evaldoc 1.0.0

package/tests/integration/api-org.test.js

@@ -0,0 +1,328 @@
+process.env.NODE_ENV = 'test';
+
+jest.mock('firebase-admin', () => require('../mocks/firebase-admin'));
+jest.mock('stripe', () => jest.fn().mockReturnValue({}));
+jest.mock('openai', () => jest.fn().mockImplementation(() => ({
+  chat: { completions: { create: jest.fn().mockResolvedValue({ choices: [{ message: { content: '{}' } }] }) } }
+})));
+jest.mock('@google/generative-ai', () => ({
+  GoogleGenerativeAI: jest.fn().mockImplementation(() => ({
+    getGenerativeModel: () => ({ generateContent: jest.fn().mockResolvedValue({ response: { text: () => 'mock' } }) })
+  }))
+}));
+jest.mock('../../functions/src/stripe-config', () => ({ stripe: {} }));
+jest.mock('../../functions/src/payment', () => ({
+  createConnectAccount: jest.fn(), createAccountLink: jest.fn(), refreshAccountStatus: jest.fn(),
+  setProviderPricing: jest.fn(), createCheckoutSession: jest.fn(), createPaymentIntent: jest.fn(),
+  createSubscription: jest.fn(), cancelSubscription: jest.fn(), checkPaymentAccess: jest.fn(),
+  getRevenueAnalytics: jest.fn(), handleStripeWebhook: jest.fn()
+}));
+process.env.DEEPSEEK_API_KEY = 'test-key';
+process.env.GEMINI_API_KEY = 'test-key';
+
+const request = require('supertest');
+const admin = require('firebase-admin');
+
+admin.auth().verifyIdToken = jest.fn(async (token) => {
+  if (token === 'owner-token') return { uid: 'owner-uid', email: 'owner@clinic.com' };
+  if (token === 'invitee-token') return { uid: 'invitee-uid', email: 'newdoc@clinic.com' };
+  if (token === 'admin-token') return { uid: 'admin-uid', email: 'admin@clinic.com' };
+  if (token === 'clinician-token') return { uid: 'clinician-uid', email: 'clin@clinic.com' };
+  throw new Error('Invalid token');
+});
+
+const app = require('../../server');
+
+// Seed a clinic org (plan clinic = 5 seats) with owner already a member.
+function seedClinic(plan = 'clinic', seats = 5) {
+  admin.__seed('providers', 'owner-uid', {
+    ownerUid: 'owner-uid', displayName: 'Dr Owner', handle: 'drowner',
+    plan, specialty: 'General', status: 'preview'
+  });
+  admin.__seed('organizations', 'owner-uid', {
+    ownerUid: 'owner-uid', name: 'Test Clinic', type: 'clinic', plan, seats
+  });
+  admin.__seed('organizations/owner-uid/members', 'owner-uid', {
+    uid: 'owner-uid', email: 'owner@clinic.com', role: 'owner', providerId: 'owner-uid', status: 'active'
+  });
+  admin.__seed('memberships', 'owner-uid', { orgId: 'owner-uid', role: 'owner' });
+}
+
+describe('Organizations & Team API', () => {
+  beforeEach(() => {
+    admin.__reset();
+  });
+
+  describe('GET /api/org', () => {
+    it('lazily creates a personal org for an existing provider', async () => {
+      admin.__seed('providers', 'owner-uid', {
+        ownerUid: 'owner-uid', displayName: 'Dr Solo', handle: 'drsolo', plan: 'free', status: 'preview'
+      });
+
+      const res = await request(app).get('/api/org').set('Authorization', 'Bearer owner-token');
+
+      expect(res.status).toBe(200);
+      expect(res.body.role).toBe('owner');
+      expect(res.body.org.type).toBe('personal');
+      expect(res.body.seatLimit).toBe(1);
+      expect(res.body.activeMembers).toBe(1);
+    });
+
+    it('returns 404 when user has no provider and no membership', async () => {
+      const res = await request(app).get('/api/org').set('Authorization', 'Bearer owner-token');
+      expect(res.status).toBe(404);
+    });
+
+    it('returns the seeded clinic org with correct seat math', async () => {
+      seedClinic();
+      const res = await request(app).get('/api/org').set('Authorization', 'Bearer owner-token');
+      expect(res.status).toBe(200);
+      expect(res.body.org.type).toBe('clinic');
+      expect(res.body.seatLimit).toBe(5);
+      expect(res.body.seatsRemaining).toBe(4);
+    });
+
+    it('rejects unauthenticated requests', async () => {
+      const res = await request(app).get('/api/org');
+      expect(res.status).toBe(401);
+    });
+  });
+
+  describe('POST /api/org/invite', () => {
+    it('owner can invite a clinician', async () => {
+      seedClinic();
+      const res = await request(app).post('/api/org/invite')
+        .set('Authorization', 'Bearer owner-token')
+        .send({ email: 'newdoc@clinic.com', role: 'clinician' });
+
+      expect(res.status).toBe(200);
+      expect(res.body.success).toBe(true);
+      expect(res.body.invite.status).toBe('pending');
+      expect(res.body.invite.token).toBeTruthy();
+    });
+
+    it('rejects an invalid email', async () => {
+      seedClinic();
+      const res = await request(app).post('/api/org/invite')
+        .set('Authorization', 'Bearer owner-token')
+        .send({ email: 'not-an-email', role: 'clinician' });
+      expect(res.status).toBe(400);
+    });
+
+    it('rejects assigning the owner role', async () => {
+      seedClinic();
+      const res = await request(app).post('/api/org/invite')
+        .set('Authorization', 'Bearer owner-token')
+        .send({ email: 'newdoc@clinic.com', role: 'owner' });
+      expect(res.status).toBe(403);
+    });
+
+    it('enforces the seat limit on a free plan', async () => {
+      seedClinic('free', 1);
+      const res = await request(app).post('/api/org/invite')
+        .set('Authorization', 'Bearer owner-token')
+        .send({ email: 'newdoc@clinic.com', role: 'clinician' });
+      expect(res.status).toBe(402);
+      expect(res.body.code).toBe('SEAT_LIMIT_REACHED');
+    });
+
+    it('a clinician cannot invite members', async () => {
+      seedClinic();
+      admin.__seed('organizations/owner-uid/members', 'clinician-uid', {
+        uid: 'clinician-uid', email: 'clin@clinic.com', role: 'clinician', status: 'active'
+      });
+      admin.__seed('memberships', 'clinician-uid', { orgId: 'owner-uid', role: 'clinician' });
+
+      const res = await request(app).post('/api/org/invite')
+        .set('Authorization', 'Bearer clinician-token')
+        .send({ email: 'another@clinic.com', role: 'clinician' });
+      expect(res.status).toBe(403);
+    });
+
+    it('rejects unauthenticated requests', async () => {
+      const res = await request(app).post('/api/org/invite').send({ email: 'x@y.com', role: 'clinician' });
+      expect(res.status).toBe(401);
+    });
+  });
+
+  describe('POST /api/org/invite/accept', () => {
+    it('invitee with matching email accepts and becomes a member', async () => {
+      seedClinic();
+      admin.__seed('invitations', 'tok123', {
+        orgId: 'owner-uid', email: 'newdoc@clinic.com', role: 'clinician',
+        token: 'tok123', status: 'pending', expiresAt: 9999999999999
+      });
+
+      const res = await request(app).post('/api/org/invite/accept')
+        .set('Authorization', 'Bearer invitee-token')
+        .send({ token: 'tok123' });
+      expect(res.status).toBe(200);
+      expect(res.body.role).toBe('clinician');
+
+      const members = await request(app).get('/api/org/members').set('Authorization', 'Bearer owner-token');
+      expect(members.body.members.some(m => m.uid === 'invitee-uid')).toBe(true);
+    });
+
+    it('rejects a user whose email does not match the invite', async () => {
+      seedClinic();
+      admin.__seed('invitations', 'tok123', {
+        orgId: 'owner-uid', email: 'someoneelse@clinic.com', role: 'clinician',
+        token: 'tok123', status: 'pending', expiresAt: 9999999999999
+      });
+      const res = await request(app).post('/api/org/invite/accept')
+        .set('Authorization', 'Bearer invitee-token')
+        .send({ token: 'tok123' });
+      expect(res.status).toBe(403);
+    });
+
+    it('returns 404 for an unknown token', async () => {
+      seedClinic();
+      const res = await request(app).post('/api/org/invite/accept')
+        .set('Authorization', 'Bearer invitee-token')
+        .send({ token: 'nope' });
+      expect(res.status).toBe(404);
+    });
+
+    it('rejects an already-accepted invite', async () => {
+      seedClinic();
+      admin.__seed('invitations', 'tok123', {
+        orgId: 'owner-uid', email: 'newdoc@clinic.com', role: 'clinician',
+        token: 'tok123', status: 'accepted', expiresAt: 9999999999999
+      });
+      const res = await request(app).post('/api/org/invite/accept')
+        .set('Authorization', 'Bearer invitee-token')
+        .send({ token: 'tok123' });
+      expect(res.status).toBe(409);
+    });
+  });
+
+  describe('PATCH /api/org/members/:uid', () => {
+    beforeEach(() => {
+      seedClinic();
+      admin.__seed('organizations/owner-uid/members', 'invitee-uid', {
+        uid: 'invitee-uid', email: 'newdoc@clinic.com', role: 'clinician', status: 'active'
+      });
+      admin.__seed('memberships', 'invitee-uid', { orgId: 'owner-uid', role: 'clinician' });
+    });
+
+    it('owner can promote a clinician to admin', async () => {
+      const res = await request(app).patch('/api/org/members/invitee-uid')
+        .set('Authorization', 'Bearer owner-token')
+        .send({ role: 'admin' });
+      expect(res.status).toBe(200);
+      expect(res.body.role).toBe('admin');
+    });
+
+    it('owner cannot assign the owner role', async () => {
+      const res = await request(app).patch('/api/org/members/invitee-uid')
+        .set('Authorization', 'Bearer owner-token')
+        .send({ role: 'owner' });
+      expect(res.status).toBe(403);
+    });
+
+    it('returns 404 for a non-existent member', async () => {
+      const res = await request(app).patch('/api/org/members/ghost-uid')
+        .set('Authorization', 'Bearer owner-token')
+        .send({ role: 'admin' });
+      expect(res.status).toBe(404);
+    });
+  });
+
+  describe('DELETE /api/org/members/:uid', () => {
+    beforeEach(() => {
+      seedClinic();
+      admin.__seed('organizations/owner-uid/members', 'invitee-uid', {
+        uid: 'invitee-uid', email: 'newdoc@clinic.com', role: 'clinician', status: 'active'
+      });
+      admin.__seed('memberships', 'invitee-uid', { orgId: 'owner-uid', role: 'clinician' });
+    });
+
+    it('owner can remove a clinician', async () => {
+      const res = await request(app).delete('/api/org/members/invitee-uid')
+        .set('Authorization', 'Bearer owner-token');
+      expect(res.status).toBe(200);
+
+      const members = await request(app).get('/api/org/members').set('Authorization', 'Bearer owner-token');
+      expect(members.body.members.some(m => m.uid === 'invitee-uid')).toBe(false);
+    });
+
+    it('cannot remove self', async () => {
+      const res = await request(app).delete('/api/org/members/owner-uid')
+        .set('Authorization', 'Bearer owner-token');
+      expect(res.status).toBe(400);
+    });
+
+    it('returns 404 for a non-existent member', async () => {
+      const res = await request(app).delete('/api/org/members/ghost-uid')
+        .set('Authorization', 'Bearer owner-token');
+      expect(res.status).toBe(404);
+    });
+  });
+
+  describe('GET /api/org/inbox (clinic-wide)', () => {
+    beforeEach(() => {
+      seedClinic();
+      // second provider/member in the clinic
+      admin.__seed('organizations/owner-uid/members', 'invitee-uid', {
+        uid: 'invitee-uid', email: 'newdoc@clinic.com', role: 'clinician', providerId: 'clin-provider', status: 'active'
+      });
+      admin.__seed('memberships', 'invitee-uid', { orgId: 'owner-uid', role: 'clinician' });
+      admin.__seed('threads', 't-owner', { doctorId: 'owner-uid', status: 'active', lastMessageAt: { _seconds: 200 }, lastUserMessage: 'hi' });
+      admin.__seed('threads', 't-clin', { doctorId: 'clin-provider', status: 'active', lastMessageAt: { _seconds: 100 }, lastUserMessage: 'hello' });
+    });
+
+    it('owner sees threads across all org providers', async () => {
+      const res = await request(app).get('/api/org/inbox').set('Authorization', 'Bearer owner-token');
+      expect(res.status).toBe(200);
+      const ids = res.body.threads.map(t => t.id);
+      expect(ids).toContain('t-owner');
+      expect(ids).toContain('t-clin');
+      expect(res.body.providerCount).toBe(2);
+    });
+
+    it('a clinician cannot view the clinic-wide inbox', async () => {
+      admin.__seed('organizations/owner-uid/members', 'clinician-uid', {
+        uid: 'clinician-uid', email: 'clin@clinic.com', role: 'clinician', providerId: 'x', status: 'active'
+      });
+      admin.__seed('memberships', 'clinician-uid', { orgId: 'owner-uid', role: 'clinician' });
+      const res = await request(app).get('/api/org/inbox').set('Authorization', 'Bearer clinician-token');
+      expect(res.status).toBe(403);
+    });
+
+    it('rejects unauthenticated', async () => {
+      const res = await request(app).get('/api/org/inbox');
+      expect(res.status).toBe(401);
+    });
+  });
+
+  describe('GET /api/org/analytics (clinic-wide)', () => {
+    beforeEach(() => {
+      seedClinic();
+      admin.__seed('providers', 'owner-uid', {
+        ownerUid: 'owner-uid', displayName: 'Dr Owner', handle: 'drowner', plan: 'clinic',
+        status: 'preview', totalChatCount: 30, totalEscalationCount: 3
+      });
+      admin.__seed('organizations/owner-uid/members', 'invitee-uid', {
+        uid: 'invitee-uid', email: 'newdoc@clinic.com', role: 'clinician', providerId: 'clin-provider', status: 'active'
+      });
+      admin.__seed('providers', 'clin-provider', {
+        ownerUid: 'invitee-uid', displayName: 'Dr Two', handle: 'drtwo', status: 'preview',
+        totalChatCount: 70, totalEscalationCount: 7
+      });
+    });
+
+    it('aggregates chats and escalations across providers', async () => {
+      const res = await request(app).get('/api/org/analytics').set('Authorization', 'Bearer owner-token');
+      expect(res.status).toBe(200);
+      expect(res.body.totalChats).toBe(100);
+      expect(res.body.totalEscalations).toBe(10);
+      expect(res.body.escalationRate).toBe(10);
+      expect(res.body.perProvider.length).toBe(2);
+    });
+
+    it('rejects unauthenticated', async () => {
+      const res = await request(app).get('/api/org/analytics');
+      expect(res.status).toBe(401);
+    });
+  });
+});