create-fullstack-scaffold 0.1.0

package/template/src/server/module-admin/__tests__/admin-routes.test.ts

@@ -0,0 +1,360 @@
+import { describe, it, expect, beforeAll, afterAll, beforeEach } from 'vitest'
+import { createTestClient } from '@server/test-utils/test-client'
+import { setupTestDatabase, cleanupTestDatabase } from '@server/db/test-setup'
+import { getRawClient } from '@server/db'
+import { Role } from '@shared/modules/permission'
+import * as notificationService from '@server/module-notifications/services/notification-service'
+
+function authedClient(token = 'admin-token') {
+  return createTestClient(undefined, {
+    headers: { Authorization: `Bearer ${token}` },
+  })
+}
+
+describe('Admin Routes', () => {
+  beforeAll(async () => {
+    await setupTestDatabase()
+  })
+
+  afterAll(async () => {
+    await cleanupTestDatabase()
+  })
+
+  beforeEach(async () => {
+    await cleanupTestDatabase()
+  })
+
+  describe('Authentication', () => {
+    it('should reject request without token', async () => {
+      const client = createTestClient()
+      const res = await client.api.admin.stats.$get()
+      expect(res.status).toBe(401)
+      const text = await res.text()
+      expect(text.length).toBeGreaterThan(0)
+    })
+
+    it('should reject request with invalid token', async () => {
+      const client = authedClient('invalid-token')
+      const res = await client.api.admin.stats.$get()
+      expect(res.status).toBe(401)
+      const text = await res.text()
+      expect(text.length).toBeGreaterThan(0)
+    })
+
+    it('should reject non-admin user', async () => {
+      const client = authedClient('user-token')
+      const res = await client.api.admin.stats.$get()
+      expect(res.status).toBe(403)
+      const text = await res.text()
+      expect(text.length).toBeGreaterThan(0)
+    })
+  })
+
+  describe('GET /api/admin/stats', () => {
+    it('should return system stats for admin', async () => {
+      const client = authedClient('admin-token')
+      const res = await client.api.admin.stats.$get()
+
+      expect(res.status).toBe(200)
+      const data = await res.json()
+      expect(data.success).toBe(true)
+      if (data.success) {
+        expect(data.data).toHaveProperty('totalTodos')
+        expect(data.data).toHaveProperty('pendingTodos')
+        expect(data.data).toHaveProperty('completedTodos')
+        expect(data.data).toHaveProperty('lastUpdated')
+      }
+    })
+
+    it('should return correct todo counts', async () => {
+      const rawClient = await getRawClient()
+      if (rawClient && 'execute' in rawClient) {
+        const now = Date.now()
+        await rawClient.execute({
+          sql: `INSERT INTO todos (title, status, created_at, updated_at) VALUES (?, ?, ?, ?)`,
+          args: ['Pending Todo', 'pending', now, now],
+        })
+        await rawClient.execute({
+          sql: `INSERT INTO todos (title, status, created_at, updated_at) VALUES (?, ?, ?, ?)`,
+          args: ['Completed Todo', 'completed', now, now],
+        })
+
+        const client = authedClient('admin-token')
+        const res = await client.api.admin.stats.$get()
+
+        const data = await res.json()
+        expect(data.success).toBe(true)
+        if (data.success) {
+          expect(data.data.totalTodos).toBe(2)
+          expect(data.data.pendingTodos).toBe(1)
+          expect(data.data.completedTodos).toBe(1)
+        }
+      }
+    })
+  })
+
+  describe('GET /api/admin/health', () => {
+    it('should return health status for admin', async () => {
+      const client = authedClient('admin-token')
+      const res = await client.api.admin.health.$get()
+
+      expect(res.status).toBe(200)
+      const data = await res.json()
+      expect(data.success).toBe(true)
+      if (data.success) {
+        expect(data.data).toHaveProperty('database')
+        expect(data.data).toHaveProperty('timestamp')
+      }
+    })
+  })
+
+  describe('GET /api/admin/activity', () => {
+    it('should return recent activity for admin', async () => {
+      const client = authedClient('admin-token')
+      const res = await client.api.admin.activity.$get({ query: {} })
+
+      expect(res.status).toBe(200)
+      const data = await res.json()
+      expect(data.success).toBe(true)
+      if (data.success) {
+        expect(Array.isArray(data.data)).toBe(true)
+      }
+    })
+
+    it('should respect limit parameter', async () => {
+      const rawClient = await getRawClient()
+      if (rawClient && 'execute' in rawClient) {
+        const now = Date.now()
+        for (let i = 0; i < 5; i++) {
+          await rawClient.execute({
+            sql: `INSERT INTO todos (title, status, created_at, updated_at) VALUES (?, ?, ?, ?)`,
+            args: [`Todo ${i}`, 'pending', now + i, now + i],
+          })
+        }
+
+        const client = authedClient('admin-token')
+        const res = await client.api.admin.activity.$get({ query: { limit: '3' } })
+
+        const data = await res.json()
+        expect(data.success).toBe(true)
+        if (data.success) {
+          expect(data.data.length).toBeLessThanOrEqual(3)
+        }
+      }
+    })
+  })
+
+  describe('DELETE /api/admin/todos/all', () => {
+    it('should clear all todos for admin', async () => {
+      const rawClient = await getRawClient()
+      if (rawClient && 'execute' in rawClient) {
+        const now = Date.now()
+        await rawClient.execute({
+          sql: `INSERT INTO todos (title, status, created_at, updated_at) VALUES (?, ?, ?, ?)`,
+          args: ['Todo to delete', 'pending', now, now],
+        })
+
+        const client = authedClient('admin-token')
+        const res = await client.api.admin.todos.all.$delete()
+
+        expect(res.status).toBe(200)
+        const data = await res.json()
+        expect(data.success).toBe(true)
+      }
+    })
+  })
+
+  describe('GET /api/admin/me', () => {
+    it('should return current admin user info', async () => {
+      const client = authedClient('admin-token')
+      const res = await client.api.admin.me.$get()
+
+      expect(res.status).toBe(200)
+      const data = await res.json()
+      expect(data.success).toBe(true)
+      if (data.success) {
+        expect(data.data).toMatchObject({
+          id: 'super-admin-1',
+          role: 'super_admin',
+          permissions: expect.arrayContaining(['user:view', 'user:create']),
+        })
+        expect(data.data.permissions.length).toBeGreaterThan(10)
+      }
+    })
+
+    it('should return current user info for regular user', async () => {
+      const client = authedClient('user-token')
+      const res = await client.api.admin.me.$get()
+
+      expect(res.status).toBe(200)
+      const data = await res.json()
+      expect(data.success).toBe(true)
+      if (data.success) {
+        expect(data.data.role).toBe('user')
+      }
+    })
+  })
+
+  describe('POST /api/admin/login', () => {
+    it('should login with valid credentials', async () => {
+      const client = createTestClient()
+      const res = await client.api.admin.login.$post({
+        json: { username: 'superadmin', password: '123456' },
+      })
+
+      expect(res.status).toBe(200)
+      const data = await res.json()
+      expect(data.success).toBe(true)
+      if (data.success) {
+        expect(data.data).toHaveProperty('user')
+        expect(data.data).toHaveProperty('token')
+        expect(data.data.user.username).toBe('superadmin')
+      }
+    })
+
+    it('should reject invalid credentials', async () => {
+      const client = createTestClient()
+      const res = await client.api.admin.login.$post({
+        json: { username: 'superadmin', password: 'wrongpassword' },
+      })
+
+      expect(res.status).toBe(401)
+    })
+  })
+
+  describe('POST /api/admin/register', () => {
+    it('should register new user', async () => {
+      const client = createTestClient()
+      const res = await client.api.admin.register.$post({
+        json: {
+          username: 'newuser',
+          email: 'newuser@example.com',
+          password: '123456',
+        },
+      })
+
+      expect(res.status).toBe(201)
+      const data = await res.json()
+      expect(data.success).toBe(true)
+      if (data.success) {
+        expect(data.data).toHaveProperty('id')
+        expect(data.data).toHaveProperty('username')
+        expect(data.data.username).toBe('newuser')
+      }
+    })
+  })
+
+  describe('PUT /api/admin/users/:id', () => {
+    it('should update user by super admin', async () => {
+      const client = authedClient('test-super-admin-1')
+      const createRes = await client.api.admin.users.$post({
+        json: {
+          username: 'testuser',
+          email: 'testuser@example.com',
+          password: '123456',
+          role: Role.USER,
+        },
+      })
+
+      if (createRes.status === 200) {
+        const createData = await createRes.json()
+        if (createData.success && createData.data?.id) {
+          const res = await client.api.admin.users[':id'].$put({
+            param: { id: createData.data.id },
+            json: { status: 'locked' },
+          })
+
+          expect(res.status).toBe(200)
+          const data = await res.json()
+          expect(data.success).toBe(true)
+        }
+      }
+    })
+  })
+
+  describe('POST /api/admin/users', () => {
+    it('should create user by super admin', async () => {
+      const client = authedClient('test-super-admin-1')
+      const uniqueId = Date.now()
+      const res = await client.api.admin.users.$post({
+        json: {
+          username: `testuser${uniqueId}`,
+          email: `testuser${uniqueId}@example.com`,
+          password: '123456',
+          role: Role.USER,
+        },
+      })
+
+      expect([200, 201, 400]).toContain(res.status)
+      const data = await res.json()
+      expect(typeof data.success).toBe('boolean')
+      if (data.success && data.data) {
+        expect(data.data).toHaveProperty('id')
+      }
+    })
+  })
+
+  describe('PUT /api/admin/notifications/:id/read', () => {
+    it('should mark notification as read', async () => {
+      const notif = notificationService.createNotification({
+        type: 'info',
+        title: 'Test',
+        message: 'Test notification',
+      })
+      const client = authedClient('admin-token')
+      const res = await client.api.admin.notifications[':id'].read.$put({
+        param: { id: notif.id },
+      })
+
+      expect(res.status).toBe(200)
+      const data = await res.json()
+      expect(data.success).toBe(true)
+    })
+  })
+
+  describe('PUT /api/admin/notifications/read-all', () => {
+    it('should mark all notifications as read', async () => {
+      const client = authedClient('admin-token')
+      const res = await client.api.admin.notifications['read-all'].$put()
+
+      expect(res.status).toBe(200)
+      const data = await res.json()
+      expect(data.success).toBe(true)
+    })
+  })
+
+  describe('POST /api/admin/notifications/test', () => {
+    it('should send test notification', async () => {
+      const client = authedClient('admin-token')
+      const res = await client.api.admin.notifications.test.$post({
+        json: {
+          type: 'info',
+        },
+      })
+
+      expect([200, 500]).toContain(res.status)
+      if (res.status === 200) {
+        const data = await res.json()
+        expect(typeof data.success).toBe('boolean')
+      } else {
+        const text = await res.text()
+        expect(text.length).toBeGreaterThan(0)
+      }
+    })
+  })
+
+  describe('POST /api/admin/todos/export/token', () => {
+    it('should generate download token', async () => {
+      const client = authedClient('admin-token')
+      const res = await client.api.admin.todos.export.token.$post()
+
+      expect(res.status).toBe(200)
+      const data = await res.json()
+      expect(data.success).toBe(true)
+      if (data.success) {
+        expect(data.data).toHaveProperty('token')
+        expect(data.data).toHaveProperty('downloadUrl')
+      }
+    })
+  })
+})

package/template/src/server/module-admin/__tests__/admin-service.test.ts

@@ -0,0 +1,222 @@
+import { describe, it, expect, beforeEach, beforeAll, afterAll } from 'vitest'
+import * as adminService from '../services/admin-service'
+import { getRawClient } from '@server/db'
+import { setupTestDatabase, cleanupTestDatabase } from '@server/db/test-setup'
+
+describe('Admin Service', () => {
+  beforeAll(async () => {
+    await setupTestDatabase()
+  })
+
+  afterAll(async () => {
+    await cleanupTestDatabase()
+  })
+
+  beforeEach(async () => {
+    const rawClient = await getRawClient()
+    if (rawClient && 'execute' in rawClient) {
+      await rawClient.execute('DELETE FROM todos')
+    }
+  })
+
+  describe('getSystemStats', () => {
+    it('should return zero stats when no todos exist', async () => {
+      const stats = await adminService.getSystemStats()
+
+      expect(stats.totalTodos).toBe(0)
+      expect(stats.pendingTodos).toBe(0)
+      expect(stats.completedTodos).toBe(0)
+      expect(stats.lastUpdated).toBeDefined()
+    })
+
+    it('should return correct stats for mixed todo statuses', async () => {
+      const rawClient = await getRawClient()
+      if (rawClient && 'execute' in rawClient) {
+        const now = Date.now()
+        await rawClient.execute({
+          sql: `INSERT INTO todos (title, status, created_at, updated_at) VALUES (?, ?, ?, ?)`,
+          args: ['Pending 1', 'pending', now, now],
+        })
+        await rawClient.execute({
+          sql: `INSERT INTO todos (title, status, created_at, updated_at) VALUES (?, ?, ?, ?)`,
+          args: ['Pending 2', 'pending', now, now],
+        })
+        await rawClient.execute({
+          sql: `INSERT INTO todos (title, status, created_at, updated_at) VALUES (?, ?, ?, ?)`,
+          args: ['Completed 1', 'completed', now, now],
+        })
+      }
+
+      const stats = await adminService.getSystemStats()
+
+      expect(stats.totalTodos).toBe(3)
+      expect(stats.pendingTodos).toBe(2)
+      expect(stats.completedTodos).toBe(1)
+      expect(stats.lastUpdated).toBeDefined()
+    })
+  })
+
+  describe('checkDatabaseHealth', () => {
+    it('should return connected status when database is available', async () => {
+      const health = await adminService.checkDatabaseHealth()
+
+      expect(health.database).toBe('connected')
+      expect(health.timestamp).toBeDefined()
+    })
+  })
+
+  describe('getRecentActivity', () => {
+    it('should return empty array when no activity exists', async () => {
+      const activity = await adminService.getRecentActivity(10)
+
+      expect(Array.isArray(activity)).toBe(true)
+      expect(activity.length).toBe(0)
+    })
+
+    it('should return recent activity with correct limit', async () => {
+      const rawClient = await getRawClient()
+      if (rawClient && 'execute' in rawClient) {
+        const now = Date.now()
+        for (let i = 0; i < 5; i++) {
+          await rawClient.execute({
+            sql: `INSERT INTO todos (title, status, created_at, updated_at) VALUES (?, ?, ?, ?)`,
+            args: [`Todo ${i}`, 'pending', now + i, now + i],
+          })
+        }
+      }
+
+      const activity = await adminService.getRecentActivity(3)
+
+      expect(activity.length).toBeLessThanOrEqual(3)
+      expect(Array.isArray(activity)).toBe(true)
+    })
+
+    it('should return activity with correct fields', async () => {
+      const rawClient = await getRawClient()
+      if (rawClient && 'execute' in rawClient) {
+        const now = Date.now()
+        await rawClient.execute({
+          sql: `INSERT INTO todos (title, status, created_at, updated_at) VALUES (?, ?, ?, ?)`,
+          args: ['Test Todo', 'pending', now, now],
+        })
+      }
+
+      const activity = await adminService.getRecentActivity(10)
+
+      expect(activity.length).toBeGreaterThan(0)
+      expect(activity[0]).toHaveProperty('id')
+      expect(activity[0]).toHaveProperty('title')
+      expect(activity[0]).toHaveProperty('status')
+      expect(activity[0]).toHaveProperty('updatedAt')
+    })
+  })
+
+  describe('clearAllTodos', () => {
+    it('should clear all todos and return count', async () => {
+      const rawClient = await getRawClient()
+      if (rawClient && 'execute' in rawClient) {
+        const now = Date.now()
+        await rawClient.execute({
+          sql: `INSERT INTO todos (title, status, created_at, updated_at) VALUES (?, ?, ?, ?)`,
+          args: ['Todo 1', 'pending', now, now],
+        })
+        await rawClient.execute({
+          sql: `INSERT INTO todos (title, status, created_at, updated_at) VALUES (?, ?, ?, ?)`,
+          args: ['Todo 2', 'completed', now, now],
+        })
+      }
+
+      const result = await adminService.clearAllTodos()
+
+      expect(result.deletedCount).toBe(2)
+
+      const stats = await adminService.getSystemStats()
+      expect(stats.totalTodos).toBe(0)
+    })
+
+    it('should return zero when no todos exist', async () => {
+      const result = await adminService.clearAllTodos()
+
+      expect(result.deletedCount).toBe(0)
+    })
+  })
+
+  describe('Error Scenarios', () => {
+    it('should handle getRecentActivity with invalid limit gracefully', async () => {
+      const activity = await adminService.getRecentActivity(-1)
+
+      expect(Array.isArray(activity)).toBe(true)
+      expect(activity.length).toBe(0)
+    })
+
+    it('should handle getRecentActivity with zero limit', async () => {
+      const rawClient = await getRawClient()
+      if (rawClient && 'execute' in rawClient) {
+        const now = Date.now()
+        await rawClient.execute({
+          sql: `INSERT INTO todos (title, status, created_at, updated_at) VALUES (?, ?, ?, ?)`,
+          args: ['Test Todo', 'pending', now, now],
+        })
+      }
+
+      const activity = await adminService.getRecentActivity(0)
+
+      expect(Array.isArray(activity)).toBe(true)
+      expect(activity.length).toBe(0)
+    })
+
+    it('should handle very large limit value', async () => {
+      const activity = await adminService.getRecentActivity(999999)
+
+      expect(Array.isArray(activity)).toBe(true)
+      expect(activity.length).toBeGreaterThanOrEqual(0)
+    })
+
+    it('should return empty result when database has no todos', async () => {
+      const stats = await adminService.getSystemStats()
+
+      expect(stats.totalTodos).toBe(0)
+      expect(stats.pendingTodos).toBe(0)
+      expect(stats.completedTodos).toBe(0)
+    })
+
+    it('should handle clearAllTodos on empty database', async () => {
+      const result = await adminService.clearAllTodos()
+
+      expect(result.deletedCount).toBe(0)
+      expect(result).toHaveProperty('deletedCount')
+    })
+
+    it('should return false for invalid operations', async () => {
+      const rawClient = await getRawClient()
+      if (rawClient && 'execute' in rawClient) {
+        const now = Date.now()
+        await rawClient.execute({
+          sql: `INSERT INTO todos (title, status, created_at, updated_at) VALUES (?, ?, ?, ?)`,
+          args: ['Test', 'pending', now, now],
+        })
+      }
+
+      const result = await adminService.clearAllTodos()
+      const isEmpty = result.deletedCount === 0
+
+      expect(isEmpty).toBeFalsy()
+      expect(result.deletedCount).toBeGreaterThan(0)
+    })
+
+    it('should return empty array for invalid limit parameter', async () => {
+      const activity = await adminService.getRecentActivity(-1)
+
+      expect(activity.length).toBe(0)
+      expect(activity).toEqual([])
+    })
+
+    it('should handle getRecentActivity returning null for edge case', async () => {
+      const activity = await adminService.getRecentActivity(0)
+      const result = activity.length > 0 ? activity[0] : null
+
+      expect(result).toBeNull()
+      expect(activity.length).toBe(0)
+    })
+  })
+})