ['booked', 'done'],
+  ['booked', 'on-site-at-granary-court'],
 ]
 
 const person = (ownerId: string, recordScope: string) => ({
@@ -78,7 +120,7 @@ const body = (visitId: string, status = 'on-site') => ({ visitId, status })
 
 describe('the visit-status write gate', () => {
   it('accepts an own-scoped person setting status on their own visit', async () => {
-    const { database, inserted } = db(ROWS, person('alice', 'own'))
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
     const h = await processVisitStatus(body('v1'), 'sess', env(database), () => {}, 1)
     expect(h.status).toBe(200)
     expect(inserted).toHaveLength(1)
@@ -87,28 +129,28 @@ describe('the visit-status write gate', () => {
   it('refuses an own-scoped person setting status on someone else visit', async () => {
     // A read leak shows someone a day that is not theirs. A write leak lets
     // them change it, which is why the gate is the same one and is structural.
-    const { database, inserted } = db(ROWS, person('alice', 'own'))
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
     const h = await processVisitStatus(body('v2'), 'sess', env(database), () => {}, 1)
     expect(h.status).toBe(404)
     expect(inserted).toEqual([])
   })
 
   it('refuses an own-scoped person setting status on an unbound visit', async () => {
-    const { database, inserted } = db(ROWS, person('alice', 'own'))
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
     const h = await processVisitStatus(body('v3'), 'sess', env(database), () => {}, 1)
     expect(h.status).toBe(404)
     expect(inserted).toEqual([])
   })
 
   it('lets an account-scoped person set status on any visit for the account', async () => {
-    const { database, inserted } = db(ROWS, person('marie', 'account'))
+    const { database, inserted } = db(ROWS, person('marie', 'account'), DECLARED)
     const h = await processVisitStatus(body('v2'), 'sess', env(database), () => {}, 1)
     expect(h.status).toBe(200)
     expect(inserted).toHaveLength(1)
   })
 
   it('refuses another account visit even at account scope', async () => {
-    const { database, inserted } = db(ROWS, person('marie', 'account'))
+    const { database, inserted } = db(ROWS, person('marie', 'account'), DECLARED)
     const h = await processVisitStatus(body('v4'), 'sess', env(database), () => {}, 1)
     expect(h.status).toBe(404)
     expect(inserted).toEqual([])
@@ -123,7 +165,7 @@ describe('the visit-status write gate', () => {
   })
 
   it('refuses a body with no visitId or no status', async () => {
-    const { database, inserted } = db(ROWS, person('alice', 'own'))
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
     const e = env(database)
     expect((await processVisitStatus({ status: 'x' }, 'sess', e, () => {}, 1)).status).toBe(400)
     expect((await processVisitStatus({ visitId: 'v1' }, 'sess', e, () => {}, 1)).status).toBe(400)
@@ -135,7 +177,7 @@ describe('the visit-status write gate', () => {
     // The value reaches :Visit.status through the pull. An unbounded free-text
     // field written from the open web is refused at the door, not truncated:
     // a truncated status is a different status, silently.
-    const { database, inserted } = db(ROWS, person('alice', 'own'))
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
     const h = await processVisitStatus(
       body('v1', 'x'.repeat(MAX_STATUS_LENGTH + 1)),
       'sess',
@@ -148,7 +190,7 @@ describe('the visit-status write gate', () => {
   })
 
   it('stamps the setter own id, never one the request supplies', async () => {
-    const { database, inserted } = db(ROWS, person('alice', 'own'))
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
     await processVisitStatus(
       { visitId: 'v1', status: 'on-site', ownerId: 'bob' },
       'sess',
@@ -162,7 +204,7 @@ describe('the visit-status write gate', () => {
 
   it('logs the scope and the outcome, and no status text', async () => {
     const lines: string[] = []
-    const { database } = db(ROWS, person('alice', 'own'))
+    const { database } = db(ROWS, person('alice', 'own'), DECLARED)
     await processVisitStatus(
       body('v1', 'on-site-at-granary-court'),
       'sess',
@@ -181,7 +223,7 @@ describe('the working day a status edit may carry', () => {
   const day = (extra: Record<string, unknown>) => ({ visitId: 'v1', status: 'done', ...extra })
 
   it('inserts the day, the date and the note when the claim is well formed', async () => {
-    const { database, inserted } = db(ROWS, person('alice', 'own'))
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
     const h = await processVisitStatus(
       day({ dayHundredths: 100, workDate: '2026-08-05', workNote: 'second fix' }),
       'sess',
@@ -197,7 +239,7 @@ describe('the working day a status edit may carry', () => {
 
   it('defaults to no claim when the body carries no day', async () => {
     // A status-only edit is the common case and must stay a one-field write.
-    const { database, inserted } = db(ROWS, person('alice', 'own'))
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
     const h = await processVisitStatus(day({}), 'sess', env(database), () => {}, 1)
     expect(h.status).toBe(200)
     expect(inserted[0]).toContain(0)
@@ -207,7 +249,7 @@ describe('the working day a status edit may carry', () => {
   it('refuses a day outside 0..100 rather than writing it into the graph', async () => {
     // A value above a full day is described by no shipped surface. Refused at
     // the door, exactly as an over-long status is.
-    const { database, inserted } = db(ROWS, person('alice', 'own'))
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
     const e = env(database)
     for (const d of [101, -1, 50.5, '100']) {
       const h = await processVisitStatus(
@@ -225,7 +267,7 @@ describe('the working day a status edit may carry', () => {
   it('refuses a claim whose date is missing or malformed', async () => {
     // The date becomes part of the cost key. A claim the roll-up cannot date is
     // told to the person now, not left sitting in the queue.
-    const { database, inserted } = db(ROWS, person('alice', 'own'))
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
     const e = env(database)
     for (const wd of [undefined, '', '5th Aug', '2026-8-5']) {
       const h = await processVisitStatus(
@@ -246,7 +288,7 @@ describe('the working day a status edit may carry', () => {
   })
 
   it('refuses a note longer than the cap rather than truncating it', async () => {
-    const { database, inserted } = db(ROWS, person('alice', 'own'))
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
     const h = await processVisitStatus(
       day({
         dayHundredths: 100,
@@ -264,7 +306,7 @@ describe('the working day a status edit may carry', () => {
 
   it('logs whether the edit carried a day, and never the note', async () => {
     const lines: string[] = []
-    const { database } = db(ROWS, person('alice', 'own'))
+    const { database } = db(ROWS, person('alice', 'own'), DECLARED)
     await processVisitStatus(
       day({ dayHundredths: 100, workDate: '2026-08-05', workNote: 'granary court rewire' }),
       'sess',
@@ -280,7 +322,7 @@ describe('the working day a status edit may carry', () => {
 
   it('still refuses another person visit when the edit carries a day', async () => {
     // The gate is the SELECT and the new fields must not have moved it.
-    const { database, inserted } = db(ROWS, person('alice', 'own'))
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
     const h = await processVisitStatus(
       { visitId: 'v2', status: 'done', dayHundredths: 100, workDate: '2026-08-05' },
       'sess',
@@ -292,3 +334,272 @@ describe('the working day a status edit may carry', () => {
     expect(inserted).toEqual([])
   })
 })
+
+describe('the move a status edit may carry (Task 2511)', () => {
+  const move = (extra: Record<string, unknown>) => ({ visitId: 'v1', status: 'on-site', ...extra })
+
+  it('inserts the new owner and the new start when both are well formed', async () => {
+    const { database, inserted } = db(ROWS, person('marie', 'account'), DECLARED)
+    const h = await processVisitStatus(
+      move({ assignedOwnerId: 'bob', startDate: '2026-08-10T09:00:00.000Z' }),
+      'sess',
+      env(database),
+      () => {},
+      1,
+    )
+    expect(h.status).toBe(200)
+    expect(inserted[0]).toContain('bob')
+    expect(inserted[0]).toContain('2026-08-10T09:00:00.000Z')
+  })
+
+  it('defaults both to empty when the body carries neither', async () => {
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
+    const h = await processVisitStatus(move({}), 'sess', env(database), () => {}, 1)
+    expect(h.status).toBe(200)
+    // status, statusAt, workDate, workNote, assignedOwnerId, startDate: four of
+    // those six are empty on a status-only edit.
+    expect(inserted[0].filter((v) => v === '').length).toBeGreaterThanOrEqual(4)
+  })
+
+  it('refuses an offset-bearing, date-only or second-precision start rather than converting it', async () => {
+    // readCommitments compares stored start values LEXICALLY, so an
+    // offset-bearing row reads the wrong window and a real double-booking goes
+    // unreported. Refused at the door, never normalised here.
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
+    const e = env(database)
+    for (const s of [
+      '2026-08-10T09:00:00+01:00',
+      '2026-08-10',
+      '2026-08-10T09:00:00Z',
+      '2026-08-10 09:00:00.000Z',
+      'soon',
+    ]) {
+      const h = await processVisitStatus(move({ startDate: s }), 'sess', e, () => {}, 1)
+      expect(h.status, `refuses ${s}`).toBe(400)
+    }
+    expect(inserted).toEqual([])
+  })
+
+  it('refuses an over-long assignedOwnerId rather than truncating it', async () => {
+    // A truncated id matches a different person, or nobody, silently.
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
+    const h = await processVisitStatus(
+      move({ assignedOwnerId: 'x'.repeat(MAX_OWNER_ID_LENGTH + 1) }),
+      'sess',
+      env(database),
+      () => {},
+      1,
+    )
+    expect(h.status).toBe(400)
+    expect(inserted).toEqual([])
+  })
+
+  it('still refuses another person visit when the edit carries a move', async () => {
+    // The gate is the SELECT and the new fields must not have moved it.
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
+    const h = await processVisitStatus(
+      { visitId: 'v2', status: 'on-site', assignedOwnerId: 'bob' },
+      'sess',
+      env(database),
+      () => {},
+      1,
+    )
+    expect(h.status).toBe(404)
+    expect(inserted).toEqual([])
+  })
+
+  it('accepts a start only in the shape the tree stores', () => {
+    expect(INSTANT_RE.test('2026-08-10T09:00:00.000Z')).toBe(true)
+    expect(INSTANT_RE.test('2026-08-10T09:00:00Z')).toBe(false)
+    expect(INSTANT_RE.test('2026-08-10')).toBe(false)
+  })
+
+  it('names the visit and the reason when it refuses a bad instant', async () => {
+    const lines: string[] = []
+    const { database } = db(ROWS, person('alice', 'own'), DECLARED)
+    await processVisitStatus(
+      move({ startDate: 'soon' }),
+      'sess',
+      env(database),
+      (l) => lines.push(l),
+      1,
+    )
+    expect(lines.join('\n')).toContain('op=rejected')
+    expect(lines.join('\n')).toContain('reason=bad-instant')
+    expect(lines.join('\n')).toContain('v1')
+  })
+})
+
+describe('the transition gate at the door (Task 2511)', () => {
+  it('accepts a move the account declared', async () => {
+    const { database, inserted } = db(ROWS, person('marie', 'account'), [['booked', 'on-site']])
+    const h = await processVisitStatus(
+      { visitId: 'v1', status: 'on-site' },
+      'sess',
+      env(database),
+      () => {},
+      1,
+    )
+    expect(h.status).toBe(200)
+    expect(inserted).toHaveLength(1)
+  })
+
+  it('refuses a move the account did not declare, and writes nothing', async () => {
+    // The refusal is here and not at the pull, which runs sixty seconds later
+    // with no screen to refuse to, and which sets the status unconditionally.
+    const { database, inserted } = db(ROWS, person('marie', 'account'), [['booked', 'on-site']])
+    const h = await processVisitStatus(
+      { visitId: 'v1', status: 'done' },
+      'sess',
+      env(database),
+      () => {},
+      1,
+    )
+    expect(h.status).toBe(400)
+    expect(h.payload).toEqual({ ok: false, error: 'illegal-transition' })
+    expect(inserted).toEqual([])
+  })
+
+  it('lets a re-time through when the status is unchanged', async () => {
+    // `[from, to]` declares a MOVE. A write whose status equals the current one
+    // is not a move, and no account declares a self-transition, so without this
+    // rule every pure re-timing would be refused.
+    const { database, inserted } = db(ROWS, person('marie', 'account'), [['booked', 'on-site']])
+    const h = await processVisitStatus(
+      { visitId: 'v1', status: 'booked', startDate: '2026-08-10T09:00:00.000Z' },
+      'sess',
+      env(database),
+      () => {},
+      1,
+    )
+    expect(h.status).toBe(200)
+    expect(inserted).toHaveLength(1)
+  })
+
+  it('refuses every move when the account published no transitions', async () => {
+    // An empty list means the account declared none, which refuses everything.
+    // That is visibly wrong on screen; accepting everything would leave the page
+    // enforcing nothing and looking identical to one that enforces correctly.
+    const { database, inserted } = db(ROWS, person('marie', 'account'), [])
+    const h = await processVisitStatus(
+      { visitId: 'v1', status: 'on-site' },
+      'sess',
+      env(database),
+      () => {},
+      1,
+    )
+    expect(h.status).toBe(400)
+    expect(inserted).toEqual([])
+  })
+
+  it('refuses every move when the published list is malformed', async () => {
+    const { database, inserted } = db(ROWS, person('marie', 'account'), 'not json')
+    const h = await processVisitStatus(
+      { visitId: 'v1', status: 'on-site' },
+      'sess',
+      env(database),
+      () => {},
+      1,
+    )
+    expect(h.status).toBe(400)
+    expect(inserted).toEqual([])
+  })
+
+  it('answers 404 for a visit the person may not see, before any transition check', async () => {
+    const { database, inserted } = db(ROWS, person('alice', 'own'), [['booked', 'on-site']])
+    const h = await processVisitStatus(
+      { visitId: 'v2', status: 'on-site' },
+      'sess',
+      env(database),
+      () => {},
+      1,
+    )
+    expect(h.status).toBe(404)
+    expect(inserted).toEqual([])
+  })
+
+  it('names the reason in the log, with the visit', async () => {
+    const lines: string[] = []
+    const { database } = db(ROWS, person('marie', 'account'), [['booked', 'on-site']])
+    await processVisitStatus(
+      { visitId: 'v1', status: 'done' },
+      'sess',
+      env(database),
+      (l) => lines.push(l),
+      1,
+    )
+    expect(lines.join('\n')).toContain('op=rejected')
+    expect(lines.join('\n')).toContain('reason=illegal-transition')
+    expect(lines.join('\n')).toContain('v1')
+  })
+
+  it('still never says whether the visit exists, on a 404', async () => {
+    // One answer for "no such visit" and "not yours". Distinguishing them would
+    // let anyone enumerate the account's visit ids.
+    const { database } = db(ROWS, person('alice', 'own'), [['booked', 'on-site']])
+    const missing = await processVisitStatus(
+      { visitId: 'nope', status: 'on-site' },
+      'sess',
+      env(database),
+      () => {},
+      1,
+    )
+    const theirs = await processVisitStatus(
+      { visitId: 'v2', status: 'on-site' },
+      'sess',
+      env(database),
+      () => {},
+      1,
+    )
+    expect(missing.payload).toEqual(theirs.payload)
+    expect(missing.status).toBe(theirs.status)
+  })
+})
+
+describe('a move and a labour claim are separate edits (Task 2511)', () => {
+  it('refuses a body carrying both, and writes nothing', async () => {
+    // The device applies a move in one statement that writes no cost, so a row
+    // carrying both would set the status, move the worker, be claimed, and drop
+    // the day the worker stated.
+    const { database, inserted } = db(ROWS, person('marie', 'account'), DECLARED)
+    const e = env(database)
+    for (const move of [{ assignedOwnerId: 'bob' }, { startDate: '2026-08-10T09:00:00.000Z' }]) {
+      const h = await processVisitStatus(
+        { visitId: 'v1', status: 'on-site', dayHundredths: 100, workDate: '2026-08-05', ...move },
+        'sess',
+        e,
+        () => {},
+        1,
+      )
+      expect(h.status).toBe(400)
+    }
+    expect(inserted).toEqual([])
+  })
+
+  it('still accepts each one on its own', async () => {
+    const { database, inserted } = db(ROWS, person('marie', 'account'), DECLARED)
+    const e = env(database)
+    const labour = await processVisitStatus(
+      { visitId: 'v1', status: 'done', dayHundredths: 100, workDate: '2026-08-05' },
+      'sess', e, () => {}, 1,
+    )
+    const move = await processVisitStatus(
+      { visitId: 'v1', status: 'on-site', assignedOwnerId: 'bob' },
+      'sess', e, () => {}, 1,
+    )
+    expect(labour.status).toBe(200)
+    expect(move.status).toBe(200)
+    expect(inserted).toHaveLength(2)
+  })
+
+  it('names the reason with the visit', async () => {
+    const lines: string[] = []
+    const { database } = db(ROWS, person('marie', 'account'), DECLARED)
+    await processVisitStatus(
+      { visitId: 'v1', status: 'on-site', dayHundredths: 100, workDate: '2026-08-05', assignedOwnerId: 'bob' },
+      'sess', env(database), (l) => lines.push(l), 1,
+    )
+    expect(lines.join('\n')).toContain('reason=move-with-labour')
+    expect(lines.join('\n')).toContain('v1')
+  })
+})