@varshylinc/team-management 0.1.0

package/tests/integration/ownership-transfer-locks.test.ts

@@ -0,0 +1,146 @@
+import { describe, it, expect, beforeAll, afterAll, beforeEach } from 'vitest';
+import express from 'express';
+import request from 'supertest';
+import { Pool } from 'pg';
+import { createServerModule } from '../../src/server/index.js';
+import type { ServerModuleAdapter, OrgRole } from '../../src/server/types.js';
+
+const describeWithDb = process.env.DATABASE_URL ? describe : describe.skip;
+
+let currentUserId: number | null = null;
+let currentOrgId: number | null = null;
+
+const testAdapter: ServerModuleAdapter = {
+  getCurrentUserId: async () => currentUserId,
+  getOrganizationIdForUser: async () => currentOrgId,
+  isUserOrgAdmin: async (userId) => userId <= 2,
+  logger: { info: () => {}, warn: () => {}, error: () => {} },
+  getUserById: async (id) => ({ id, email: `u${id}@test.com`, name: `User${id}` }),
+  getUsersByIds: async (ids) => ids.map(id => ({ id, email: `u${id}@test.com`, name: `User${id}` })),
+  findUserByEmail: async (email) => {
+    const m = email.match(/^u(\d+)@test\.com$/);
+    return m ? { id: parseInt(m[1]), email } : null;
+  },
+  createUserFromInvite: async ({ email }: { email: string; orgId: number; role: OrgRole }) => ({ id: 99, email }),
+  setUserPassword: async () => {},
+  hashPassword: async (p) => `h:${p}`,
+  verifyPassword: async (p, h) => h === `h:${p}`,
+  invalidateAllUserSessions: async () => {},
+  sendInviteEmail: async () => {},
+  sendOwnershipTransferEmail: async () => {},
+  sendEmailChangeVerification: async () => {},
+  sendEmailChangeOldNotice: async () => {},
+  sendEmailChangedFinalNotice: async () => {},
+  sendPasswordResetEmail: async () => {},
+  sendOrgDeletionNotice: async () => {},
+  emitNotification: async () => {},
+};
+
+async function cleanAll(pool: Pool) {
+  await pool.query(`TRUNCATE tm_super_admins, tm_password_reset_requests,
+    tm_email_change_requests, tm_ownership_transfers, tm_audit_events,
+    tm_invitations, tm_memberships, tm_organizations RESTART IDENTITY CASCADE`);
+}
+
+async function seedOrg(pool: Pool, orgId = 1) {
+  await pool.query(`INSERT INTO tm_organizations (id, name, slug, owner_user_id, settings)
+    VALUES (${orgId}, 'Test Org ${orgId}', 'test-org-${orgId}', 1, '{}') ON CONFLICT DO NOTHING`);
+  await pool.query(`INSERT INTO tm_memberships (org_id, user_id, role) VALUES
+    (${orgId}, 1, 'owner'), (${orgId}, 2, 'admin'), (${orgId}, 3, 'member'), (${orgId}, 4, 'viewer')
+    ON CONFLICT DO NOTHING`);
+}
+
+describeWithDb('ownership transfer — locks', () => {
+  let pool: Pool;
+  let app: express.Express;
+  let pendingTransferId: number;
+
+  beforeAll(async () => {
+    pool = new Pool({ connectionString: process.env.DATABASE_URL });
+    const mod = createServerModule({ adapter: testAdapter, pool, features: {} });
+    app = express();
+    app.use(express.json());
+    app.use(mod.router);
+  });
+
+  afterAll(async () => {
+    await pool.end();
+  });
+
+  beforeEach(async () => {
+    await cleanAll(pool);
+    currentUserId = 1;
+    currentOrgId = 1;
+    await seedOrg(pool);
+
+    // Establish a pending transfer for all lock tests
+    const initRes = await request(app)
+      .post('/orgs/1/transfer')
+      .send({ toUserId: 2 });
+    expect(initRes.status).toBe(201);
+    pendingTransferId = initRes.body.transfer.id as number;
+  });
+
+  it('initiating another transfer while one is pending → 409 or 422', async () => {
+    currentUserId = 1;
+    const res = await request(app)
+      .post('/orgs/1/transfer')
+      .send({ toUserId: 3 });
+
+    expect([409, 422]).toContain(res.status);
+  });
+
+  it('deleting the org while transfer is pending → 409', async () => {
+    currentUserId = 1;
+    const res = await request(app)
+      .delete('/orgs/1')
+      .send({ confirmOrgName: 'Test Org 1' });
+
+    expect(res.status).toBe(409);
+  });
+
+  it('removing the transfer recipient while transfer is pending → 409', async () => {
+    currentUserId = 1;
+    const res = await request(app).delete('/orgs/1/members/2');
+
+    expect(res.status).toBe(409);
+  });
+
+  it('removing the transfer initiator (owner) while transfer is pending → 409 or 400', async () => {
+    // Switch to an admin trying to remove the owner — should be 409 or 400
+    currentUserId = 2;
+    const res = await request(app).delete('/orgs/1/members/1');
+
+    // Could be 400 (owner protection) or 409 (transfer lock) — both acceptable
+    expect([400, 403, 409]).toContain(res.status);
+  });
+
+  it('changing recipient role while transfer is pending → 409', async () => {
+    currentUserId = 1;
+    const res = await request(app)
+      .patch('/orgs/1/members/2')
+      .send({ role: 'member' });
+
+    expect(res.status).toBe(409);
+  });
+
+  it('after cancelling the transfer, org delete is no longer locked', async () => {
+    currentUserId = 1;
+    await request(app).delete('/orgs/1/transfer');
+
+    const deleteRes = await request(app)
+      .delete('/orgs/1')
+      .send({ confirmOrgName: 'Test Org 1' });
+
+    // Should no longer be 409 — either succeeds or fails for another reason
+    expect(deleteRes.status).not.toBe(409);
+  });
+
+  it('after cancelling the transfer, removing members is no longer locked', async () => {
+    currentUserId = 1;
+    await request(app).delete('/orgs/1/transfer');
+
+    const removeRes = await request(app).delete('/orgs/1/members/3');
+    expect(removeRes.status).not.toBe(409);
+  });
+});

package/tests/integration/password-reset.test.ts

@@ -0,0 +1,200 @@
+import { describe, it, expect, beforeAll, afterAll, beforeEach, vi } from 'vitest';
+import { createHash } from 'crypto';
+import express from 'express';
+import request from 'supertest';
+import { Pool } from 'pg';
+import { createServerModule } from '../../src/server/index.js';
+import type { ServerModuleAdapter, OrgRole } from '../../src/server/types.js';
+
+const describeWithDb = process.env.DATABASE_URL ? describe : describe.skip;
+
+function sha256(s: string): string {
+  return createHash('sha256').update(s).digest('hex');
+}
+
+function extractResetToken(spy: ReturnType<typeof vi.fn>): string {
+  const callArg = spy.mock.calls[0]?.[0] as { resetUrl?: string } | undefined;
+  const url = callArg?.resetUrl ?? '';
+  const qs = url.includes('?') ? url.split('?')[1] : '';
+  return new URLSearchParams(qs).get('token') ?? '';
+}
+
+let currentUserId: number | null = null;
+let currentOrgId: number | null = null;
+
+const sendPasswordResetEmail = vi.fn(async () => {});
+
+const testAdapter: ServerModuleAdapter = {
+  getCurrentUserId: async () => currentUserId,
+  getOrganizationIdForUser: async () => currentOrgId,
+  isUserOrgAdmin: async (userId) => userId <= 2,
+  logger: { info: () => {}, warn: () => {}, error: () => {} },
+  getUserById: async (id) => ({ id, email: `u${id}@test.com`, name: `User${id}` }),
+  getUsersByIds: async (ids) => ids.map(id => ({ id, email: `u${id}@test.com`, name: `User${id}` })),
+  findUserByEmail: async (email) => {
+    const m = email.match(/^u(\d+)@test\.com$/);
+    return m ? { id: parseInt(m[1]), email } : null;
+  },
+  createUserFromInvite: async ({ email }: { email: string; orgId: number; role: OrgRole }) => ({ id: 99, email }),
+  setUserPassword: vi.fn(async () => {}),
+  hashPassword: async (p) => `h:${p}`,
+  verifyPassword: async (p, h) => h === `h:${p}`,
+  invalidateAllUserSessions: async () => {},
+  sendInviteEmail: async () => {},
+  sendOwnershipTransferEmail: async () => {},
+  sendEmailChangeVerification: async () => {},
+  sendEmailChangeOldNotice: async () => {},
+  sendEmailChangedFinalNotice: async () => {},
+  sendPasswordResetEmail,
+  sendOrgDeletionNotice: async () => {},
+  emitNotification: async () => {},
+};
+
+async function cleanAll(pool: Pool) {
+  await pool.query(`TRUNCATE tm_super_admins, tm_password_reset_requests,
+    tm_email_change_requests, tm_ownership_transfers, tm_audit_events,
+    tm_invitations, tm_memberships, tm_organizations RESTART IDENTITY CASCADE`);
+}
+
+async function seedOrg(pool: Pool, orgId = 1) {
+  await pool.query(`INSERT INTO tm_organizations (id, name, slug, owner_user_id, settings)
+    VALUES (${orgId}, 'Test Org ${orgId}', 'test-org-${orgId}', 1, '{}') ON CONFLICT DO NOTHING`);
+  await pool.query(`INSERT INTO tm_memberships (org_id, user_id, role) VALUES
+    (${orgId}, 1, 'owner'), (${orgId}, 2, 'admin'), (${orgId}, 3, 'member'), (${orgId}, 4, 'viewer')
+    ON CONFLICT DO NOTHING`);
+}
+
+describeWithDb('password reset flow', () => {
+  let pool: Pool;
+  let app: express.Express;
+
+  beforeAll(async () => {
+    pool = new Pool({ connectionString: process.env.DATABASE_URL });
+    const mod = createServerModule({ adapter: testAdapter, pool, features: {} });
+    app = express();
+    app.use(express.json());
+    app.use(mod.router);
+  });
+
+  afterAll(async () => {
+    await pool.end();
+  });
+
+  beforeEach(async () => {
+    await cleanAll(pool);
+    sendPasswordResetEmail.mockClear();
+    (testAdapter.setUserPassword as ReturnType<typeof vi.fn>).mockClear?.();
+    currentUserId = null;
+    currentOrgId = null;
+    await seedOrg(pool);
+  });
+
+  it('POST /me/password-reset/request with existing email → 200', async () => {
+    const res = await request(app)
+      .post('/me/password-reset/request')
+      .send({ email: 'u1@test.com' });
+
+    expect(res.status).toBe(200);
+    expect(sendPasswordResetEmail).toHaveBeenCalledOnce();
+
+    const dbRow = await pool.query(
+      `SELECT * FROM tm_password_reset_requests WHERE user_id = 1 ORDER BY created_at DESC LIMIT 1`
+    );
+    expect(dbRow.rows.length).toBe(1);
+    // used_at is NULL when not yet used
+    expect(dbRow.rows[0].used_at).toBeNull();
+  });
+
+  it('POST /me/password-reset/request with unknown email → 200 (no user enumeration)', async () => {
+    const res = await request(app)
+      .post('/me/password-reset/request')
+      .send({ email: 'nonexistent@example.com' });
+
+    expect(res.status).toBe(200);
+    expect(sendPasswordResetEmail).not.toHaveBeenCalled();
+  });
+
+  it('POST /me/password-reset with valid token → 200 and password updated', async () => {
+    await request(app)
+      .post('/me/password-reset/request')
+      .send({ email: 'u1@test.com' });
+
+    // Extract plaintext token from the reset URL sent via mock
+    const token = extractResetToken(sendPasswordResetEmail);
+    expect(token).toBeTruthy();
+
+    // Confirm endpoint is POST /me/password-reset (not /confirm)
+    const confirmRes = await request(app)
+      .post('/me/password-reset')
+      .send({ token, newPassword: 'NewSecurePass123!' });
+
+    expect(confirmRes.status).toBe(200);
+    expect(testAdapter.setUserPassword).toHaveBeenCalledOnce();
+  });
+
+  it('POST /me/password-reset with used token → 422', async () => {
+    await request(app)
+      .post('/me/password-reset/request')
+      .send({ email: 'u1@test.com' });
+
+    const token = extractResetToken(sendPasswordResetEmail);
+    expect(token).toBeTruthy();
+
+    // Use it once
+    await request(app)
+      .post('/me/password-reset')
+      .send({ token, newPassword: 'FirstUse!' });
+
+    // Try to use again → 422 (Invalid or expired)
+    const res = await request(app)
+      .post('/me/password-reset')
+      .send({ token, newPassword: 'SecondUse!' });
+
+    expect(res.status).toBe(422);
+  });
+
+  it('POST /me/password-reset with expired token → 422', async () => {
+    // Request first to get a real token (captures from mock)
+    await request(app)
+      .post('/me/password-reset/request')
+      .send({ email: 'u1@test.com' });
+    const token = extractResetToken(sendPasswordResetEmail);
+    expect(token).toBeTruthy();
+
+    // Force-expire it in DB
+    await pool.query(
+      `UPDATE tm_password_reset_requests SET expires_at = NOW() - INTERVAL '3 hours' WHERE token_hash = $1`,
+      [sha256(token)]
+    );
+
+    const res = await request(app)
+      .post('/me/password-reset')
+      .send({ token, newPassword: 'DoesNotMatter!' });
+
+    expect(res.status).toBe(422);
+  });
+
+  it('rate limit: 4th password reset request → 200 but email suppressed (silent rate limit)', async () => {
+    const recent = new Date(Date.now() - 20 * 60 * 1000).toISOString();
+    const futureExpiry = new Date(Date.now() + 60 * 60 * 1000).toISOString();
+
+    // Insert 3 existing reset requests with token_hash
+    for (let i = 0; i < 3; i++) {
+      const fakeToken = `rate-tok-placeholder-${i}`;
+      await pool.query(
+        `INSERT INTO tm_password_reset_requests (user_id, token_hash, expires_at, created_at)
+         VALUES (1, $1, $2, $3)`,
+        [sha256(fakeToken), futureExpiry, recent]
+      );
+    }
+
+    const res = await request(app)
+      .post('/me/password-reset/request')
+      .send({ email: 'u1@test.com' });
+
+    // Service silently swallows rate limit (no 429) to prevent email enumeration
+    expect(res.status).toBe(200);
+    // But the email must NOT have been sent
+    expect(sendPasswordResetEmail).not.toHaveBeenCalled();
+  });
+});

package/tests/integration/super-admin-actions.test.ts

@@ -0,0 +1,180 @@
+import { describe, it, expect, beforeAll, afterAll, beforeEach, vi } from 'vitest';
+import express from 'express';
+import request from 'supertest';
+import { Pool } from 'pg';
+import { createServerModule } from '../../src/server/index.js';
+import type { ServerModuleAdapter, OrgRole } from '../../src/server/types.js';
+
+const describeWithDb = process.env.DATABASE_URL ? describe : describe.skip;
+
+let currentUserId: number | null = null;
+let currentOrgId: number | null = null;
+
+const sendPasswordResetEmail = vi.fn(async () => {});
+
+const testAdapter: ServerModuleAdapter = {
+  getCurrentUserId: async () => currentUserId,
+  getOrganizationIdForUser: async () => currentOrgId,
+  isUserOrgAdmin: async (userId) => userId <= 2,
+  logger: { info: () => {}, warn: () => {}, error: () => {} },
+  getUserById: async (id) => ({ id, email: `u${id}@test.com`, name: `User${id}` }),
+  getUsersByIds: async (ids) => ids.map(id => ({ id, email: `u${id}@test.com`, name: `User${id}` })),
+  findUserByEmail: async (email) => {
+    const m = email.match(/^u(\d+)@test\.com$/);
+    return m ? { id: parseInt(m[1]), email } : null;
+  },
+  createUserFromInvite: async ({ email }: { email: string; orgId: number; role: OrgRole }) => ({ id: 99, email }),
+  setUserPassword: async () => {},
+  hashPassword: async (p) => `h:${p}`,
+  verifyPassword: async (p, h) => h === `h:${p}`,
+  invalidateAllUserSessions: async () => {},
+  sendInviteEmail: async () => {},
+  sendOwnershipTransferEmail: async () => {},
+  sendEmailChangeVerification: async () => {},
+  sendEmailChangeOldNotice: async () => {},
+  sendEmailChangedFinalNotice: async () => {},
+  sendPasswordResetEmail,
+  sendOrgDeletionNotice: async () => {},
+  emitNotification: async () => {},
+};
+
+async function cleanAll(pool: Pool) {
+  await pool.query(`TRUNCATE tm_super_admins, tm_password_reset_requests,
+    tm_email_change_requests, tm_ownership_transfers, tm_audit_events,
+    tm_invitations, tm_memberships, tm_organizations RESTART IDENTITY CASCADE`);
+}
+
+async function seedOrg(pool: Pool, orgId = 1) {
+  await pool.query(`INSERT INTO tm_organizations (id, name, slug, owner_user_id, settings)
+    VALUES (${orgId}, 'Test Org ${orgId}', 'test-org-${orgId}', 1, '{}') ON CONFLICT DO NOTHING`);
+  await pool.query(`INSERT INTO tm_memberships (org_id, user_id, role) VALUES
+    (${orgId}, 1, 'owner'), (${orgId}, 2, 'admin'), (${orgId}, 3, 'member'), (${orgId}, 4, 'viewer')
+    ON CONFLICT DO NOTHING`);
+}
+
+describeWithDb('super admin', () => {
+  let pool: Pool;
+  let app: express.Express;
+
+  beforeAll(async () => {
+    pool = new Pool({ connectionString: process.env.DATABASE_URL });
+    // Enable super admin feature
+    const mod = createServerModule({
+      adapter: testAdapter,
+      pool,
+      features: { enableSuperAdmin: true },
+    });
+    app = express();
+    app.use(express.json());
+    app.use(mod.router);
+  });
+
+  afterAll(async () => {
+    await pool.end();
+  });
+
+  beforeEach(async () => {
+    await cleanAll(pool);
+    sendPasswordResetEmail.mockClear();
+    currentOrgId = 1;
+    await seedOrg(pool);
+    // Register user 1 as super admin
+    await pool.query(`INSERT INTO tm_super_admins (user_id) VALUES (1) ON CONFLICT DO NOTHING`);
+    currentUserId = 1;
+  });
+
+  it('GET /admin/orgs → 200 with list of orgs', async () => {
+    const res = await request(app).get('/admin/orgs');
+    expect(res.status).toBe(200);
+    // Route returns { orgs: [...] }
+    const orgs = res.body.orgs ?? res.body;
+    expect(Array.isArray(orgs)).toBe(true);
+    expect(orgs.length).toBeGreaterThanOrEqual(1);
+  });
+
+  it('POST /admin/orgs/:id/restore → 200 on a deleted org', async () => {
+    // Soft-delete the org
+    await pool.query(`UPDATE tm_organizations SET deleted_at = NOW() WHERE id = 1`);
+
+    const res = await request(app)
+      .post('/admin/orgs/1/restore')
+      .send({ reason: 'test restore' });
+    expect(res.status).toBe(200);
+
+    const row = await pool.query(`SELECT deleted_at FROM tm_organizations WHERE id = 1`);
+    expect(row.rows[0].deleted_at).toBeNull();
+  });
+
+  it('POST /admin/orgs/:id/appoint-owner → 200, audit event with actor_type=super_admin', async () => {
+    const res = await request(app)
+      .post('/admin/orgs/1/appoint-owner')
+      .send({ targetUserId: 2, reason: 'test' });
+
+    expect(res.status).toBe(200);
+
+    // Verify new owner in DB
+    const org = await pool.query(`SELECT owner_user_id FROM tm_organizations WHERE id = 1`);
+    expect(org.rows[0].owner_user_id).toBe(2);
+
+    // Reason is stored in audit reason column
+    const adminEvent = await pool.query(
+      `SELECT reason FROM tm_audit_events WHERE actor_type = 'super_admin' ORDER BY created_at DESC LIMIT 1`
+    );
+    if (adminEvent.rows.length > 0) {
+      expect(adminEvent.rows[0].reason).toContain('test');
+    }
+  });
+
+  it('POST /admin/users/:userId/lock → 200', async () => {
+    const res = await request(app)
+      .post('/admin/users/3/lock')
+      .send({ reason: 'spam' });
+
+    expect(res.status).toBe(200);
+  });
+
+  it('POST /admin/users/:userId/password-reset → 200 and calls sendPasswordResetEmail', async () => {
+    const res = await request(app)
+      .post('/admin/users/3/password-reset')
+      .send({ reason: 'support request' });
+
+    expect(res.status).toBe(200);
+    expect(sendPasswordResetEmail).toHaveBeenCalledOnce();
+  });
+
+  it('audit events from super-admin actions show actor_type = "super_admin"', async () => {
+    await request(app)
+      .post('/admin/orgs/1/appoint-owner')
+      .send({ targetUserId: 2, reason: 'audit test' });
+
+    const events = await pool.query(
+      `SELECT * FROM tm_audit_events WHERE actor_type = 'super_admin'`
+    );
+    expect(events.rows.length).toBeGreaterThanOrEqual(1);
+  });
+
+  it('non-super-admin accessing /admin/* → 403', async () => {
+    currentUserId = 2; // admin but not super-admin
+
+    const res = await request(app).get('/admin/orgs');
+    expect(res.status).toBe(403);
+  });
+
+  it('unauthenticated user accessing /admin/* → 401 or 403', async () => {
+    currentUserId = null;
+
+    const res = await request(app).get('/admin/orgs');
+    expect([401, 403]).toContain(res.status);
+  });
+
+  it('GET /admin/orgs includes soft-deleted orgs', async () => {
+    await pool.query(`UPDATE tm_organizations SET deleted_at = NOW() WHERE id = 1`);
+
+    const res = await request(app).get('/admin/orgs');
+    expect(res.status).toBe(200);
+
+    const orgs = (res.body.orgs ?? res.body) as Array<{ id: number }>;
+    const ids = orgs.map(o => o.id);
+    expect(ids).toContain(1);
+  });
+});