canopycms 0.0.0

package/src/__integration__/settings/groups-api.test.ts

@@ -0,0 +1,403 @@
+/**
+ * Integration tests for Groups API endpoints
+ *
+ * These tests verify that the Groups API works correctly with settings stored
+ * in the new settings directory structure across all operating modes.
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import path from 'node:path'
+import fs from 'node:fs/promises'
+
+import { createTestWorkspace, type TestWorkspace } from '../test-utils/test-workspace'
+import { BLOG_SCHEMA } from '../fixtures/schemas'
+import { createTestServices } from '../../config-test'
+import { createMockApiContext } from '../../test-utils/api-test-helpers'
+import { RESERVED_GROUPS, type InternalGroup } from '../../authorization'
+import { GROUP_ROUTES } from '../../api/groups'
+import { operatingStrategy } from '../../operating-mode'
+import { mockConsole } from '../../test-utils/console-spy'
+
+// Extract handlers
+const getInternalGroups = GROUP_ROUTES.getInternal.handler
+const updateInternalGroups = GROUP_ROUTES.updateInternal.handler
+
+describe('Groups API Integration', () => {
+  beforeEach(() => {
+    mockConsole()
+  })
+
+  describe('prod-sim mode', () => {
+    let workspace: TestWorkspace
+
+    beforeEach(async () => {
+      workspace = await createTestWorkspace({
+        schema: BLOG_SCHEMA,
+        mode: 'prod-sim',
+      })
+    })
+
+    afterEach(async () => {
+      await workspace.cleanup()
+    })
+
+    it('should load groups from settings directory', async () => {
+      // Create services
+      const services = await createTestServices({
+        ...workspace.config,
+        schema: BLOG_SCHEMA,
+      })
+      const context = createMockApiContext({ services })
+
+      // Call the groups API
+      const result = await getInternalGroups(context, {
+        user: {
+          type: 'authenticated',
+          userId: 'admin-1',
+          groups: [RESERVED_GROUPS.ADMINS],
+        },
+      })
+
+      expect(result.ok).toBe(true)
+      if (result.ok && result.data) {
+        expect(result.data.groups).toBeDefined()
+        expect(Array.isArray(result.data.groups)).toBe(true)
+        // Should have at least Admins and Reviewers groups
+        expect(result.data.groups.length).toBeGreaterThanOrEqual(2)
+
+        const adminsGroup = result.data.groups.find((g) => g.id === RESERVED_GROUPS.ADMINS)
+        expect(adminsGroup).toBeDefined()
+        expect(adminsGroup?.name).toBe(RESERVED_GROUPS.ADMINS)
+      }
+    })
+
+    it('should save groups to settings directory with autogenerated IDs', async () => {
+      const services = await createTestServices({
+        ...workspace.config,
+        schema: BLOG_SCHEMA,
+      })
+      const context = createMockApiContext({ services })
+
+      // Create new groups (with empty IDs for new groups, server will generate them)
+      const newGroups: InternalGroup[] = [
+        {
+          id: '',
+          name: RESERVED_GROUPS.ADMINS,
+          description: 'Full access',
+          members: ['admin-1'],
+        },
+        {
+          id: '',
+          name: RESERVED_GROUPS.REVIEWERS,
+          description: 'Can review',
+          members: [],
+        },
+        {
+          id: '', // Empty ID for new group
+          name: 'Editors',
+          description: 'Can edit content',
+          members: ['user-1', 'user-2'],
+        },
+      ]
+
+      // Update groups
+      const result = await updateInternalGroups(
+        context,
+        {
+          user: {
+            type: 'authenticated',
+            userId: 'admin-1',
+            groups: [RESERVED_GROUPS.ADMINS],
+          },
+        },
+        { groups: newGroups },
+      )
+
+      expect(result.ok).toBe(true)
+
+      // Verify file exists at correct path
+      const strategy = operatingStrategy('prod-sim')
+      const settingsRoot = strategy.getSettingsRoot(workspace.tmpRoot)
+      const groupsPath = path.join(settingsRoot, 'groups.json')
+
+      const fileExists = await fs.access(groupsPath).then(
+        () => true,
+        () => false,
+      )
+      expect(fileExists).toBe(true)
+
+      // Verify file content
+      const fileContent = await fs.readFile(groupsPath, 'utf-8')
+      const parsed = JSON.parse(fileContent)
+      expect(parsed.groups).toBeDefined()
+      expect(parsed.groups.length).toBe(3)
+
+      // Verify reserved groups use their names as IDs
+      const adminsGroup = parsed.groups.find(
+        (g: InternalGroup) => g.name === RESERVED_GROUPS.ADMINS,
+      )
+      expect(adminsGroup).toBeDefined()
+      expect(adminsGroup.id).toBe(RESERVED_GROUPS.ADMINS)
+
+      const reviewersGroup = parsed.groups.find(
+        (g: InternalGroup) => g.name === RESERVED_GROUPS.REVIEWERS,
+      )
+      expect(reviewersGroup).toBeDefined()
+      expect(reviewersGroup.id).toBe(RESERVED_GROUPS.REVIEWERS)
+
+      // Verify regular group has generated ID
+      const editorsGroup = parsed.groups.find((g: InternalGroup) => g.name === 'Editors')
+      expect(editorsGroup).toBeDefined()
+      expect(editorsGroup.id).not.toBe('')
+      expect(editorsGroup.id.length).toBeGreaterThan(0)
+      expect(editorsGroup.members).toEqual(['user-1', 'user-2'])
+    })
+
+    it('should handle concurrent group loads without race conditions', async () => {
+      const services = await createTestServices({
+        ...workspace.config,
+        schema: BLOG_SCHEMA,
+      })
+      const context = createMockApiContext({ services })
+
+      // Make 5 concurrent requests
+      const promises = Array.from({ length: 5 }, () =>
+        getInternalGroups(context, {
+          user: {
+            type: 'authenticated',
+            userId: 'admin-1',
+            groups: [RESERVED_GROUPS.ADMINS],
+          },
+        }),
+      )
+
+      const results = await Promise.all(promises)
+
+      // All should succeed
+      results.forEach((result) => {
+        expect(result.ok).toBe(true)
+        if (result.ok && result.data) {
+          expect(result.data.groups.length).toBeGreaterThanOrEqual(2)
+        }
+      })
+    })
+
+    it('should preserve groups across service restarts', async () => {
+      // Create services and save groups
+      const services1 = await createTestServices({
+        ...workspace.config,
+        schema: BLOG_SCHEMA,
+      })
+      const context1 = createMockApiContext({ services: services1 })
+
+      const customGroups: InternalGroup[] = [
+        {
+          id: '',
+          name: RESERVED_GROUPS.ADMINS,
+          description: 'Admins',
+          members: ['admin-1'],
+        },
+        {
+          id: '',
+          name: RESERVED_GROUPS.REVIEWERS,
+          description: 'Reviewers',
+          members: [],
+        },
+        {
+          id: '', // Empty ID for new group
+          name: 'Custom Group',
+          description: 'A custom group',
+          members: ['user-1', 'user-2', 'user-3'],
+        },
+      ]
+
+      await updateInternalGroups(
+        context1,
+        {
+          user: {
+            type: 'authenticated',
+            userId: 'admin-1',
+            groups: [RESERVED_GROUPS.ADMINS],
+          },
+        },
+        { groups: customGroups },
+      )
+
+      // Create new services instance (simulating restart)
+      const services2 = await createTestServices({
+        ...workspace.config,
+        schema: BLOG_SCHEMA,
+      })
+      const context2 = createMockApiContext({ services: services2 })
+
+      // Load groups with new services
+      const result = await getInternalGroups(context2, {
+        user: {
+          type: 'authenticated',
+          userId: 'admin-1',
+          groups: [RESERVED_GROUPS.ADMINS],
+        },
+      })
+
+      expect(result.ok).toBe(true)
+      if (result.ok && result.data) {
+        const customGroup = result.data.groups.find((g) => g.name === 'Custom Group')
+        expect(customGroup).toBeDefined()
+        expect(customGroup?.id).not.toBe('') // Should have generated ID
+        expect(customGroup?.members).toEqual(['user-1', 'user-2', 'user-3'])
+      }
+    })
+  })
+
+  describe('dev mode', () => {
+    let workspace: TestWorkspace
+
+    beforeEach(async () => {
+      workspace = await createTestWorkspace({
+        schema: BLOG_SCHEMA,
+        mode: 'dev',
+      })
+    })
+
+    afterEach(async () => {
+      await workspace.cleanup()
+    })
+
+    it('should load groups from dev settings directory', async () => {
+      const services = await createTestServices({
+        ...workspace.config,
+        schema: BLOG_SCHEMA,
+      })
+      const context = createMockApiContext({ services })
+
+      const result = await getInternalGroups(context, {
+        user: {
+          type: 'authenticated',
+          userId: 'admin-1',
+          groups: [RESERVED_GROUPS.ADMINS],
+        },
+      })
+
+      expect(result.ok).toBe(true)
+      if (result.ok && result.data) {
+        expect(result.data.groups).toBeDefined()
+        expect(result.data.groups.length).toBeGreaterThanOrEqual(2)
+      }
+    })
+
+    it('should save groups to .canopy-dev/settings directory', async () => {
+      const services = await createTestServices({
+        ...workspace.config,
+        schema: BLOG_SCHEMA,
+      })
+      const context = createMockApiContext({ services })
+
+      const newGroups: InternalGroup[] = [
+        {
+          id: '', // Empty ID for new reserved group
+          name: RESERVED_GROUPS.ADMINS,
+          description: 'Admins',
+          members: ['admin-1'],
+        },
+        {
+          id: '', // Empty ID for new reserved group
+          name: RESERVED_GROUPS.REVIEWERS,
+          description: 'Reviewers',
+          members: [],
+        },
+      ]
+
+      await updateInternalGroups(
+        context,
+        {
+          user: {
+            type: 'authenticated',
+            userId: 'admin-1',
+            groups: [RESERVED_GROUPS.ADMINS],
+          },
+        },
+        { groups: newGroups },
+      )
+
+      // Verify file exists at correct path in dev mode
+      const strategy = operatingStrategy('dev')
+      const settingsRoot = strategy.getSettingsRoot(workspace.tmpRoot)
+      const groupsPath = path.join(settingsRoot, 'groups.json')
+
+      const fileExists = await fs.access(groupsPath).then(
+        () => true,
+        () => false,
+      )
+      expect(fileExists).toBe(true)
+
+      // Verify reserved groups use their names as IDs
+      const fileContent = await fs.readFile(groupsPath, 'utf-8')
+      const parsed = JSON.parse(fileContent)
+      expect(parsed.groups.length).toBe(2)
+      expect(parsed.groups[0].id).toBe(RESERVED_GROUPS.ADMINS)
+      expect(parsed.groups[1].id).toBe(RESERVED_GROUPS.REVIEWERS)
+    })
+  })
+
+  describe('permissions checking', () => {
+    let workspace: TestWorkspace
+
+    beforeEach(async () => {
+      workspace = await createTestWorkspace({
+        schema: BLOG_SCHEMA,
+        mode: 'prod-sim',
+      })
+    })
+
+    afterEach(async () => {
+      await workspace.cleanup()
+    })
+
+    it('should deny access to non-admin users for getting groups', async () => {
+      const services = await createTestServices({
+        ...workspace.config,
+        schema: BLOG_SCHEMA,
+      })
+      const context = createMockApiContext({ services })
+
+      const result = await getInternalGroups(context, {
+        user: { type: 'authenticated', userId: 'regular-user', groups: [] },
+      })
+
+      expect(result.ok).toBe(false)
+      expect(result.status).toBe(403)
+    })
+
+    it('should deny access to non-admin users for updating groups', async () => {
+      const services = await createTestServices({
+        ...workspace.config,
+        schema: BLOG_SCHEMA,
+      })
+      const context = createMockApiContext({ services })
+
+      const newGroups: InternalGroup[] = [
+        {
+          id: RESERVED_GROUPS.ADMINS,
+          name: RESERVED_GROUPS.ADMINS,
+          description: 'Admins',
+          members: ['admin-1'],
+        },
+        {
+          id: RESERVED_GROUPS.REVIEWERS,
+          name: RESERVED_GROUPS.REVIEWERS,
+          description: 'Reviewers',
+          members: [],
+        },
+      ]
+
+      const result = await updateInternalGroups(
+        context,
+        { user: { type: 'authenticated', userId: 'regular-user', groups: [] } },
+        { groups: newGroups },
+      )
+
+      expect(result.ok).toBe(false)
+      expect(result.status).toBe(403)
+    })
+  })
+})

package/src/__integration__/test-utils/api-client.ts

@@ -0,0 +1,167 @@
+/**
+ * API client helper for integration tests.
+ * Creates requests and calls the Canopy HTTP handler.
+ */
+
+import type { CanopyRequest } from '../../http/types'
+import { createCanopyRequestHandler } from '../../http/handler'
+import { createTestServices } from '../../config-test'
+import type { CreateCanopyServicesOptions } from '../../services'
+import type { CanopyConfig, RootCollectionConfig } from '../../config'
+import type { AuthPlugin } from '../../auth/plugin'
+import { CanopyApiClient } from '../../api/client'
+
+export interface ApiClientOptions {
+  config: CanopyConfig
+  authPlugin: AuthPlugin
+  /** Pre-resolved schema for tests (bypasses .collection.json loading) */
+  schema?: RootCollectionConfig
+  /** Entry schema registry for resolving .collection.json references */
+  entrySchemaRegistry?: CreateCanopyServicesOptions['entrySchemaRegistry']
+}
+
+/**
+ * Create an API client that makes requests through the HTTP handler.
+ * This simulates real API calls without needing a server.
+ *
+ * The client wraps the production CanopyApiClient with a custom fetch
+ * that routes through the handler directly instead of making network requests.
+ */
+export async function createApiClient(options: ApiClientOptions) {
+  // Use test services with schema
+  const services = await createTestServices(
+    {
+      ...options.config,
+      schema: options.schema ?? { collections: [] },
+    },
+    {
+      entrySchemaRegistry: options.entrySchemaRegistry,
+    },
+  )
+  const handler = createCanopyRequestHandler({
+    services,
+    authPlugin: options.authPlugin,
+    getBranchContext: async (branchName: string, opts?: { loadSchema?: boolean }) => {
+      if (!services.registry) {
+        throw new Error('Branch registry not available in dev mode')
+      }
+      const context = await services.registry.get(branchName)
+      if (!context) {
+        return null
+      }
+
+      // Load per-branch schema if requested
+      if (opts?.loadSchema) {
+        const contentRootName = services.config.contentRoot || 'content'
+        const cached = await services.branchSchemaCache.getSchema(
+          context.branchRoot,
+          services.entrySchemaRegistry,
+          contentRootName,
+        )
+        context.flatSchema = cached.flatSchema
+      }
+
+      return context
+    },
+  })
+
+  /**
+   * Custom fetch that routes through the handler
+   */
+  const testFetch: typeof fetch = async (input: RequestInfo | URL, init?: RequestInit) => {
+    // Handle Request objects by extracting URL
+    const urlStr =
+      typeof input === 'string' ? input : input instanceof URL ? input.toString() : input.url
+
+    const path = urlStr.replace(/^http:\/\/[^/]+/, '') // Strip protocol/host
+    const segments = path
+      .replace(/^\/api\/canopycms\/?/, '')
+      .split('/')
+      .filter(Boolean)
+
+    const req: CanopyRequest = {
+      method: init?.method ?? 'GET',
+      url: urlStr,
+      header: (name: string) => {
+        if (!init?.headers) return null
+        if (init.headers instanceof Headers) {
+          return init.headers.get(name)
+        }
+        return (init.headers as Record<string, string>)[name.toLowerCase()] ?? null
+      },
+      json: async () => {
+        if (!init?.body) return undefined
+        if (typeof init.body === 'string') {
+          return JSON.parse(init.body)
+        }
+        return undefined
+      },
+    }
+
+    const response = await handler(req, segments)
+
+    // Return a Response-like object
+    return {
+      status: response.status,
+      ok: response.status >= 200 && response.status < 300,
+      json: async () => response.body,
+    } as Response
+  }
+
+  // Create production client with test fetch
+  const client = new CanopyApiClient({
+    baseUrl: '/api/canopycms',
+    fetch: testFetch,
+  })
+
+  /**
+   * Legacy request function for backward compatibility
+   */
+  async function request(
+    method: string,
+    path: string,
+    body?: any,
+    headers: Record<string, string> = {},
+  ) {
+    const response = await testFetch(path, {
+      method,
+      headers,
+      body: body ? JSON.stringify(body) : undefined,
+    })
+
+    return {
+      status: response.status,
+      ok: response.ok,
+      json: async <T = unknown>() => response.json() as Promise<T>,
+      body: await response.json(),
+    }
+  }
+
+  return {
+    // Expose all typed client methods
+    ...client,
+
+    // Legacy compatibility: keep old method signatures
+    get: (path: string, headers?: Record<string, string>) =>
+      request('GET', path, undefined, headers),
+
+    post: (path: string, body?: any, headers?: Record<string, string>) =>
+      request('POST', path, body, headers),
+
+    put: (path: string, body?: any, headers?: Record<string, string>) =>
+      request('PUT', path, body, headers),
+
+    patch: (path: string, body?: any, headers?: Record<string, string>) =>
+      request('PATCH', path, body, headers),
+
+    delete: (path: string, headers?: Record<string, string>) =>
+      request('DELETE', path, undefined, headers),
+
+    /**
+     * Access to underlying services for setup/teardown
+     */
+    services,
+  }
+}
+
+export type ApiClient = ReturnType<typeof createApiClient>

package/src/__integration__/test-utils/multi-user.ts

@@ -0,0 +1,129 @@
+import type { AuthPlugin } from '../../auth/plugin'
+import type { AuthenticatedUser } from '../../user'
+import type { UserSearchResult, GroupMetadata, AuthenticationResult } from '../../auth/types'
+import type { CanopyUserId, CanopyGroupId } from '../../types'
+
+export type TestUserRole = 'admin' | 'reviewer' | 'editor'
+
+export interface TestUser {
+  userId: CanopyUserId
+  name: string
+  email: string
+  role: TestUserRole
+  groups: CanopyGroupId[]
+}
+
+/**
+ * Predefined test user personas with different permission levels
+ */
+export const TEST_USERS: Record<TestUserRole, TestUser> = {
+  admin: {
+    userId: 'test-admin',
+    name: 'Admin User',
+    email: 'admin@test.local',
+    role: 'admin',
+    groups: ['Admins'], // Reserved group with full access
+  },
+  reviewer: {
+    userId: 'test-reviewer',
+    name: 'Reviewer User',
+    email: 'reviewer@test.local',
+    role: 'reviewer',
+    groups: ['Reviewers'], // Reserved group with review access
+  },
+  editor: {
+    userId: 'test-editor',
+    name: 'Editor User',
+    email: 'editor@test.local',
+    role: 'editor',
+    groups: ['ContentEditors'], // Custom group with limited access
+  },
+}
+
+/**
+ * Convert test user persona to AuthenticatedUser
+ */
+export function createTestUser(role: TestUserRole): AuthenticatedUser {
+  const user = TEST_USERS[role]
+  return {
+    type: 'authenticated',
+    userId: user.userId,
+    email: user.email,
+    name: user.name,
+    groups: user.groups,
+  }
+}
+
+/**
+ * Create a mock auth plugin for integration tests.
+ * Allows switching between test users to simulate multi-user scenarios.
+ */
+export function createMockAuthPlugin(currentRole: TestUserRole): AuthPlugin {
+  return {
+    async authenticate(_context: unknown): Promise<AuthenticationResult> {
+      const testUser = createTestUser(currentRole)
+      return {
+        success: true,
+        user: {
+          userId: testUser.userId,
+          email: testUser.email,
+          name: testUser.name,
+          externalGroups: testUser.groups,
+        },
+      }
+    },
+
+    async searchUsers(query: string, limit = 10): Promise<UserSearchResult[]> {
+      const allUsers = Object.values(TEST_USERS)
+      return allUsers
+        .filter(
+          (u) =>
+            u.name.toLowerCase().includes(query.toLowerCase()) ||
+            u.email.toLowerCase().includes(query.toLowerCase()),
+        )
+        .slice(0, limit)
+        .map((u) => ({
+          id: u.userId,
+          name: u.name,
+          email: u.email,
+        }))
+    },
+
+    async getUserMetadata(userId: CanopyUserId): Promise<UserSearchResult | null> {
+      const user = Object.values(TEST_USERS).find((u) => u.userId === userId)
+      return user
+        ? {
+            id: user.userId,
+            name: user.name,
+            email: user.email,
+          }
+        : null
+    },
+
+    async getGroupMetadata(groupId: CanopyGroupId): Promise<GroupMetadata | null> {
+      const groups: Record<string, GroupMetadata> = {
+        Admins: { id: 'Admins', name: 'Administrators', memberCount: 1 },
+        Reviewers: { id: 'Reviewers', name: 'Reviewers', memberCount: 1 },
+        ContentEditors: {
+          id: 'ContentEditors',
+          name: 'Content Editors',
+          memberCount: 1,
+        },
+      }
+      return groups[groupId] || null
+    },
+
+    async listGroups(limit = 100): Promise<GroupMetadata[]> {
+      return [
+        { id: 'Admins', name: 'Administrators', memberCount: 1 },
+        { id: 'Reviewers', name: 'Reviewers', memberCount: 1 },
+        { id: 'ContentEditors', name: 'Content Editors', memberCount: 1 },
+      ].slice(0, limit)
+    },
+
+    async searchExternalGroups(_query: string) {
+      // Return empty for tests - external groups are optional
+      return []
+    },
+  }
+}