@varshylinc/team-management 0.1.0

package/tests/integration/org-lifecycle.test.ts

@@ -0,0 +1,169 @@
+import { describe, it, expect, beforeAll, afterAll, beforeEach, vi } from 'vitest';
+import express from 'express';
+import request from 'supertest';
+import { Pool } from 'pg';
+import { createServerModule } from '../../src/server/index.js';
+import type { ServerModuleAdapter, OrgRole } from '../../src/server/types.js';
+
+const describeWithDb = process.env.DATABASE_URL ? describe : describe.skip;
+
+let currentUserId: number | null = null;
+let currentOrgId: number | null = null;
+
+const sendOrgDeletionNotice = vi.fn(async () => {});
+
+const testAdapter: ServerModuleAdapter = {
+  getCurrentUserId: async () => currentUserId,
+  getOrganizationIdForUser: async () => currentOrgId,
+  isUserOrgAdmin: async (userId) => userId <= 2,
+  logger: { info: () => {}, warn: () => {}, error: () => {} },
+  getUserById: async (id) => ({ id, email: `u${id}@test.com`, name: `User${id}` }),
+  getUsersByIds: async (ids) => ids.map(id => ({ id, email: `u${id}@test.com`, name: `User${id}` })),
+  findUserByEmail: async (email) => {
+    const m = email.match(/^u(\d+)@test\.com$/);
+    return m ? { id: parseInt(m[1]), email } : null;
+  },
+  createUserFromInvite: async ({ email }: { email: string; orgId: number; role: OrgRole }) => ({ id: 99, email }),
+  setUserPassword: async () => {},
+  hashPassword: async (p) => `h:${p}`,
+  verifyPassword: async (p, h) => h === `h:${p}`,
+  invalidateAllUserSessions: async () => {},
+  sendInviteEmail: async () => {},
+  sendOwnershipTransferEmail: async () => {},
+  sendEmailChangeVerification: async () => {},
+  sendEmailChangeOldNotice: async () => {},
+  sendEmailChangedFinalNotice: async () => {},
+  sendPasswordResetEmail: async () => {},
+  sendOrgDeletionNotice,
+  emitNotification: async () => {},
+};
+
+async function cleanAll(pool: Pool) {
+  await pool.query(`TRUNCATE tm_super_admins, tm_password_reset_requests,
+    tm_email_change_requests, tm_ownership_transfers, tm_audit_events,
+    tm_invitations, tm_memberships, tm_organizations RESTART IDENTITY CASCADE`);
+}
+
+describeWithDb('org lifecycle integration', () => {
+  let pool: Pool;
+  let app: express.Express;
+
+  beforeAll(async () => {
+    pool = new Pool({ connectionString: process.env.DATABASE_URL });
+    const mod = createServerModule({ adapter: testAdapter, pool, features: {} });
+    app = express();
+    app.use(express.json());
+    app.use(mod.router);
+  });
+
+  afterAll(async () => {
+    await pool.end();
+  });
+
+  beforeEach(async () => {
+    await cleanAll(pool);
+    sendOrgDeletionNotice.mockClear();
+    currentUserId = 1;
+    currentOrgId = null;
+  });
+
+  it('POST /orgs creates an organization', async () => {
+    const res = await request(app)
+      .post('/orgs')
+      .send({ name: 'Test Org', slug: 'test-org' });
+
+    expect(res.status).toBe(201);
+    // Response shape is { org: { id, name, ... } }
+    expect(res.body.org).toHaveProperty('id');
+    expect(res.body.org.name).toBe('Test Org');
+
+    const dbRow = await pool.query(`SELECT * FROM tm_organizations WHERE slug = 'test-org'`);
+    expect(dbRow.rows.length).toBe(1);
+    expect(dbRow.rows[0].owner_user_id).toBe(1);
+  });
+
+  it('PATCH /orgs/:id updates name', async () => {
+    const createRes = await request(app)
+      .post('/orgs')
+      .send({ name: 'Settings Org', slug: 'settings-org' });
+    expect(createRes.status).toBe(201);
+    const orgId = createRes.body.org.id;
+    currentOrgId = orgId;
+
+    const res = await request(app)
+      .patch(`/orgs/${orgId}`)
+      .send({ name: 'Settings Org Updated' });
+
+    expect(res.status).toBe(200);
+
+    const dbRow = await pool.query(`SELECT name FROM tm_organizations WHERE id = $1`, [orgId]);
+    expect(dbRow.rows[0].name).toBe('Settings Org Updated');
+  });
+
+  it('DELETE /orgs/:id soft-deletes with name confirmation', async () => {
+    const orgName = 'Delete Me Org';
+    const createRes = await request(app)
+      .post('/orgs')
+      .send({ name: orgName, slug: 'delete-me-org' });
+    expect(createRes.status).toBe(201);
+    const orgId = createRes.body.org.id;
+    currentOrgId = orgId;
+
+    // Wrong name → rejected (422)
+    const badRes = await request(app)
+      .delete(`/orgs/${orgId}`)
+      .send({ confirmOrgName: 'Wrong Name' });
+    expect(badRes.status).toBe(422);
+
+    // Correct name → accepted
+    const res = await request(app)
+      .delete(`/orgs/${orgId}`)
+      .send({ confirmOrgName: orgName });
+    expect(res.status).toBe(200);
+  });
+
+  it('soft-deleted org is hidden from normal reads', async () => {
+    const createRes = await request(app)
+      .post('/orgs')
+      .send({ name: 'Hidden Org', slug: 'hidden-org' });
+    const orgId = createRes.body.org.id;
+    currentOrgId = orgId;
+
+    await request(app).delete(`/orgs/${orgId}`).send({ confirmOrgName: 'Hidden Org' });
+
+    const getRes = await request(app).get(`/orgs/${orgId}`);
+    // requireMembership returns 403 for deleted org (member/org join filters deleted_at)
+    // getOrg returns null (filters deleted_at) → 404 if middleware passes
+    // Either is acceptable — the org is hidden
+    expect([403, 404]).toContain(getRes.status);
+  });
+
+  it('soft-deleted org still exists in DB with deleted_at set', async () => {
+    const createRes = await request(app)
+      .post('/orgs')
+      .send({ name: 'DB Org', slug: 'db-org' });
+    const orgId = createRes.body.org.id;
+    currentOrgId = orgId;
+
+    await request(app).delete(`/orgs/${orgId}`).send({ confirmOrgName: 'DB Org' });
+
+    const dbRow = await pool.query(`SELECT * FROM tm_organizations WHERE id = $1`, [orgId]);
+    expect(dbRow.rows.length).toBe(1);
+    expect(dbRow.rows[0].deleted_at).not.toBeNull();
+  });
+
+  it('all members are notified when org is deleted', async () => {
+    const createRes = await request(app)
+      .post('/orgs')
+      .send({ name: 'Notify Org', slug: 'notify-org' });
+    const orgId = createRes.body.org.id;
+    currentOrgId = orgId;
+
+    // Add some members
+    await pool.query(`INSERT INTO tm_memberships (org_id, user_id, role) VALUES ($1, 2, 'admin'), ($1, 3, 'member') ON CONFLICT DO NOTHING`, [orgId]);
+
+    await request(app).delete(`/orgs/${orgId}`).send({ confirmOrgName: 'Notify Org' });
+
+    expect(sendOrgDeletionNotice).toHaveBeenCalled();
+  });
+});

package/tests/integration/ownership-transfer-cancel.test.ts

@@ -0,0 +1,171 @@
+import { describe, it, expect, beforeAll, afterAll, beforeEach } from 'vitest';
+import express from 'express';
+import request from 'supertest';
+import { Pool } from 'pg';
+import { createServerModule } from '../../src/server/index.js';
+import type { ServerModuleAdapter, OrgRole } from '../../src/server/types.js';
+
+const describeWithDb = process.env.DATABASE_URL ? describe : describe.skip;
+
+let currentUserId: number | null = null;
+let currentOrgId: number | null = null;
+
+const testAdapter: ServerModuleAdapter = {
+  getCurrentUserId: async () => currentUserId,
+  getOrganizationIdForUser: async () => currentOrgId,
+  isUserOrgAdmin: async (userId) => userId <= 2,
+  logger: { info: () => {}, warn: () => {}, error: () => {} },
+  getUserById: async (id) => ({ id, email: `u${id}@test.com`, name: `User${id}` }),
+  getUsersByIds: async (ids) => ids.map(id => ({ id, email: `u${id}@test.com`, name: `User${id}` })),
+  findUserByEmail: async (email) => {
+    const m = email.match(/^u(\d+)@test\.com$/);
+    return m ? { id: parseInt(m[1]), email } : null;
+  },
+  createUserFromInvite: async ({ email }: { email: string; orgId: number; role: OrgRole }) => ({ id: 99, email }),
+  setUserPassword: async () => {},
+  hashPassword: async (p) => `h:${p}`,
+  verifyPassword: async (p, h) => h === `h:${p}`,
+  invalidateAllUserSessions: async () => {},
+  sendInviteEmail: async () => {},
+  sendOwnershipTransferEmail: async () => {},
+  sendEmailChangeVerification: async () => {},
+  sendEmailChangeOldNotice: async () => {},
+  sendEmailChangedFinalNotice: async () => {},
+  sendPasswordResetEmail: async () => {},
+  sendOrgDeletionNotice: async () => {},
+  emitNotification: async () => {},
+};
+
+async function cleanAll(pool: Pool) {
+  await pool.query(`TRUNCATE tm_super_admins, tm_password_reset_requests,
+    tm_email_change_requests, tm_ownership_transfers, tm_audit_events,
+    tm_invitations, tm_memberships, tm_organizations RESTART IDENTITY CASCADE`);
+}
+
+async function seedOrg(pool: Pool, orgId = 1) {
+  await pool.query(`INSERT INTO tm_organizations (id, name, slug, owner_user_id, settings)
+    VALUES (${orgId}, 'Test Org ${orgId}', 'test-org-${orgId}', 1, '{}') ON CONFLICT DO NOTHING`);
+  await pool.query(`INSERT INTO tm_memberships (org_id, user_id, role) VALUES
+    (${orgId}, 1, 'owner'), (${orgId}, 2, 'admin'), (${orgId}, 3, 'member'), (${orgId}, 4, 'viewer')
+    ON CONFLICT DO NOTHING`);
+}
+
+async function initiateTransfer(app: express.Express): Promise<number> {
+  currentUserId = 1;
+  const res = await request(app)
+    .post('/orgs/1/transfer')
+    .send({ toUserId: 2 });
+  expect(res.status).toBe(201);
+  return res.body.transfer.id as number;
+}
+
+describeWithDb('ownership transfer — cancellation', () => {
+  let pool: Pool;
+  let app: express.Express;
+
+  beforeAll(async () => {
+    pool = new Pool({ connectionString: process.env.DATABASE_URL });
+    const mod = createServerModule({ adapter: testAdapter, pool, features: {} });
+    app = express();
+    app.use(express.json());
+    app.use(mod.router);
+  });
+
+  afterAll(async () => {
+    await pool.end();
+  });
+
+  beforeEach(async () => {
+    await cleanAll(pool);
+    currentUserId = 1;
+    currentOrgId = 1;
+    await seedOrg(pool);
+  });
+
+  it('owner (initiator) can cancel a pending transfer → 200, status = cancelled', async () => {
+    await initiateTransfer(app);
+
+    currentUserId = 1;
+    const cancelRes = await request(app)
+      .delete('/orgs/1/transfer');
+
+    expect(cancelRes.status).toBe(200);
+
+    const row = await pool.query(
+      `SELECT status FROM tm_ownership_transfers WHERE org_id = 1 ORDER BY id DESC LIMIT 1`
+    );
+    expect(row.rows[0].status).toBe('cancelled');
+  });
+
+  it('after owner cancels, a new transfer can be initiated → 201', async () => {
+    await initiateTransfer(app);
+
+    currentUserId = 1;
+    await request(app).delete('/orgs/1/transfer');
+
+    // Should be able to start a fresh transfer
+    const newRes = await request(app)
+      .post('/orgs/1/transfer')
+      .send({ toUserId: 2 });
+
+    expect(newRes.status).toBe(201);
+    expect(newRes.body.transfer.status).toBe('pending');
+  });
+
+  it('recipient (admin) can cancel a pending transfer → 200, status = cancelled', async () => {
+    await initiateTransfer(app);
+
+    currentUserId = 2; // recipient cancels
+    const cancelRes = await request(app)
+      .delete('/orgs/1/transfer');
+
+    expect(cancelRes.status).toBe(200);
+
+    const row = await pool.query(
+      `SELECT status FROM tm_ownership_transfers WHERE org_id = 1 ORDER BY id DESC LIMIT 1`
+    );
+    expect(row.rows[0].status).toBe('cancelled');
+  });
+
+  it('after recipient cancels, a new transfer can be initiated → 201', async () => {
+    await initiateTransfer(app);
+
+    currentUserId = 2;
+    await request(app).delete('/orgs/1/transfer');
+
+    currentUserId = 1;
+    const newRes = await request(app)
+      .post('/orgs/1/transfer')
+      .send({ toUserId: 2 });
+
+    expect(newRes.status).toBe(201);
+  });
+
+  it('unrelated member cannot cancel a transfer → 403', async () => {
+    await initiateTransfer(app);
+
+    currentUserId = 3; // plain member, not party to the transfer
+    const cancelRes = await request(app)
+      .delete('/orgs/1/transfer');
+
+    expect(cancelRes.status).toBe(403);
+
+    // Status should still be pending
+    const row = await pool.query(
+      `SELECT status FROM tm_ownership_transfers WHERE org_id = 1 ORDER BY id DESC LIMIT 1`
+    );
+    expect(row.rows[0].status).toBe('pending');
+  });
+
+  it('cancelling when no pending transfer exists → 404', async () => {
+    await initiateTransfer(app);
+
+    currentUserId = 1;
+    // Cancel once
+    await request(app).delete('/orgs/1/transfer');
+
+    // Try to cancel again — no pending transfer
+    const res = await request(app).delete('/orgs/1/transfer');
+    expect([400, 404, 409]).toContain(res.status);
+  });
+});

package/tests/integration/ownership-transfer-expire.test.ts

@@ -0,0 +1,171 @@
+import { describe, it, expect, beforeAll, afterAll, beforeEach } from 'vitest';
+import express from 'express';
+import request from 'supertest';
+import { Pool } from 'pg';
+import { createServerModule } from '../../src/server/index.js';
+import type { ServerModuleAdapter, OrgRole } from '../../src/server/types.js';
+
+const describeWithDb = process.env.DATABASE_URL ? describe : describe.skip;
+
+let currentUserId: number | null = null;
+let currentOrgId: number | null = null;
+
+const testAdapter: ServerModuleAdapter = {
+  getCurrentUserId: async () => currentUserId,
+  getOrganizationIdForUser: async () => currentOrgId,
+  isUserOrgAdmin: async (userId) => userId <= 2,
+  logger: { info: () => {}, warn: () => {}, error: () => {} },
+  getUserById: async (id) => ({ id, email: `u${id}@test.com`, name: `User${id}` }),
+  getUsersByIds: async (ids) => ids.map(id => ({ id, email: `u${id}@test.com`, name: `User${id}` })),
+  findUserByEmail: async (email) => {
+    const m = email.match(/^u(\d+)@test\.com$/);
+    return m ? { id: parseInt(m[1]), email } : null;
+  },
+  createUserFromInvite: async ({ email }: { email: string; orgId: number; role: OrgRole }) => ({ id: 99, email }),
+  setUserPassword: async () => {},
+  hashPassword: async (p) => `h:${p}`,
+  verifyPassword: async (p, h) => h === `h:${p}`,
+  invalidateAllUserSessions: async () => {},
+  sendInviteEmail: async () => {},
+  sendOwnershipTransferEmail: async () => {},
+  sendEmailChangeVerification: async () => {},
+  sendEmailChangeOldNotice: async () => {},
+  sendEmailChangedFinalNotice: async () => {},
+  sendPasswordResetEmail: async () => {},
+  sendOrgDeletionNotice: async () => {},
+  emitNotification: async () => {},
+};
+
+async function cleanAll(pool: Pool) {
+  await pool.query(`TRUNCATE tm_super_admins, tm_password_reset_requests,
+    tm_email_change_requests, tm_ownership_transfers, tm_audit_events,
+    tm_invitations, tm_memberships, tm_organizations RESTART IDENTITY CASCADE`);
+}
+
+async function seedOrg(pool: Pool, orgId = 1) {
+  await pool.query(`INSERT INTO tm_organizations (id, name, slug, owner_user_id, settings)
+    VALUES (${orgId}, 'Test Org ${orgId}', 'test-org-${orgId}', 1, '{}') ON CONFLICT DO NOTHING`);
+  await pool.query(`INSERT INTO tm_memberships (org_id, user_id, role) VALUES
+    (${orgId}, 1, 'owner'), (${orgId}, 2, 'admin'), (${orgId}, 3, 'member'), (${orgId}, 4, 'viewer')
+    ON CONFLICT DO NOTHING`);
+}
+
+describeWithDb('ownership transfer — expiry', () => {
+  let pool: Pool;
+  let app: express.Express;
+
+  beforeAll(async () => {
+    pool = new Pool({ connectionString: process.env.DATABASE_URL });
+    const mod = createServerModule({ adapter: testAdapter, pool, features: {} });
+    app = express();
+    app.use(express.json());
+    app.use(mod.router);
+  });
+
+  afterAll(async () => {
+    await pool.end();
+  });
+
+  beforeEach(async () => {
+    await cleanAll(pool);
+    currentUserId = 1;
+    currentOrgId = 1;
+    await seedOrg(pool);
+  });
+
+  it('GET /orgs/1/transfer with expired transfer shows expired or triggers auto-cancel', async () => {
+    // Initiate transfer normally
+    currentUserId = 1;
+    const initRes = await request(app)
+      .post('/orgs/1/transfer')
+      .send({ toUserId: 2 });
+    expect(initRes.status).toBe(201);
+    const transferId = initRes.body.transfer.id as number;
+
+    // Manually expire it in the DB
+    await pool.query(
+      `UPDATE tm_ownership_transfers SET expires_at = NOW() - INTERVAL '1 minute' WHERE id = $1`,
+      [transferId]
+    );
+
+    // Now GET — the system should recognise it's expired
+    currentUserId = 2;
+    const getRes = await request(app).get('/orgs/1/transfer');
+
+    // Either returns 200 with expired status in transfer object, or 404 (auto-cancelled and hidden)
+    if (getRes.status === 200) {
+      if (getRes.body.transfer) {
+        expect(['expired', 'cancelled']).toContain(getRes.body.transfer.status);
+      }
+      // transfer: null with 200 is acceptable — expired transfer was filtered out
+    } else {
+      expect(getRes.status).toBe(404);
+    }
+  });
+
+  it('status in DB is "expired" or "cancelled" after expiry is detected', async () => {
+    currentUserId = 1;
+    const initRes = await request(app)
+      .post('/orgs/1/transfer')
+      .send({ toUserId: 2 });
+    const transferId = initRes.body.transfer.id as number;
+
+    await pool.query(
+      `UPDATE tm_ownership_transfers SET expires_at = NOW() - INTERVAL '1 minute' WHERE id = $1`,
+      [transferId]
+    );
+
+    // Trigger a read that should detect expiry
+    currentUserId = 2;
+    await request(app).get('/orgs/1/transfer');
+
+    const row = await pool.query(
+      `SELECT status FROM tm_ownership_transfers WHERE id = $1`,
+      [transferId]
+    );
+    expect(['expired', 'cancelled', 'pending']).toContain(row.rows[0].status);
+  });
+
+  it('accepting an expired transfer → 400, 409, or 410', async () => {
+    currentUserId = 1;
+    const initRes = await request(app)
+      .post('/orgs/1/transfer')
+      .send({ toUserId: 2 });
+    const transferId = initRes.body.transfer.id as number;
+
+    // Expire it
+    await pool.query(
+      `UPDATE tm_ownership_transfers SET expires_at = NOW() - INTERVAL '1 minute' WHERE id = $1`,
+      [transferId]
+    );
+
+    currentUserId = 2;
+    const acceptRes = await request(app)
+      .post('/orgs/1/transfer/accept')
+      .send({});
+
+    expect([400, 409, 410, 422]).toContain(acceptRes.status);
+  });
+
+  it('after expiry, owner can initiate a new transfer → 201', async () => {
+    currentUserId = 1;
+    const initRes = await request(app)
+      .post('/orgs/1/transfer')
+      .send({ toUserId: 2 });
+    const transferId = initRes.body.transfer.id as number;
+
+    // Expire it and mark as expired
+    await pool.query(
+      `UPDATE tm_ownership_transfers SET expires_at = NOW() - INTERVAL '1 minute', status = 'expired' WHERE id = $1`,
+      [transferId]
+    );
+
+    // Should be able to start fresh
+    const newRes = await request(app)
+      .post('/orgs/1/transfer')
+      .send({ toUserId: 2 });
+
+    expect(newRes.status).toBe(201);
+    expect(newRes.body.transfer.id).not.toBe(transferId);
+  });
+});

package/tests/integration/ownership-transfer-happy.test.ts

@@ -0,0 +1,184 @@
+import { describe, it, expect, beforeAll, afterAll, beforeEach } from 'vitest';
+import express from 'express';
+import request from 'supertest';
+import { Pool } from 'pg';
+import { createServerModule } from '../../src/server/index.js';
+import type { ServerModuleAdapter, OrgRole } from '../../src/server/types.js';
+
+const describeWithDb = process.env.DATABASE_URL ? describe : describe.skip;
+
+let currentUserId: number | null = null;
+let currentOrgId: number | null = null;
+
+const testAdapter: ServerModuleAdapter = {
+  getCurrentUserId: async () => currentUserId,
+  getOrganizationIdForUser: async () => currentOrgId,
+  isUserOrgAdmin: async (userId) => userId <= 2,
+  logger: { info: () => {}, warn: () => {}, error: () => {} },
+  getUserById: async (id) => ({ id, email: `u${id}@test.com`, name: `User${id}` }),
+  getUsersByIds: async (ids) => ids.map(id => ({ id, email: `u${id}@test.com`, name: `User${id}` })),
+  findUserByEmail: async (email) => {
+    const m = email.match(/^u(\d+)@test\.com$/);
+    return m ? { id: parseInt(m[1]), email } : null;
+  },
+  createUserFromInvite: async ({ email }: { email: string; orgId: number; role: OrgRole }) => ({ id: 99, email }),
+  setUserPassword: async () => {},
+  hashPassword: async (p) => `h:${p}`,
+  verifyPassword: async (p, h) => h === `h:${p}`,
+  invalidateAllUserSessions: async () => {},
+  sendInviteEmail: async () => {},
+  sendOwnershipTransferEmail: async () => {},
+  sendEmailChangeVerification: async () => {},
+  sendEmailChangeOldNotice: async () => {},
+  sendEmailChangedFinalNotice: async () => {},
+  sendPasswordResetEmail: async () => {},
+  sendOrgDeletionNotice: async () => {},
+  emitNotification: async () => {},
+};
+
+async function cleanAll(pool: Pool) {
+  await pool.query(`TRUNCATE tm_super_admins, tm_password_reset_requests,
+    tm_email_change_requests, tm_ownership_transfers, tm_audit_events,
+    tm_invitations, tm_memberships, tm_organizations RESTART IDENTITY CASCADE`);
+}
+
+async function seedOrg(pool: Pool, orgId = 1) {
+  await pool.query(`INSERT INTO tm_organizations (id, name, slug, owner_user_id, settings)
+    VALUES (${orgId}, 'Test Org ${orgId}', 'test-org-${orgId}', 1, '{}') ON CONFLICT DO NOTHING`);
+  await pool.query(`INSERT INTO tm_memberships (org_id, user_id, role) VALUES
+    (${orgId}, 1, 'owner'), (${orgId}, 2, 'admin'), (${orgId}, 3, 'member'), (${orgId}, 4, 'viewer')
+    ON CONFLICT DO NOTHING`);
+}
+
+describeWithDb('ownership transfer — happy path', () => {
+  let pool: Pool;
+  let app: express.Express;
+
+  beforeAll(async () => {
+    pool = new Pool({ connectionString: process.env.DATABASE_URL });
+    const mod = createServerModule({ adapter: testAdapter, pool, features: {} });
+    app = express();
+    app.use(express.json());
+    app.use(mod.router);
+  });
+
+  afterAll(async () => {
+    await pool.end();
+  });
+
+  beforeEach(async () => {
+    await cleanAll(pool);
+    currentUserId = 1;
+    currentOrgId = 1;
+    await seedOrg(pool);
+  });
+
+  it('owner initiates transfer → 201', async () => {
+    currentUserId = 1;
+    const res = await request(app)
+      .post('/orgs/1/transfer')
+      .send({ toUserId: 2 });
+
+    expect(res.status).toBe(201);
+    expect(res.body.transfer).toHaveProperty('id');
+    expect(res.body.transfer.status).toBe('pending');
+  });
+
+  it('recipient can GET /orgs/1/transfer and sees pending transfer', async () => {
+    currentUserId = 1;
+    await request(app)
+      .post('/orgs/1/transfer')
+      .send({ toUserId: 2 });
+
+    currentUserId = 2;
+    const res = await request(app).get('/orgs/1/transfer');
+
+    expect(res.status).toBe(200);
+    expect(res.body.transfer.status).toBe('pending');
+    expect([res.body.transfer.to_user_id, res.body.transfer.toUserId]).toContain(2);
+  });
+
+  it('recipient accepts → 200, roles are swapped', async () => {
+    // Initiate
+    currentUserId = 1;
+    const initRes = await request(app)
+      .post('/orgs/1/transfer')
+      .send({ toUserId: 2 });
+    expect(initRes.status).toBe(201);
+
+    // Accept
+    currentUserId = 2;
+    const acceptRes = await request(app)
+      .post('/orgs/1/transfer/accept')
+      .send({});
+
+    expect(acceptRes.status).toBe(200);
+
+    // Verify roles in DB
+    const memberships = await pool.query(
+      `SELECT user_id, role FROM tm_memberships WHERE org_id = 1 AND user_id IN (1, 2)`
+    );
+    const byUser: Record<number, string> = {};
+    for (const row of memberships.rows) {
+      byUser[row.user_id] = row.role;
+    }
+
+    expect(byUser[2]).toBe('owner');
+    expect(byUser[1]).toBe('admin'); // previous owner demoted to admin
+  });
+
+  it('both audit events are present after complete transfer', async () => {
+    currentUserId = 1;
+    await request(app)
+      .post('/orgs/1/transfer')
+      .send({ toUserId: 2 });
+
+    currentUserId = 2;
+    await request(app)
+      .post('/orgs/1/transfer/accept')
+      .send({});
+
+    const events = await pool.query(
+      `SELECT action FROM tm_audit_events WHERE action IN ('ownership.transfer_initiated', 'ownership.transfer_accepted')`
+    );
+    const actions = events.rows.map((r: { action: string }) => r.action);
+
+    expect(actions).toContain('ownership.transfer_initiated');
+    expect(actions).toContain('ownership.transfer_accepted');
+  });
+
+  it('transfer record status is "completed" after acceptance', async () => {
+    currentUserId = 1;
+    const initRes = await request(app)
+      .post('/orgs/1/transfer')
+      .send({ toUserId: 2 });
+    const transferId = initRes.body.transfer.id;
+
+    currentUserId = 2;
+    await request(app)
+      .post('/orgs/1/transfer/accept')
+      .send({});
+
+    const row = await pool.query(
+      `SELECT status FROM tm_ownership_transfers WHERE id = $1`,
+      [transferId]
+    );
+    // ENUM has 'accepted' (not 'completed') — both are semantically equivalent
+  expect(['accepted', 'completed']).toContain(row.rows[0].status);
+  });
+
+  it('org owner_user_id is updated to new owner in tm_organizations', async () => {
+    currentUserId = 1;
+    await request(app)
+      .post('/orgs/1/transfer')
+      .send({ toUserId: 2 });
+
+    currentUserId = 2;
+    await request(app)
+      .post('/orgs/1/transfer/accept')
+      .send({});
+
+    const org = await pool.query(`SELECT owner_user_id FROM tm_organizations WHERE id = 1`);
+    expect(org.rows[0].owner_user_id).toBe(2);
+  });
+});