sea-dev 1.0.0

package/libs/dal/src/form.test.ts

@@ -0,0 +1,637 @@
+import { resetTestDb } from "@/_tests/mock-db"; // Must always be the first import
+
+import { db, schema } from "@sea/db";
+import { and, eq, isNull } from "drizzle-orm";
+import { beforeEach, describe, expect, it } from "vitest";
+import { cloneForm, deleteForm, getForm, getFormGroup, getForms, moveFormToWorkflow } from "./form";
+
+describe("dbtest: deleteForm", () => {
+  beforeEach(async () => {
+    await resetTestDb();
+  });
+
+  it("prevents deleting forms from other organizations", async () => {
+    // Create two organizations
+    const [org1, org2] = await db
+      .insert(schema.organization)
+      .values([{ name: "Org 1" }, { name: "Org 2" }])
+      .returning();
+
+    // Create users for both organizations
+    const [user1, user2] = await db
+      .insert(schema.user)
+      .values([
+        { name: "User 1", email: "user1-delete-form@example.com", emailVerified: true },
+        { name: "User 2", email: "user2-delete-form@example.com", emailVerified: true },
+      ])
+      .returning();
+
+    // Create members for both organizations
+    const [member1, _member2] = await db
+      .insert(schema.member)
+      .values([
+        { organizationId: org1!.id, userId: user1!.id, role: "member" },
+        { organizationId: org2!.id, userId: user2!.id, role: "member" },
+      ])
+      .returning();
+
+    // Create conversations for both organizations
+    const [conversation1, conversation2] = await db
+      .insert(schema.conversation)
+      .values([
+        { organizationId: org1!.id, model: "gpt-4.1" },
+        { organizationId: org2!.id, model: "gpt-4.1" },
+      ])
+      .returning();
+
+    // Create workflow for both organizations
+    const [workflow1, workflow2] = await db
+      .insert(schema.workflow)
+      .values([
+        { organizationId: org1!.id, name: "Workflow 1" },
+        { organizationId: org2!.id, name: "Workflow 2" },
+      ])
+      .returning();
+
+    // Create forms for both organizations
+    const [form1, form2] = await db
+      .insert(schema.form)
+      .values([
+        {
+          workflowId: workflow1!.id,
+          organizationId: org1!.id,
+          conversationId: conversation1!.id,
+          name: "form 1",
+        },
+        {
+          workflowId: workflow2!.id,
+          organizationId: org2!.id,
+          conversationId: conversation2!.id,
+          name: "form 2",
+        },
+      ])
+      .returning();
+
+    // Verify both forms are initially active (not deleted)
+    const initialForm1 = await db.query.form.findFirst({
+      where: and(eq(schema.form.id, form1!.id), isNull(schema.form.deletedAt)),
+    });
+    const initialForm2 = await db.query.form.findFirst({
+      where: and(eq(schema.form.id, form2!.id), isNull(schema.form.deletedAt)),
+    });
+
+    expect(initialForm1).toBeDefined();
+    expect(initialForm2).toBeDefined();
+
+    // Attempt to delete org2's form using member1 (should not work due to organization isolation)
+    await deleteForm({ member: member1!, formId: form2!.id });
+
+    // Verify org2's form is NOT deleted (still exists and not soft-deleted)
+    const org2FormAfterAttempt = await db.query.form.findFirst({
+      where: and(eq(schema.form.id, form2!.id), isNull(schema.form.deletedAt)),
+    });
+    expect(org2FormAfterAttempt).toBeDefined();
+
+    // Now delete org1's form using member1 (should work)
+    await deleteForm({ member: member1!, formId: form1!.id });
+
+    // Verify org1's form is deleted (soft-deleted)
+    const org1FormAfterDelete = await db.query.form.findFirst({
+      where: and(eq(schema.form.id, form1!.id), isNull(schema.form.deletedAt)),
+    });
+    expect(org1FormAfterDelete).toBeUndefined();
+
+    // Verify org2's form is still not deleted
+    const org2FormFinal = await db.query.form.findFirst({
+      where: and(eq(schema.form.id, form2!.id), isNull(schema.form.deletedAt)),
+    });
+    expect(org2FormFinal).toBeDefined();
+
+    // Verify that the deleted form still exists in the database but with deletedAt set
+    const deletedForm = await db.query.form.findFirst({
+      where: eq(schema.form.id, form1!.id),
+    });
+    expect(deletedForm).toBeDefined();
+    expect(deletedForm!.deletedAt).toBeDefined();
+  });
+});
+
+describe("dbtest: getForm", () => {
+  beforeEach(async () => {
+    await resetTestDb();
+  });
+
+  it("prevents accessing forms from other organizations", async () => {
+    // Create two organizations
+    const [org1, org2] = await db
+      .insert(schema.organization)
+      .values([{ name: "Org 1" }, { name: "Org 2" }])
+      .returning();
+
+    // Create users for both organizations
+    const [user1, user2] = await db
+      .insert(schema.user)
+      .values([
+        { name: "User 1", email: "user1-get-form@example.com", emailVerified: true },
+        { name: "User 2", email: "user2-get-form@example.com", emailVerified: true },
+      ])
+      .returning();
+
+    // Create members for both organizations
+    const [member1, _member2] = await db
+      .insert(schema.member)
+      .values([
+        { organizationId: org1!.id, userId: user1!.id, role: "member" },
+        { organizationId: org2!.id, userId: user2!.id, role: "member" },
+      ])
+      .returning();
+
+    // Create conversations for both organizations
+    const [conversation1, conversation2] = await db
+      .insert(schema.conversation)
+      .values([
+        { organizationId: org1!.id, model: "gpt-4.1" },
+        { organizationId: org2!.id, model: "gpt-4.1" },
+      ])
+      .returning();
+
+    // Create workflow for both organizations
+    const [workflow1, workflow2] = await db
+      .insert(schema.workflow)
+      .values([
+        { organizationId: org1!.id, name: "Workflow 1" },
+        { organizationId: org2!.id, name: "Workflow 2" },
+      ])
+      .returning();
+
+    // Create forms for both organizations
+    const [form1, form2] = await db
+      .insert(schema.form)
+      .values([
+        {
+          workflowId: workflow1!.id,
+          organizationId: org1!.id,
+          conversationId: conversation1!.id,
+          name: "form 1",
+        },
+        {
+          workflowId: workflow2!.id,
+          organizationId: org2!.id,
+          conversationId: conversation2!.id,
+          name: "form 2",
+        },
+      ])
+      .returning();
+
+    // Verify member1 can access their own organization's form
+    const accessibleForm = await getForm({
+      member: member1!,
+      formId: form1!.id,
+    });
+    expect(accessibleForm).toBeDefined();
+    expect(accessibleForm.id).toBe(form1!.id);
+    expect(accessibleForm.organizationId).toBe(org1!.id);
+
+    // Verify member1 cannot access other organization's form (should throw due to invariant)
+    await expect(getForm({ member: member1!, formId: form2!.id })).rejects.toThrow();
+  });
+});
+
+describe("dbtest: cloneForm", () => {
+  beforeEach(async () => {
+    await resetTestDb();
+  });
+
+  it("prevents cloning forms from other organizations", async () => {
+    // Create two organizations
+    const [org1, org2] = await db
+      .insert(schema.organization)
+      .values([{ name: "Org 1" }, { name: "Org 2" }])
+      .returning();
+
+    // Create users for both organizations
+    const [user1, user2] = await db
+      .insert(schema.user)
+      .values([
+        { name: "User 1", email: "user1-clone-form@example.com", emailVerified: true },
+        { name: "User 2", email: "user2-clone-form@example.com", emailVerified: true },
+      ])
+      .returning();
+
+    // Create members for both organizations
+    const [member1, _member2] = await db
+      .insert(schema.member)
+      .values([
+        { organizationId: org1!.id, userId: user1!.id, role: "member" },
+        { organizationId: org2!.id, userId: user2!.id, role: "member" },
+      ])
+      .returning();
+
+    // Create conversations for both organizations
+    const [conversation1, conversation2] = await db
+      .insert(schema.conversation)
+      .values([
+        { organizationId: org1!.id, model: "gpt-4.1" },
+        { organizationId: org2!.id, model: "gpt-4.1" },
+      ])
+      .returning();
+
+    // Create workflow for both organizations
+    const [workflow1, workflow2] = await db
+      .insert(schema.workflow)
+      .values([
+        { organizationId: org1!.id, name: "Workflow 1" },
+        { organizationId: org2!.id, name: "Workflow 2" },
+      ])
+      .returning();
+
+    // Create forms for both organizations
+    const [form1, form2] = await db
+      .insert(schema.form)
+      .values([
+        {
+          workflowId: workflow1!.id,
+          organizationId: org1!.id,
+          conversationId: conversation1!.id,
+          name: "form 1",
+        },
+        {
+          workflowId: workflow2!.id,
+          organizationId: org2!.id,
+          conversationId: conversation2!.id,
+          name: "form 2",
+        },
+      ])
+      .returning();
+
+    // Create groups and items for the forms to have comprehensive data to clone
+    const [group1, group2] = await db
+      .insert(schema.formGroup)
+      .values([
+        { formId: form1!.id, name: "Group 1", order: 1 },
+        { formId: form2!.id, name: "Group 2", order: 1 },
+      ])
+      .returning();
+
+    await db.insert(schema.formField).values([
+      { formGroupId: group1!.id, name: "Item 1", type: "string", order: 1 },
+      { formGroupId: group2!.id, name: "Item 2", type: "string", order: 1 },
+    ]);
+
+    // Verify member1 can successfully clone their own organization's form
+    const { newForm } = await cloneForm({
+      member: member1!,
+      formId: form1!.id,
+    });
+
+    expect(newForm).toBeDefined();
+    expect(newForm.organizationId).toBe(org1!.id);
+    expect(newForm.name).toBe("form 1 (copy)");
+
+    // Verify member1 cannot clone other organization's form (should throw due to invariant)
+    await expect(cloneForm({ member: member1!, formId: form2!.id })).rejects.toThrow();
+  });
+});
+
+describe("dbtest: getForms", () => {
+  beforeEach(async () => {
+    await resetTestDb();
+  });
+
+  it("prevents accessing forms from other organizations", async () => {
+    // Create two organizations
+    const [org1, org2] = await db
+      .insert(schema.organization)
+      .values([{ name: "Org 1" }, { name: "Org 2" }])
+      .returning();
+
+    // Create users for both organizations
+    const [user1, user2] = await db
+      .insert(schema.user)
+      .values([
+        { name: "User 1", email: "user1-get-forms@example.com", emailVerified: true },
+        { name: "User 2", email: "user2-get-forms@example.com", emailVerified: true },
+      ])
+      .returning();
+
+    // Create members for both organizations
+    const [member1, member2] = await db
+      .insert(schema.member)
+      .values([
+        { organizationId: org1!.id, userId: user1!.id, role: "member" },
+        { organizationId: org2!.id, userId: user2!.id, role: "member" },
+      ])
+      .returning();
+
+    // Create conversations for both organizations
+    const [conversation1, conversation2] = await db
+      .insert(schema.conversation)
+      .values([
+        { organizationId: org1!.id, model: "gpt-4.1" },
+        { organizationId: org2!.id, model: "gpt-4.1" },
+      ])
+      .returning();
+
+    // Create workflow for both organizations
+    const [workflow1, workflow2] = await db
+      .insert(schema.workflow)
+      .values([
+        { organizationId: org1!.id, name: "Workflow 1" },
+        { organizationId: org2!.id, name: "Workflow 2" },
+      ])
+      .returning();
+
+    // Create forms for both organizations
+    const [form1, form2] = await db
+      .insert(schema.form)
+      .values([
+        {
+          workflowId: workflow1!.id,
+          organizationId: org1!.id,
+          conversationId: conversation1!.id,
+          name: "form 1",
+        },
+        {
+          workflowId: workflow2!.id,
+          organizationId: org2!.id,
+          conversationId: conversation2!.id,
+          name: "form 2",
+        },
+      ])
+      .returning();
+
+    // Create additional form for org1 to test multiple results
+    const [form3] = await db
+      .insert(schema.form)
+      .values([
+        {
+          workflowId: workflow1!.id,
+          organizationId: org1!.id,
+          conversationId: conversation1!.id,
+          name: "form 3",
+        },
+      ])
+      .returning();
+
+    // Verify member1 can access only their organization's forms
+    const org1Forms = await getForms({ member: member1! });
+    expect(org1Forms).toHaveLength(2);
+    expect(org1Forms.map((s) => s.id)).toEqual(expect.arrayContaining([form1!.id, form3!.id]));
+    expect(org1Forms.every((s) => s.organizationId === org1!.id)).toBe(true);
+
+    // Verify member2 can access only their organization's forms
+    const org2Forms = await getForms({ member: member2! });
+    expect(org2Forms).toHaveLength(1);
+    expect(org2Forms[0]!.id).toBe(form2!.id);
+    expect(org2Forms[0]!.organizationId).toBe(org2!.id);
+
+    // Create a deleted form for org1 to verify it's filtered out
+    const [deletedForm] = await db
+      .insert(schema.form)
+      .values([
+        {
+          workflowId: workflow1!.id,
+          organizationId: org1!.id,
+          conversationId: conversation1!.id,
+          name: "Deleted form",
+          deletedAt: new Date(),
+        },
+      ])
+      .returning();
+
+    // Verify deleted form is not returned
+    const org1FormsAfterDelete = await getForms({ member: member1! });
+    expect(org1FormsAfterDelete).toHaveLength(2);
+    expect(org1FormsAfterDelete.map((s) => s.id)).not.toContain(deletedForm!.id);
+  });
+});
+
+describe("dbtest: getFormGroup", () => {
+  beforeEach(async () => {
+    await resetTestDb();
+  });
+
+  it("prevents accessing form groups from other organizations", async () => {
+    // Create two organizations
+    const [org1, org2] = await db
+      .insert(schema.organization)
+      .values([{ name: "Org 1" }, { name: "Org 2" }])
+      .returning();
+
+    // Create users for both organizations
+    const [user1, user2] = await db
+      .insert(schema.user)
+      .values([
+        { name: "User 1", email: "user1-get-form-group@example.com", emailVerified: true },
+        { name: "User 2", email: "user2-get-form-group@example.com", emailVerified: true },
+      ])
+      .returning();
+
+    // Create members for both organizations
+    const [member1, _member2] = await db
+      .insert(schema.member)
+      .values([
+        { organizationId: org1!.id, userId: user1!.id, role: "member" },
+        { organizationId: org2!.id, userId: user2!.id, role: "member" },
+      ])
+      .returning();
+
+    // Create conversations for both organizations
+    const [conversation1, conversation2] = await db
+      .insert(schema.conversation)
+      .values([
+        { organizationId: org1!.id, model: "gpt-4.1" },
+        { organizationId: org2!.id, model: "gpt-4.1" },
+      ])
+      .returning();
+
+    // Create workflow for both organizations
+    const [workflow1, workflow2] = await db
+      .insert(schema.workflow)
+      .values([
+        { organizationId: org1!.id, name: "Workflow 1" },
+        { organizationId: org2!.id, name: "Workflow 2" },
+      ])
+      .returning();
+
+    // Create forms for both organizations
+    const [form1, form2] = await db
+      .insert(schema.form)
+      .values([
+        {
+          workflowId: workflow1!.id,
+          organizationId: org1!.id,
+          conversationId: conversation1!.id,
+          name: "form 1",
+        },
+        {
+          workflowId: workflow2!.id,
+          organizationId: org2!.id,
+          conversationId: conversation2!.id,
+          name: "form 2",
+        },
+      ])
+      .returning();
+
+    // Create groups for both forms
+    const [group1, group2] = await db
+      .insert(schema.formGroup)
+      .values([
+        { formId: form1!.id, name: "Group 1", order: 1 },
+        { formId: form2!.id, name: "Group 2", order: 1 },
+      ])
+      .returning();
+
+    // Verify member1 can access their own organization's form group
+    const accessibleGroup = await getFormGroup({
+      member: member1!,
+      formId: form1!.id,
+      formGroupId: group1!.id,
+    });
+    expect(accessibleGroup).toBeDefined();
+    expect(accessibleGroup.id).toBe(group1!.id);
+    expect(accessibleGroup.name).toBe("Group 1");
+
+    // Verify member1 cannot access other organization's form group (should throw due to invariant)
+    await expect(
+      getFormGroup({
+        member: member1!,
+        formId: form2!.id,
+        formGroupId: group2!.id,
+      }),
+    ).rejects.toThrow();
+  });
+});
+
+describe("dbtest: moveFormToWorkflow", () => {
+  beforeEach(async () => {
+    await resetTestDb();
+  });
+
+  it("allows moving forms between workflows in the same organization", async () => {
+    // Create an organization
+    const [org] = await db
+      .insert(schema.organization)
+      .values([{ name: "Test Org" }])
+      .returning();
+
+    // Create a user and member
+    const [user] = await db
+      .insert(schema.user)
+      .values([{ name: "Test User", email: "test-move-form@example.com", emailVerified: true }])
+      .returning();
+
+    const [member] = await db
+      .insert(schema.member)
+      .values([{ organizationId: org!.id, userId: user!.id, role: "member" }])
+      .returning();
+
+    // Create two workflows in the same organization
+    const [workflow1, workflow2] = await db
+      .insert(schema.workflow)
+      .values([
+        { organizationId: org!.id, name: "Workflow 1" },
+        { organizationId: org!.id, name: "Workflow 2" },
+      ])
+      .returning();
+
+    // Create a conversation
+    const [conversation] = await db
+      .insert(schema.conversation)
+      .values([{ organizationId: org!.id, model: "gpt-4.1" }])
+      .returning();
+
+    // Create a form in workflow1
+    const [form] = await db
+      .insert(schema.form)
+      .values([
+        {
+          workflowId: workflow1!.id,
+          organizationId: org!.id,
+          conversationId: conversation!.id,
+          name: "Test Form",
+        },
+      ])
+      .returning();
+
+    // Verify form is initially in workflow1
+    const initialForm = await getForm({ member: member!, formId: form!.id });
+    expect(initialForm.workflowId).toBe(workflow1!.id);
+
+    // Move form to workflow2
+    const movedForm = await moveFormToWorkflow({
+      member: member!,
+      formId: form!.id,
+      workflowId: workflow2!.id,
+    });
+
+    // Verify form is now in workflow2
+    expect(movedForm.workflowId).toBe(workflow2!.id);
+    expect(movedForm.id).toBe(form!.id);
+    expect(movedForm.name).toBe("Test Form");
+
+    // Double-check by fetching the form again
+    const verifyForm = await getForm({ member: member!, formId: form!.id });
+    expect(verifyForm.workflowId).toBe(workflow2!.id);
+  });
+
+  it("prevents moving forms to workflows in other organizations", async () => {
+    // Create two organizations
+    const [org1, org2] = await db
+      .insert(schema.organization)
+      .values([{ name: "Org 1" }, { name: "Org 2" }])
+      .returning();
+
+    // Create users and members for both organizations
+    const [user1] = await db
+      .insert(schema.user)
+      .values([{ name: "User 1", email: "user1-move-form@example.com", emailVerified: true }])
+      .returning();
+
+    const [member1] = await db
+      .insert(schema.member)
+      .values([{ organizationId: org1!.id, userId: user1!.id, role: "member" }])
+      .returning();
+
+    // Create workflows in both organizations
+    const [workflow1, workflow2] = await db
+      .insert(schema.workflow)
+      .values([
+        { organizationId: org1!.id, name: "Workflow 1" },
+        { organizationId: org2!.id, name: "Workflow 2" },
+      ])
+      .returning();
+
+    // Create a conversation for org1
+    const [conversation] = await db
+      .insert(schema.conversation)
+      .values([{ organizationId: org1!.id, model: "gpt-4.1" }])
+      .returning();
+
+    // Create a form in org1's workflow
+    const [form] = await db
+      .insert(schema.form)
+      .values([
+        {
+          workflowId: workflow1!.id,
+          organizationId: org1!.id,
+          conversationId: conversation!.id,
+          name: "Test Form",
+        },
+      ])
+      .returning();
+
+    // Attempt to move form to org2's workflow (should fail)
+    await expect(
+      moveFormToWorkflow({
+        member: member1!,
+        formId: form!.id,
+        workflowId: workflow2!.id,
+      }),
+    ).rejects.toThrow();
+
+    // Verify form is still in workflow1
+    const unchangedForm = await getForm({ member: member1!, formId: form!.id });
+    expect(unchangedForm.workflowId).toBe(workflow1!.id);
+  });
+});