evaldoc 1.0.0

package/tests/unit/orgs.test.js

@@ -0,0 +1,328 @@
+/**
+ * Unit tests for the Organizations & RBAC pure-logic module.
+ * Module under test: functions/src/orgs.js
+ */
+
+const {
+  ROLES,
+  ROLE_RANK,
+  PERMISSIONS,
+  SEAT_LIMITS,
+  can,
+  isValidRole,
+  canManageMember,
+  canAssignRole,
+  seatLimitForPlan,
+  seatsRemaining,
+  hasSeatAvailable,
+  personalOrgDefaults
+} = require('../../functions/src/orgs');
+
+describe('ROLES / ROLE_RANK', () => {
+  test('exactly 4 roles exist', () => {
+    expect(ROLES).toHaveLength(4);
+    expect(ROLES).toEqual(expect.arrayContaining(['owner', 'admin', 'clinician', 'staff']));
+  });
+
+  test('ranks order: owner > admin > clinician > staff', () => {
+    expect(ROLE_RANK.owner).toBeGreaterThan(ROLE_RANK.admin);
+    expect(ROLE_RANK.admin).toBeGreaterThan(ROLE_RANK.clinician);
+    expect(ROLE_RANK.clinician).toBeGreaterThan(ROLE_RANK.staff);
+  });
+
+  test('every role has a numeric rank', () => {
+    ROLES.forEach((r) => {
+      expect(typeof ROLE_RANK[r]).toBe('number');
+    });
+  });
+});
+
+describe('can(role, action) — permission matrix', () => {
+  describe('owner can do every defined action', () => {
+    const actions = [
+      'billing.manage',
+      'org.delete',
+      'members.invite',
+      'members.remove',
+      'members.role',
+      'inbox.viewAll',
+      'settings.edit',
+      'provider.own',
+      'inbox.viewOwn',
+      'inbox.reply'
+    ];
+    test.each(actions)('owner can %s', (action) => {
+      expect(can('owner', action)).toBe(true);
+    });
+
+    test('owner is allowed on every action in PERMISSIONS', () => {
+      Object.keys(PERMISSIONS).forEach((action) => {
+        expect(can('owner', action)).toBe(true);
+      });
+    });
+  });
+
+  describe('admin', () => {
+    const allowed = [
+      'members.invite',
+      'members.remove',
+      'members.role',
+      'inbox.viewAll',
+      'settings.edit',
+      'provider.own',
+      'inbox.viewOwn',
+      'inbox.reply'
+    ];
+    test.each(allowed)('admin CAN %s', (action) => {
+      expect(can('admin', action)).toBe(true);
+    });
+
+    test('admin CANNOT billing.manage', () => {
+      expect(can('admin', 'billing.manage')).toBe(false);
+    });
+    test('admin CANNOT org.delete', () => {
+      expect(can('admin', 'org.delete')).toBe(false);
+    });
+  });
+
+  describe('clinician', () => {
+    const allowed = ['provider.own', 'inbox.viewOwn', 'inbox.reply'];
+    test.each(allowed)('clinician CAN %s', (action) => {
+      expect(can('clinician', action)).toBe(true);
+    });
+
+    const denied = [
+      'members.invite',
+      'inbox.viewAll',
+      'settings.edit',
+      'billing.manage',
+      'org.delete'
+    ];
+    test.each(denied)('clinician CANNOT %s', (action) => {
+      expect(can('clinician', action)).toBe(false);
+    });
+  });
+
+  describe('staff', () => {
+    const allowed = ['inbox.viewOwn', 'inbox.reply'];
+    test.each(allowed)('staff CAN %s', (action) => {
+      expect(can('staff', action)).toBe(true);
+    });
+
+    const denied = [
+      'provider.own',
+      'members.invite',
+      'settings.edit',
+      'inbox.viewAll'
+    ];
+    test.each(denied)('staff CANNOT %s', (action) => {
+      expect(can('staff', action)).toBe(false);
+    });
+  });
+
+  test('unknown action returns false', () => {
+    expect(can('owner', 'does.not.exist')).toBe(false);
+    expect(can('owner', '')).toBe(false);
+    expect(can('owner', undefined)).toBe(false);
+  });
+
+  test('unknown role returns false', () => {
+    expect(can('hacker', 'inbox.reply')).toBe(false);
+    expect(can('', 'inbox.reply')).toBe(false);
+    expect(can(null, 'inbox.reply')).toBe(false);
+    expect(can(undefined, 'inbox.reply')).toBe(false);
+  });
+});
+
+describe('isValidRole', () => {
+  test.each(['owner', 'admin', 'clinician', 'staff'])('true for %s', (role) => {
+    expect(isValidRole(role)).toBe(true);
+  });
+
+  test('false for unrecognized / falsy values', () => {
+    expect(isValidRole('hacker')).toBe(false);
+    expect(isValidRole('')).toBe(false);
+    expect(isValidRole(null)).toBe(false);
+    expect(isValidRole(undefined)).toBe(false);
+  });
+});
+
+describe('canManageMember(actor, target)', () => {
+  test('owner can manage admin, clinician, staff', () => {
+    expect(canManageMember('owner', 'admin')).toBe(true);
+    expect(canManageMember('owner', 'clinician')).toBe(true);
+    expect(canManageMember('owner', 'staff')).toBe(true);
+  });
+
+  test('owner cannot manage another owner (equal rank)', () => {
+    expect(canManageMember('owner', 'owner')).toBe(false);
+  });
+
+  test('admin can manage clinician, staff', () => {
+    expect(canManageMember('admin', 'clinician')).toBe(true);
+    expect(canManageMember('admin', 'staff')).toBe(true);
+  });
+
+  test('admin cannot manage owner or another admin', () => {
+    expect(canManageMember('admin', 'owner')).toBe(false);
+    expect(canManageMember('admin', 'admin')).toBe(false);
+  });
+
+  test('clinician cannot manage anyone', () => {
+    expect(canManageMember('clinician', 'staff')).toBe(false);
+    expect(canManageMember('clinician', 'clinician')).toBe(false);
+    expect(canManageMember('clinician', 'admin')).toBe(false);
+    expect(canManageMember('clinician', 'owner')).toBe(false);
+  });
+
+  test('staff cannot manage anyone', () => {
+    expect(canManageMember('staff', 'staff')).toBe(false);
+    expect(canManageMember('staff', 'clinician')).toBe(false);
+    expect(canManageMember('staff', 'admin')).toBe(false);
+    expect(canManageMember('staff', 'owner')).toBe(false);
+  });
+
+  test('invalid roles return false', () => {
+    expect(canManageMember('hacker', 'staff')).toBe(false);
+    expect(canManageMember('owner', 'hacker')).toBe(false);
+    expect(canManageMember(null, 'staff')).toBe(false);
+    expect(canManageMember('owner', undefined)).toBe(false);
+    expect(canManageMember('', '')).toBe(false);
+  });
+});
+
+describe('canAssignRole(actor, newRole)', () => {
+  test('owner can assign admin, clinician, staff', () => {
+    expect(canAssignRole('owner', 'admin')).toBe(true);
+    expect(canAssignRole('owner', 'clinician')).toBe(true);
+    expect(canAssignRole('owner', 'staff')).toBe(true);
+  });
+
+  test('owner cannot assign owner (no minting owners)', () => {
+    expect(canAssignRole('owner', 'owner')).toBe(false);
+  });
+
+  test('admin can assign clinician, staff', () => {
+    expect(canAssignRole('admin', 'clinician')).toBe(true);
+    expect(canAssignRole('admin', 'staff')).toBe(true);
+  });
+
+  test('admin cannot assign admin or owner', () => {
+    expect(canAssignRole('admin', 'admin')).toBe(false);
+    expect(canAssignRole('admin', 'owner')).toBe(false);
+  });
+
+  test('clinician cannot assign anything', () => {
+    expect(canAssignRole('clinician', 'staff')).toBe(false);
+    expect(canAssignRole('clinician', 'clinician')).toBe(false);
+    expect(canAssignRole('clinician', 'admin')).toBe(false);
+    expect(canAssignRole('clinician', 'owner')).toBe(false);
+  });
+
+  test('staff cannot assign anything', () => {
+    expect(canAssignRole('staff', 'staff')).toBe(false);
+    expect(canAssignRole('staff', 'clinician')).toBe(false);
+    expect(canAssignRole('staff', 'admin')).toBe(false);
+    expect(canAssignRole('staff', 'owner')).toBe(false);
+  });
+
+  test('invalid roles return false', () => {
+    expect(canAssignRole('hacker', 'staff')).toBe(false);
+    expect(canAssignRole('owner', 'hacker')).toBe(false);
+    expect(canAssignRole(null, 'staff')).toBe(false);
+    expect(canAssignRole('owner', undefined)).toBe(false);
+    expect(canAssignRole('', '')).toBe(false);
+  });
+});
+
+describe('seatLimitForPlan', () => {
+  test('free = 1', () => {
+    expect(seatLimitForPlan('free')).toBe(1);
+  });
+  test('pro = 1', () => {
+    expect(seatLimitForPlan('pro')).toBe(1);
+  });
+  test('clinic = 5', () => {
+    expect(seatLimitForPlan('clinic')).toBe(5);
+  });
+  test('enterprise = null (unlimited)', () => {
+    expect(seatLimitForPlan('enterprise')).toBeNull();
+  });
+  test('unknown plan defaults to 1', () => {
+    expect(seatLimitForPlan('mystery')).toBe(1);
+    expect(seatLimitForPlan('')).toBe(1);
+    expect(seatLimitForPlan(undefined)).toBe(1);
+  });
+});
+
+describe('seatsRemaining', () => {
+  test('free with 1 member = 0', () => {
+    expect(seatsRemaining('free', 1)).toBe(0);
+  });
+  test('clinic with 2 members = 3', () => {
+    expect(seatsRemaining('clinic', 2)).toBe(3);
+  });
+  test('clinic with 5 members = 0', () => {
+    expect(seatsRemaining('clinic', 5)).toBe(0);
+  });
+  test('clinic with 6 members = 0 (clamped, never negative)', () => {
+    expect(seatsRemaining('clinic', 6)).toBe(0);
+  });
+  test('enterprise with 100 members = Infinity', () => {
+    expect(seatsRemaining('enterprise', 100)).toBe(Infinity);
+  });
+  test('free with 0 members = 1', () => {
+    expect(seatsRemaining('free', 0)).toBe(1);
+  });
+});
+
+describe('hasSeatAvailable', () => {
+  test('clinic with 4 members = true', () => {
+    expect(hasSeatAvailable('clinic', 4)).toBe(true);
+  });
+  test('clinic with 5 members = false', () => {
+    expect(hasSeatAvailable('clinic', 5)).toBe(false);
+  });
+  test('enterprise always true', () => {
+    expect(hasSeatAvailable('enterprise', 0)).toBe(true);
+    expect(hasSeatAvailable('enterprise', 1000000)).toBe(true);
+  });
+  test('free with 0 = true', () => {
+    expect(hasSeatAvailable('free', 0)).toBe(true);
+  });
+  test('free with 1 = false', () => {
+    expect(hasSeatAvailable('free', 1)).toBe(false);
+  });
+});
+
+describe('personalOrgDefaults', () => {
+  test('returns the expected default shape', () => {
+    const org = personalOrgDefaults({ orgId: 'org_1', ownerUid: 'uid_1' });
+    expect(org.type).toBe('personal');
+    expect(org.plan).toBe('free');
+    expect(org.seats).toBe(1);
+    expect(org.id).toBe('org_1');
+    expect(org.ownerUid).toBe('uid_1');
+  });
+
+  test('ownerUid passed through', () => {
+    const org = personalOrgDefaults({ orgId: 'o', ownerUid: 'abc123' });
+    expect(org.ownerUid).toBe('abc123');
+  });
+
+  test('name defaults to "My Practice" when omitted', () => {
+    const org = personalOrgDefaults({ orgId: 'o', ownerUid: 'u' });
+    expect(org.name).toBe('My Practice');
+  });
+
+  test('uses provided name when supplied', () => {
+    const org = personalOrgDefaults({ orgId: 'o', ownerUid: 'u', name: 'Downtown Clinic' });
+    expect(org.name).toBe('Downtown Clinic');
+  });
+
+  test('createdAt and updatedAt are null (stamped by caller)', () => {
+    const org = personalOrgDefaults({ orgId: 'o', ownerUid: 'u' });
+    expect(org.createdAt).toBeNull();
+    expect(org.updatedAt).toBeNull();
+  });
+});