create-ailk 0.1.0 → 0.2.0

package/templates/apps/api/src/services/__tests__/tenant-context.test.ts

@@ -0,0 +1,379 @@
+// oss: false
+/**
+ * @file tenant-context.test.ts
+ *
+ * Unit tests for `resolveActiveTenant`'s single-tenant default-scope
+ * resolution — the owner-pin privilege-escalation fix (#3631,
+ * docs/specs/single-tenant-owner-pin-spec.md AC-1 … AC-6). Supersedes the
+ * #3627 Phase-2 tests: the original AC-1 encoded the now-fixed bug (an
+ * unconditional `role: "owner"` grant, keyed on `workspace.count() === 1`,
+ * with NO Membership check). Mocks the module-level `prisma` singleton via
+ * the repo's manual-mock convention (`jest.mock("../../lib/prisma.js")` →
+ * `apps/api/src/lib/__mocks__/prisma.ts`) — `resolveActiveTenant` has no DI
+ * seam; it reads the `prisma` singleton directly.
+ *
+ * SECURITY-SENSITIVE (tenant isolation) — see spec §5.3: these tests are the
+ * objective pass/fail record the mandatory `security-reviewer` verifies
+ * against.
+ */
+
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
+jest.mock("../../lib/prisma.js");
+
+import { prisma } from "../../lib/prisma.js";
+import type { SessionTenant } from "../../middleware/auth.js";
+import { resolveActiveTenant } from "../tenant-context";
+
+// The reserved-range sentinel values from database/tenancy.ts (ADR-0031
+// rule 7) — re-declared here as literals so the test pins the WIRE values,
+// not whatever the constants happen to be.
+const DEFAULT_ORG_ID = "org_00000000-0000-7000-8000-000000000001";
+const DEFAULT_WORKSPACE_ID = "wksp_00000000-0000-7000-8000-000000000001";
+const OPERATOR_MEMBERSHIP_ID = "member_00000000-0000-7000-8000-000000000001";
+
+function unboundSession(): SessionTenant {
+  return {
+    sessionRowId: "session-1",
+    activeOrganizationId: null,
+    activeWorkspaceId: null,
+  };
+}
+
+function boundSession(
+  workspaceId: string,
+  organizationId: string,
+): SessionTenant {
+  return {
+    sessionRowId: "session-1",
+    activeOrganizationId: organizationId,
+    activeWorkspaceId: workspaceId,
+  };
+}
+
+/**
+ * Stubs the single-tenant guard prerequisites (`count === 1`, default
+ * Workspace present) shared by every test that exercises the single-tenant
+ * branch. Individual tests still stub `membership.findUnique` /
+ * `membership.create` / `user.findUnique` themselves.
+ */
+function mockSingleTenantWorkspace(): void {
+  (prisma.workspace.count as jest.Mock).mockResolvedValue(1);
+  (prisma.workspace.findUnique as jest.Mock).mockResolvedValue({
+    id: DEFAULT_WORKSPACE_ID,
+    organizationId: DEFAULT_ORG_ID,
+  });
+}
+
+const ORIGINAL_ENV = process.env;
+
+beforeEach(() => {
+  jest.clearAllMocks();
+  process.env = { ...ORIGINAL_ENV };
+  delete process.env.AILK_OPERATOR_EMAIL;
+});
+
+afterAll(() => {
+  process.env = ORIGINAL_ENV;
+});
+
+describe("resolveActiveTenant — single-tenant owner-pin (#3631)", () => {
+  it("AC-1: single-tenant, unbound session, caller HOLDS a Membership on the default Org — resolves owner via a real membership.findUnique (the prior D4 bypass is gone)", async () => {
+    mockSingleTenantWorkspace();
+    (prisma.membership.create as jest.Mock).mockResolvedValue({});
+    (prisma.membership.findUnique as jest.Mock).mockResolvedValue({
+      role: "owner",
+    });
+
+    const result = await resolveActiveTenant({
+      userId: "solo-operator",
+      sessionTenant: unboundSession(),
+    });
+
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.workspaceId).toBe(DEFAULT_WORKSPACE_ID);
+      expect(result.value.organizationId).toBe(DEFAULT_ORG_ID);
+      expect(result.value.role).toBe("owner");
+    }
+    expect(prisma.membership.findUnique).toHaveBeenCalledTimes(1);
+  });
+
+  it("AC-2 (the fix): single-tenant, unbound session, caller has NO Membership (a prior operator already holds OPERATOR_MEMBERSHIP_ID, so this caller's create raises P2002) — DENIES; a second single-tenant OAuth user is not auto-owner", async () => {
+    mockSingleTenantWorkspace();
+    (prisma.membership.create as jest.Mock).mockRejectedValue({
+      code: "P2002",
+    });
+    (prisma.membership.findUnique as jest.Mock).mockResolvedValue(null);
+
+    const result = await resolveActiveTenant({
+      userId: "second-oauth-user",
+      sessionTenant: unboundSession(),
+    });
+
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error.kind).toBe("forbidden");
+    }
+    expect(prisma.membership.findUnique).toHaveBeenCalledTimes(1);
+  });
+
+  it("AC-3: TOFU — no Membership yet, no env pin: bindOperatorMembership issues membership.create with id===OPERATOR_MEMBERSHIP_ID, organizationId===DEFAULT_ORG_ID, role===owner; the caller then resolves owner", async () => {
+    mockSingleTenantWorkspace();
+    (prisma.membership.create as jest.Mock).mockResolvedValue({
+      id: OPERATOR_MEMBERSHIP_ID,
+      organizationId: DEFAULT_ORG_ID,
+      userId: "first-operator",
+      role: "owner",
+    });
+    (prisma.membership.findUnique as jest.Mock).mockResolvedValue({
+      role: "owner",
+    });
+
+    const result = await resolveActiveTenant({
+      userId: "first-operator",
+      sessionTenant: unboundSession(),
+    });
+
+    expect(prisma.membership.create).toHaveBeenCalledWith({
+      data: {
+        id: OPERATOR_MEMBERSHIP_ID,
+        organizationId: DEFAULT_ORG_ID,
+        userId: "first-operator",
+        role: "owner",
+      },
+    });
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.role).toBe("owner");
+    }
+  });
+
+  it("AC-3 (continued): a second, different caller's create raises P2002 (swallowed) — no second owner is created, and that caller is denied (AC-2)", async () => {
+    mockSingleTenantWorkspace();
+    (prisma.membership.create as jest.Mock).mockRejectedValue({
+      code: "P2002",
+    });
+    (prisma.membership.findUnique as jest.Mock).mockResolvedValue(null);
+
+    const result = await resolveActiveTenant({
+      userId: "second-user",
+      sessionTenant: unboundSession(),
+    });
+
+    expect(prisma.membership.create).toHaveBeenCalledTimes(1);
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error.kind).toBe("forbidden");
+    }
+  });
+
+  it("AC-4: env pin — a caller whose email does NOT match AILK_OPERATOR_EMAIL is not bound (no membership.create) and is denied", async () => {
+    process.env.AILK_OPERATOR_EMAIL = "op@x.io";
+    mockSingleTenantWorkspace();
+    (prisma.user.findUnique as jest.Mock).mockResolvedValue({
+      email: "attacker@evil.com",
+    });
+    (prisma.membership.findUnique as jest.Mock).mockResolvedValue(null);
+
+    const result = await resolveActiveTenant({
+      userId: "attacker",
+      sessionTenant: unboundSession(),
+    });
+
+    expect(prisma.user.findUnique).toHaveBeenCalledWith({
+      where: { id: "attacker" },
+      select: { email: true },
+    });
+    expect(prisma.membership.create).not.toHaveBeenCalled();
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error.kind).toBe("forbidden");
+    }
+  });
+
+  it("AC-4 (continued): env pin — a caller whose email MATCHES (case-insensitive, trimmed) is bound and resolves owner", async () => {
+    process.env.AILK_OPERATOR_EMAIL = "  Op@X.io  ";
+    mockSingleTenantWorkspace();
+    (prisma.user.findUnique as jest.Mock).mockResolvedValue({
+      email: "op@x.io",
+    });
+    (prisma.membership.create as jest.Mock).mockResolvedValue({});
+    (prisma.membership.findUnique as jest.Mock).mockResolvedValue({
+      role: "owner",
+    });
+
+    const result = await resolveActiveTenant({
+      userId: "the-operator",
+      sessionTenant: unboundSession(),
+    });
+
+    expect(prisma.membership.create).toHaveBeenCalledWith({
+      data: {
+        id: OPERATOR_MEMBERSHIP_ID,
+        organizationId: DEFAULT_ORG_ID,
+        userId: "the-operator",
+        role: "owner",
+      },
+    });
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.role).toBe("owner");
+    }
+  });
+
+  it("AC-4 (empty-pin edge — spec §5.3(d)): a blank/whitespace-only AILK_OPERATOR_EMAIL is treated as unset — pure TOFU, no email lookup, never matches a blank User.email", async () => {
+    process.env.AILK_OPERATOR_EMAIL = "   ";
+    mockSingleTenantWorkspace();
+    (prisma.membership.create as jest.Mock).mockResolvedValue({});
+    (prisma.membership.findUnique as jest.Mock).mockResolvedValue({
+      role: "owner",
+    });
+
+    const result = await resolveActiveTenant({
+      userId: "any-caller",
+      sessionTenant: unboundSession(),
+    });
+
+    expect(prisma.user.findUnique).not.toHaveBeenCalled();
+    expect(prisma.membership.create).toHaveBeenCalledTimes(1);
+    expect(result.ok).toBe(true);
+  });
+
+  it("AC-5 (regression floor): multi-tenant unbound (count>1) DENIES — default-deny preserved, no default scope granted, no membership.create", async () => {
+    (prisma.workspace.count as jest.Mock).mockResolvedValue(2);
+
+    const result = await resolveActiveTenant({
+      userId: "some-user",
+      sessionTenant: unboundSession(),
+    });
+
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error.kind).toBe("forbidden");
+    }
+    expect(prisma.workspace.findUnique).not.toHaveBeenCalled();
+    expect(prisma.membership.findUnique).not.toHaveBeenCalled();
+    expect(prisma.membership.create).not.toHaveBeenCalled();
+  });
+
+  it("AC-5 (regression floor): explicit-binding path is unchanged — workspace-exists + org-match + membership required; missing Membership still denies; the single-tenant default branch is NOT entered", async () => {
+    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue({
+      id: "real-workspace",
+      organizationId: "real-org",
+    });
+    (prisma.membership.findUnique as jest.Mock).mockResolvedValue(null);
+
+    const result = await resolveActiveTenant({
+      userId: "member-user",
+      sessionTenant: boundSession("real-workspace", "real-org"),
+    });
+
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error.kind).toBe("forbidden");
+    }
+    expect(prisma.membership.findUnique).toHaveBeenCalledTimes(1);
+    expect(prisma.workspace.count).not.toHaveBeenCalled();
+    expect(prisma.membership.create).not.toHaveBeenCalled();
+  });
+
+  it("AC-5 (regression floor): explicit-binding path grants a scope when workspace + membership both resolve", async () => {
+    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue({
+      id: "real-workspace",
+      organizationId: "real-org",
+    });
+    (prisma.membership.findUnique as jest.Mock).mockResolvedValue({
+      role: "admin",
+    });
+
+    const result = await resolveActiveTenant({
+      userId: "member-user",
+      sessionTenant: boundSession("real-workspace", "real-org"),
+    });
+
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.workspaceId).toBe("real-workspace");
+      expect(result.value.role).toBe("admin");
+    }
+    expect(prisma.workspace.count).not.toHaveBeenCalled();
+  });
+
+  it("AC-5 (regression floor): count===1 but the sole workspace id !== DEFAULT_WORKSPACE_ID DENIES — the branch binds on DEFAULT_WORKSPACE_ID, not any single workspace", async () => {
+    (prisma.workspace.count as jest.Mock).mockResolvedValue(1);
+    // The DEFAULT_WORKSPACE_ID lookup returns null: the sole workspace in this
+    // deployment has some other (real, DB-generated prefixed-uuid) id.
+    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue(null);
+
+    const result = await resolveActiveTenant({
+      userId: "some-user",
+      sessionTenant: unboundSession(),
+    });
+
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error.kind).toBe("forbidden");
+    }
+    expect(prisma.membership.findUnique).not.toHaveBeenCalled();
+    expect(prisma.membership.create).not.toHaveBeenCalled();
+  });
+
+  it("AC-6 (race): two concurrent first-caller resolves against the mocked unique constraint converge to EXACTLY ONE owner — the create-losing caller swallows P2002 and is denied", async () => {
+    mockSingleTenantWorkspace();
+    let membershipBoundTo: string | null = null;
+    (prisma.membership.create as jest.Mock).mockImplementation(
+      ({ data }: { data: { userId: string } }) => {
+        if (membershipBoundTo !== null) {
+          return Promise.reject({ code: "P2002" });
+        }
+        membershipBoundTo = data.userId;
+        return Promise.resolve({
+          id: OPERATOR_MEMBERSHIP_ID,
+          organizationId: DEFAULT_ORG_ID,
+          userId: data.userId,
+          role: "owner",
+        });
+      },
+    );
+    (prisma.membership.findUnique as jest.Mock).mockImplementation(
+      ({
+        where,
+      }: {
+        where: { organizationId_userId: { userId: string } };
+      }) =>
+        Promise.resolve(
+          where.organizationId_userId.userId === membershipBoundTo
+            ? { role: "owner" }
+            : null,
+        ),
+    );
+
+    const results = await Promise.all([
+      resolveActiveTenant({
+        userId: "caller-a",
+        sessionTenant: unboundSession(),
+      }),
+      resolveActiveTenant({
+        userId: "caller-b",
+        sessionTenant: unboundSession(),
+      }),
+    ]);
+
+    // Exactly one OPERATOR_MEMBERSHIP_ID row results from two concurrent
+    // first-callers — the PK-uniqueness invariant (D2). This test does not
+    // depend on WHICH of the two callers wins (that's scheduling order, not
+    // the invariant under test).
+    expect(prisma.membership.create).toHaveBeenCalledTimes(2);
+    const oks = results.map((r) => r.ok);
+    expect(oks.filter((ok) => ok === true)).toHaveLength(1);
+    expect(oks.filter((ok) => ok === false)).toHaveLength(1);
+    const denied = results.find((r) => !r.ok);
+    if (denied && !denied.ok) {
+      expect(denied.error.kind).toBe("forbidden");
+    }
+    const granted = results.find((r) => r.ok);
+    if (granted && granted.ok) {
+      expect(granted.value.role).toBe("owner");
+    }
+  });
+});