create-ailk 0.24.0 → 0.26.0

package/templates/apps/api/src/routes/auth/__tests__/tokens.test.ts

@@ -1,313 +0,0 @@
-import { FastifyInstance } from 'fastify';
-import { tokenRoutes } from '../tokens';
-
-// Mock Prisma — lib/prisma.ts wraps the external DB boundary (PrismaClient
-// requires a live connection). This call auto-resolves to the manual mock at
-// src/lib/__mocks__/prisma.ts which covers apiToken/user/userData models.
-// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
-jest.mock('../../../lib/prisma.js');
-
-import { prisma } from '../../../lib/prisma.js';
-
-describe('Token Routes', () => {
-  let app: FastifyInstance;
-
-  beforeEach(async () => {
-    const fastify = require('fastify')();
-    fastify.decorateRequest('userId', null);
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- #506/#507: pre-existing test-hygiene violation
-    fastify.addHook('preHandler', async (request: any) => {
-      // Default to authenticated - set userId if not explicitly set to null
-      if (request.userId === null) {
-        request.userId = 'user_123';
-      }
-    });
-    await fastify.register(tokenRoutes);
-    app = fastify;
-    jest.clearAllMocks();
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  describe('POST /v1/auth/tokens', () => {
-    it('should return 401 when user is not authenticated', async () => {
-      const fastify2 = require('fastify')();
-      fastify2.decorateRequest('userId', null);
-      // Add hook that explicitly keeps userId as null
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- #506/#507: pre-existing test-hygiene violation
-      fastify2.addHook('preHandler', async (request: any) => {
-        request.userId = null; // Explicitly set to null to test unauthenticated
-      });
-      await fastify2.register(tokenRoutes);
-
-      const response = await fastify2.inject({
-        method: 'POST',
-        url: '/v1/auth/tokens',
-        payload: { name: 'Test Token' },
-      });
-
-      expect(response.statusCode).toBe(401);
-      await fastify2.close();
-    });
-
-    it('should create a new API token', async () => {
-      // ARRANGE
-      const mockToken = {
-        id: 'token_123',
-        name: 'Test Token',
-        tokenPrefix: 'tok_abc123',
-        clientType: 'api',
-        scopes: [],
-        expiresAt: null,
-        createdAt: new Date(),
-      };
-
-      (prisma.apiToken.create as jest.Mock).mockResolvedValue(mockToken);
-
-      // ACT
-      const response = await app.inject({
-        method: 'POST',
-        url: '/v1/auth/tokens',
-        payload: {
-          name: 'Test Token',
-          clientType: 'api',
-        },
-      });
-
-      // ASSERT
-      expect(response.statusCode).toBe(201);
-      const body = JSON.parse(response.body);
-      expect(body.success).toBe(true);
-      expect(body.token).toBeDefined();
-      expect(body.token).toMatch(/^tok_/);
-      expect(body.data.name).toBe('Test Token');
-      expect(prisma.apiToken.create).toHaveBeenCalled();
-    });
-
-    it('should create token with expiration', async () => {
-      // ARRANGE
-      const mockToken = {
-        id: 'token_123',
-        name: 'Test Token',
-        tokenPrefix: 'tok_abc123',
-        clientType: 'api',
-        scopes: [],
-        expiresAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000),
-        createdAt: new Date(),
-      };
-
-      (prisma.apiToken.create as jest.Mock).mockResolvedValue(mockToken);
-
-      // ACT
-      const response = await app.inject({
-        method: 'POST',
-        url: '/v1/auth/tokens',
-        payload: {
-          name: 'Test Token',
-          expiresInDays: 30,
-        },
-      });
-
-      // ASSERT
-      expect(response.statusCode).toBe(201);
-      expect(prisma.apiToken.create).toHaveBeenCalledWith(
-        expect.objectContaining({
-          data: expect.objectContaining({
-            expiresAt: expect.any(Date),
-          }),
-        })
-      );
-    });
-
-    it('should return 400 on validation error', async () => {
-      // ACT
-      const response = await app.inject({
-        method: 'POST',
-        url: '/v1/auth/tokens',
-        payload: {
-          name: '', // Invalid: empty name
-        },
-      });
-
-      // ASSERT
-      expect(response.statusCode).toBe(400);
-      const body = JSON.parse(response.body);
-      expect(body.success).toBe(false);
-      expect(body.error).toBe('Validation failed');
-    });
-
-    it('should return 500 on database error', async () => {
-      // ARRANGE
-      (prisma.apiToken.create as jest.Mock).mockRejectedValue(
-        new Error('Database error')
-      );
-
-      // ACT
-      const response = await app.inject({
-        method: 'POST',
-        url: '/v1/auth/tokens',
-        payload: {
-          name: 'Test Token',
-        },
-      });
-
-      // ASSERT
-      expect(response.statusCode).toBe(500);
-    });
-  });
-
-  describe('GET /v1/auth/tokens', () => {
-    it('should return 401 when user is not authenticated', async () => {
-      const fastify2 = require('fastify')();
-      fastify2.decorateRequest('userId', null);
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- #506/#507: pre-existing test-hygiene violation
-      fastify2.addHook('preHandler', async (request: any) => {
-        request.userId = null; // Explicitly set to null
-      });
-      await fastify2.register(tokenRoutes);
-
-      const response = await fastify2.inject({
-        method: 'GET',
-        url: '/v1/auth/tokens',
-      });
-
-      expect(response.statusCode).toBe(401);
-      await fastify2.close();
-    });
-
-    it('should list user tokens', async () => {
-      // ARRANGE
-      const mockTokens = [
-        {
-          id: 'token_1',
-          name: 'Token 1',
-          tokenPrefix: 'tok_abc',
-          clientType: 'api',
-          deviceInfo: null,
-          scopes: [],
-          expiresAt: null,
-          lastUsedAt: null,
-          createdAt: new Date(),
-        },
-        {
-          id: 'token_2',
-          name: 'Token 2',
-          tokenPrefix: 'tok_def',
-          clientType: 'mobile',
-          deviceInfo: 'iPhone',
-          scopes: ['read'],
-          expiresAt: new Date(),
-          lastUsedAt: new Date(),
-          createdAt: new Date(),
-        },
-      ];
-
-      (prisma.apiToken.findMany as jest.Mock).mockResolvedValue(mockTokens);
-
-      // ACT
-      const response = await app.inject({
-        method: 'GET',
-        url: '/v1/auth/tokens',
-      });
-
-      // ASSERT
-      expect(response.statusCode).toBe(200);
-      const body = JSON.parse(response.body);
-      expect(body.success).toBe(true);
-      expect(body.data).toHaveLength(2);
-      expect(prisma.apiToken.findMany).toHaveBeenCalledWith({
-        where: {
-          userId: 'user_123',
-          revokedAt: null,
-        },
-        select: expect.any(Object),
-        orderBy: { createdAt: 'desc' },
-      });
-    });
-  });
-
-  describe('DELETE /v1/auth/tokens/:id', () => {
-    it('should return 401 when user is not authenticated', async () => {
-      const fastify2 = require('fastify')();
-      fastify2.decorateRequest('userId', null);
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- #506/#507: pre-existing test-hygiene violation
-      fastify2.addHook('preHandler', async (request: any) => {
-        request.userId = null; // Explicitly set to null
-      });
-      await fastify2.register(tokenRoutes);
-
-      const response = await fastify2.inject({
-        method: 'DELETE',
-        url: '/v1/auth/tokens/token_123',
-      });
-
-      expect(response.statusCode).toBe(401);
-      await fastify2.close();
-    });
-
-    // Well-formed apitok_ ids (ADR-0031): the :id param is validated with
-    // zApiTokenId before any query runs.
-    const REVOKE_ID = 'apitok_00000000-0000-7000-8000-000000000001';
-    const MISSING_ID = 'apitok_00000000-0000-7000-8000-000000000002';
-
-    it('should revoke a token', async () => {
-      // ARRANGE
-      (prisma.apiToken.updateMany as jest.Mock).mockResolvedValue({ count: 1 });
-
-      // ACT
-      const response = await app.inject({
-        method: 'DELETE',
-        url: `/v1/auth/tokens/${REVOKE_ID}`,
-      });
-
-      // ASSERT
-      expect(response.statusCode).toBe(200);
-      const body = JSON.parse(response.body);
-      expect(body.success).toBe(true);
-      expect(body.message).toBe('Token revoked');
-      expect(prisma.apiToken.updateMany).toHaveBeenCalledWith({
-        where: {
-          id: REVOKE_ID,
-          userId: 'user_123',
-          revokedAt: null,
-        },
-        data: {
-          revokedAt: expect.any(Date),
-        },
-      });
-    });
-
-    it('should return 404 when token is not found', async () => {
-      // ARRANGE
-      (prisma.apiToken.updateMany as jest.Mock).mockResolvedValue({ count: 0 });
-
-      // ACT
-      const response = await app.inject({
-        method: 'DELETE',
-        url: `/v1/auth/tokens/${MISSING_ID}`,
-      });
-
-      // ASSERT
-      expect(response.statusCode).toBe(404);
-      const body = JSON.parse(response.body);
-      expect(body.success).toBe(false);
-      expect(body.error).toBe('Token not found');
-    });
-
-    it('should return 400 for a malformed token id', async () => {
-      // ACT — not apitok_-prefixed → rejected by zApiTokenId before any query
-      const response = await app.inject({
-        method: 'DELETE',
-        url: '/v1/auth/tokens/token_123',
-      });
-
-      // ASSERT
-      expect(response.statusCode).toBe(400);
-      const body = JSON.parse(response.body);
-      expect(body.success).toBe(false);
-      expect(prisma.apiToken.updateMany).not.toHaveBeenCalled();
-    });
-  });
-});