@terreno/api 0.7.2 → 0.8.0

package/dist/consentApp.test.js

@@ -0,0 +1,1132 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __read = (this && this.__read) || function (o, n) {
+    var m = typeof Symbol === "function" && o[Symbol.iterator];
+    if (!m) return o;
+    var i = m.call(o), r, ar = [], e;
+    try {
+        while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);
+    }
+    catch (error) { e = { error: error }; }
+    finally {
+        try {
+            if (r && !r.done && (m = i["return"])) m.call(i);
+        }
+        finally { if (e) throw e.error; }
+    }
+    return ar;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var bun_test_1 = require("bun:test");
+var supertest_1 = __importDefault(require("supertest"));
+var consentApp_1 = require("./consentApp");
+var consentForm_1 = require("./models/consentForm");
+var consentResponse_1 = require("./models/consentResponse");
+var terrenoApp_1 = require("./terrenoApp");
+var tests_1 = require("./tests");
+var buildApp = function (consentAppOptions) {
+    if (consentAppOptions === void 0) { consentAppOptions = {}; }
+    return new terrenoApp_1.TerrenoApp({
+        skipListen: true,
+        userModel: tests_1.UserModel,
+    })
+        .register(new consentApp_1.ConsentApp(consentAppOptions))
+        .build();
+};
+(0, bun_test_1.describe)("ConsentApp", function () {
+    var admin;
+    var notAdmin;
+    var adminAgent;
+    var userAgent;
+    (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
+        var app;
+        var _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
+                case 1:
+                    _a = __read.apply(void 0, [_b.sent(), 2]), admin = _a[0], notAdmin = _a[1];
+                    return [4 /*yield*/, Promise.all([consentForm_1.ConsentForm.deleteMany({}), consentResponse_1.ConsentResponse.deleteMany({})])];
+                case 2:
+                    _b.sent();
+                    app = buildApp({ auditTrail: true });
+                    return [4 /*yield*/, (0, tests_1.authAsUser)(app, "admin")];
+                case 3:
+                    adminAgent = _b.sent();
+                    return [4 /*yield*/, (0, tests_1.authAsUser)(app, "notAdmin")];
+                case 4:
+                    userAgent = _b.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.afterEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, Promise.all([consentForm_1.ConsentForm.deleteMany({}), consentResponse_1.ConsentResponse.deleteMany({})])];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.describe)("GET /consent-forms (admin CRUD)", function () {
+        (0, bun_test_1.it)("returns empty list when no forms exist", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, adminAgent.get("/consent-forms").expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(0);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("lists consent forms for admins", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, consentForm_1.ConsentForm.create({
+                            active: true,
+                            content: new Map([["en", "# Terms\nPlease agree."]]),
+                            order: 1,
+                            slug: "terms",
+                            title: "Terms of Service",
+                            type: "terms",
+                            version: 1,
+                        })];
+                    case 1:
+                        _a.sent();
+                        return [4 /*yield*/, adminAgent.get("/consent-forms").expect(200)];
+                    case 2:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
+                        (0, bun_test_1.expect)(res.body.data[0].title).toBe("Terms of Service");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("blocks non-admins from listing forms", function () { return __awaiter(void 0, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, userAgent.get("/consent-forms").expect(405)];
+                    case 1:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("creates a consent form as admin", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, adminAgent
+                            .post("/consent-forms")
+                            .send({
+                            active: false,
+                            content: { en: "# Privacy\nWe protect your data." },
+                            order: 2,
+                            slug: "privacy",
+                            title: "Privacy Policy",
+                            type: "privacy",
+                            version: 1,
+                        })
+                            .expect(201)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.title).toBe("Privacy Policy");
+                        (0, bun_test_1.expect)(res.body.data.slug).toBe("privacy");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("updates a consent form as admin", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var form, res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, consentForm_1.ConsentForm.create({
+                            active: false,
+                            content: new Map([["en", "# HIPAA"]]),
+                            order: 3,
+                            slug: "hipaa",
+                            title: "HIPAA Notice",
+                            type: "hipaa",
+                            version: 1,
+                        })];
+                    case 1:
+                        form = _a.sent();
+                        return [4 /*yield*/, adminAgent
+                                .patch("/consent-forms/".concat(form._id))
+                                .send({ title: "HIPAA Authorization" })
+                                .expect(200)];
+                    case 2:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.title).toBe("HIPAA Authorization");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+    (0, bun_test_1.describe)("POST /consent-forms/:id/publish", function () {
+        (0, bun_test_1.it)("creates a new version and activates it", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var form, res, oldForm;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, consentForm_1.ConsentForm.create({
+                            active: true,
+                            content: new Map([["en", "# Terms v1"]]),
+                            order: 1,
+                            slug: "terms-publish",
+                            title: "Terms v1",
+                            type: "terms",
+                            version: 1,
+                        })];
+                    case 1:
+                        form = _a.sent();
+                        return [4 /*yield*/, adminAgent.post("/consent-forms/".concat(form._id, "/publish")).expect(200)];
+                    case 2:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.version).toBe(2);
+                        (0, bun_test_1.expect)(res.body.data.active).toBe(true);
+                        (0, bun_test_1.expect)(res.body.data.slug).toBe("terms-publish");
+                        return [4 /*yield*/, consentForm_1.ConsentForm.findById(form._id)];
+                    case 3:
+                        oldForm = _a.sent();
+                        (0, bun_test_1.expect)(oldForm === null || oldForm === void 0 ? void 0 : oldForm.active).toBe(false);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("increments version number correctly", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var form, res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, consentForm_1.ConsentForm.create({
+                            active: true,
+                            content: new Map([["en", "# Content"]]),
+                            order: 1,
+                            slug: "versioned",
+                            title: "Versioned Form",
+                            type: "agreement",
+                            version: 3,
+                        })];
+                    case 1:
+                        form = _a.sent();
+                        return [4 /*yield*/, adminAgent.post("/consent-forms/".concat(form._id, "/publish")).expect(200)];
+                    case 2:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.version).toBe(4);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("requires admin to publish", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var form;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, consentForm_1.ConsentForm.create({
+                            active: true,
+                            content: new Map([["en", "# Terms"]]),
+                            order: 1,
+                            slug: "terms-nonadmin",
+                            title: "Terms",
+                            type: "terms",
+                            version: 1,
+                        })];
+                    case 1:
+                        form = _a.sent();
+                        return [4 /*yield*/, userAgent.post("/consent-forms/".concat(form._id, "/publish")).expect(403)];
+                    case 2:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+    (0, bun_test_1.describe)("GET /consent-responses (admin read-only)", function () {
+        (0, bun_test_1.it)("returns empty list when no responses", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, adminAgent.get("/consent-responses").expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(0);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("lists responses for admins", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var form, res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, consentForm_1.ConsentForm.create({
+                            active: true,
+                            content: new Map([["en", "# Terms"]]),
+                            order: 1,
+                            slug: "terms-resp",
+                            title: "Terms",
+                            type: "terms",
+                            version: 1,
+                        })];
+                    case 1:
+                        form = _a.sent();
+                        return [4 /*yield*/, consentResponse_1.ConsentResponse.create({
+                                agreed: true,
+                                agreedAt: new Date(),
+                                consentFormId: form._id,
+                                formVersionSnapshot: 1,
+                                locale: "en",
+                                userId: notAdmin._id,
+                            })];
+                    case 2:
+                        _a.sent();
+                        return [4 /*yield*/, adminAgent.get("/consent-responses").expect(200)];
+                    case 3:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
+                        (0, bun_test_1.expect)(res.body.data[0].agreed).toBe(true);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("blocks non-admins from listing responses", function () { return __awaiter(void 0, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, userAgent.get("/consent-responses").expect(405)];
+                    case 1:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("blocks create on consent-responses", function () { return __awaiter(void 0, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, adminAgent.post("/consent-responses").send({}).expect(405)];
+                    case 1:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+    (0, bun_test_1.describe)("GET /consents/pending", function () {
+        (0, bun_test_1.it)("returns empty array when no active forms", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, userAgent.get("/consents/pending").expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(0);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns active forms the user hasn't responded to", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, consentForm_1.ConsentForm.create({
+                            active: true,
+                            content: new Map([["en", "# Terms"]]),
+                            order: 1,
+                            slug: "pending-terms",
+                            title: "Terms",
+                            type: "terms",
+                            version: 1,
+                        })];
+                    case 1:
+                        _a.sent();
+                        return [4 /*yield*/, userAgent.get("/consents/pending").expect(200)];
+                    case 2:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
+                        (0, bun_test_1.expect)(res.body.data[0].title).toBe("Terms");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("excludes forms the user has already responded to at the current version", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var form, res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, consentForm_1.ConsentForm.create({
+                            active: true,
+                            content: new Map([["en", "# Terms"]]),
+                            order: 1,
+                            slug: "responded-terms",
+                            title: "Terms",
+                            type: "terms",
+                            version: 1,
+                        })];
+                    case 1:
+                        form = _a.sent();
+                        return [4 /*yield*/, consentResponse_1.ConsentResponse.create({
+                                agreed: true,
+                                agreedAt: new Date(),
+                                consentFormId: form._id,
+                                formVersionSnapshot: 1,
+                                locale: "en",
+                                userId: notAdmin._id,
+                            })];
+                    case 2:
+                        _a.sent();
+                        return [4 /*yield*/, userAgent.get("/consents/pending").expect(200)];
+                    case 3:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(0);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("includes forms when the user responded to an older version", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var form, res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, consentForm_1.ConsentForm.create({
+                            active: true,
+                            content: new Map([["en", "# Terms v2"]]),
+                            order: 1,
+                            slug: "updated-terms",
+                            title: "Terms",
+                            type: "terms",
+                            version: 2,
+                        })];
+                    case 1:
+                        form = _a.sent();
+                        // User responded to version 1
+                        return [4 /*yield*/, consentResponse_1.ConsentResponse.create({
+                                agreed: true,
+                                agreedAt: new Date(),
+                                consentFormId: form._id,
+                                formVersionSnapshot: 1,
+                                locale: "en",
+                                userId: notAdmin._id,
+                            })];
+                    case 2:
+                        // User responded to version 1
+                        _a.sent();
+                        return [4 /*yield*/, userAgent.get("/consents/pending").expect(200)];
+                    case 3:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns forms sorted by order field", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, Promise.all([
+                            consentForm_1.ConsentForm.create({
+                                active: true,
+                                content: new Map([["en", "# Second"]]),
+                                order: 2,
+                                slug: "second-form",
+                                title: "Second Form",
+                                type: "privacy",
+                                version: 1,
+                            }),
+                            consentForm_1.ConsentForm.create({
+                                active: true,
+                                content: new Map([["en", "# First"]]),
+                                order: 1,
+                                slug: "first-form",
+                                title: "First Form",
+                                type: "terms",
+                                version: 1,
+                            }),
+                        ])];
+                    case 1:
+                        _a.sent();
+                        return [4 /*yield*/, userAgent.get("/consents/pending").expect(200)];
+                    case 2:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(2);
+                        (0, bun_test_1.expect)(res.body.data[0].title).toBe("First Form");
+                        (0, bun_test_1.expect)(res.body.data[1].title).toBe("Second Form");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("applies resolveConsentForms callback to filter forms", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var filteredApp, filteredAgent, res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, Promise.all([
+                            consentForm_1.ConsentForm.create({
+                                active: true,
+                                content: new Map([["en", "# Privacy"]]),
+                                order: 1,
+                                slug: "resolver-privacy",
+                                title: "Privacy",
+                                type: "privacy",
+                                version: 1,
+                            }),
+                            consentForm_1.ConsentForm.create({
+                                active: true,
+                                content: new Map([["en", "# Terms"]]),
+                                order: 2,
+                                slug: "resolver-terms",
+                                title: "Terms",
+                                type: "terms",
+                                version: 1,
+                            }),
+                        ])];
+                    case 1:
+                        _a.sent();
+                        filteredApp = buildApp({
+                            resolveConsentForms: function (_user, forms) {
+                                return forms.filter(function (f) { return f.type === "privacy"; });
+                            },
+                        });
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(filteredApp, "notAdmin")];
+                    case 2:
+                        filteredAgent = _a.sent();
+                        return [4 /*yield*/, filteredAgent.get("/consents/pending").expect(200)];
+                    case 3:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
+                        (0, bun_test_1.expect)(res.body.data[0].type).toBe("privacy");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("resolveConsentForms can filter by user admin status", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var filteredApp, filteredAdmin, filteredUser, adminRes, userRes;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, consentForm_1.ConsentForm.create({
+                            active: true,
+                            content: new Map([["en", "# Terms"]]),
+                            order: 1,
+                            slug: "admin-filter-terms",
+                            title: "Terms",
+                            type: "terms",
+                            version: 1,
+                        })];
+                    case 1:
+                        _a.sent();
+                        filteredApp = buildApp({
+                            resolveConsentForms: function (user, forms) { return (user.admin ? [] : forms); },
+                        });
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(filteredApp, "admin")];
+                    case 2:
+                        filteredAdmin = _a.sent();
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(filteredApp, "notAdmin")];
+                    case 3:
+                        filteredUser = _a.sent();
+                        return [4 /*yield*/, filteredAdmin.get("/consents/pending").expect(200)];
+                    case 4:
+                        adminRes = _a.sent();
+                        (0, bun_test_1.expect)(adminRes.body.data).toHaveLength(0);
+                        return [4 /*yield*/, filteredUser.get("/consents/pending").expect(200)];
+                    case 5:
+                        userRes = _a.sent();
+                        (0, bun_test_1.expect)(userRes.body.data).toHaveLength(1);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("requires authentication", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var app;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        app = buildApp();
+                        return [4 /*yield*/, (0, supertest_1.default)(app).get("/consents/pending").expect(401)];
+                    case 1:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+    (0, bun_test_1.describe)("POST /consents/respond", function () {
+        var form;
+        (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, consentForm_1.ConsentForm.create({
+                            active: true,
+                            content: new Map([["en", "# Terms"]]),
+                            order: 1,
+                            slug: "respond-terms",
+                            title: "Terms",
+                            type: "terms",
+                            version: 1,
+                        })];
+                    case 1:
+                        form = _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("creates a consent response", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, userAgent
+                            .post("/consents/respond")
+                            .send({
+                            agreed: true,
+                            consentFormId: form._id,
+                            locale: "en",
+                        })
+                            .expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.agreed).toBe(true);
+                        (0, bun_test_1.expect)(res.body.data.locale).toBe("en");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns 400 when consentFormId is missing", function () { return __awaiter(void 0, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, userAgent.post("/consents/respond").send({ agreed: true, locale: "en" }).expect(400)];
+                    case 1:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns 400 when agreed field is missing", function () { return __awaiter(void 0, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, userAgent
+                            .post("/consents/respond")
+                            .send({ consentFormId: form._id, locale: "en" })
+                            .expect(400)];
+                    case 1:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns 400 when locale is missing", function () { return __awaiter(void 0, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, userAgent
+                            .post("/consents/respond")
+                            .send({ agreed: true, consentFormId: form._id })
+                            .expect(400)];
+                    case 1:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns 400 when form is not active", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var inactiveForm;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, consentForm_1.ConsentForm.create({
+                            active: false,
+                            content: new Map([["en", "# Inactive"]]),
+                            order: 5,
+                            slug: "inactive-form",
+                            title: "Inactive Form",
+                            type: "custom",
+                            version: 1,
+                        })];
+                    case 1:
+                        inactiveForm = _a.sent();
+                        return [4 /*yield*/, userAgent
+                                .post("/consents/respond")
+                                .send({ agreed: true, consentFormId: inactiveForm._id, locale: "en" })
+                                .expect(400)];
+                    case 2:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("validates required checkboxes when agreed is true", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var formWithRequired, res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, consentForm_1.ConsentForm.create({
+                            active: true,
+                            checkboxes: [{ label: "I confirm", required: true }],
+                            content: new Map([["en", "# Required Checkbox Form"]]),
+                            order: 6,
+                            slug: "required-checkbox-form",
+                            title: "Required Checkbox Form",
+                            type: "agreement",
+                            version: 1,
+                        })];
+                    case 1:
+                        formWithRequired = _a.sent();
+                        // Agree without checking the required checkbox
+                        return [4 /*yield*/, userAgent
+                                .post("/consents/respond")
+                                .send({
+                                agreed: true,
+                                checkboxValues: { "0": false },
+                                consentFormId: formWithRequired._id,
+                                locale: "en",
+                            })
+                                .expect(400)];
+                    case 2:
+                        // Agree without checking the required checkbox
+                        _a.sent();
+                        return [4 /*yield*/, userAgent
+                                .post("/consents/respond")
+                                .send({
+                                agreed: true,
+                                checkboxValues: { "0": true },
+                                consentFormId: formWithRequired._id,
+                                locale: "en",
+                            })
+                                .expect(200)];
+                    case 3:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.agreed).toBe(true);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("requires signature when captureSignature is true and agreed is true", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var sigForm, res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, consentForm_1.ConsentForm.create({
+                            active: true,
+                            captureSignature: true,
+                            content: new Map([["en", "# Signature Required"]]),
+                            order: 7,
+                            slug: "sig-form",
+                            title: "Signature Form",
+                            type: "agreement",
+                            version: 1,
+                        })];
+                    case 1:
+                        sigForm = _a.sent();
+                        return [4 /*yield*/, userAgent
+                                .post("/consents/respond")
+                                .send({ agreed: true, consentFormId: sigForm._id, locale: "en" })
+                                .expect(400)];
+                    case 2:
+                        _a.sent();
+                        return [4 /*yield*/, userAgent
+                                .post("/consents/respond")
+                                .send({
+                                agreed: true,
+                                consentFormId: sigForm._id,
+                                locale: "en",
+                                signature: "data:image/png;base64,abc123",
+                            })
+                                .expect(200)];
+                    case 3:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.signature).toBe("data:image/png;base64,abc123");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("stores formVersionSnapshot always", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, userAgent
+                            .post("/consents/respond")
+                            .send({ agreed: true, consentFormId: form._id, locale: "en" })
+                            .expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.formVersionSnapshot).toBe(1);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("stores audit trail fields when auditTrail is enabled", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, userAgent
+                            .post("/consents/respond")
+                            .send({ agreed: true, consentFormId: form._id, locale: "en" })
+                            .expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.contentSnapshot).toBeDefined();
+                        (0, bun_test_1.expect)(res.body.data.contentSnapshot).toContain("Terms");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("requires authentication", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var app;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        app = buildApp();
+                        return [4 /*yield*/, (0, supertest_1.default)(app)
+                                .post("/consents/respond")
+                                .send({ agreed: true, consentFormId: form._id, locale: "en" })
+                                .expect(401)];
+                    case 1:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+    (0, bun_test_1.describe)("GET /consents/my", function () {
+        (0, bun_test_1.it)("returns empty array when user has no consents", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, userAgent.get("/consents/my").expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(0);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns user consent history with populated form data", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var form, res, item;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, consentForm_1.ConsentForm.create({
+                            active: true,
+                            checkboxes: [{ label: "I agree to the terms", required: true }],
+                            content: new Map([["en", "# Terms"]]),
+                            order: 1,
+                            slug: "my-terms",
+                            title: "Terms of Service",
+                            type: "terms",
+                            version: 2,
+                        })];
+                    case 1:
+                        form = _a.sent();
+                        return [4 /*yield*/, consentResponse_1.ConsentResponse.create({
+                                agreed: true,
+                                agreedAt: new Date(),
+                                checkboxValues: new Map([["0", true]]),
+                                consentFormId: form._id,
+                                formVersionSnapshot: 2,
+                                locale: "en",
+                                userId: notAdmin._id,
+                            })];
+                    case 2:
+                        _a.sent();
+                        return [4 /*yield*/, userAgent.get("/consents/my").expect(200)];
+                    case 3:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
+                        item = res.body.data[0];
+                        (0, bun_test_1.expect)(item.agreed).toBe(true);
+                        (0, bun_test_1.expect)(item.locale).toBe("en");
+                        (0, bun_test_1.expect)(item.formVersionSnapshot).toBe(2);
+                        (0, bun_test_1.expect)(item.form).toBeDefined();
+                        (0, bun_test_1.expect)(item.form.title).toBe("Terms of Service");
+                        (0, bun_test_1.expect)(item.form.slug).toBe("my-terms");
+                        (0, bun_test_1.expect)(item.form.type).toBe("terms");
+                        (0, bun_test_1.expect)(item.form.version).toBe(2);
+                        (0, bun_test_1.expect)(item.form.checkboxes).toHaveLength(1);
+                        (0, bun_test_1.expect)(item.form.checkboxes[0].label).toBe("I agree to the terms");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns responses sorted by agreedAt descending", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var form, olderDate, newerDate, res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, consentForm_1.ConsentForm.create({
+                            active: true,
+                            content: new Map([["en", "# Terms"]]),
+                            order: 1,
+                            slug: "sorted-terms",
+                            title: "Terms",
+                            type: "terms",
+                            version: 1,
+                        })];
+                    case 1:
+                        form = _a.sent();
+                        olderDate = new Date("2025-01-01T00:00:00Z");
+                        newerDate = new Date("2025-06-01T00:00:00Z");
+                        return [4 /*yield*/, consentResponse_1.ConsentResponse.create({
+                                agreed: true,
+                                agreedAt: olderDate,
+                                consentFormId: form._id,
+                                formVersionSnapshot: 1,
+                                locale: "en",
+                                userId: notAdmin._id,
+                            })];
+                    case 2:
+                        _a.sent();
+                        return [4 /*yield*/, consentResponse_1.ConsentResponse.create({
+                                agreed: false,
+                                agreedAt: newerDate,
+                                consentFormId: form._id,
+                                formVersionSnapshot: 1,
+                                locale: "en",
+                                userId: notAdmin._id,
+                            })];
+                    case 3:
+                        _a.sent();
+                        return [4 /*yield*/, userAgent.get("/consents/my").expect(200)];
+                    case 4:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(2);
+                        (0, bun_test_1.expect)(res.body.data[0].agreed).toBe(false); // newer first
+                        (0, bun_test_1.expect)(res.body.data[1].agreed).toBe(true); // older second
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("includes audit trail fields when present", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var form, res, item;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, consentForm_1.ConsentForm.create({
+                            active: true,
+                            content: new Map([["en", "# Audit Terms"]]),
+                            order: 1,
+                            slug: "audit-my-terms",
+                            title: "Audit Terms",
+                            type: "terms",
+                            version: 1,
+                        })];
+                    case 1:
+                        form = _a.sent();
+                        return [4 /*yield*/, consentResponse_1.ConsentResponse.create({
+                                agreed: true,
+                                agreedAt: new Date(),
+                                consentFormId: form._id,
+                                contentSnapshot: "# Audit Terms",
+                                formVersionSnapshot: 1,
+                                ipAddress: "192.168.1.1",
+                                locale: "en",
+                                userAgent: "Mozilla/5.0 Test Agent",
+                                userId: notAdmin._id,
+                            })];
+                    case 2:
+                        _a.sent();
+                        return [4 /*yield*/, userAgent.get("/consents/my").expect(200)];
+                    case 3:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
+                        item = res.body.data[0];
+                        (0, bun_test_1.expect)(item.ipAddress).toBe("192.168.1.1");
+                        (0, bun_test_1.expect)(item.userAgent).toBe("Mozilla/5.0 Test Agent");
+                        (0, bun_test_1.expect)(item.contentSnapshot).toBe("# Audit Terms");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("includes signature when present", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var form, signedAt, res, item;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, consentForm_1.ConsentForm.create({
+                            active: true,
+                            captureSignature: true,
+                            content: new Map([["en", "# Signature Terms"]]),
+                            order: 1,
+                            slug: "sig-my-terms",
+                            title: "Signature Terms",
+                            type: "agreement",
+                            version: 1,
+                        })];
+                    case 1:
+                        form = _a.sent();
+                        signedAt = new Date();
+                        return [4 /*yield*/, consentResponse_1.ConsentResponse.create({
+                                agreed: true,
+                                agreedAt: new Date(),
+                                consentFormId: form._id,
+                                formVersionSnapshot: 1,
+                                locale: "en",
+                                signature: "data:image/png;base64,sig123",
+                                signedAt: signedAt,
+                                userId: notAdmin._id,
+                            })];
+                    case 2:
+                        _a.sent();
+                        return [4 /*yield*/, userAgent.get("/consents/my").expect(200)];
+                    case 3:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
+                        item = res.body.data[0];
+                        (0, bun_test_1.expect)(item.signature).toBe("data:image/png;base64,sig123");
+                        (0, bun_test_1.expect)(item.signedAt).toBeDefined();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("does not return other users' consents", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var form, adminRes, userRes;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, consentForm_1.ConsentForm.create({
+                            active: true,
+                            content: new Map([["en", "# Isolation Terms"]]),
+                            order: 1,
+                            slug: "isolation-terms",
+                            title: "Isolation Terms",
+                            type: "terms",
+                            version: 1,
+                        })];
+                    case 1:
+                        form = _a.sent();
+                        return [4 /*yield*/, consentResponse_1.ConsentResponse.create({
+                                agreed: true,
+                                agreedAt: new Date(),
+                                consentFormId: form._id,
+                                formVersionSnapshot: 1,
+                                locale: "en",
+                                userId: admin._id,
+                            })];
+                    case 2:
+                        _a.sent();
+                        return [4 /*yield*/, consentResponse_1.ConsentResponse.create({
+                                agreed: true,
+                                agreedAt: new Date(),
+                                consentFormId: form._id,
+                                formVersionSnapshot: 1,
+                                locale: "en",
+                                userId: notAdmin._id,
+                            })];
+                    case 3:
+                        _a.sent();
+                        return [4 /*yield*/, adminAgent.get("/consents/my").expect(200)];
+                    case 4:
+                        adminRes = _a.sent();
+                        (0, bun_test_1.expect)(adminRes.body.data).toHaveLength(1);
+                        (0, bun_test_1.expect)(adminRes.body.data[0].form.title).toBe("Isolation Terms");
+                        return [4 /*yield*/, userAgent.get("/consents/my").expect(200)];
+                    case 5:
+                        userRes = _a.sent();
+                        (0, bun_test_1.expect)(userRes.body.data).toHaveLength(1);
+                        (0, bun_test_1.expect)(userRes.body.data[0].form.title).toBe("Isolation Terms");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("requires authentication", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var app;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        app = buildApp();
+                        return [4 /*yield*/, (0, supertest_1.default)(app).get("/consents/my").expect(401)];
+                    case 1:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+    (0, bun_test_1.describe)("GET /consents/audit/:userId", function () {
+        (0, bun_test_1.it)("returns audit history for a user when auditTrail is enabled", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var form, res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, consentForm_1.ConsentForm.create({
+                            active: true,
+                            content: new Map([["en", "# Audit Terms"]]),
+                            order: 1,
+                            slug: "audit-terms",
+                            title: "Audit Terms",
+                            type: "terms",
+                            version: 1,
+                        })];
+                    case 1:
+                        form = _a.sent();
+                        return [4 /*yield*/, consentResponse_1.ConsentResponse.create({
+                                agreed: true,
+                                agreedAt: new Date(),
+                                consentFormId: form._id,
+                                contentSnapshot: "# Audit Terms",
+                                formVersionSnapshot: 1,
+                                locale: "en",
+                                userId: notAdmin._id,
+                            })];
+                    case 2:
+                        _a.sent();
+                        return [4 /*yield*/, adminAgent.get("/consents/audit/".concat(notAdmin._id)).expect(200)];
+                    case 3:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
+                        (0, bun_test_1.expect)(res.body.data[0].agreed).toBe(true);
+                        (0, bun_test_1.expect)(res.body.data[0].form.title).toBe("Audit Terms");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns 403 for non-admin users", function () { return __awaiter(void 0, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, userAgent.get("/consents/audit/".concat(notAdmin._id)).expect(403)];
+                    case 1:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns 404 when auditTrail is disabled", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var noAuditApp, noAuditAdmin;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        noAuditApp = buildApp({ auditTrail: false });
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(noAuditApp, "admin")];
+                    case 1:
+                        noAuditAdmin = _a.sent();
+                        return [4 /*yield*/, noAuditAdmin.get("/consents/audit/".concat(notAdmin._id)).expect(404)];
+                    case 2:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+});