create-ailk 0.2.0 → 0.3.0

package/templates/apps/api/src/routes/workspaces/__tests__/config-tenant-isolation.test.ts

@@ -1,356 +0,0 @@
-// oss: false
-/**
- * @file config-tenant-isolation.test.ts
- *
- * THE ACCEPTANCE GATE for the workspace-scoped site-config write surface
- * (STC-P4 / #3634): a member of Org A must not read or write Org B's site
- * config (theme / identity / seo) by ANY route.
- *
- * Fixture: two orgs, alice = owner of org A (active wsA), bob = owner of org B
- * (active wsB). The prisma mock HONORS where-clauses (workspace/membership
- * compound key) and keeps a per-workspace in-memory config store so a PUT then
- * GET round-trips — cross-tenant denials are additionally asserted by "config
- * query never ran" (the guard 403s before any handler touches the model).
- *
- * Registration mirrors server.ts exactly: auth preHandler → nested scope
- * { tenant guard → workspaceConfigRoutes }.
- *
- * SECURITY-SENSITIVE (tenant isolation for untrusted end-tenants) — see spec
- * §5.3: this suite is the objective pass/fail record the mandatory
- * `security-reviewer` verifies against.
- */
-import Fastify from "fastify";
-import type { FastifyInstance } from "fastify";
-
-// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
-jest.mock("../../../lib/prisma.js", () => ({
-  prisma: {
-    session: { findUnique: jest.fn(), update: jest.fn() },
-    apiToken: {
-      findUnique: jest.fn(),
-      update: jest.fn().mockResolvedValue(undefined),
-    },
-    workspace: { findUnique: jest.fn(), count: jest.fn() },
-    membership: { findUnique: jest.fn() },
-    workspaceTheme: {
-      findUnique: jest.fn(),
-      upsert: jest.fn(),
-      deleteMany: jest.fn(),
-    },
-    workspaceSiteIdentity: {
-      findUnique: jest.fn(),
-      upsert: jest.fn(),
-      deleteMany: jest.fn(),
-    },
-    workspaceSEO: {
-      findUnique: jest.fn(),
-      upsert: jest.fn(),
-      deleteMany: jest.fn(),
-    },
-  },
-}));
-
-import { prisma } from "../../../lib/prisma.js";
-import { authPreHandlerPlugin } from "../../../middleware/auth.js";
-import { tenantPreHandlerPlugin } from "../../../middleware/tenant.js";
-import { workspaceConfigRoutes } from "../config.js";
-
-const FRONTEND = "https://app.example.com";
-const FUTURE = new Date(Date.now() + 60 * 60 * 1000);
-
-const WS_A = "wksp_00000000-0000-7000-8000-0000000000aa";
-const WS_B = "wksp_00000000-0000-7000-8000-0000000000bb";
-const ORG_A = "org_00000000-0000-7000-8000-000000000aaa";
-const ORG_B = "org_00000000-0000-7000-8000-000000000bbb";
-
-// ── Fixture data ────────────────────────────────────────────────────────────
-
-const WORKSPACES = [
-  { id: WS_A, organizationId: ORG_A },
-  { id: WS_B, organizationId: ORG_B },
-];
-
-const MEMBERSHIPS = [
-  { organizationId: ORG_A, userId: "alice", role: "owner" },
-  { organizationId: ORG_B, userId: "bob", role: "owner" },
-];
-
-const SESSION_ROWS: Record<string, Record<string, unknown>> = {
-  cookie_alice: {
-    id: "sess_alice",
-    userId: "alice",
-    expiresAt: FUTURE,
-    activeOrganizationId: ORG_A,
-    activeWorkspaceId: WS_A,
-  },
-  cookie_bob: {
-    id: "sess_bob",
-    userId: "bob",
-    expiresAt: FUTURE,
-    activeOrganizationId: ORG_B,
-    activeWorkspaceId: WS_B,
-  },
-};
-
-// ── Valid config bodies (schema-conformant) ─────────────────────────────────
-
-const PALETTE = {
-  bg: "#ffffff",
-  bgMuted: "#f5f5f5",
-  surface: "#ffffff",
-  border: "#e5e5e5",
-  text: "#111111",
-  textMuted: "#666666",
-  primary: "#2563eb",
-  primaryFg: "#ffffff",
-  accent: "#9333ea",
-  accentFg: "#ffffff",
-  destructive: "#dc2626",
-  destructiveFg: "#ffffff",
-};
-
-const VALID_THEME = {
-  version: "1",
-  colors: { light: PALETTE, dark: PALETTE },
-  radius: { sm: "2px", md: "6px", lg: "12px" },
-  shadow: { sm: "0 1px 2px", md: "0 2px 4px", lg: "0 4px 8px" },
-  fonts: { display: "Inter", body: "Inter" },
-  lineHeight: { tight: "1.1", normal: "1.5", relaxed: "1.8" },
-  icon: { sm: "16px", md: "20px", lg: "24px" },
-  breakpoint: { sm: "640px", md: "768px", lg: "1024px", xl: "1280px" },
-  container: { sm: "640px", md: "768px", lg: "1024px", xl: "1280px" },
-};
-
-const VALID_IDENTITY = {
-  kind: "Organization",
-  name: "Acme",
-  url: "https://acme.example",
-};
-
-const VALID_SEO = { version: "1", description: "Acme site" };
-
-const CONFIG_CASES = [
-  { type: "theme", model: "workspaceTheme", valid: VALID_THEME },
-  { type: "identity", model: "workspaceSiteIdentity", valid: VALID_IDENTITY },
-  { type: "seo", model: "workspaceSEO", valid: VALID_SEO },
-] as const;
-
-// ── Where-clause-honoring mock wiring (stateful config store) ───────────────
-
-type Where = Record<string, unknown>;
-
-/** Per-model, per-workspaceId in-memory store so PUT→GET round-trips. */
-function installFixtureMocks(): void {
-  (prisma.session.findUnique as jest.Mock).mockImplementation(
-    ({ where }: { where: { token?: string } }) =>
-      Promise.resolve(where.token ? (SESSION_ROWS[where.token] ?? null) : null),
-  );
-  (prisma.session.update as jest.Mock).mockResolvedValue({});
-
-  (prisma.workspace.findUnique as jest.Mock).mockImplementation(
-    ({ where }: { where: { id?: string } }) =>
-      Promise.resolve(WORKSPACES.find((w) => w.id === where.id) ?? null),
-  );
-  // Genuinely multi-tenant (2 workspaces) — the single-tenant default-resolution
-  // branch (count() === 1) must never fire, so an unbound session keeps denying.
-  (prisma.workspace.count as jest.Mock).mockResolvedValue(WORKSPACES.length);
-
-  (prisma.membership.findUnique as jest.Mock).mockImplementation(
-    ({
-      where,
-    }: {
-      where: {
-        organizationId_userId?: { organizationId: string; userId: string };
-      };
-    }) => {
-      const key = where.organizationId_userId;
-      if (!key) return Promise.resolve(null);
-      return Promise.resolve(
-        MEMBERSHIPS.find(
-          (m) =>
-            m.organizationId === key.organizationId && m.userId === key.userId,
-        ) ?? null,
-      );
-    },
-  );
-
-  for (const { model } of CONFIG_CASES) {
-    const store = new Map<
-      string,
-      { id: string; workspaceId: string; data: unknown }
-    >();
-    const delegate = prisma[model];
-    (delegate.findUnique as jest.Mock).mockImplementation(
-      ({ where }: { where: { workspaceId?: string } }) =>
-        Promise.resolve(
-          where.workspaceId ? (store.get(where.workspaceId) ?? null) : null,
-        ),
-    );
-    (delegate.upsert as jest.Mock).mockImplementation(
-      ({
-        where,
-        create,
-        update,
-      }: {
-        where: { workspaceId: string };
-        create: { workspaceId: string; data: unknown };
-        update: { data: unknown };
-      }) => {
-        const existing = store.get(where.workspaceId);
-        const row = existing
-          ? { ...existing, data: update.data }
-          : {
-              id: `${model}_row`,
-              workspaceId: create.workspaceId,
-              data: create.data,
-            };
-        store.set(where.workspaceId, row);
-        return Promise.resolve(row);
-      },
-    );
-    (delegate.deleteMany as jest.Mock).mockImplementation(
-      ({ where }: { where: { workspaceId?: string } }) => {
-        const had = where.workspaceId ? store.has(where.workspaceId) : false;
-        if (where.workspaceId) store.delete(where.workspaceId);
-        return Promise.resolve({ count: had ? 1 : 0 });
-      },
-    );
-  }
-}
-
-// ── App assembly (mirrors server.ts registration order) ─────────────────────
-
-async function buildApp(): Promise<FastifyInstance> {
-  const app = Fastify();
-  app.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
-  app.register(async (scope) => {
-    await scope.register(tenantPreHandlerPlugin);
-    await scope.register(workspaceConfigRoutes);
-  });
-  await app.ready();
-  return app;
-}
-
-function cookieHeaders(
-  token: string,
-  mutating = false,
-): Record<string, string> {
-  return {
-    cookie: `better-auth.session_token=${token}`,
-    ...(mutating ? { origin: FRONTEND } : {}),
-  };
-}
-
-describe("site-config tenant isolation — cross-org read/write denied on every config route", () => {
-  let app: FastifyInstance;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    installFixtureMocks();
-    app = await buildApp();
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  describe.each(CONFIG_CASES)("$type", ({ type, model, valid }) => {
-    const own = `/v1/workspaces/${WS_A}/${type}`;
-    const foreign = `/v1/workspaces/${WS_B}/${type}`;
-    // The mocked delegate for this config type — jest's `expect` accepts the
-    // mock fns directly (matching the sibling tenant-isolation.test.ts pattern).
-    const delegate = prisma[model];
-
-    // AC-1 — own-workspace write then read round-trips; server-side scope only.
-    it("PUT own workspace with a valid body → 200 and GET returns the stored blob", async () => {
-      const put = await app.inject({
-        method: "PUT",
-        url: own,
-        headers: cookieHeaders("cookie_alice", true),
-        payload: valid,
-      });
-      expect(put.statusCode).toBe(200);
-      expect(put.json().ok).toBe(true);
-      expect(put.json().data).toEqual(valid);
-      // The upsert is scoped to the resolved workspace, never a body-supplied id.
-      expect(delegate.upsert).toHaveBeenCalledWith(
-        expect.objectContaining({ where: { workspaceId: WS_A } }),
-      );
-
-      const get = await app.inject({
-        method: "GET",
-        url: own,
-        headers: cookieHeaders("cookie_alice"),
-      });
-      expect(get.statusCode).toBe(200);
-      expect(get.json().data).toEqual(valid);
-    });
-
-    // AC-4 — GET a not-yet-configured workspace → data: null (not 404).
-    it("GET an unconfigured workspace → { ok: true, data: null }", async () => {
-      const res = await app.inject({
-        method: "GET",
-        url: own,
-        headers: cookieHeaders("cookie_alice"),
-      });
-      expect(res.statusCode).toBe(200);
-      expect(res.json()).toEqual({ ok: true, data: null });
-    });
-
-    // AC-3 — invalid body → 400, no upsert.
-    it("PUT with a schema-invalid body → 400 validation_failed, no upsert runs", async () => {
-      const res = await app.inject({
-        method: "PUT",
-        url: own,
-        headers: cookieHeaders("cookie_alice", true),
-        payload: { bogus: true },
-      });
-      expect(res.statusCode).toBe(400);
-      expect(res.json().error.code).toBe("validation_failed");
-      expect(delegate.upsert).not.toHaveBeenCalled();
-    });
-
-    // AC-2 — cross-workspace READ denied, no config query runs.
-    it("GET a foreign workspace's config → 403, no config query runs", async () => {
-      const res = await app.inject({
-        method: "GET",
-        url: foreign,
-        headers: cookieHeaders("cookie_alice"),
-      });
-      expect(res.statusCode).toBe(403);
-      expect(delegate.findUnique).not.toHaveBeenCalled();
-    });
-
-    // AC-2 — cross-workspace WRITE denied, no config query runs.
-    it("PUT a foreign workspace's config → 403, no upsert runs", async () => {
-      const res = await app.inject({
-        method: "PUT",
-        url: foreign,
-        headers: cookieHeaders("cookie_alice", true),
-        payload: valid,
-      });
-      expect(res.statusCode).toBe(403);
-      expect(delegate.upsert).not.toHaveBeenCalled();
-    });
-
-    // AC-2 — unauthenticated → 401.
-    it("GET without a session → 401", async () => {
-      const res = await app.inject({ method: "GET", url: own });
-      expect(res.statusCode).toBe(401);
-    });
-
-    // Grant path works for the other tenant too.
-    it("the owning tenant of the other org CAN write its own config", async () => {
-      const res = await app.inject({
-        method: "PUT",
-        url: `/v1/workspaces/${WS_B}/${type}`,
-        headers: cookieHeaders("cookie_bob", true),
-        payload: valid,
-      });
-      expect(res.statusCode).toBe(200);
-      expect(delegate.upsert).toHaveBeenCalledWith(
-        expect.objectContaining({ where: { workspaceId: WS_B } }),
-      );
-    });
-  });
-});